SoC it to EM: electromagnetic side-channel attacks on a complex - PowerPoint PPT Presentation

SoC it to EM: electromagnetic side-channel attacks on a complex system-on-chip Jake Longo 1 Elke De Mulder 2 Dan Page 1 Mike Tunstall 2 1 University Of Bristol, Merchant Venturers Building, Woodland Road, Bristol, BS8 1UB. UK. 2 Rambus Cryptography Research Division, 425 Market Street, 11th Floor, San Francisco, CA 94105, United States. 16 / 09 / 15 � jake.longo@bris.ac.uk � SoC it to EM Slide 1 of 23

Presentation Layout ◮ Motivation? ◮ Methodology outline and execution ◮ Summary of attack results ◮ Further comments ◮ Future work � jake.longo@bris.ac.uk � SoC it to EM Slide 2 of 23

Motivation? Address some misconceptions of side-channel attacks on complex devices. ◮ High-clock rate targets → high sample rate equipment. ◮ Complex embedded systems → di ffi cult DPA. ◮ High degree of parallelism → low SNR ∼ intrinsic side-channel resistance. � jake.longo@bris.ac.uk � SoC it to EM Slide 3 of 23

Analysis Plan ◮ Target selection and identification ◮ Signal exploration ◮ Batch signal pre-processing ◮ Leakage detection ◮ Signal post-processing ◮ Textbook DPA � jake.longo@bris.ac.uk � SoC it to EM Slide 4 of 23

Target Platform BeagleBone Black Attack Environment Hardware: ◮ ARM Cortex-A8 1 GHz CPU (High clock rate) ◮ ARM NEON SIMD (High degree of parallelism) ◮ TI proprietary cryptographic hardware (RNG, SHA-1, AES) Software: ◮ Debian Wheezy (3 . 15) (Full unmodified Linux distribution) ◮ OpenSSL 1 . 0 . 1 j (Bulk encryption) � jake.longo@bris.ac.uk � SoC it to EM Slide 5 of 23

Target Selection and Identification Integer core NEON core PowerVR Display GPU controller L1 I-cache L1 D-cache Cryptographic L2 cache Network co-processor controller 176 kB ROM 64 kB OCP bridge RAM 64 kB RAM OCP-based L3 / L4 NoC interconnect UART DMA SPI RTC I 2 C WDT DDR-based memory interface USB JTAG . . . . . . � jake.longo@bris.ac.uk � SoC it to EM Slide 6 of 23

Target Selection and Identification Integer core NEON core PowerVR Display GPU controller L1 I-cache L1 D-cache Cryptographic L2 cache Network co-processor controller 176 kB ROM 64 kB OCP bridge RAM 64 kB RAM OCP-based L3 / L4 NoC interconnect UART DMA SPI RTC I 2 C WDT DDR-based memory interface USB JTAG . . . . . . ◮ OpenSSL software AES-128-CBC � jake.longo@bris.ac.uk � SoC it to EM Slide 6 of 23

Target Selection and Identification Integer core NEON core PowerVR Display GPU controller L1 I-cache L1 D-cache Cryptographic L2 cache Network co-processor controller 176 kB ROM 64 kB OCP bridge RAM 64 kB RAM OCP-based L3 / L4 NoC interconnect UART DMA SPI RTC I 2 C WDT DDR-based memory interface USB JTAG . . . . . . ◮ OpenSSL software AES-128-CBC ◮ OpenSSL NEON Bitsliced AES-128-CBC � jake.longo@bris.ac.uk � SoC it to EM Slide 6 of 23

Target Selection and Identification Integer core NEON core PowerVR Display GPU controller L1 I-cache L1 D-cache Cryptographic L2 cache Network co-processor controller 176 kB ROM 64 kB OCP bridge RAM 64 kB RAM OCP-based L3 / L4 NoC interconnect UART DMA SPI RTC I 2 C WDT DDR-based memory interface USB JTAG . . . . . . ◮ OpenSSL software AES-128-CBC ◮ OpenSSL NEON Bitsliced AES-128-CBC ◮ OpenSSL hardware accelerated AES-128-CBC � jake.longo@bris.ac.uk � SoC it to EM Slide 6 of 23

NEON? “NEON technology is a 128-bit SIMD (Single Instruction, Multiple Data) architecture extension for the ARM Cortex ™ -A series processors.” ◮ Clear use-cases for wide datapath bit-slicing. ◮ Gradually being adopted to accelerate crypto imlementations. [BS12] D.J. Bernstein and P. Schwabe. “NEON Crypto”. In: CHES . LNCS 7428, 2012, pp. 320–339. D.F. Câmara et al. “Fast Software Polynomial Multiplication on ARM [Câm + 13] Processors Using the NEON Engine”. In: CD-ARES . 2013, pp. 137–154. S. Holzer-Graf et al. “E ffi cient Vector Implementations of AES-Based [Hol + 13] Designs: A Case Study and New Implemenations for Grøstl”. In: CT-RSA . 2013, pp. 145–161. H. Seo et al. “Montgomery Modular Multiplication on ARM-NEON [Seo + 14] Revisited”. In: ICISC . 2014, pp. 328–342. J. Wang et al. “Higher-Order Masking in Practice: A Vector Implementation [Wan + 15] of Masked AES for ARM NEON”. In: CT-RSA . 2015, pp. 181–198. � jake.longo@bris.ac.uk � SoC it to EM Slide 7 of 23

THE DOCUMENTATION HAS ...PROBABLY DMA Engine something in a key some mode settings something out IRQ_0 IRQ_1 AES NOTHING ABOUT IT IT SORT OF LOOKS SOMETHING LIKE THIS... Cryptographic Co-processor? � jake.longo@bris.ac.uk � SoC it to EM Slide 8 of 23

Signal Exploration (1) Test loop 1 while true do sleep(0.08) ; 2 openssl aes-128-cbc -in pt.bin -out ct.bin; 3 sleep(0.025); 4 matrixMultiply -in pt.bin; 5 6 end Spectrogram − 30 1200 Frequency (MHz) − 35 1000 − 40 Power (db) 800 − 45 − 50 600 − 55 400 − 60 200 − 65 0 − 70 0 10 20 30 40 50 60 70 80 Time (ms) � jake.longo@bris.ac.uk � SoC it to EM Slide 9 of 23

Signal Exploration (1) Test loop 1 while true do sleep(0.08) ; 2 openssl aes-128-cbc -in pt.bin -out ct.bin; 3 sleep(0.025); 4 matrixMultiply -in pt.bin; 5 6 end Spectrogram − 30 1200 Frequency (MHz) − 35 1000 − 40 Power (db) 800 − 45 − 50 600 − 55 400 − 60 200 − 65 0 − 70 0 10 20 30 40 50 60 70 80 Time (ms) � jake.longo@bris.ac.uk � SoC it to EM Slide 9 of 23

Signal Exploration (1) Test loop 1 while true do sleep(0.08) ; 2 openssl aes-128-cbc -in pt.bin -out ct.bin; 3 sleep(0.025); 4 matrixMultiply -in pt.bin; 5 6 end Spectrogram − 30 1200 Frequency (MHz) − 35 1000 − 40 Power (db) 800 − 45 − 50 600 − 55 400 − 60 200 − 65 0 − 70 0 10 20 30 40 50 60 70 80 Time (ms) � jake.longo@bris.ac.uk � SoC it to EM Slide 9 of 23

Signal Exploration (1) Test loop 1 while true do sleep(0.08) ; 2 openssl aes-128-cbc -in pt.bin -out ct.bin; 3 sleep(0.025); 4 matrixMultiply -in pt.bin; 5 6 end Spectrogram − 30 1200 Frequency (MHz) − 35 1000 − 40 Power (db) 800 − 45 − 50 600 − 55 400 − 60 200 − 65 0 − 70 0 10 20 30 40 50 60 70 80 Time (ms) � jake.longo@bris.ac.uk � SoC it to EM Slide 9 of 23

Signal Exploration (1) Test loop 1 while true do sleep(0.08) ; 2 openssl aes-128-cbc -in pt.bin -out ct.bin; 3 sleep(0.025); 4 matrixMultiply -in pt.bin; 5 6 end Spectrogram − 30 1200 Frequency (MHz) − 35 1000 − 40 Power (db) 800 − 45 − 50 600 − 55 400 − 60 200 − 65 0 − 70 0 10 20 30 40 50 60 70 80 Time (ms) � jake.longo@bris.ac.uk � SoC it to EM Slide 9 of 23

Signal Pre-processing (1) OpenSSL S / W Trace Amplitude OpenSSL Frequency Response − 30 1200 0 2000 4000 6000 8000 10000 12000 Sample Index − 35 1000 − 40 Frequency (MHz) 800 − 45 Power (db) − 50 600 − 55 400 − 60 200 − 65 0 − 70 Time (ms) � jake.longo@bris.ac.uk � SoC it to EM Slide 10 of 23

Signal Pre-processing (1) OpenSSL S / W Trace Amplitude OpenSSL Frequency Response − 30 1200 0 2000 4000 6000 8000 10000 12000 Sample Index − 35 1000 − 40 OpenSSL S / W Trace – Filtered Frequency (MHz) 800 − 45 Power (db) Amplitude − 50 600 − 55 400 − 60 0 2000 4000 6000 8000 10000 12000 Sample Index 200 − 65 0 − 70 Time (ms) � jake.longo@bris.ac.uk � SoC it to EM Slide 10 of 23

Signal Pre-processing (1) OpenSSL S / W Trace Amplitude OpenSSL Frequency Response − 30 1200 0 2000 4000 6000 8000 10000 12000 Sample Index − 35 1000 − 40 OpenSSL S / W Trace – Filtered Frequency (MHz) 800 − 45 Power (db) Amplitude − 50 600 − 55 400 − 60 0 2000 4000 6000 8000 10000 12000 Sample Index 200 − 65 0 − 70 Time (ms) � jake.longo@bris.ac.uk � SoC it to EM Slide 10 of 23

Signal Pre-processing (1) OpenSSL S / W Trace Amplitude OpenSSL Frequency Response − 30 1200 0 2000 4000 6000 8000 10000 12000 Sample Index − 35 1000 − 40 OpenSSL S / W Trace – Filtered Frequency (MHz) 800 − 45 Power (db) Amplitude − 50 600 − 55 400 − 60 0 2000 4000 6000 8000 10000 12000 Sample Index 200 − 65 OpenSSL S / W Trace – Filtered & De-modulated 0 − 70 Time (ms) Amplitude 0 2000 4000 6000 8000 10000 12000 Sample Index � jake.longo@bris.ac.uk � SoC it to EM Slide 10 of 23

Signal Pre-processing (2) OpenSSL NEON Trace Amplitude 0 10000 20000 30000 40000 50000 Sample Index OpenSSL NEON Trace – Filtered Amplitude 0 10000 20000 30000 40000 50000 Sample Index OpenSSL NEON Trace – Filtered & De-modulated Amplitude 0 10000 20000 30000 40000 50000 Sample Index � jake.longo@bris.ac.uk � SoC it to EM Slide 11 of 23

YAY! Signal Pre-processing (3) OpenSSL H / W Trace Amplitude 20000 30000 40000 50000 60000 70000 Sample Index ◮ Number of peaks match number of encryptions! � � jake.longo@bris.ac.uk � SoC it to EM Slide 12 of 23

HMMMM... Signal Pre-processing (3) OpenSSL H / W Trace Amplitude 20000 30000 40000 50000 60000 70000 Sample Index ◮ Number of peaks match number of encryptions! � ◮ Peaks track by Hamming weight of plaintext... � jake.longo@bris.ac.uk � SoC it to EM Slide 12 of 23