FPGA Bitstream Security Broken 90
NumberField writes "Researchers in Germany released a pair of papers documenting severe power analysis vulnerabilities in the bitstream encryption of multiple Xilinx FPGAs. The problem exposes products using FPGAs to cloning, hardware Trojan insertion, and reverse engineering. Unfortunately, there is no easy downloadable fix, as hardware changes are required. These papers are also a reminder that differential power analysis (DPA) remains a potent threat to unprotected hardware devices. On the FPGA front, only Actel seems to be tackling the DPA issue so far, although their FPGAs are much smaller than Xilinx's."
Good or bad? (Score:4, Interesting)
Is this the good kind of security breach, which enables end users to do new things with their FPGAs? Or the bad kind, that enables attackers to do malicious things with others FPGAs? Or both?
Re: (Score:3, Informative)
If the encryption is cracked it can expose the core to reverse engineering as well as injecting malicious code. If the bitstream contains a soft processor and sw image it could really get interesting as it opens up another vector for getting malicious software onto the device in question.
Re: (Score:3)
Heck, a modern DSO will even decode the I2C bitstream for you. Even if it's encrypted, the data can still be copied.
The Chinese have proven capable of cloning a whole goddamned Apple store, so I don't imagine a serial EEPROM is going to cause them too much grief. As a culture, they seem to be happy to invest amounts of money and effort to copy our stuff that could otherwise have been used to compete legitimately. Go figure...
Re: (Score:2)
Bzzzt, no. The encrypted data is tied to each chip's unique identifier. Each of those EEPROMs is programmed with a unique image, AFAIK.
Re: (Score:2)
That sounds like a real pain in the neck for manufacturing, but if that's how it works, I can see how it might slow down the cloners. Until now, anyway.
Re: (Score:2)
Actually the FPGA stores the AES key in battery-backed RAM. The AES key is therefore just as reprogrammable as the FPGA itself. In a typical application, every EEPROM is programmed with the same image, and every FPGA is programmed with the same key.
To avoid allowing an untrusted manufacturer access to the AES key, you might decide to have the boards manufactured and populated in one place, and then sent to your main office for the final key-programming stage.
Re: (Score:2)
You have to understand that Chinese people don't consider copies to be inferior to the original, at least not automatically. And by "inferior" I mean both in terms of quality and desirability. My Chinese friends all love to chat about how all of their clothes are just copies of famous brands.
It works pretty well. Someone who buys £5 jeans isn't going to pony up £100 for some designer ones just because you shut down the factory making copies.
Re: (Score:1)
Unless you're into industrial espionage or are Chinese (but I repeat myself), it's purely the bad kind.
Re: (Score:2)
Erm, USA is the hands down #1 in industrial espionage. Have no doubt about that, ever. If you do, look at what USA did to Russia during cold war. Things like the biggest pipeline explosion in the world caused by industrial espionage.
Re: (Score:2)
You really don't understand what industrial espionage is, do you?
Re: (Score:2)
No you are wrong. The sabotage was counter-intelligence, Soviets where spying an US-based company.
Re: (Score:2)
Reply comment got cut: If you want a more recent example of just how good West in general and US in particular is at industrial espionage, look at Stuxnet-Natanz issue.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Sure, and that means that smart people in intelligence most likely already fed them a whole lot of long-term critical errors that will bloom when needed.
It even goes back to the Industrial Revolution (Score:2)
Back in the late 1700s, the technology behind the textile industry (spinning, looms) was a British state secret. Nobody who had been trained in the technology was allowed to leave Britain. Samuel Slater [wikipedia.org] dressed as a girl, sailed to America, and replicated the British technology. That was a big part of the beginning of the American Industrial Revolution, and the beginning of the end of the British monopoly on cheap textiles.
Some of the mills built in the early 1800s in New England still stand. Of course,
Re: (Score:2)
This sounds like it makes it harder for manufacturers to TiVoize their products.
Re:Good or bad? (Score:4, Insightful)
Also, if you SELL products with FPGAs in them, it makes it harder to make a profit if somebody decides to reverse-engineer your stuff. Really, all this is good for is cracking into a design that somebody else made. Once you GET the actual bitstream, there are really two things that you can do with it...
1) Make copies of the FPGA. Boards are not that hard to reverse-engineer, so you could copy somebody else's design completely.
2) Reverse engineer the code. However, you will NOT have anything that would help you do this, like net names or hierarchies. This will make actual reverse-engineering in order to change something or learn something very challenging.
This doe NOT make FPGAs any more useful, since you can easily download free development software from every FPGA vendor and put whatever you want on there. Really, the only thing that you CAN'T do with the free software is stuff related to licensed IP (processor cores, various controllers for things like Ethernet, SATA, etc.). While you COULD pull that out of an encrypted bitstream, using it without any sort of documentation or the configuration wizards would be very challenging and, 9 times out of 10, it is just easier to pony up the money to license the cores in the first place.
Re: (Score:2)
Re: (Score:3)
there are really two things that you can do with it... 2) Reverse engineer the code. However, you will NOT have anything that would help you do this, like net names or hierarchies. This will make actual reverse-engineering in order to change something or learn something very challenging.
I think you underestimate the difficulty of number 2. I know I guy who figured out the bitstream format of a particular FPGA type that he was using so that he could write his own synthesis tools for research. It took him a couple of months, but he did it. There are now published papers on this topic From the bitstream to the netlist [psu.edu], A library and platform for FPGA bitstream manipulation [megacz.com], so it should be somewhat easier. There was even a tool called "debit" that disassembled the bitstream back to FPGA tools
Re: (Score:3)
I think you underestimate the difficulty of number 2.
Should obviously be "overestimate"...
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Is this the good kind of security breach, which enables end users to do new things with their FPGAs? Or the bad kind, that enables attackers to do malicious things with others FPGAs? Or both?
Both.
FPGAs are used for a lot of stuff, so on the one hand, it could be used to decrypt media after purchasing it... but they're also used by hardware which transmits information most people want to be secure (as an example, many modern Gas/Electric meters use FPGAs to transmit encrypted usage information back to the utility for billing and use analysis. I think most people would agree that this data should be encrypted in transit, and this means that it can't be trusted 100%).
The big issue is that this doe
Re:Good or bad? (Score:4, Informative)
There's nothing about the Xilinx bitstream encryption that prevents you from loading in an unencrypted bitstream, or a new bitstream with a new key.
Unfortunately it means that it's easier to compromise/clone/tamper with FPGA designs. FPGA cloning/tampering has been a big problem for Cisco as I understand it (counterfeit Cisco products).
Re: (Score:1)
You are supplying full designs files: schematic, gerber file, firmware and FPGA loads to the contract manufacturer so that they can make legit products for you. What if someone at the factory decided to simply copy that data to a Flash drive and sell it to someone else? No amount of encryption is going to do you any good against that level of attack.
Re: (Score:1)
You are supplying full designs files: schematic, gerber file, firmware and FPGA loads to the contract manufacturer so that they can make legit products for you.
...and it's well known that the same manufacturers are building Cisco replicas *cough* huawei *cough*
Not surprisingly they even have the same bugs.
Re: (Score:1)
There's nothing about the Xilinx bitstream encryption that prevents you from loading in an unencrypted bitstream, or a new bitstream with a new key.
Unfortunately it means that it's easier to compromise/clone/tamper with FPGA designs. FPGA cloning/tampering has been a big problem for Cisco as I understand it (Huawei products).
ftfy
Re:Good or bad? (Score:5, Informative)
Is this the good kind of security breach, which enables end users to do new things with their FPGAs? Or the bad kind, that enables attackers to do malicious things with others FPGAs? Or both?
This attack is only useful when an FPGA is programmed by a third-party manufacturer using a canned encrypted bitstream provided by someone else. This is the case for many products nominally made by US, Japanese, or Taiwanese firms but actually built in China. The attack allows someone with access to the encrypted bitstream to recover the unencrypted bitstream, from which they can potentially reverse-engineer the device and make changes.
An end user, who has only the programmed FPGA, can't do anything with this attack.
For background, here's a short note on where this technology is used. [militaryaerospace.com]
Re: (Score:2)
An end user, who has only the programmed FPGA, can't do anything with this attack.
Not really. According the TFA, the majority of deployed systems utilise external memory for the bitstream, so an end user will be able to easily extract the bitstream. Also, many devices are now updatable via the internet - so the bitstream is accessible via web (or via satellite/cable, for Pay TV).
"One of the disadvantages of FPGAs, especially with respect to custom hardware such as ASICs, is that an attacker who has access to the bitstream can clone the system and extract the intellectual property of t
Re: (Score:2)
Afaict the silicon processes that make good high speed logic do not make good EEprom/flash and vice-versa. So high end processors and FPGAs tend to have little to no programable areas on the chip and rely on reading their code from a seperate device.
Re: (Score:2)
Re: (Score:2)
An end user, who has only the programmed FPGA, can't do anything with this attack.
If I understand correctly, the end user isn't threatened by this attack either then. The only thing the end user has to worry about is potentially getting a cloned device.
Re: (Score:2)
Well on one hand i would appreciate that you have the freedom to reprogram HW build by somebody else (e.g. Cisco). On the other hand the most prominent reason to do so i can imagine for that would be HW trojan insertion. (You would have to verify the flashs contents with cisco after you bought a router)....
Alright, someone help (Score:1)
Re:Alright, someone help (Score:4, Informative)
As transistors switch they create little glitches in the power supply, or rather they consume a little more or less current than at the previous steady state (where steady state may be nanoseconds long). By correctly interpreting the changes in current consumption the encryption key can be read.
For the car analogy (this is slashdot after all) think of it as monitoring fuel flow to extrapolate acceleration, speed and distance.
they would have to add additional circuitry... (Score:3)
...to try to keep the power consumption constant, therefore not giving hints, if I understand correctly.
Re:they would have to add additional circuitry... (Score:4, Insightful)
There is only so much you can do. We put a fair amount of power supply filtering around FPGAs because of the switching noise, but the cost in board space and materials to make the switching undetectable would be astronomical. As HW engineers we're always asked to cram a little more in that space, and "do you really need that many capacitors?"
The company I work for (and the reason I'm posting anonymously) uses a bunch of FPGAs per board with man-years of code invested into them, and we usually use Xilinx parts. It's relatively trivial to get the bitstreams from our systems which hasn't bothered us since they're encrypted (or I guess they used to be).
I think I understand, but... (Score:3)
I am referring to adding circuitry into the FPGA's themselves, so that the current consumption cannot be as easily used for side-channel attacks.
In a sense, think of adding additional NOT gates, within the FPGA itself, and their only purpose would be to always have the combination of an actual [data line + NOT] provide a sum of constant power consumption wherever the FPGA is doing anything that might leak side-channel info. None of the NOT gates would actually be part of processing actual data. At least, th
Re: (Score:1)
Adding that into an FPGA still adds cost and takes room, if you put inverting gates to drive equivalent loads that reduces the number of resources available for the job. Therefore I have to pay more to get and FPGA that will do what I want. Then there's the unfortunate reality of real circuits. The two gates will never be perfectly timed and so as a result there will still be small glitches on the power supply. This becomes a race to security through obscurity which is only effective if it is the last st
Re: (Score:1)
See here: http://en.wikipedia.org/wiki/Cmos#Power:_switching_and_leakage [wikipedia.org]
Re: (Score:2)
IANA EE, but ... include an additional circuit that switches randomly, imposing a random element on the current flow - if you have some gate space left over from doing the real work.
Re:Alright, someone help (Score:5, Informative)
An FPGA is sort of like a PROM except that instead of memory circuits you program logic circuits into it.
If this hack allows people to reverse-engineer the chip, they can basically dump its logic diagram, which means that they could copy it. As I understand it, it's normally pretty hard to reverse-engineer a microchip, so this is a pretty significant breakthrough.
Re: (Score:2)
Re: (Score:3)
Note that most FPGAs (and all of Xilinx's) are SRAM based - the bitstream has to generally be loaded from an external memory IC at boot-time.
Not true, the Xilinx Spartan-3AN can store the bitstream in internal flash memory.
That is the only family with that feature though.
Re: (Score:2)
DPA protection is patented... (Score:3)
An interesting blurb from the Actel linked page:
Many of the fundamental techniques used to defend against DPA and other side-channel attacks are patented by Cryptography Research, Inc. ... One of CRI's businesses today is licensing this portfolio of very fundamental patents. Nearly all the secure microcontrollers used in smart cards, set-top boxes, SIM cards for GSM phones and Trusted Platform Modules (TPM) for personal computers are built under license to CRI, amounting to about 4.5 billion chips per year in total.
Yet another critical set of concepts which should be obvious to anyone working in the field locked behind a paywall due to USPTO incompetence and/or malfeasance...
Re:DPA protection is patented... (Score:5, Insightful)
Yet another idiot who doesn't understand the simple fact that the 'obvious' test is applied BEFORE the patent is public. Of course it is 'obvious' AFTER the patent is public. If you asked 100 people working in the field how to "defend against DPA and other side-channel attacks" BEFORE the patent (or anything using the patent, or any papers based on the patent, etc) was public, what percentage of them would have come up with the EXACT SAME WAY (not 'general concepts', the exact methods used) that CR did? It had better be very close to 100% if you are going to claim 'obvious'. If you ask these same 100 people AFTER the patent is public, 99 of them will claim that the CR method is 'obvious'.
General concepts (Score:2)
what percentage of them would have come up with the EXACT SAME WAY (not 'general concepts', the exact methods used) that CR did?
People who complain on Slashdot about the USPTO's examination process are under the impression that inventors manage to score patents on "general concepts".
Re: (Score:3)
Not everyone who complains on Slashdot is naive on patent realities, and the problem is real and ugly.
Aside from the legal fiction of the PHOSITA (Person Having Ordinary Skill In The Art), the intent of this clause by the framers was that it should not be possible for anyone to obtain a patent on something that would be obvious to someone working in the field.
In this specific case, once the feasibility of power vector side channel attacks was understood, any ideas that should have been obvious to someone ha
Re:General concepts (Score:4, Interesting)
You miss the point - the researchers discovered an application of the laws of physics to cryptanalysis. Cool, interesting, but not inherently patentable. Then they patented every way to fix that problem, many of which would be obvious to someone skilled in the art.
If I discover that 1+2 = 3, I cannot patent that equation. If I discover an application of that equation to a physical problem, the intent of the framers in patent law was that only a non obvious application may be patented. The fact that they discovered the problem doesn't (at least by law) eliminate or nullify the PHOSITA requirement.
The researchers found a hard to find problem, then patented the obvious solutions to that problem.
This is one of the problem with patents in general - patents are being issued where the person "skilled in the art", i.e. someone who has the same degree of specialization, would have developed the same solution, and the USPTO no longer makes a reasonable effort to prevent that.
vulnerable (Score:2)
I'm not a hardware person... (Score:1)
the first paper (Score:2)
They should create a chain of trust and sign vendors certificates (or for large production runs allow purchasers to do so). The FPGA would only accept a signed bitstream that can be traced back to a particular vendor. All new FPGAs should have a burned in CRL and a burned in xilinx-signed certificate in ROM. That would allow mutual authentication at least. you can layer encryption on top of
Signing for evaluation kits (Score:2)
The FPGA would only accept a signed bitstream that can be traced back to a particular vendor.
How would the user of an evaluation kit sign a bitstream for such an FPGA?
Re: (Score:2)
They already provide devices with lots of different options, the certificate options would only add a few more {xilinx CA, any CA acceptable, customer-1 CA, customer2 CA} etc. with parts accepting customerX CA only available to customer X. For all I care, they could provide them for programming by anything with a verisign certificate if they wanted to or
This reminds me of the Stuxnet Attack (Score:1)
Re: (Score:2)
"Terminators..." (Score:1)
Remember kids: FPGA's are used in robotics... so, see subject-line above & beware!
("Muahahahaha" mad-scientist laughter & "SiNiSteR" sounding organ music plays...)
APK
P.S.=> On a more serious note though - this MAY have "security-implications" on the note of robotics, one day in the future - Hence the subject-line I used...
... apk