Upload File

new methods for cost-effective side-channel attacks on cryptographic rfids

  • Home
  • Documents
  • New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs
49
New Methods for Cost- Effective Side-Channel Attacks on Cryptographic RFIDs Chair for Embedded Security Ruhr University Bochum David Oswald Timo Kasper Christof Paar www.crypto.rub.de 01.07.2009

Upload: kare

Post on 06-Jan-2016

32 views

Category:

Documents


1 download

Report

Tags:

DESCRIPTION

New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs. Chair for Embedded Security Ruhr University Bochum David Oswald Timo Kasper Christof Paar www.crypto.rub.de 01.07.2009. Motivation. RFID Smartcards. Source: Wikimedia Commons. - PowerPoint PPT Presentation

TRANSCRIPT

Page 1: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Chair for Embedded SecurityRuhr University BochumDavid OswaldTimo KasperChristof Paarwww.crypto.rub.de

01.07.2009

http://www.crypto.rub.de/
Page 2: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Motivation

Page 3: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

RFID Smartcards

• Applications: Payment, Access control, ...• Proprietary ciphers: Often insecure• New Generation: 3DES / AES• Mathematically secure

Side Channel Analysis?

01.07.20093

Source: Wikimedia Commons

Page 4: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

RFID Side Channel Measurement:Authentication Protocol

01.07.20094

??

Reader: Send protocol value

Smartcard: Encrypt this value with

3DES

Output: Success/Failure

Measure EM

Page 5: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Measurement Setup

Page 6: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Measurement Setup

01.07.20096

Page 7: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Measurement Setup• ISO14443-compatible• Freely Programmable• Low Cost (< 40 €)

01.07.20097

Page 8: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Measurement Setup

• 1 GS/s, 128 MB Memory• ± 100 mV• USB 2.0 Interface

01.07.20098

Page 9: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Measurement Setup

01.07.20099

Aim: Reduce Carrier Wave Influence

vs.

Page 10: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Carrier Dampening

01.07.200910

Aim: Reduce Carrier Wave Influence

vs.

Page 11: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Carrier Dampening

Side-Channel Model (idealised):

=

01.07.200911

Page 12: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Carrier Dampening

Side-Channel Model (idealised):

=

01.07.200912

Page 13: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Carrier Dampening

01.07.200913

Page 14: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Side Channel Analysis

Step 1: Raw measurements

Page 15: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Trace (without analogue filter)

01.07.200915

Page 16: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Trace (without analogue filter)

01.07.200916

Page 17: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Trace (without analogue filter)

01.07.200917

??

Page 18: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Step 2: Analogue filter

Page 19: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Trace (with analogue filter)

01.07.200919

Page 20: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Trace (with analogue filter)

01.07.200920

Page 21: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Trace (with analogue filter)

01.07.200921

??

Page 22: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Step 3: Digital Demodulation

Page 23: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Digital Demodulation

Rectifier Digital Filter

Digital Demodulator

01.07.200923

Page 24: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Digital Demodulation

01.07.200924

Page 25: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Digital Demodulation

01.07.200925

?!?!

Page 26: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Step 4: Alignment

Page 27: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Alignment

Pick Reference Pattern

01.07.200927

Page 28: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Alignment

Pick Reference Pattern

01.07.200928

Page 29: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Alignment

01.07.200929

Page 30: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Alignment

01.07.200930

Varies for identical Plaintext

Page 31: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Step 5: Location of 3DES

Page 32: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Data Bus

Locate Plain- & Ciphertext Transfer

01.07.200932

Page 33: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Data Bus DPA: Plaintext

01.07.200933

8 BitHamming Weight

Page 34: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Data Bus DPA: Ciphertext

01.07.200934

8 BitHamming Weight

Page 35: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Trace Overview

01.07.200935

Plaintext Ciphertext3DES... Other processing

Page 36: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Assumptions

01.07.200936

?!?!

?! ?!CC 3DES3DES

Page 37: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Step 6: Attack

Page 38: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

3DES Engine DPA

• 3DES located • Power Model:

Hamming distance R0 R1, 4 Bit (S-Box output)

01.07.200938

?! ?!CC 3DES3DES

Page 39: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

3DES-Engine DPA

But:Only for S-Box 1 & 3

01.07.200939

Page 40: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

3DES Engine DPA: Peak Extraction

01.07.200940

Page 41: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

3DES Engine DPA: Peak Extraction

01.07.200941

Page 42: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

3DES Engine DPA: Binwise

01.07.200942

Page 43: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

3DES Engine DPA: Binwise

01.07.200943

Apply DPA binwise

Page 44: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

3DES Engine DPA: Binwise Correlation

Correct Key for 4 of 8 S-Boxes

01.07.200944

Page 45: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Conclusion

Page 46: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Results

• Real World Device • Black Box Analysis• Low Cost• Key Recovery

01.07.200946

Page 47: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Summary

• Measurement Setup built • Profiling done • Data Bus revealed • Correct Subkey for 4/8 S-Boxes found

01.07.200947

Page 48: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Future Work

• Improve– More traces– Equipment

• Extend– Other RFID smartcards

• Remote Attacks

01.07.200948

Page 49: New Methods for Cost-Effective Side-Channel Attacks on Cryptographic RFIDs

Thank you for your attention! Questions?

Chair for Embedded SecurityTimo KasperDavid OswaldChristof Paar www.crypto.rub.de

[email protected]@[email protected]

http://www.crypto.rub.de/

Code-Based Cryptography - Key Attacks...Code-Based Cryptography 1.Error-Correcting Codes and Cryptography 2.McEliece Cryptosystem 3.Message Attacks (ISD) 4. Key Attacks 5.Other Cryptographic

CellTrust Cryptographic Module (CTCM) · PDF fileThe physical cryptographic boundary is the ... Design Assurance 3 Mitigation of Other Attacks NA ... wrapper function. CellTrust

NSA Suite B Crypto, Keys, and Side Channel Attacks · cryptographic attacks But implementations have no inherent protections against non-invasive attacks ! E.g., side-channel attacks,

Efficient Padding Oracle Attacks on Cryptographic Hardware · 2020-03-18 · E cient Padding Oracle Attacks on Cryptographic Hardware 5 section 5. 2 Padding Oracle Attacks A padding

Fault injection attacks on cryptographic devices and ...euler.ecs.umass.edu/ece597/pdf/Fault-Injection-Attacks-F16-1.pdf · 2 3 Side-Channel Attacks Use information obtained from

The application of RFIDs in libraries

Beyond the Barcode RFIDs Radio Frequency Identification

Synthesis of Fault Attacks on Cryptographic Implementations · access to a cryptographic device, say a smartcard, tampers with the execution of an algorithm to retrieve secret mate-rial

Preparing for Cryptographic Attacks Cryptography Standards and Protocols Key management and Key life cycle Introduction of PKI Trust models

Physical Security [email protected]. IIS 2 Overview Smart cards RFIDs Attacks (Semi)-Natural tags Conclusions

Differential Scan-Based Side-Channel Attacks and ... · Abstract Cryptographic circuits are vulnerable to various side-channel attacks that target their hardware implementations to

October 7, 2003Serguei A. Mokhov, [email protected] 1 Cryptographic Protocols and Possible Attacks SOEN321- Information-Systems Security Revision:

Efficient Padding Oracle Attacks On Cryptographic … August 2012 Efficient Padding Oracle Attacks On Cryptographic Hardware or The Million Message Attack in 15 000 Messages Graham

Topic 3: Sensor Networks and RFIDs

Lecture 4 Denial of Service Attack. Cryptographic attacks Sometimes referred as cryptanalysis based attacks There is no random weakness discovery in this

Superposition Attacks on Cryptographic Protocols · against superposition attacks if and only if the threshold is lowered to t=2. This holds for all classical as well as all known

Assorted Attacks on the RSA Cryptographic Algorithm · 2019-01-11 · Assorted Attacks on the RSA Cryptographic Algorithm Edmond J. Murphy Honors Thesis 2005 Boston College Computer

Attacks Overview Nguyen Cao Dat 1. BK TP.HCM Outline Cryptographic Attacks ▫ Frequency analysis ▫ Brute force attack ▫ Meet-in-the-middle attack ▫ Birthday

Part A Cryptographic Hash Functions - University of Technologythai/networksecurity/Chapter 04A Cryptographic... · 2 Outline Cryptographic Hash Functions Message Authentication Attacks

Cryptographic Attacks on Scrambled LZ-Compression and Arithmetic Coding By: RAJBIR SINGH BIKRAM KAHLON

RF-Compass: Robot Object Manipulation Using RFIDs

Cache-Timing Attacks on RSA Key Generation - Conference on ... · Cache-Timing Attacks on RSA Key Generation - Conference on Cryptographic Hardware and Embedded Systems (CHES) 2019

Efficient Cryptographic Protocols Preventing “Man-in-the-Middle” Attacks, Phd Thesis, Jonathan Katz

Lightweight Cryptography for RFID Systems · LPN Based Entity Authentication Protocol for RFIDs WG-7 Based Authentication Protocol for RFIDs G. Gong (University of Waterloo) Lightweight

Xoodyak, a lightweight cryptographic scheme...hermetic philosophy: It implies that there are no shortcut attacks with higher success probability than generic attacks. The claimed security

Online Template Attacks · 2015-07-15 · attacks that exploit the power-consumption leakage from a device run-ning some cryptographic algorithm. Attacking elliptic-curve cryptosys-tems

Cryptographic Reverse Firewalls · • Kleptography and cryptovirology - Young and Yung 1996 • Algorithm Substitution Attacks - Bellare, Paterson, Rogaway 2014 • Symmetric-key

Protecting Cryptographic Keys from Memory Disclosure Attacks Presented by John Shu Shouhuai Xu and Keith Harrison UTSA, Dept. Computer Science

Power Analysis Attacks against QUAD - IAENG · 2019. 2. 4. · C. Power analysis attacks A power analysis attack extracts the secret keys of a cryptographic algorithm based on the

Cryptographic Attacks on Scrambled LZ-Compression and Arithmetic Coding

Indoor Location Sensing using Active RFIDs

Efficient Cryptographic Protocols Preventing “Man-in …jkatz/papers/thesis.pdf · ABSTRACT Efficient Cryptographic Protocols Preventing “Man-in-the-Middle” Attacks Jonathan

A On the Practicality of Cryptographic Defenses against Pollution Attacks …homes.cerias.purdue.edu/~crisn/papers/pollution... · 2012. 11. 5. · A On the Practicality of Cryptographic

Client Puzzles A Cryptographic Defense Against Connection Depletion Attacks Most of slides come from Ari Juels and John Brainard RSA Laboratories

Wireless Sensor Networks and RFIDs - University of Michigan