Researchers Break Military Chip Encryption Keys using Nvidia Tesla GPUs

German IT Security researchers at Ruhr University have recently released a report documenting the ability to crack strong encryption used in programmable chips. These chips are used in Military and Aerospace embedded systems.

According to Government Computer News, the researchers were able to crack the encryption key and access data on two different model Field Programmable Gate Array (FPGA) chips using an attack called differential power analysis (DPA).

In the attack, power use is monitored during the power up sequence of the chip. As it is powered up, the chip accesses a key used to decrypt the configuration data file and data stream. By analyzing the power used, the team was able to decrypt the key:

“Side-channel analysis attacks follow a divide-and-conquer strategy,” they wrote. “That is, the key is recovered in small pieces.”

The keys were extracted in eight pieces of 32 bits each from the data gathered in a single power up for each chip. They analyzed the power consumption of 50,000 encrypted bitstream blocks for the Virtex 4 and 90,000 blocks for Virtex 5.

According to the report, a set of four nVidia Fermi Tesla C2070 GPU’s analyzing the data could obtain the key from a Virtex 4 device in about 6 hours, and a Virtex 5 device in about 9 hours.

But what could an attacker do if they obtained the key? An attacker could possibly reverse engineer the bitstream, modify the device configuration or implant a hardware trojan.

Defenses against this type of attack exist, but according to the research some new chips do not use the defense technology and some existing chips may also be vulnerable. Though at this time no known attacks using DPA exist,  that doesn’t mean that some nation states have not thought about using it in an attack. Paul Kocher, a developer of DPA and president of Cryptography Research, had this to say:

“If China gets a piece of military equipment and breaks the key in an FPGA, they wouldn’t talk about it, but if [the researchers] can do it, the presumption is that anyone else who wants to could.”

Counterfeit network gear intended for the US military has already been recovered by FBI agents. It is not a long stretch to think that FPGA chips could also be a target of foreign nations.

* Update – “Cracks in encryption security for embedded chips not fatal, company says” – GCN


Kinect for the PS3

Another Xbox Kinect hack, this one for the PS3!

Shantanu Goel demonstrates the software he has been working on to get the Kinect to work with “Killzone 3” on his PS3. The video shows him navigating the game by only using the Kinect.

Shantanu has released the software he used and instructions on PSGroove.

XBox Kinect for your PC or a Robot!

Time out for a message for your inner geek. Most of you have heard about XBox’s new amazing Kinect controller, if not, here is one of their commercials:

What could be cooler than that you say? How about Kinect for the PC? Or using Kinect in your latest robotics project? Adafruit Industries offered a cash reward for anyone who could hack the Kinect, and what do you know they did it already.

Here is an example of Kinect connected to a PC:

Also, anyone into robotics will be very interested in the options that will eventually become available with using Kinect with an arduino or other microcontroller platform.