German IT Security researchers at Ruhr University have recently released a report documenting the ability to crack strong encryption used in programmable chips. These chips are used in Military and Aerospace embedded systems.
According to Government Computer News, the researchers were able to crack the encryption key and access data on two different model Field Programmable Gate Array (FPGA) chips using an attack called differential power analysis (DPA).
In the attack, power use is monitored during the power up sequence of the chip. As it is powered up, the chip accesses a key used to decrypt the configuration data file and data stream. By analyzing the power used, the team was able to decrypt the key:
“Side-channel analysis attacks follow a divide-and-conquer strategy,” they wrote. “That is, the key is recovered in small pieces.”
The keys were extracted in eight pieces of 32 bits each from the data gathered in a single power up for each chip. They analyzed the power consumption of 50,000 encrypted bitstream blocks for the Virtex 4 and 90,000 blocks for Virtex 5.
According to the report, a set of four nVidia Fermi Tesla C2070 GPU’s analyzing the data could obtain the key from a Virtex 4 device in about 6 hours, and a Virtex 5 device in about 9 hours.
But what could an attacker do if they obtained the key? An attacker could possibly reverse engineer the bitstream, modify the device configuration or implant a hardware trojan.
Defenses against this type of attack exist, but according to the research some new chips do not use the defense technology and some existing chips may also be vulnerable. Though at this time no known attacks using DPA exist, that doesn’t mean that some nation states have not thought about using it in an attack. Paul Kocher, a developer of DPA and president of Cryptography Research, had this to say:
“If China gets a piece of military equipment and breaks the key in an FPGA, they wouldn’t talk about it, but if [the researchers] can do it, the presumption is that anyone else who wants to could.”
Counterfeit network gear intended for the US military has already been recovered by FBI agents. It is not a long stretch to think that FPGA chips could also be a target of foreign nations.
* Update – “Cracks in encryption security for embedded chips not fatal, company says” – GCN