DOCSLIB.ORG

Cross-Core Microarchitectural Side Channel Attacks and Countermeasures

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Cross-Core Microarchitectural Side Channel Attacks and Countermeasures Cross-core Microarchitectural Side Channel Attacks and Countermeasures by Gorka Irazoqui A Dissertation Submitted to the Faculty of the WORCESTER POLYTECHNIC INSTITUTE In partial fulfillment of the requirements for the Degree of Doctor of Philosophy in Electrical and Computer Engineering by April 2017 APPROVED: Professor Thomas Eisenbarth Professor Berk Sunar Dissertation Advisor Dissertation Committee ECE Department ECE Department Professor Craig Shue Professor Engın Kirda Dissertation Committee Dissertation Committee CS Department Northeastern University Abstract In the last decade, multi-threaded systems and resource sharing have brought a number of technologies that facilitate our daily tasks in a way we never imagined. Among others, cloud computing has emerged to offer us powerful computational resources without having to physically acquire and install them, while smartphones have almost acquired the same importance desktop computers had a decade ago. This has only been possible thanks to the ever evolving performance optimization improvements made to modern microarchitectures that efficiently manage concur- rent usage of hardware resources. One of the aforementioned optimizations is the usage of shared Last Level Caches (LLCs) to balance different CPU core loads and to maintain coherency between shared memory blocks utilized by different cores. The latter for instance has enabled concurrent execution of several processes in low RAM devices such as smartphones. Although efficient hardware resource sharing has become the de-facto model for several modern technologies, it also poses a major concern with respect to security. Some of the concurrently executed co-resident processes might in fact be malicious and try to take advantage of hardware proximity. New technologies usually claim to be secure by implementing sandboxing techniques and executing processes in isolated software environments, called Virtual Machines (VMs). However, the design of these isolated environments aims at preventing pure software-based attacks and usually does not consider hardware leakages. In fact, the malicious utilization of hardware resources as covert channels might have severe consequences to the privacy of the customers. Our work demonstrates that malicious customers of such technologies can utilize the LLC as the covert channel to obtain sensitive information from a co-resident victim. We show that the LLC is an attractive resource to be targeted by attackers, as it offers high resolution and, unlike previous microarchitectural attacks, does not require core-colocation. Particularly concerning are the cases in which cryptography is compromised, as it is the main component of every security solution. In this sense, the presented work does not only introduce three attack variants that can be applicable in different scenarios, but also demonstrates the ability to recover cryptographic keys (e.g. AES and RSA) and TLS session messages across VMs, bypassing sandboxing techniques. Finally, two countermeasures to prevent microarchitectural attacks in general and LLC attacks in particular from retrieving fine-grain information are presented. Unlike previously proposed countermeasures, ours do not add permanent overheads in the system but can be utilized as preemptive defenses. The first identifies leakages in cryptographic software that can potentially lead to key extraction, and thus, can be utilized by cryptographic code designers to ensure the sanity of their libraries before deployment. The second detects microarchitectural attacks embedded into innocent-looking binaries, preventing them from being posted in official application repositories that usually have the full trust of the customer. 2 Acknowledgements The attacks described in Chapter 4 are based on collaborative work with Mehmet Sinan Inci_ and resulted in peer-reviewed publications [IIES14b, IIES15]. The content presented in Chapter 5 has been published as [IES16]. Parts of the results introduced in Chapter 6 are based joint work with Mehmet Sinan Inci_ and Berk Gulmezoglu and resulted in publication [IGI_ +16a]. The rest of the content of Chapter 6 has been published in [IES15a, IES15b] The vulnerability analysis described in Chapter 7 was performed jointly with Intel employes Xiaofei Guo, Hareesh Khattri, Arun Kanuparthi and Kai Cong, and it is under submission for a peer-review venue. The remaining contributions in the chapter have also been submitted to a peer-review conference. This work was supported by the National Science Foundation (NSF), under grants CNS-1318919, CNS-1314770 and CNS-1618837. This thesis is the result of several years of effort that would not have been successful without the collaboration, both in a professional and personal way, of certain people to whom I would like to express my gratitude. My two advisors Thomas Eisenbarth and Berk Sunar have given me confidence and freedom to achieve the results presented in this thesis. Without their knowledge, advise and personal treatment this journey would have been much more complicated. They were able to take the best out of my skills, and sometimes even believed in me more than I did. I will always feel that part of the achievements that I will accomplish during my career will belong to them. As part of this thesis I had the chance of working closely to Yuval Yarom and Xiaofei Guo. Besides the pleasure that it was working with them, with both of them I established a relationship that goes beyond our professional collaborations. I wish them the best of the lucks in both their professional careers and their personal lives. I would like to thank the members of the Vernam lab, for being such a great support in the most difficult moments. Every single person in the lab was helpful at some specific point during the last 4 years. I am looking forward to maintain the good relationships we built in the upcoming years. I also would like to express my gratitude to the One United and E soccer team members, who gave me the distraction that every person needs to accomplish profes- sional success. Besides the three tournaments that we won together, they provided me an invaluable personal support which produced friendship relationships that I will never forget. They can feel proud of being one of the most positive things I take from this experience. My parents and my sister have always been the first ones believing in me, and have a great influence in any success I achieve in my personal career. Although they already know what they mean to me, I would still like to thank them for everything they do to take always the best of me. I cannot imagine a better source of strength for the upcoming challenges. i Finally, I would like to thank Elena Gonzalez for being the best person I could ever find to stay by my side. Despite all the obstacles she never gave up on us. I will always be in debt with her for all the support she gave me to complete this thesis. She has shown me personal values that I hardly find in other people, and that I am willing to enjoy everyday from now on. ii Contents 1 Introduction 1 2 Background 6 2.1 Side Channel Attacks . .6 2.2 Computer Microarchitecture . .7 2.2.1 Hardware Caches . .8 2.3 The Cache as a Covert Channel . 11 2.3.1 The Evict and Time attack . 11 2.3.2 The Prime and Probe Attack . 13 2.4 Funcionality of Commonly Used Cryptographic Algorithms . 13 2.4.1 AES . 13 2.4.2 RSA . 16 2.4.3 Elliptic Curve Cryptography . 19 3 Related Work 21 3.1 Classical Side Channel Attacks . 21 3.1.1 Timing Attacks . 21 3.1.2 Power Attacks . 22 3.2 Microarchitectural Attacks . 23 3.2.1 Hyper-threading . 24 iii 3.2.2 Branch Prediction Unit Attacks . 24 3.2.3 Out-of-order Execution Attacks . 25 3.2.4 Performance Monitoring Units . 26 3.2.5 Special Instructions . 26 3.2.6 Hardware Caches . 27 3.2.7 Cache Internals . 28 3.2.8 Cache Pre-Fetching . 29 3.2.9 Other Attacks on Caches . 29 3.2.10 Memory Bus Locking Attacks . 30 3.2.11 DRAM and Rowhammer Attacks . 30 3.2.12 TEE Attacks . 31 3.2.13 Cross-core/-CPU Attacks . 32 4 The Flush and Reload attack 34 4.1 Flush and Reload Requirements . 35 4.2 Memory Deduplication . 36 4.3 Flush and Reload Functionality . 37 4.4 Flush and Reload Attacking AES . 39 4.4.1 Description of the Attack . 40 4.4.2 Recovering the Full Key . 42 4.4.3 Attack Scenario 1: Spy Process . 44 4.4.4 Attack Scenario 2: Cross-VM Attack . 45 4.4.5 Experiment Setup and Results . 45 4.4.6 Comparison to Other Attacks . 47 4.5 Flush and Reload Attacking Transport Layer Security: Re-viving the Lucky 13 Attack . 49 4.5.1 The TLS Record Protocol . 49 iv 4.5.2 HMAC . 50 4.5.3 CBC Encryption & Padding . 51 4.5.4 An Attack On CBC Encryption . 51 4.5.5 Analysis of Lucky 13 Patches . 52 4.5.6 Patches Immune to Flush and Reload .............. 53 4.5.7 Patches Vulnerable to Flush and Reload ............ 53 4.5.8 Reviving Lucky 13 on the Cloud . 55 4.5.9 Experiment Setup and Results . 59 4.6 Flush and Reload Outcomes . 62 5 The First Cross-CPU Attack: Invalidate and Transfer 64 5.1 Cache Coherence Protocols . 65 5.1.1 AMD HyperTransport Technology . 67 5.1.2 Intel QuickPath Interconnect Technology . 68 5.2 Invalidate and Transfer Attack Procedure . 69 5.3 Exploiting the New Covert Channel . 71 5.3.1 Attacking Table Based AES . 72 5.3.2 Attacking Square and Multiply El Gamal Decryption . 72 5.4 Experiment Setup and Results . 73 5.4.1 Experiment Setup . 74 5.4.2 AES Results . 74 5.4.3 El Gamal Results . 76 5.5 Invalidate and Transfer Outcomes .
Load more

Recommended publications
  • Future EW Capabilities
    CRITICAL UNCLASSIFIED INFORMATION Future EW Capabilities COL Daniel Holland, ACM-EW Director [email protected] 706-791-8476 CRITICAL17 UNCLASSIFIEDAug 2021 INFORMATION Future Army EW Capabilities AISR Target identification, geo-location, and advanced non-kinetic effects delivery for the MDO fight. HELIOS (MDSS) Altitude 60k’ EW Planning and Management Tool LOS 500 kms (nadir 18 kms) HADES (MDSS) Altitude 40k+’ UAV LOS 400 kms Spectrum Analyzer MFEW Air Large MFEW Air Small Altitude 15k-25k’ Altitude 2500-8000’ LOS 250-300 kms LOS 100-150 kms C2 Counter Fire XX Radar SAM SRBM MEMSS C2 TT Radar Tech Effects CP TA Radar C2 AISR – Aerial ISR DEA – Defensive Electromagnetic Attack GSR- Ground Surveillance Radar TA Radar ERCA – Extended Range Cannon Artillery FLOT – Forward Line of Troops IFPC – Indirect Fire Protection Capability GMLS-ER – Guided Multiple Launch Rocket System Extended Rng UGS HADES – High Accuracy Detection & Exploitation System HELIOS – High altitude Extended range Long endurance Intel Observation System LOS – Line of Sight MDSS – Multi-Domain Sensor System MEMSS - Modular Electromagnetic Spectrum System TLS EAB MFEW – Multifunction Electromagnetic Warfare Ground to Air TLS BCT M-SHORAD – Mobile Short Range Air Defense Close fight TLS – Terrestrial Layer System 30km 70km 150km TT – Target Tracking 500km FLOT THREAT TA – Target Acquisition PrSM Ver 14.6 – 30 Jul 21 155mm ERCA GMLS-ER UGS – Unmanned Ground System AREA UNCLASSIFIED Electronic Warfare Planning and Management Tool (EWPMT) Electromagnetic Warfare/Spectrum
    [Show full text]
  • Electromagnetic Side Channels of an FPGA Implementation of AES
    Electromagnetic Side Channels of an FPGA Implementation of AES Vincent Carlier, Herv´e Chabanne, Emmanuelle Dottax and Herv´e Pelletier SAGEM SA Abstract. We show how to attack an FPGA implementation of AES where all bytes are processed in parallel using differential electromag- netic analysis. We first focus on exploiting local side channels to isolate the behaviour of our targeted byte. Then, generalizing the Square at- tack, we describe a new way of retrieving information, mixing algebraic properties and physical observations. Keywords: side channel attacks, DEMA, FPGA, AES hardware im- plementation, Square attack. 1 Introduction Side channel attacks first appear in [Koc96] where timing attacks are de- scribed. This kind of attack tends to retrieve information from the secret items stored inside a device by observing its behaviour during a crypto- graphical computation. In a timing attack, the adversary measures the time taken to perform the computations and deduces additionnal information about the cryptosystems. Similarly, power analysis attacks are introduced in [KJJ99] where the attacker wants to discover the secrets by analysing the power consumption. Smart cards are targets of choice as their power is sup- plied externally. Usually we distinguish Simple Power Analysis (SPA), that tries to gain information directly from the power consumption, and Differ- ential Power Analysis (DPA) where a large number of traces are acquired and statistically processed. Another side channel is the one that exploits the Electromagnetic (EM) emanations. Indeed, these emanations are correlated with the current flowing through the device. EM leakage in a PC environ- ment where eavesdroppers reconstruct video screens has been known for a 1 long time [vE85], see also [McN] for more references.
    [Show full text]
  • Conductive Concrete’ Shields Electronics from EMP Attack
    ‘Conductive concrete’ shields electronics from EMP attack November 14, 2016 Credit: Craig Chandler/University Communication/University of Nebraska-Lincoln An attack via a burst of electromagnetic energy could cripple vital electronic systems, threatening national security and critical infrastructure, such as power grids and data centers. The technology is ready for commercialization, and the University of Nebraska-Lincoln has signed an agreement to license this shielding technology to American Business Continuity Group LLC, a developer of disaster-resistant structures. Electromagnetic energy is everywhere. It travels in waves and spans a wide spectrum, from sunlight, radio waves and microwaves to X- rays and gamma rays. But a burst of electromagnetic waves caused by a high-altitude nuclear explosion or an EMP device could induce electric current and voltage surges that cause widespread electronic failures. "EMP is very lethal to electronic equipment," said Tuan, professor of civil engineering. "We found a key ingredient that dissipates wave energy. This technology oöers a lot of advantages so the construction industry is very interested." EMP-shielding concrete stemmed from Tuan and Nguyen's partnership to study concrete that conducts electricity. They ñrst developed their patented conductive concrete to melt snow and ice from surfaces, such as roadways and bridges. They also recognized and conñrmed it has another important property – the ability to block electromagnetic energy. Their technology works by both absorbing and reòecting electromagnetic waves. The team replaced some standard concrete aggregates with their key ingredient – magnetite, a mineral with magnetic properties that absorbs microwaves like a sponge. Their patented recipe includes carbon and metal components for better absorption as well as reòection.
    [Show full text]
  • Analysis of EM Emanations from Cache Side-Channel Attacks on Iot Devices
    Analysis of EM Emanations from Cache Side-Channel Attacks on IoT Devices Moumita Dey School of Electrical and Computer Engineering, Georgia Institute of Technology, Atlanta, USA [email protected] Abstract— As the days go by, the number of IoT devices are growing exponentially and because of their low computing capabilities, they are being targeted to perform bigger attacks that are compromising their security. With cache side channel attacks increasing on devices working on different platforms, it is important to take precautions beforehand to detect when a cache side channel attack is performed on an IoT device. In this paper, the FLUSH+RELOAD attack, a popular cache side channel attack, is first implemented and the proof of concept is demonstrated on GnuPG RSA and bitcnts benchmark of MiBench suite. The effects it has are then seen through EM emanations of the device under different conditions. There was distinctive activity observed due to FLUSH+RELOAD attack, which can be identified by profiling the applications to be monitored. INTRODUCTION Fig. 1. IoT devices demand trend [1] The Internet of Things (IoT) is the next frontier in technology, and there’s already several companies trying to capitalize it. Its a network of products that are connected to the Internet, thus they have their own IP address and can GitHub, Netflix, Shopify, SoundCloud, Spotify, Twitter, and connect to each other to automate simple tasks. As prices a number of other major websites. This piece of malicious of semiconductor fall and connectivity technology develops, code took advantage of devices running out-of-date versions more machines are going online.
    [Show full text]
  • Key Update Countermeasure for Correlation-Based Side-Channel Attacks
    Key Update Countermeasure for Correlation-Based Side-Channel Attacks Yutian Gui, Suyash Mohan Tamore, Ali Shuja Siddiqui & Fareena Saqib Journal of Hardware and Systems Security ISSN 2509-3428 J Hardw Syst Secur DOI 10.1007/s41635-020-00094-x 1 23 Your article is protected by copyright and all rights are held exclusively by Springer Nature Switzerland AG. This e-offprint is for personal use only and shall not be self- archived in electronic repositories. If you wish to self-archive your article, please use the accepted manuscript version for posting on your own website. You may further deposit the accepted manuscript version in any repository, provided it is only made publicly available 12 months after official publication or later and provided acknowledgement is given to the original source of publication and a link is inserted to the published article on Springer's website. The link must be accompanied by the following text: "The final publication is available at link.springer.com”. 1 23 Author's personal copy Journal of Hardware and Systems Security https://doi.org/10.1007/s41635-020-00094-x Key Update Countermeasure for Correlation-Based Side-Channel Attacks Yutian Gui1 · Suyash Mohan Tamore1 · Ali Shuja Siddiqui1 · Fareena Saqib1 Received: 14 January 2020 / Accepted: 13 April 2020 © Springer Nature Switzerland AG 2020 Abstract Side-channel analysis is a non-invasive form of attack that reveals the secret key of the cryptographic circuit by analyzing the leaked physical information. The traditional brute-force and cryptanalysis attacks target the weakness in the encryption algorithm, whereas side-channel attacks use statistical models such as differential analysis and correlation analysis on the leaked information gained from the cryptographic device during the run-time.
    [Show full text]
  • Method for Effectiveness Assessment of Electronic Warfare Systems In
    S S symmetry Article Method for Effectiveness Assessment of Electronic Warfare Systems in Cyberspace Seungcheol Choi 1, Oh-Jin Kwon 1,* , Haengrok Oh 2 and Dongkyoo Shin 3 1 Department of Electrical Engineering, Sejong University, 209 Neungdong-ro, Gwangjin-gu, Seoul 05006, Korea; [email protected] 2 Agency for Defense Development (ADD), Seoul 05771, Korea; [email protected] 3 Department of Computer Engineering, Sejong University, 209 Neungdong-ro, Gwangjin-gu, Seoul 05006, Korea; [email protected] * Correspondence: [email protected] Received: 27 November 2020; Accepted: 16 December 2020; Published: 18 December 2020 Abstract: Current electronic warfare (EW) systems, along with the rapid development of information and communication technology, are essential elements in the modern battlefield associated with cyberspace. In this study, an efficient evaluation framework is proposed to assess the effectiveness of various types of EW systems that operate in cyberspace, which is recognized as an indispensable factor affecting modern military operations. The proposed method classifies EW systems into primary and sub-categories according to EWs’ types and identifies items for the measurement of the effectiveness of each EW system by considering the characteristics of cyberspace for evaluating the damage caused by cyberattacks. A scenario with an integrated EW system incorporating two or more different types of EW equipment is appropriately provided to confirm the effectiveness of the proposed framework in cyber electromagnetic warfare. The scenario explicates an example of assessing the effectiveness of EW systems under cyberattacks. Finally, the proposed method is demonstrated sufficiently by assessing the effectiveness of the EW systems using the scenario.
    [Show full text]
  • Physical Key Extraction Attacks On
    contributed articles DOI:10.1145/2851486 needs to never output it or anything that Computers broadcast their secrets via may reveal it. (The operating system may be misused to allow someone else’s inadvertent physical emanations that process to peek into the program’s are easily measured and exploited. memory or files, though we are getting better at avoiding such attacks, too.) BY DANIEL GENKIN, LEV PACHMANOV, ITAMAR PIPMAN, Yet programs’ control over their ADI SHAMIR, AND ERAN TROMER own outputs is a convenient fiction, for a deeper reason. The hardware run- ning the program is a physical object and, as such, interacts with its envi- ronment in complex ways, including Physical electric currents, electromagnetic fields, sound, vibrations, and light emissions. All these “side channels” may depend on the computation per- Key Extraction formed, along with the secrets within it. “Side-channel attacks,” which ex- ploit such information leakage, have been used to break the security of nu- merous cryptographic implementa- Attacks on PCs tions; see Anderson,2 Kocher et al.,19 and Mangard et al.23 and references therein. Side channels on small devices. Many past works addressed leakage from small devices (such as smart- cards, RFID tags, FPGAs, and simple embedded devices); for such devices, CRYPTOGRAPHY IS UBIQUITOUS. Secure websites and physical key extraction attacks have financial, personal communication, corporate, and been demonstrated with devastating effectiveness and across multiple phys- national secrets all depend on cryptographic algorithms ical channels. For example, a device’s operating correctly. Builders of cryptographic systems power consumption is often correlated with the computation it is currently ex- have learned (often the hard way) to devise algorithms ecuting.
    [Show full text]
  • Electromagnetic Spectrum Superiority Strategy
    Our task is to ensure that American military superiority endures, and in combination with other elements of national power, is ready to protect Americans against sophisticated challenges to national security. — 2017 National Security Strategy It is the policy of the United States to use radiofrequency spectrum (spectrum) as efficiently and effectively as possible to help meet our economic, national security, science, safety, and other Federal mission goals now and in the future. — Presidential Memorandum on Developing a Sustainable Spectrum Strategy for America’s Future, October 25, 2018 2020 Department of Defense Electromagnetic Spectrum Superiority Strategy Foreword The Nation has entered an age of warfighting wherein U.S. dominance in air, land, sea, space, cyberspace, and the electromagnetic spectrum (EMS) is challenged by peer and near peer adversaries. These challenges have exposed the cross-cutting reliance of U.S. Forces on the EMS, and are driving a change in how the DoD approaches activities in the EMS to maintain an all-domain advantage. EMS challenges go well beyond the military battlespace. The EMS is being repurposed for commercial mobile broadband technologies to bolster economic growth and prosperity, which further restricts DoD’s freedom of action. These sophisticated technologies represent new opportunities for the Department and our national economy. However, they also present new challenges across the competition continuum as the electromagnetic operational environment becomes increasingly congested, contested, and constrained (i.e., complex). The Department is transitioning from the traditional consideration of electromagnetic warfare (EW) as separable from spectrum management to a unified treatment of these activities as Electromagnetic Spectrum Operations (EMSO).
    [Show full text]
  • FM 3-12 Cyberspace and Electromagnetic Warfare
    FM 3-12 CYBERSPACE OPERATIONS AND ELECTROMAGNETIC WARFARE AUGUST 2021 DISTRIBUTION RESTRICTION: Approved for public release; distribution is unlimited. This publication supersedes FM 3-12, dated 11 April 2017. HEADQUARTERS, DEPARTMENT OF THE ARMY This publication is available at the Army Publishing Directorate site (https://armypubs.army.mil), and the Central Army Registry site (https://atiam.train.army.mil/catalog/dashboard). Foreword Over the past two decades of persistent conflict, the Army has deployed its most capable communications systems ever. During this time, U.S. forces have continued to dominate cyberspace and the electromagnetic spectrum while conducting counterinsurgency operations in Afghanistan and Iraq against enemies and adversaries who lack the ability to challenge our technological superiority. However, in recent years, regional peers have demonstrated formidable capabilities in hybrid operational environments. These capabilities threaten the Army’s dominance in both cyberspace and the electromagnetic spectrum. The Department of Defense information network-Army is an essential warfighting platform that is a critical element of the command and control system and foundational to success in Army operations. Effectively operating, securing, and defending the network to maintain trust in its confidentiality, integrity, and availability is essential to commanders’ success at all echelons. A commander who cannot access or trust communications and information systems or the data they carry risks the loss of lives, loss of critical resources, or mission failure. At the same time, our adversaries and enemies are also increasingly reliant on networks and networked weapons systems. The Army, as part of the joint force, must be prepared to exploit or deny our adversaries and enemies the operational advantages that these networks and systems provide.
    [Show full text]
  • EMP) Effect on Surveillance Unmanned Aerial Vehicles (Uavs
    Study of electromagnetic pulse (EMP) effect on surveillance unmanned aerial vehicles (UAVs) Samuel Ibeobi, Xuchao Pan Department of Mechanical Engineering, Nanjing University of Science and Technology, Nanjing, Jiangsu Province, China 1Corresponding author E-mail: [email protected], [email protected] Received 10 February 2021; accepted 1 March 2021 DOI https://doi.org/10.21595/jmeacs.2021.21926 Copyright © 2021 Samuel Ibeobi, et al. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited. Abstract. The contemporary deployment of unmanned aerial vehicles (UAVs) for commercial purposes and electromagnetic pulse (EMP) threat to mechatronic devices necessitates the study of EMP on surveillance UAVs. This research paper describes the effect of EMP interference on the structure, communication and cabling circuit of the UAV. This was achieved using the CST microwave studio with an induced plane wave referring to MIL-STD464 and applying the transmission line matric solver method. The cable field coupling for bi-directional, uni-directional radiation and uni-directional irradiation were carried out with a constant resistive load of 50 Ω and the induced coupling currents and voltages, current in space domain, TLM mesh is obtained indicating the susceptibility of the UAV under different conditions of EMP interference and the electromagnetic distribution in the UAV circuit layout. Experimentally, the UAV is setup with an EMP generator and its response was observed at 12 m, 10 m and 8 m from the radiation source with the corresponding field strengths. Keywords: CST, electromagnetic interference, induced coupling, UAV.
    [Show full text]
  • Active Electromagnetic Attacks on Secure Hardware
    UCAM-CL-TR-811 Technical Report ISSN 1476-2986 Number 811 Computer Laboratory Active electromagnetic attacks on secure hardware A. Theodore Markettos December 2011 15 JJ Thomson Avenue Cambridge CB3 0FD United Kingdom phone +44 1223 763500 http://www.cl.cam.ac.uk/ c 2011 A. Theodore Markettos This technical report is based on a dissertation submitted March 2010 by the author for the degree of Doctor of Philosophy to the University of Cambridge, Clare Hall. Technical reports published by the University of Cambridge Computer Laboratory are freely available via the Internet: http://www.cl.cam.ac.uk/techreports/ ISSN 1476-2986 Active electromagnetic attacks on secure hardware A. Theodore Markettos Summary The field of side-channel attacks on cryptographic hardware has been extensively studied. In many cases it is easier to derive the secret key from these attacks than to break the cryptography itself. One such side- channel attack is the electromagnetic side-channel attack, giving rise to electromagnetic analysis (EMA). EMA, when otherwise known as ‘TEMPEST’ or ‘compromising eman- ations’, has a long history in the military context over almost the whole of the twentieth century. The US military also mention three related at- tacks, believed to be: HIJACK (modulation of secret data onto conducted signals), NONSTOP (modulation of secret data onto radiated signals) and TEAPOT (intentional malicious emissions). In this thesis I perform a fusion of TEAPOT and HIJACK/NONSTOP techniques on secure integrated circuits. An attacker is able to introduce one or more frequencies into a cryptographic system with the intention of forcing it to misbehave or to radiate secrets.
    [Show full text]
  • TEMPEST Font Protects Text Data Against RF Electromagnetic Attack
    ISSN 1330-3651 (Print), ISSN 1848-6339 (Online) https://doi.org/10.17559/TV-20180325143031 Original scientific paper TEMPEST Font Protects Text Data against RF Electromagnetic Attack Ireneusz KUBIAK Abstract: Nowadays an electromagnetic penetration process of electronic devices has a big significance. Processed information in electronic form could be protected in different ways. Very often used methods limit the levels of valuable emissions. But such methods could not always be implemented in commercial devices. A new solution (soft tempest) is proposed. The solution is based on TEMPEST font. The font does not possess distinctive features. This phenomenon causes that at an output of Side Channel Attack the possibilities of recognition of each character which appears on the reconstructed image for sources in the form of graphic lines (VGA and DVI) are limited. In this way the TEMPEST font protects processed data against electromagnetic penetration not only for VGA and DVI standards. The data are protected during printing them on laser printers too. Keywords: digital image processing; digital signal processing; eavesdropping process; protection of information; soft TEMPEST; valuable (sensitive) emission 1 INTRODUCTION processed information against electromagnetic penetration. A shielding is a very popular method which limits levels of Protection of information against electromagnetic electromagnetic disturbances from IT devices [2, 17]. penetration process is a very important challenge. To Other method consists in filtering electric video signals protect information various methods and solutions are Fig. 1, [18, 19]. used. Most popular solution is a restricted access to space where classified information is processed [1, 2]. However, electronic devices are sources of electromagnetic emissions.
    [Show full text]