TrustZone-backed Bitcoin Wallet Miraje Gentilal Thesis to obtain the Master of Science Degree in Electrical and Computer Engineering Supervisor: Dr. Leonel Augusto Pires Seabra de Sousa Examination Committee Chairperson: Dr. Gonçalo Nuno Gomes Tavares Supervisor: Dr. Leonel Augusto Pires Seabra de Sousa Members of the Committee: Dr. Ricardo Jorge Fernandes Chaves November, 2016 Acknowledgments I would like to thank to all those who, in some way, contributed for this dissertation by supporting and encouraging me. To my supervisor, Doutor Leonel Sousa, for introducing me to the topic, providing me with guidance, and for permanent availability shown. His knowledge and support were fundamental during the process of developing this dissertation. To Paulo Martins for his helpful advices, suggestions, critical comments, and for his unconditional support through the writing process of this dissertation. To Instituto Superior Técnico (IST) and Instituto de Engenharia de Sistemas e Computadores - Investigação e Desenvolvimento (INESC-ID) for providing me with all the needed resources to develop this dissertation. To my family and friends who have supported me at all times and gave me strong motivation. Thank you for always reminding me what my priorities are and for encouraging me to follow my dreams. Lastly, to all those who I did not have the opportunity to mention as I should, my sincere thank you. i ii Resumo Nos últimos anos, a popularidade das moedas virtuais tem aumentado em grande parte devido à crescente aceitação de Bitcoin, cujo núcleo é baseado na criptografia de chave pública. Enquanto que a chave pública é utilizada como endereço destino de um pagamento, a chave privada é usada para aceder aos fundos armazenados no endereço correspondente, através da assinatura digital de transações. A maioria das carteiras de Bitcoin processam a informação sensível num ambiente susceptível a ataques. Além disso, a segurança que é atribuída ao armazenamento dessa informação é suportada na sua encriptação com uma chave baseada na palavra-passe do utilizador, tornando-se suscetível a ataques de dicionário. Como a chave privada define a posse dos bitcoins, deve ser muito bem protegida e guardada, criando assim a necessidade de se utilizar medidas de segurança mais robustas do que as que são utilizadas atualmente. A ARM tornou disponível uma extensão da arquitetura dos processadores denominada de Trust- Zone, que permite separar ambientes seguros e não seguros, garantindo simultaneamente a integri- dade do código do Sistema Operativo. Nesta dissertação, é proposta a exploração da TrustZone para implementar uma carteira de Bitcoins flexível, confiável e resistente a ataques de dicionário e de canal lateral. A utilização desta extensão tem a desvantagem de a execução das operações de leitura e escrita serem mais lentas devido à encriptação do armazenamento. Contudo, como resultado das otimizações específicas associadas à plataforma através do uso duma interface de programação da TrustZone é demonstrado que as oper- ações criptográficas podem, de facto, ser mais eficientes. Palavras-Chave: Ambiente de Execução Confiável; Bitcoin; Carteira de Bitcoins; Carteira de Hardware; Mundo Seguro; TrustZone. iii iv Abstract The popularity of virtual currencies has been increasing in the recent years, largely due the growing acceptance of Bitcoin, whose core is based on public key cryptography. While the public key is used as an address for a payment, the private key is used to access the funds stored in the correspondent address, through the digital signature of transactions. Sensitive information is processed in an environment susceptible to attacks in almost every Bitcoin wallet. Moreover, the security that is provided to store such information, is supported on the encryption with a key based in a user’s password, making it susceptible to dictionary attacks. As the private key defines the ownership of bitcoins, it must be very well protected and secured. Thus, the need of using stronger security measures than the ones that are currently used arises. ARM has made available an extension of processors architectures, designated TrustZone, which allows for the separation of trusted and non-trusted environments, while ensuring the integrity of the Operating System code. In this dissertation, it is proposed the exploitation of TrustZone, in order to implement a flexible and reliable Bitcoin wallet that is more resilient to dictionary and side-channel attacks. Making use this extension comes with the downside that writing and reading operations become slower, due to the encrypted storage, but it is shown that cryptographic operations can in fact be executed more efficiently as a result of platform-specific optimizations, which are available through the use of a TrustZone API. Keywords: Bitcoin; Bitcoin Wallet; Hardware Wallet; Secure World; Trusted Execution Environ- ment; TrustZone. v vi Contents Acknowledgments . .i Resumo . iii Abstract . .v List of Tables . ix List of Figures . xi Acronyms . xiii 1 Introduction 1 1.1 Motivation . .2 1.2 Objectives . .3 1.3 Main Contributions . .4 1.4 Outline . .5 2 Background 7 2.1 TrustZone Technology . .8 2.1.1 Overview . .8 2.1.2 Hardware Architecture . .9 2.1.3 Software Architecture . 10 2.1.4 Security Features and Economic Impact . 11 2.2 Bitcoin Protocol . 12 2.2.1 Bitcoin Architecture . 12 2.2.2 Bitcoin Addresses . 14 2.2.3 Bitcoin Transaction Process . 16 2.2.4 Bitcoin Wallets . 18 2.2.5 Security Features . 20 2.3 Related Work . 20 2.4 Summary . 21 3 Proposed TrustZone-based Bitcoin Wallet 23 3.1 Available Base Wallets . 24 3.2 Base Wallet Description . 28 3.3 Proposed Improvements . 33 3.4 Summary . 40 4 Implementation Details and System Assessment 43 4.1 TrustZone-enabled Platform . 44 4.2 Software Stack . 46 4.3 Implementation . 48 vii 4.3.1 Platform Configuration . 48 4.3.2 Implementation Details . 53 4.4 Experimental Results . 55 4.5 Summary . 59 5 Conclusion 61 5.1 Summary and Overall Conclusions . 62 5.2 Future Work . 63 Bibliography 65 viii List of Tables 2.1 Main types of Bitcoin Wallets. 19 3.1 Main Hardware Wallets. 25 3.2 BitSafe’s development prototype main characteristics [87]. 27 3.3 Brief description of the main Wallet Functions [11]. 31 3.4 Brief description of the main Transaction Functions [11]. 31 3.5 Brief description of the main Pseudo-Random Number Generation Functions [11]. 32 3.6 Brief description of the platform dependent functions [11]. 32 3.7 Available packets for the communication between BitSafe and the host [11]. 33 4.1 Processors with TrustZone support. [101, 102] . 44 4.2 Main characteristics of TrustZone-enabled development boards. 45 4.3 Execution time of storage related functions. The values are presented in clock cycles. In parenthesis the execution time increase in percentage of the TBW relative to the OBW is presented. 56 4.4 Execution time of the used Cryptographic Operations. The values are presented in clock cycles. In parenthesis the execution time increase in percentage of the TBW relative to the OBW is presented. 57 4.5 Execution time of the available packets. The values are presented in clock cycles. In parenthesis the execution time increase in percentage of the TBW relative to the OBW is presented. 58 4.6 Qualitative comparison between the OBW and the TBW. 59 ix x List of Figures 1.1 Total USD value of trading volume on major bitcoin exchanges per day since the imple- mentation of the Bitcoin protocol (logarithmic scale) [12]. .3 1.2 Number of confirmed transactions per day since the implementation of the Bitcoin protocol (logarithmic scale) [12]. .3 2.1 Possible software design for the Trusted Execution Environment [28]. .9 2.2 Simplified structure and flow of the Bitcoin architecture. 13 2.3 Example of a fork in the blockchain. 14 2.4 Simplified Bitcoin transaction example. 17 2.5 Example of real Bitcoin transactions with some information about the scripts used [54, 55]. 18 3.1 On the left it is displayed how the Storage is partitioned, and on the right it is shown the information stored in each wallet. The represented memory is byte addressable. 28 3.2 The three main modules of the BitSafe wallet. 30 3.3 BitSafe’s main modules. a) Initial configuration. b) Final configuration. The dotted boxes are fully implemented in the Normal World, the dashed boxes are partially implemented in the Secure World and the full boxes are completely implemented in the Secure World. Some of the Cryptographic Operations are only used to implement the functions of the boxes they are contained. 40 4.1 OP-TEE software architecture [112]. 47 4.2 OP-TEE secure storage architecture [14]. 47 xi xii Acronyms AES Advanced Encryption Standard AMBA Advanced Microcontroller Bus Architecture API Application Programming Interface ARM Advanced RISC Machine AXI Advanced eXtensible Interface BIP Bitcoin Improvement Proposal CA Client Application CPU Central Processing Unit DRBG Deterministic Random Bit Generator DRM Digital Rights Management ECC Elliptic Curve Cryptography ECDSA Elliptic Curve Digital Signature Algorithm GCC GNU Compiler Collection HD Hierarchical Deterministic HMAC Hash-based Message Authentication Code IP Intellectual Property OBW Original Base Wallet OEM Original Equipment Manufacturer OP-TEE Open Source Trusted Execution Enviornment OS Operating System P2PKH Pay To Public Key Hash PBKDF2 Password-Based Key Derivation Function 2 REE Rich Execution Environment RIPEMD RACE Integrity Primitives Evaluation Message Digest SCP Secure Copy SDK Software Development Kit SHA Secure Hash Algorithm SMC Secure Monitor Call SoC System on Chip SSH Secure Shell TA Trusted Application TBW TrustZone-backed Bitcoin Wallet TEE Trusted Execution Environment xiii xiv CHAPTER 1 INTRODUCTION Contents 1.1 Motivation . .2 1.2 Objectives . .3 1.3 Main Contributions ..