Bitstream reverse engineering is traditionally associated with Intellectual Property (IP) theft. Another, less known, threat deriving from that is bitstream modification attacks. It has been shown that the secret key can be extracted from FPGA implementations of cryptographic algorithms by injecting faults directly into the bitstream. Such bitstream modification attacks rely on changing the content of Look Up Tables (LUTs). Therefore, related countermeasures aim to make the task of identifying a LUT more difficult (e.g. by masking LUT content). However, recent advances in FPGA reverse engineering revealed information on how interconnects are encoded in the bitstream of Xilinx 7 series FPGAs. In this paper, we show that this knowledge can be used to break or weaken existing countermeasures, as well as improve existing attacks. Furthermore, a straightforward attack that re-routes the key to an output pin becomes possible. We demonstrate our claims on an FPGA implementation of SNOW3G stream cipher, a core algorithm for confidentiality and integrity used in several 3GPP wireless communication standards, including the new Next Generation 5G.
Recent years have seen a growing concern over System Management Mode (SMM) and its broad access to platform resources. The SMI Transfer Monitor (STM) is Intel’s most powerful executing CPU context. The STM is a firmware-based hypervisor that applies the principle of least privilege to powerful System Management Interrupt (SMI) handlers that control runtime firmware. These handlers have traditionally had full access to memory as well as the register state of applications and kernel code even when their functionality did not require it. The STM has been been enabled for UEFI and, most recently, coreboot firmware, adding protection against runtime SMM-based attacks as well as establishing a firmware-based Trusted Execution Environment (TEE) capability. We provide a detailed overview of the STM architecture, evaluate its protections, and quantify its performance. Our results show the STM can protect against published SMM vulnerabilities with tolerable performance overheads.
The mathematical constructs, nature of computations and challenges in optimizing lattice post-quantum cryptographic algorithms on modern many-core processors are discussed in this paper. Identification of time-consuming functions and subsequent hardware optimization using vector units and hardware accelerators of one of the candidates, CRYSTALS-Kyber, leads to performance improvement of around 52% for its SHA3 variant and 83% for its AES variant. Detailed Cycles-per-Instruction (CPI) stack breakdown before and after optimization indicates a CPI of around 0.5 and dominance of load/store operations in these workloads.
RISC-V is an increasingly popular, free and open Instruction Set Architecture (ISA). Many standard extensions to RISC-V are currently being designed and evaluated, including one for accelerating cryptographic workloads. Unlike most incumbent ISAs which re-use existing large SIMD state and data-paths to accelerate cryptographic operations, RISC-V also adds support for smaller machines with narrow 32 and 64-bit data-paths. For embedded, IoT class devices, this significantly lowers the barrier to entry for secure and efficient accelerated cryptography. In this paper, we describe (to our knowledge) the first complete, free and open-source implementation of the draft 32-bit RISC-V Cryptography Extension. We detail the performance benefits for several important algorithms, and associated hardware costs. Our experiences help to guide the ongoing standardisation work and provide a platform for other researchers to experiment with a complete and representative CPU system, implementing the draft cryptography extension.
Though system and application level security has received and continue to receive significant attention, interest in hardware security has spiked only in the last few years. The majority of recently disclosed hardware security attacks exploit well known and documented hardware behaviours such as speculation, cache and memory timings, etc. We observe that security exploits in undocumented hardware behaviour can have even more severe consequences as such behaviour is rarely verified and protected against. This paper introduces armshaker, a tool to uncover one such undocumented behaviour in the Armv8 architecture, namely hidden instructions. These are the instructions that are not documented in the ISA reference manual, but still execute successfully. We tested five different Armv8-A hardware platforms from four different vendors, as well as two Armv8-A emulators, and uncovered multiple hidden instructions. An interesting finding is that, though we did not discover any hidden instruction in the hardware itself, bugs in the system software can induce hidden instructions in the system that, from a user's perspective, are indistinguishable from hidden instructions in hardware. Though armshaker did not find any hidden instruction in the hardware of the tested platforms, their existence cannot be ruled out, given the diversity of available Arm processors. Consequently, we make armshaker publicly available as open-source software to enable users to audit their own systems for hidden instructions.
