Smart cards play it safe

The latest revision of the Federal Information Processing Standard for cryptographic modules is a year overdue, but a draft should be out soon.'It's going through our regular release review,' before being presented for a 90-day comment period, said Ray Snouffer, manager of the security testing and metrics group at the National Institute of Standards and Technology.The third iteration of the standard, FIPS 140-3, contains the usual sorts of updates and clarifications that every maturing standard undergoes, but it also tackles a novel problem of growing concern ' protecting smart cards from power analysis attacks. In those attacks, a hacker reads the power fluctuations in a working cryptographic module to crack its code.Power analysis was a relatively new technique for cracking codes in single-chip processors when the last version of FIPS, FIPS 140-2, was approved in 2001, said Stan Kladko, director of the FIPS validation lab at BKP Security Labs. 'At that time, there was not enough time to include it' in the standard.Today, though, 'this is one of the bread-and-butter attacks,' said Paul Kocher, president of Cryptography Research.Power analysis was first described in 1999 by Kocher, along with researchers Joshua Jaffe and Benjamin Jun.'Immediately, a number of smart cards were compromised,' Kladko said. All that is required is an oscilloscope, access to a smart card and reader, 'and one week of work will get you the key.'The hacker must get access to the power line source going into the chip or to an output pin to measure the power fluctuation. 'The voltage in that pin will sag as power consumption increases,' Kocher said.Feeding the voltage into an oscilloscope gives a visual output that can be correlated with the input and output of the processor. This is simple power analysis that works if you can get a simple one-to-one correlation between power consumption and the bits the processor is using.If the correlation is not so simple, there is a more complex differential power analysis, which uses statistical analysis with a much larger group of measurements and statistical techniques to separate the signal from the noise and pull out the key.Power analysis works with single-chip processors, including smart cards, and there are a growing number of government smart cards with cryptography. The Defense Department has issued more than 10 million Common Access Cards, and civilian agencies are supposed to be ramping up to replace millions more traditional identification cards with the Personal ID Verification smart card mandated in Homeland Security Presidential Directive 12.Also, smart cards are not the only devices at risk. TV set-top boxes, game consoles, Blu-ray players, 'anything that has a chip that has a crypto key inside' is vulnerable, industry experts say.Theoretically, an analysis of a single chip could let you quickly read the key of any identical chip. The odds of any two chips being identical are pretty small. But analyzing the power consumption of one chip could dramatically cut the amount of analysis needed to crack subsequent chips built to the same standard.Simple and differential power analysis get a mention in the current FIPS 140-2 under 'other attacks,' but protection against them is not required.'We looked at this back when 140-2 was developed, and at that time it was fairly new,' Snouffer said. 'We understand it a little better now.'The current standard grew out of Federal Standard 1027, General Security Requirements for Equipment, which used the now-outdated Data Encryption Standard. FIPS 140-1 was issued in 1994, with a requirement that it be reviewed every five years. The review and revision process can take several years, and FIPS 140-2 was approved in 2001.Preparations for reviewing that version began at NIST in September 2004, by which time advances in technology were making it obsolete. A request for comments on FIPS 140-2 was published in January 2005, and the original timeline, which had slipped somewhat, called for FIPS 140-3 to be approved by May 2006 and for FIPS 140-2 to be retired in May 2007, although products validated under that standard still could be used.The starting point for the new draft is the implementation guidance for the standard that has been published. 'We also look at how technology has changed in the last five years,' Snouffer said.The changes that have made power analysis of interest for the new version are not so much in the technology for cracking keys, as in the ability of laboratories to accurately evaluate the effectiveness of countermeasures.'We only specify requirements where there is a test available,' Snouffer said.Many cryptographic implementations now employ countermeasures against power analysis, and the technology for evaluating them now is now available, Kladko said.'It's pretty simple, actually,' he said. 'We do FIPS evaluation as a separate business, but we do power analysis for customers. We submitted a draft proposal to NIST for the metrics for testing' that would use a signal-to-noise ratio.The way to protect against this is to introduce randomness, or noise, to the process. This can be done by introducing additional power to the circuits, randomly skipping some CPU cycles or by breaking a process up and having it performed on a variety of circuits.As with any security measures, nothing is perfect, and there is a trade-off. Any form of noise injected into the system will affect the chip's power consumption and/or performance.'It could easily degrade performance by a factor of two,' Kladko said.But this is not necessarily a significant impact, Kocher said.'For most implementations, it's not performance you are concerned with, it's security,' he said. 'And if computation time goes from 1 millisecond to 2 milliseconds, nobody's going to notice.'But even with additional noise, no system is going to be foolproof. With enough samples to work with and enough analysis, 'the noise is going to fall away,' leaving a signal that can be evaluated, Kocher said.But the additional time, effort and equipment required to do this analysis raises the bar for a would-be hacker.Frequently changing keys makes the attack even less attractive.'We're expecting to see this type of technique become prevalent in government cryptography because of the FIPS requirement,' Kocher said.Because absolute security is impossible, BKP Security recommended to NIST that the standard in FIPS 140-3 be protection of keys against cracking from a single power measurement.Security is not free, and neither is certification. BKP Security estimated that equipment cost to a testing lab would be minimal, probably no more than $5,000 for a digital oscilloscope, although additional training for personnel probably would be needed. Power analysis testing would add $5,000 to $10,000 to the cost of evaluation ' about 20 percent of the total cost of FIPS 140-2 testing ' and would require one to two person-weeks of testing time.That is likely to be included in the price of admission to the federal crypto market in the near future.