Team cracks chips used in military, aerospace systems

A team of German researchers has demonstrated a technique for breaking strong encryption keys used in programmable chips that are widely used in the defense and aerospace industries.

Encryption protects configuration instructions that are loaded onto Field Programmable Gate Array (FPGA) chips when they are powered up. Researchers at the Horst Gortz Institute for IT-Security at Ruhr University reported in a paper this month that they were able to extract the key used to decrypt data in two models of FPGAs using differential power analysis, a side-channel attack that analyzes the power consumption of the chip during the decryption process.

They reported that they were able to extract the keys from off-the-shelf chips using off-the-shelf hardware with moderate effort.

Related stories:

New crypto standard to require protection against power analysis

“Side-channel attacks are not a pure academic playground but have a real-world impact on the security of embedded systems,” the authors wrote in their paper.

The impacts could include the theft of intellectual data included in the encrypted bitstream as well as the introduction of hardware Trojans and the modification of configuration instructions on chips embedded in military hardware.

The researchers are well-respected and their attack is plausible, said Paul Kocher, president of Cryptography Research and one of the developers of differential power analysis (DPA).

“To someone who knows this stuff it absolutely makes sense,” Kocher said. Some of the math used is complex, but the process is not once the method is implemented. “If you use any FPGAs in secure applications it’s a big deal,” he said.

Countermeasures to defeat DPA attacks are known and not difficult to implement, Kocher said, and many FPGA providers have used them. But Xilinx Inc., whose Virtex 4 and 5 FPGAs were cracked in the study, apparently do not use this protection.

Xilinx said it was examining the paper.

FPGA is an integrated circuit that can be configured after manufacture by loading a configuration stored in separate memory when it is powered up. This gives greater flexibility and lower costs than an Application Specific Integrated Circuit, although the chips are not as powerful.

Copying the configuration allows FPGAs to perform the same task in mass-produced products. It is most often used in products with moderate to low-volume production runs of under a half-million items, Kocher said.

Government is a major customer for products produced in this range, including radios, security devices, vehicles, weapons systems and other military gear. Xilinx lists the aerospace and defense industry as one of its major markets.

The first commercially viable FPGAs were invented by Xilinx co-founders Ross Freeman and Bernard Vonderschmitt in 1985, and the company claims about 50 percent of the market today.

The ability to configure the FPGA makes it easy to update or modify a product in the field and to fix early design flaws. But it also leaves them open to abuse. The configuration file is loaded from external memory on powering up, and if this bitstream can be intercepted and read it could be copied or modified. For this reason, Xilinx began 10 years ago encrypting the configuration file in memory, to be decrypted with a key stored on the FPGA.

Differential power analysis was developed in 1999 to extract an encryption or decryption key by analyzing power usage during the process.

Amir Moradi, Markus Kasper and Christof Paar of the Gortz Institute earlier this year presented results of a side-channel DPA attack on the Triple Data Encryption Standard encryption of a Xilinx Virtex-II FPGA. The more recent paper gives the results of a similar effort against later families of chips that use 256-bit Advanced Encryption Standard encryption.

“We were able to perform the key extraction by using only the measurements of a single power-up,” they wrote. “To the best of our knowledge, this is the first successful attack against the bitstream encryption of Xilinx Virtex 4 and Virtex 5 reported in the open literature.”

Kocher described DPT as analogous to listening to the clicks coming from the tumblers of a safe, “but instead of using sound, you're using electrical power consumption.”

The researchers first mapped out the encryption architecture of the chip by analyzing power traces using a known key. With this information they were able to “eavesdrop” on the encrypted configuration bitstream and measure fluctuations in power consumption at the points in which blocks of data were being decrypted.

“Side-channel analysis attacks follow a divide-and-conquer strategy,” they wrote. “That is, the key is recovered in small pieces.”

The keys were extracted in eight pieces of 32 bits each from the data gathered in a single power up for each chip. They analyzed the power consumption of 50,000 encrypted bitstream blocks for the Virtex 4 and 90,000 blocks for Virtex 5. It took about six hours to extract the full key for the Virtex 4 and about nine hours for the Virtex 5.

“These are just the first results and we believe that it is possible to further reduce the number of required traces and hypotheses in the future,” they wrote.

Because the same decryption key usually is used in all FPGAs in a mass produced product, breaking that key could make each item vulnerable.

Although no cracks of this type have been reported to date, that does not mean it has not happened, Kocher said.

“If China gets a piece of military equipment and breaks the key in an FPGA, they wouldn’t talk about it,” he said. “But if [the researchers] can do it, the presumption is that anyone else who wants to could.”

Implementing countermeasures to foil a DPA attack could be done with a few man-weeks of development and testing, Kocher said, but that would only protect new FPGAs. The installed base remains a hardware vulnerability in the products using the chips because the vulnerability cannot be addressed without physically replacing the chip.

“The irony is that the value of the FPGA is that it is fully programmable, except for the loader,” Kocher said. “And that’s where the vulnerability lies.”