Smart Card security analysis Smart Card security analysis Marc Witteman, TNO

Do we need smart card security?

What are the threats ? disclosure Confidentiality:unauthorized disclosure of information sender receiver modification Integrity:unauthorized modification of information Authenticity:unauthorized use of service

Whats inside a smart card ? CPU RAM test logic ROM EEPROM serial i/o interface security logic databus

Smart card security evaluations logical analysis: software internal analysis: hardware side channel analysis: both hw and sw

Logical analysis Communication Functional testing Protocol analysis Code review

InternalAnalysis

Internal analysis tools Etching tools Optical microscope Probe stations Laser cutters Scanning Electron Microscope Focussed Ion Beam System and more…….

Reverse engineering

Staining of ion implant ROM array

Sub micron probe station

Probing with eight needles

FIB: fuse repair

Side channel analysis Use of hidden signals –timing –power consumption –electromagnetic emission –etc.. Insertion of signals –power glitches –electromagnetic pulses

Power consumption in clock cycle peak slope time I ddq area shape

Power consumption in routines

Power consumption in programs

Timing attack on RSA RSA principle: –Key set e,d,n –Encipherment: C = M e mod n –Decipherment: M = C d mod n RSA-implementation (binary exponentiation) –M := 1 –For i from t down to 0 do: M := M * M If d i = 1, then M := M*C

Timing Attack on RSA (2)

Differential Power Analysis Assume power consumption relates to hamming weight of data Subtract traces with high and low hamming weight Resulting trace shows hamming weight and data manipulation

Fault injection on smart cards Change a value read from memory to another value by manipulating the supply power: Threshold of read value A power dip at the moment of reading a memory cell

Differential Fault Analysis on RSA Efficient implementation splits exponentiation: d p = d mod (p-1) d q = d mod (q-1) K = p -1 mod q M p = C d p mod p M q = C d q mod q M = C d mod n = ( ( (M q - M p )*K ) mod q ) * p + M p

DFA on CRT Inject a fault during CRT that corrupts M q : M q is a corrupted result of M q computation M = ( ( (M q - M p )*K ) mod q ) * p + M p subtract M and M: M - M = (((M q - M p )*K) mod q)*p - (((M q - M p )*K) mod q)*p = (x 1 -x 2 )*p compute Gcd( M-M, n ) = Gcd( (x 1 -x 2 )*p, p*q ) = p compute q = n / p

Conclusions Smart cards can be broken by advanced analysis techniques. Users of security systems should think about: –What is the value of our secrets? –What are the risks (e.g. fraud, eavesdropping) –What are the costs and benefits of fraud? Perfect security does not exist!

For information: TNO Evaluation Centre Marc Witteman PO-Box GA Delft, The Netherlands Phone: Fax: