Scan chain encryption in Test Standards

Transcription

1 Scan chain encryption in Test Standards Mathieu Da Silva, Giorgio Di Natale, Marie-Lise Flottes, Bruno Rouzeyre To cite this version: Mathieu Da Silva, Giorgio Di Natale, Marie-Lise Flottes, Bruno Rouzeyre. Scan chain encryption in Test Standards. SURREALIST: SecURity, REliAbiLity, test, privacy, Safety and Trust of Future Devices, May 2018, Bremen, Germany. Workshop on SecURity, REliAbiLity, test, privacy, Safety and Trust of Future Devices, 2018, < <lirmm v2> HAL Id: lirmm Submitted on 10 Oct 2018 HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

2 SCAN CHAIN ENCRYPTION IN TEST STANDARDS Mathieu Da Silva, Marie-Lise Flottes, Giorgio Di Natale, Bruno Rouzeyre SURREALIST 2018

3 BSR BSR CONTEXT Test standards IEEE 1149 (JTAG) for board testing TDI Device 1 Device 2 Device 3 TDO Device Scan chain TMS TCK TDI IDCODE BYP IR TAP controller TMS TCK TDO IEEE 1500 for cores testing in a SoC IEEE 1687 (IJTAG) for embedded instruments 2

4 BSR BSR CONTEXT Threats Unauthorized user Malicious device TDI Device 1 Device 2 Device 3 TDO Device Scan chain TMS TCK TDI IDCODE BYP IR TDO Untrusted devices Rosenfeld et al., Attacks and Defenses for JTAG, IEEE Design & Test 2010 TAP controller Malicious users (example: scan attacks) TMS TCK Yang et al., Secure Scan: A Design-for-Test Architecture for Crypto Chips, TCAD 06 3

5 SUMMARY 1) Scan chain encryption 2) State-of-the-art based on test communication encryption 3) Implementation with block cipher 4) Implementation with stream cipher 5) Conclusion 4

6 SCAN CHAIN ENCRYPTION Solution: test communication encryption Unauthorized user Unauthorized user TDI Dec Decrypted data Encrypted data Malicious device Device 1 Enc Device 3 TDO TMS TCK Input decryption prevents sending desired test data Output encryption prevents reading plain test responses 5

7 SCAN CHAIN ENCRYPTION Solution: test communication encryption Unauthorized user Unauthorized user Encryption Malicious device Decryption TDI Dec Device 1 Enc Device 3 TDO TMS TCK Test patterns Symmetric ciphers Authorized user Authorized user Test responses Input decryption prevents sending desired test data Output encryption prevents reading plain test responses Test/debug only possible by authorized user knowing the secret key 6

8 SYMMETRIC CIPHER 2 types of symmetric cipher: stream and block ciphers 7

9 STREAM CIPHER / BLOCK CIPHER Stream cipher encryption Keystream XORed bitwise with the plaintext Block cipher encryption Confusion and diffusion on a block of plaintext Plaintext R IV Pseudo-Random Key Generator Keystream S(IV, Key) Plaintext R N Block cipher Ciphertext c Key Preference for stream ciphers Ciphertext c "Naturally" adapted to serial test communication (JTAG, IEEE 1500, IJTAG) Smaller area footprint compared to block ciphers But.. N 8

10 TWO-TIMES PAD: STREAM CIPHER REQUIREMENT Two-times pad: same key and IV re-used => same keystream generated to encrypt different data IV IV Key Stream cipher Reset Key Stream cipher S(IV, Key) S(IV, Key) R 1 R 1 S(IV, Key) R 2 R 2 S(IV, Key) Possible to carry out attacks if requirement is not fit R1 S(IV, Key) R2 S(IV, Key) Solution: IV generated randomly at each circuit reset R1 S(IV 1, Key) R2 S (IV 2, Key) 9

11 SUMMARY 1) Scan chain encryption 2) State-of-the-art based on test communication encryption 3) Implementation with block cipher 4) Implementation with stream cipher 5) Conclusion 10

12 STREAM-BASED ENCRYPTION ON JTAG INTERFACE Challenge/Response protocol to encrypt JTAG test communication 1) Challenge C Hashmodule 2) Response as Key Key Fuses IV Stream cipher S(IV, Key) TDI Test Data Register TDO Requirement not fulfilled 3) Encryption of the JTAG TDR with the keystream S(IV, Key) Rosenfeld et al., Attacks and Defenses for JTAG, IEEE Design & Test

13 BSR BSR STREAM-BASED ENCRYPTION ON IEEE 1500 INTERFACE IEEE 1500 standard Similar as JTAG standard, but for SoC wrappers Parallel test inputs WPI and parallel test outputs WPO WSI Core 1 Core 2 Core 3 WSO Core under test WPI Scan chain WPO WSC WSI IDCODE BYP WSO IR 12

14 STREAM-BASED ENCRYPTION ON IEEE 1500 INTERFACE Encrypt test data on a targeted core (IEEE 1500) 1) Send the key to the core via specific scan chain non-visible from the others cores WSI Core 1 Core 2 Core 3 WSO WSC Rosenfeld et al., Security-Aware SoC Test Access Mechanisms, VTS 11 13

15 BSR BSR STREAM-BASED ENCRYPTION ON IEEE 1500 INTERFACE Encrypt test data on a targeted core (IEEE 1500) 1) Encrypt the parallel input/output (WPI and WPO) WSI Core 1 Core 2 Core 3 WSO Core under test WPI Scan chain WPO WSC WSI WPI IDCODE BYP IR WSO WPO Requirement not fulfilled Rosenfeld et al., Security-Aware SoC Test Access Mechanisms, VTS 11 14

16 STREAM-BASED ENCRYPTION ON IJTAG INTERFACE Encryption of Test Data Register associated to Instruments in the IJTAG network TDI Cipher In Cipher Out Requirement not fulfilled TDO Kan et al., Echeloned IJTAG data protection, AsianHOST

17 OUR PROPOSITION Insertion of block or stream ciphers at Scan-In and Scan-Out Assumption: original circuit embedded a crypto-core with its key management and storing Scan chain encryption solution shares the key management and storing already implemented 16

18 SUMMARY 1) Scan chain encryption 2) State-of-the-art based on test communication encryption 3) Implementation with block cipher 4) Implementation with stream cipher 5) Conclusion 17

19 BLOCK CIPHER-BASED SCAN ENCRYPTION Implementation on scan chain with 2 PRESENT block ciphers: Lightweight (1 PRESENT = GE) Encryption by 64-bits block size 18

20 MODE OF OPERATIONS 64 bits encrypted every 32 clock cycles Original circuit 64 bits Input Scan Cipher S i (64 bits) S i 1 (64 bits) S 2 (64 bits) Scan chain length #SFF S 1 (64 bits) Output Scan Cipher #SFF = Px64 No test time overhead on each pattern 19

21 MODE OF OPERATIONS S 1 R+U = 64 bits U bits = Unused bits R=#SFF mod 64 U bits added Original circuit 64 bits Input Scan Cipher S i (64 bits) S i 1 (64 bits) S 2 (64 bits) Scan chain length #SFF Output Scan Cipher #SFF = Px64 + R Loss of U clock cycles per pattern 20

22 SUMMARY 1) Scan chain encryption 2) State-of-the-art based on test communication encryption 3) Implementation with block cipher 4) Implementation with stream cipher 5) Conclusion 21

23 STREAM CIPHER-BASED SCAN ENCRYPTION Implementation on JTAG: 1 TRIVIUM stream cipher (2 016 GE) TRNG to generate random IV New instruction GetIV with a test data register IV Mode of operations in 2 phases: initialization and encryption 22

24 INITIALIZATION PHASE 1) TRNG initialization: reach sufficient entropy to generate random number 23

25 INITIALIZATION PHASE 2) Shift IV in the dedicated Test Data Register 24

26 INITIALIZATION PHASE 3) Stream cipher setup 25

27 INITIALIZATION PHASE Initialization phase finished => Encryption phase 26

28 ENCRYPTION PHASE User sends GETIV instruction Shift the content of the IV register out the circuit GetIV IV 27

29 ENCRYPTION PHASE User can encrypt and decrypt test data with the obtained IV and the shared secret key 28

30 TIME FOR THE INITIALIZATION PROCESS T TRNG_init to initialize the TRNG 80 clock cycles to shift the IV in the register clock cycles for the stream cipher setup Original circuit Triple-DES Pipelined AES-128 Test time* (clock cycles) Test time overhead Block-based solution (%) Stream-based solution (%)** Pipelined AES-256 RSA 1024 LEON *: Test time considered for a fault coverage of 100%, except for LEON3 where it reaches 70% **: test time overhead without the initialization of the TRNG 29

31 SUMMARY 1) Scan chain encryption 2) State-of-the-art based on test communication encryption 3) Implementation with block cipher 4) Implementation with stream cipher 5) Conclusion 30

32 COMPARISON BETWEEN BOTH SOLUTIONS Security Block cipher-based solution (PRESENT) Stream cipher-based solution (TRIVIUM) - Scan attacks Protected Protected (two times pad not possible) - Malicious core Protected Protected Cost - Area µm² µm² ( µm² for TRNG) - Test time Depends on the scan length (multiple or not of the block size) Integration - Diagnosis & debug Still possible in-field Clock cycles required for the initialization phase - Key management Re-use key management already implemented - Integration in test daisy-chain Possible issue with the padding of test data No issue 31

33

34 ACKNOWLEDGEMENTS FUI#20 TEEVA Project Partners 33