FPGAhammer: Remote Voltage Fault Attacks on Shared FPGAs, suitable for DFA on AES

Transcription

1 , suitable for DFA on AES Jonas Krautter, Dennis R.E. Gnad, Mehdi B. Tahoori INSTITUTE OF COMPUTER ENGINEERING CHAIR OF DEPENDABLE NANO COMPUTING KIT Die Forschungsuniversität in der Helmholtz-Gemeinschaft

2 Motivation More resources per FPGA Multi-user environments: Amazon, Microsoft and introduce FPGA usage in cloud computing System-on-Chip (SoC) variants, tightly coupled FPGA based systems (Xilinx PYNQ, Intel Xeon FPGA, Intel/Altera-SoCs...) Accelerators deployed to partitions through partial reconfiguration Multi-tenant FPGAs

3 Motivation More resources per FPGA Multi-user environments: Amazon, Microsoft and introduce FPGA usage in cloud computing System-on-Chip (SoC) variants, tightly coupled FPGA based systems (Xilinx PYNQ, Intel Xeon FPGA, Intel/Altera-SoCs...) Accelerators deployed to partitions through partial reconfiguration Multi-tenant FPGAs New attack scenarios: Passive on-chip side-channels 1 Denial-of-Service 2 This work: Fault attacks... 1 Schellenberg et al., An Inside Job: Remote Power Analysis Attacks on FPGAs, DATE Gnad et al., Voltage drop-based fault attacks on FPGAs using valid bitstreams, FPL 2017

4 Motivation More resources per FPGA Multi-user environments: Amazon, Microsoft and introduce FPGA usage in cloud computing System-on-Chip (SoC) variants, tightly coupled FPGA based systems (Xilinx PYNQ, Intel Xeon FPGA, Intel/Altera-SoCs...) Accelerators deployed to partitions through partial reconfiguration Multi-tenant FPGAs New attack scenarios: Passive on-chip side-channels 1 Denial-of-Service 2 This work: Fault attacks... Proof-of-Concept work: Successful DFA on AES 1 Schellenberg et al., An Inside Job: Remote Power Analysis Attacks on FPGAs, DATE Gnad et al., Voltage drop-based fault attacks on FPGAs using valid bitstreams, FPL 2017

5 Threat model Shared FPGA fabric Shared Power Distribution Network (PDN)

6 Threat model Shared FPGA fabric Shared Power Distribution Network (PDN) Attacker and victim design logically isolated

7 Threat model Shared FPGA fabric Shared Power Distribution Network (PDN) Attacker and victim design logically isolated Victim software process has a public interface

8 Threat model Shared FPGA fabric Shared Power Distribution Network (PDN) Attacker and victim design logically isolated Victim software process has a public interface Chosen-Plaintext Attack scenario

9 Outline 1 Background 2 Fault Injection and Analysis 3 Experimental Setup 4 Results 5 Discussion and Future Work 6 Conclusion

10 Outline 1 Background 2 Fault Injection and Analysis 3 Experimental Setup 4 Results 5 Discussion and Future Work 6 Conclusion

11 Power Distribution Network (PDN) Interconnections from the voltage regulator down to logic elements Model: RLC-mesh (Resistive, Inductive and Capacitive elements)

12 Power Distribution Network (PDN) Interconnections from the voltage regulator down to logic elements Model: RLC-mesh (Resistive, Inductive and Capacitive elements) Law of Inductance: V drop = I R + L di dt

13 Power Distribution Network (PDN) Interconnections from the voltage regulator down to logic elements Model: RLC-mesh (Resistive, Inductive and Capacitive elements) Law of Inductance: V drop = I R + L di dt High current variation Power supply voltage variation

14 Power Distribution Network (PDN) Interconnections from the voltage regulator down to logic elements Model: RLC-mesh (Resistive, Inductive and Capacitive elements) Law of Inductance: V drop = I R + L di dt High current variation Power supply voltage variation Lower supply voltage Timing faults

15 Malicious Logic Logic element to cause high current variation 2 : Ring Oscillators (ROs) 2 Gnad et al., Voltage drop-based fault attacks on FPGAs using valid bitstreams, FPL 2017

16 Malicious Logic Logic element to cause high current variation 2 : Ring Oscillators (ROs) Oscillation Gate switching Current variation Voltage drop 2 Gnad et al., Voltage drop-based fault attacks on FPGAs using valid bitstreams, FPL 2017

17 Malicious Logic Logic element to cause high current variation 2 : Ring Oscillators (ROs) Oscillation Gate switching Current variation Voltage drop RO-grid must be toggled in a very specific way (freq, duty-cycle, delay) 2 Gnad et al., Voltage drop-based fault attacks on FPGAs using valid bitstreams, FPL 2017

18 Malicious Logic Logic element to cause high current variation 2 : Ring Oscillators (ROs) Oscillation Gate switching Current variation Voltage drop RO-grid must be toggled in a very specific way (freq, duty-cycle, delay) Calibration of fault injection parameters required VCC (V) VCC max recommended VCC min recommended Time (s) FPGA supply voltage VCC during frequency scan 2 Gnad et al., Voltage drop-based fault attacks on FPGAs using valid bitstreams, FPL 2017

19 Malicious Logic Logic element to cause high current variation 2 : Ring Oscillators (ROs) Oscillation Gate switching Current variation Voltage drop RO-grid must be toggled in a very specific way (freq, duty-cycle, delay) Calibration of fault injection parameters required VCC (V) Toggle frequency decrease VCC max recommended VCC min recommended Time (s) FPGA supply voltage VCC during frequency scan 2 Gnad et al., Voltage drop-based fault attacks on FPGAs using valid bitstreams, FPL 2017

20 Outline 1 Background 2 Fault Injection and Analysis 3 Experimental Setup 4 Results 5 Discussion and Future Work 6 Conclusion

21 Fault Injection and Analysis Differential Fault Analysis on AES 3 3 Piret et al., A Differential Fault Attack Technique against SPN Structures, with Application to the AES and Khazad, CHES 2003

22 Fault Injection and Analysis Differential Fault Analysis on AES 3 Original scheme: Single-byte faults before 8th round All output bytes faulty 3 Piret et al., A Differential Fault Attack Technique against SPN Structures, with Application to the AES and Khazad, CHES 2003

23 Fault Injection and Analysis Differential Fault Analysis on AES 3 Original scheme: Single-byte faults before 8th round All output bytes faulty Injection requires high precision Fault injection before 9th round 3 Piret et al., A Differential Fault Attack Technique against SPN Structures, with Application to the AES and Khazad, CHES 2003

24 Fault Injection and Analysis Differential Fault Analysis on AES 3 Original scheme: Single-byte faults before 8th round All output bytes faulty Injection requires high precision Fault injection before 9th round Successful injection can be verified 3 Piret et al., A Differential Fault Attack Technique against SPN Structures, with Application to the AES and Khazad, CHES 2003

25 Fault Injection and Analysis Attacker issues encryption request to get correct ciphertext

26 Fault Injection and Analysis Attacker issues encryption request to get correct ciphertext Attacker issues encryption requests while activating RO grid

27 Fault Injection and Analysis Attacker issues encryption request to get correct ciphertext Attacker issues encryption requests while activating RO grid Fault injection is calibrated until desired faults appear

28 Fault Injection and Analysis Attacker issues encryption request to get correct ciphertext Attacker issues encryption requests while activating RO grid Fault injection is calibrated until desired faults appear Calibration is done only once for a specific board

29 Outline 1 Background 2 Fault Injection and Analysis 3 Experimental Setup 4 Results 5 Discussion and Future Work 6 Conclusion

30 Experimental Setup RO grid ARM CPU FPGA boards: 3 Terasic DE1-SoC, 1 Terasic DE0-Nano-SoC 3 boards of the same type 2 different boards Show generality of attack Cyclone V FPGA and ARM Cortex-A9 on one chip Linux environment on ARM Cortex-A9 AES

31 Experimental Setup RO grid AES ARM CPU FPGA boards: 3 Terasic DE1-SoC, 1 Terasic DE0-Nano-SoC 3 boards of the same type 2 different boards Show generality of attack Cyclone V FPGA and ARM Cortex-A9 on one chip Linux environment on ARM Cortex-A9 Entire threat model in one SoC: Attacker and victim software on ARM core Respective IP cores on FPGA fabric

32 Experimental Setup RO grid AES ARM CPU FPGA boards: 3 Terasic DE1-SoC, 1 Terasic DE0-Nano-SoC 3 boards of the same type 2 different boards Show generality of attack Cyclone V FPGA and ARM Cortex-A9 on one chip Linux environment on ARM Cortex-A9 Entire threat model in one SoC: Attacker and victim software on ARM core Respective IP cores on FPGA fabric Fault injection on SoC, Key recovery on PC

33 Outline 1 Background 2 Fault Injection and Analysis 3 Experimental Setup 4 Results 5 Discussion and Future Work 6 Conclusion

34 Fault Injection Rate vs #RO #faults per million requests DE1-SoC-A Logic utilization by attacker design (% of total LUTs) Measured total amount of faults F tot Measured amount of usable faults F DFA Experiments on DE1-SoC, design fully constrained

35 Fault Injection Rate vs #RO #faults per million requests DE1-SoC-A Logic utilization by attacker design (% of total LUTs) Measured total amount of faults F tot Measured amount of usable faults F DFA Experiments on DE1-SoC, design fully constrained Evaluate usable (for DFA) faults and total amount of faults

36 Fault Injection Rate vs #RO #faults per million requests DE1-SoC-A Logic utilization by attacker design (% of total LUTs) Measured total amount of faults F tot Measured amount of usable faults F DFA Experiments on DE1-SoC, design fully constrained Evaluate usable (for DFA) faults and total amount of faults Injection rate increases with amount of ROs

37 Fault Injection Rate vs #RO #faults per million requests DE1-SoC-A Logic utilization by attacker design (% of total LUTs) Measured total amount of faults F tot Measured amount of usable faults F DFA Experiments on DE1-SoC, design fully constrained Evaluate usable (for DFA) faults and total amount of faults Injection rate increases with amount of ROs Injection accuracy decreases after a certain amount

38 Fault Injection Rate vs #RO DE1-SoC-A Extended experiments: 3 different boards #faults per million requests DE1-SoC-B DE1-SoC-C Logic utilization by attacker design (% of total LUTs)

39 Fault Injection Rate vs #RO DE1-SoC-A Extended experiments: 3 different boards #faults per million requests DE1-SoC-B All boards vulnerable, Calibration finds params DE1-SoC-C Logic utilization by attacker design (% of total LUTs)

40 Fault Injection Rate vs #RO DE1-SoC-A Extended experiments: 3 different boards #faults per million requests DE1-SoC-B DE1-SoC-C All boards vulnerable, Calibration finds params Process variation Different optimal #RO Logic utilization by attacker design (% of total LUTs)

41 Key Recovery on 5000 random keys #keys % 87.9% 95.6% 2.2% 2.9% 2.6% 0.1% 0.1% 0.1% 2.0% 8.7% 1.9% 0.0% 0.1% 0.5% 0.2% 0.0% 0.1% Recovered keys Amount of key candidates remaining for each key DE1-SoC-A DE1-SoC-B DE1-SoC-C Experiments on DE1-SoC with best fault injection configuration

42 Key Recovery on 5000 random keys #keys % 87.9% 95.6% 2.2% 2.9% 2.6% 0.1% 0.1% 0.1% 2.0% 8.7% 1.9% 0.0% 0.1% 0.5% 0.2% 0.0% 0.1% Recovered keys Amount of key candidates remaining for each key DE1-SoC-A DE1-SoC-B DE1-SoC-C Experiments on DE1-SoC with best fault injection configuration Majority of 5000 keys can be recovered

43 Key Recovery on 5000 random keys #keys % 87.9% 95.6% 2.2% 2.9% 2.6% 0.1% 0.1% 0.1% 2.0% 8.7% 1.9% 0.0% 0.1% 0.5% 0.2% 0.0% 0.1% Recovered keys Amount of key candidates remaining for each key DE1-SoC-A DE1-SoC-B DE1-SoC-C Experiments on DE1-SoC with best fault injection configuration Majority of 5000 keys can be recovered Unrecovered keys due to multi-byte faults

44 Outline 1 Background 2 Fault Injection and Analysis 3 Experimental Setup 4 Results 5 Discussion and Future Work 6 Conclusion

45 Discussion and Future Work Attack on fully constrained design on DE1-SoC with < 50% resources

46 Discussion and Future Work Attack on fully constrained design on DE1-SoC with < 50% resources Smaller DE0-Nano-SoC: Fully constrained design not vulnerable Not all devices are equally vulnerable

47 Discussion and Future Work Attack on fully constrained design on DE1-SoC with < 50% resources Smaller DE0-Nano-SoC: Fully constrained design not vulnerable Not all devices are equally vulnerable Alternatives to using ROs may exist

48 Discussion and Future Work Attack on fully constrained design on DE1-SoC with < 50% resources Smaller DE0-Nano-SoC: Fully constrained design not vulnerable Not all devices are equally vulnerable Alternatives to using ROs may exist Attack may be extended to hard cores (ARM SoC)

49 Discussion and Future Work Attack on fully constrained design on DE1-SoC with < 50% resources Smaller DE0-Nano-SoC: Fully constrained design not vulnerable Not all devices are equally vulnerable Alternatives to using ROs may exist Attack may be extended to hard cores (ARM SoC) Possible mitigation: Internal sensors Bitstream checking Voltage islands

50 Outline 1 Background 2 Fault Injection and Analysis 3 Experimental Setup 4 Results 5 Discussion and Future Work 6 Conclusion

51 Conclusion High precision fault injection on shared FPGAs is possible

52 Conclusion High precision fault injection on shared FPGAs is possible Logical isolation is not enough to prevent manipulation

53 Conclusion High precision fault injection on shared FPGAs is possible Logical isolation is not enough to prevent manipulation Threat model must be considered for FPGA multi-user environments

54 Conclusion High precision fault injection on shared FPGAs is possible Logical isolation is not enough to prevent manipulation Threat model must be considered for FPGA multi-user environments Mitigation may require new/modified hardware

55 Thank you for your attention!

56 Additional Slides Complete Scan Flow

57 Additional Slides Slack Dependent Analysis #faults per million requests Reported worst-case setup slack Reported best-case setup slack Reference worst-case setup slack on DE1-SoC for 0 fop = 111 MHz AES clock frequency f op (MHz) slack (ns) 1 2 3

58 Additional Slides Slack Dependent Analysis #faults per million requests Measured amount of usable faults FDFA Measured total amount of faults Ftot Reference worst-case setup slack on DE1-SoC for 0 fop = 111 MHz AES clock frequency f op (MHz) Reported worst-case setup slack Reported best-case setup slack slack (ns) 1 2 3

59 Additional Slides Injection Process VCC (V) aes_rst_n ro_ena 0 1 AES encryption starts V CC max recommended V CC min recommended RO activation toggles V CC fluctuation Time (µs) Externally measured FPGA supply voltage V CC during fault injection AES reset logic signal (active low) RO grid activation signal

60 Additional Slides RO Floorplan ROs Virtual Pins

61 Additional Slides Adder Test Design