EM Analysis in the IoT Context: Lessons Learned from an Attack on Thread
|
|
- Julian Stafford
- 5 years ago
- Views:
Transcription
1 EM Analysis in the IoT Context: Lessons Learned from an Attack on Thread Daniel Dinu 1, Ilya Kizhvatov 2 1 Virginia Tech 2 Radboud University Nijmegen CHES 2018
2 Outline 1 Introduction 2 Side-Channel Vulnerability Analysis 3 The Most Feasible Attack 4 Countermeasures 5 Lessons Learned 1 / 14
3 EM Analysis leakage commands/traces Oscilloscope data Target Device PC 2 / 14
4 Thread Networking protocol for the IoT Simple for consumer Built-in security Power efficient IPv6 connectivity Robust mesh network Runs on IEEE radio silicon More than 100 members 3 / 14
5 Motivation Numerous low-cost hardware and software tools for side-channel attacks Evaluate the effort required to apply an EM attack in the IoT context Do cryptographic implementations in the network layer need protection against side-channel attacks? 4 / 14
6 Outline 1 Introduction 2 Side-Channel Vulnerability Analysis 3 The Most Feasible Attack 4 Countermeasures 5 Lessons Learned 4 / 14
7 Communication Security Security is enforced at two layers: Medium Access Control (MAC) AES CCM using key K MAC Mesh Link Establishment (MLE) AES CCM using key K MLE A node gets the master key K when it is commissioned to a Thread network Fresh keys are generated from the 16-byte K and 4-byte Sequence number: K MAC K MLE = HMAC SHA 256(K, Sequence Thread ) The default key rotation period is set to 28 days 5 / 14
8 Processing a MLE Parent Request Message Received Sequence Current Sequence? NO YES MLE Parent Request Generate temporary key HMAC SHA 256 Child Parent (Router) Tag verification AES CCM 6 / 14
9 AES CCM Combines CBC MAC mode and CTR mode The execution of both modes of operation can be attacked The attacker can control up to 12 input bytes of the first block: Source MAC Address 8 bytes Frame Counter 4 bytes Known attack: Jaffe [CHES 07], O Flynn and Chen [COSADE 16] AES-CBC 49 Source MAC Address Frame Counter AES-CTR 01 Source MAC Address Frame Counter / 14
10 Relationship between K and K MLE Master key to MLE key (K K MLE ) Key derivation using HMAC 8 / 14
11 Relationship between K and K MLE Master key to MLE key (K K MLE ) Key derivation using HMAC MLE key to master key (K MLE K) Send MLE Child ID Request to ask for the master key The MLE Child ID Response includes the master key 8 / 14
12 Relationship between K and K MLE Master key to MLE key (K K MLE ) Key derivation using HMAC MLE key to master key (K MLE K) Send MLE Child ID Request to ask for the master key The MLE Child ID Response includes the master key Master key and MLE key are equivalent! K K MLE 8 / 14
13 Outline 1 Introduction 2 Side-Channel Vulnerability Analysis 3 The Most Feasible Attack 4 Countermeasures 5 Lessons Learned 8 / 14
14 The Most Feasible Attack Attacker Target Router 9 / 14
15 The Most Feasible Attack MLE Advertisement Attacker MLE Advertisement MLE Advertisement Target Router Step 1: Observe an MLE Advertisement message Record the Sequence number 9 / 14
16 The Most Feasible Attack MLE Parent Request Attacker Target Router Step 2: Inject MLE Parent Request messages Recorded Sequence number Random Source MAC Address and Frame Number 9 / 14
17 The Most Feasible Attack MLE Parent Request Attacker Target Router Step 3: Observe the EM leakage Save the injected inputs and corresponding EM traces 9 / 14
18 The Most Feasible Attack Attacker Target Router Step 4: Recover the MLE key K MLE Mount a DEMA attack 9 / 14
19 The Most Feasible Attack MLE Child ID Request MLE Child ID Response Attacker Target Router Step 5: Get the master key K Send a MLE Child ID Request message The MLE Child ID Response message contains K 9 / 14
20 The Most Feasible Attack Thread communication Attacker Target Router Full network access! 9 / 14
21 Experimental Setup Target: TI CC2538 (Cortex-M3, 32 MHz) Thread stack: OpenThread Oscilloscope: LeCroy waverunner 625Zi Langer EM probes No trigger signal from target! 10 / 14
22 Results Sampling rate set to 1 GS/s 10,000 EM traces acquired in about 3 hours Full recovery of the MLE key K MLE Two key bytes were much more difficult to recover than the rest Message fragmentation prevented recovery of the master key The attack may succeed on other implementations of the stack 11 / 14
23 Outline 1 Introduction 2 Side-Channel Vulnerability Analysis 3 The Most Feasible Attack 4 Countermeasures 5 Lessons Learned 11 / 14
24 Countermeasures Shielding & tamper resistance Protected cryptographic implementations Protocol level mitigations Security certification scheme 12 / 14
25 Countermeasures Shielding & tamper resistance Protected cryptographic implementations Protocol level mitigations Security certification scheme A combination of the above countermeasures is recommended for high security! 12 / 14
26 Outline 1 Introduction 2 Side-Channel Vulnerability Analysis 3 The Most Feasible Attack 4 Countermeasures 5 Lessons Learned 12 / 14
27 Lessons Learned Lessons learned from our evaluation can be applied to other IoT systems and protocols. 13 / 14
28 Lessons Learned Lessons learned from our evaluation can be applied to other IoT systems and protocols. Prevent electromagnetic leakage 13 / 14
29 Lessons Learned Lessons learned from our evaluation can be applied to other IoT systems and protocols. Prevent electromagnetic leakage Do not allow access to the master key from temporary key(s) 13 / 14
30 Lessons Learned Lessons learned from our evaluation can be applied to other IoT systems and protocols. Prevent electromagnetic leakage Do not allow access to the master key from temporary key(s) A network-wide master key is a double-edged sword 13 / 14
31 Lessons Learned Lessons learned from our evaluation can be applied to other IoT systems and protocols. Prevent electromagnetic leakage Do not allow access to the master key from temporary key(s) A network-wide master key is a double-edged sword Side-channel attacks are a real threat for the IoT! 13 / 14
32 SECURE 14 / 14
33 SECURE Thank you! 14 / 14
34 Appendix
35 References Joshua Jaffe. A first-order DPA attack against AES in counter mode with unknown initial counter. In Cryptographic Hardware and Embedded Systems - CHES Colin O Flynn and Zhizhang Chen. Power analysis attacks against IEEE nodes. In Constructive Side-Channel Analysis and Secure Design - COSADE / 8
36 Thread Stack Source: 2 / 8
37 Mesh Link Establishment (MLE) Facilitates the secure configuration of radio links Allows exchange of network parameters MLE messages are sent inside UDP datagrams Routers periodically multicast MLE Advertisement messages Link configuration is initiated by a MLE Parent Request message 3 / 8
38 Establishing a Communication Link Attach. Child Sync. Link Sync. MLE Parent Request MLE Parent Response MLE Child ID Request MLE Child ID Response MLE Child Update Request MLE Child Update Response MLE Link Request MLE Link Accept & Request MLE Link Accept Child (N 1 ) Parent (N 2 ) 4 / 8
39 HMAC SHA 256 m = Sequence Thread 0x80 0x x00 len The attacker targets k 1 and k 2 k 1, k 2, and Sequence give K MAC and K MLE Not enough control of the input! K ipad m IV F k 1 F K opad IV F k 2 F K MAC K MLE 5 / 8
40 Attack Feasibility Attack Effort Adaptation of the rating for smart cards from the Joint Interpretation Library Last step of the attack is feasible enhanced-basic no rating basic enhanced-basic moderate high Equipment Cost Cost Oscilloscope Attack Success HIGH LeCroy WaveRunner 6Zi MEDIUM PicoScope, ChipWhisperer-Pro LOW ChipWhisperer-Lite 6 / 8
41 Guessing Entropy Figure: Evolution of the guessing entropy for the second key byte. 7 / 8
42 Correlation Matrix Figure: Correlation of all key candidates for the second key byte when using 3,000 traces. 8 / 8
Practical Electromagnetic Template Attack on HMAC
Practical Electromagnetic Template Attack on HMAC Pierre Alain Fouque 1 Gaétan Leurent 1 Denis Réal 2,3 Frédéric Valette 2 1ENS,75Paris,France. 2CELAR,35Bruz,France. 3INSA-IETR,35Rennes,France. September
More informationDissecting Leakage Resilient PRFs with Multivariate Localized EM Attacks
Dissecting Leakage Resilient PRFs with Multivariate Localized EM Attacks A Practical Security Evaluation on FPGA Florian Unterstein Johann Heyszl Fabrizio De Santis a Robert Specht, 13.04.2017 a Technical
More informationSECURITY CRYPTOGRAPHY Cryptography Overview Brochure. Cryptography Overview
SECURITY CRYPTOGRAPHY Cryptography Overview Brochure Cryptography Overview DPA-resistant and Standard Cryptographic Hardware Cores DPA (Differential Power Analysis) Resistant Hardware Cores prevent against
More informationExternal Encodings Do not Prevent Transient Fault Analysis
External Encodings Do not Prevent Transient Fault Analysis Christophe Clavier Gemalto, Security Labs CHES 2007 Vienna - September 12, 2007 Christophe Clavier CHES 2007 Vienna September 12, 2007 1 / 20
More informationRiscure Inspector Release Notes
Date 15 January 2018 Modified behavior Issue number INS-7594 INS-7593 INS-7709 INS-7620 INS-7427 INS-7576 Description Modified behavior: During module execution it was possible to start another module
More informationECRYPT II Workshop on Physical Attacks November 27 th, Graz, Austria. Stefan Mangard.
Building Secure Hardware ECRYPT II Workshop on Physical Attacks November 27 th, Graz, Austria Stefan Mangard Infineon Technologies, Munich, Germany Stefan.Mangard@infineon.com Outline Assets and Requirements
More informationSIDE CHANNEL ATTACKS AGAINST IOS CRYPTO LIBRARIES AND MORE DR. NAJWA AARAJ HACK IN THE BOX 13 APRIL 2017
SIDE CHANNEL ATTACKS AGAINST IOS CRYPTO LIBRARIES AND MORE DR. NAJWA AARAJ HACK IN THE BOX 13 APRIL 2017 WHAT WE DO What we do Robust and Efficient Cryptographic Protocols Research in Cryptography and
More informationMidgame Attacks. (and their consequences) Donghoon Chang 1 and Moti Yung 2. IIIT-Delhi, India. Google Inc. & Columbia U., USA
Midgame Attacks (and their consequences) Donghoon Chang 1 and Moti Yung 2 1 IIIT-Delhi, India 2 Google Inc. & Columbia U., USA Crypto is a Technical Science As technology moves, so should crypto designs
More informationBreaking Korea Transit Card with Side-Channel Attack
Breaking Korea Transit Card with Side-Channel Attack -Unauthorized Recharging- Black Hat Asia 2017 Tae Won Kim, Tae Hyun Kim, and Seokhie Hong Outline 1. Attack Goal & Scenario 2. Target Device Details
More informationHOST Differential Power Attacks ECE 525
Side-Channel Attacks Cryptographic algorithms assume that secret keys are utilized by implementations of the algorithm in a secure fashion, with access only allowed through the I/Os Unfortunately, cryptographic
More informationChapter 24 Wireless Network Security
Chapter 24 Wireless Network Security Wireless Security Key factors contributing to higher security risk of wireless networks compared to wired networks include: o Channel Wireless networking typically
More informationA Systematic Approach to the Side-Channel Analysis of ECC Implementations with Worst-Case Horizontal Attacks
A Systematic Approach to the Side-Channel Analysis of ECC Implementations with Worst-Case Horizontal Attacks Romain Poussier, François-Xavier Standaert: Université catholique de Louvain Yuanyuan Zhou:
More informationA Power Attack Method Based on Clustering Ruo-nan ZHANG, Qi-ming ZHANG and Ji-hua CHEN
2017 International Conference on Computer, Electronics and Communication Engineering (CECE 2017) ISBN: 978-1-60595-476-9 A Power Attack Method Based on Clustering Ruo-nan ZHANG, Qi-ming ZHANG and Ji-hua
More informationA Surfeit of SSH Cipher Suites
A Surfeit of SSH Cipher Suites Jean Paul Degabriele Information Security Group www.isg.rhul.ac.uk/~psai074 Based in part on slides by Kenny Paterson Outline of this talk Overview of SSH and related work
More informationSide channel attack: Power Analysis. Chujiao Ma, Z. Jerry Shi CSE, University of Connecticut
Side channel attack: Power Analysis Chujiao Ma, Z. Jerry Shi CSE, University of Connecticut Conventional Cryptanalysis Conventional cryptanalysis considers crypto systems as mathematical objects Assumptions:
More informationBreaking the Bitstream Decryption of FPGAs
Breaking the Bitstream Decryption of FPGAs 05. Sep. 2012 Amir Moradi Embedded Security Group, Ruhr University Bochum, Germany Acknowledgment Christof Paar Markus Kasper Timo Kasper Alessandro Barenghi
More informationPlaintext-Recovery Attacks Against Datagram TLS
Information Security Group Royal Holloway, University of London 6th Feb 2012 Contents 1 Results 2 3 4 Padding Oracle Realisation Against OpenSSL 5 Attacking the GnuTLS Implementation of DTLS 6 Results
More informationLecture 6: Symmetric Cryptography. CS 5430 February 21, 2018
Lecture 6: Symmetric Cryptography CS 5430 February 21, 2018 The Big Picture Thus Far Attacks are perpetrated by threats that inflict harm by exploiting vulnerabilities which are controlled by countermeasures.
More informationFPGAhammer: Remote Voltage Fault Attacks on Shared FPGAs, suitable for DFA on AES
, suitable for DFA on AES Jonas Krautter, Dennis R.E. Gnad, Mehdi B. Tahoori 10.09.2018 INSTITUTE OF COMPUTER ENGINEERING CHAIR OF DEPENDABLE NANO COMPUTING KIT Die Forschungsuniversität in der Helmholtz-Gemeinschaft
More informationOnce upon a time... A first-order chosen-plaintext DPA attack on the third round of DES
A first-order chosen-plaintext DPA attack on the third round of DES Oscar Reparaz, Benedikt Gierlichs KU Leuven, imec - COSIC CARDIS 2017 Once upon a time... 14 November 2017 Benedikt Gierlichs - DPA on
More informationA New Attack with Side Channel Leakage during Exponent Recoding Computations
A New Attack with Side Channel Leakage during Exponent Recoding Computations Yasuyuki Sakai 1 and Kouichi Sakurai 2 1 Mitsubishi Electric Corporation, 5-1-1 Ofuna, Kamakura, Kanagawa 247-8501, Japan ysakai@iss.isl.melco.co.jp
More informationPower Analysis of MAC-Keccak: A Side Channel Attack. Advanced Cryptography Kyle McGlynn 4/12/18
Power Analysis of MAC-Keccak: A Side Channel Attack Advanced Cryptography Kyle McGlynn 4/12/18 Contents Side-Channel Attack Power Analysis Simple Power Analysis (SPA) Differential Power Analysis (DPA)
More informationSynthesis of Fault-Attack Countermeasures for Cryptographic Circuits
Synthesis of Fault-Attack Countermeasures for Cryptographic Circuits Hassan Eldib, Meng Wu, and Chao Wang CAV, July 23, 2016 Cryptographic Algorithm: an example Plaintext Chip Ciphertext 0110 1001 1011
More informationA FRAMEWORK FOR EMBEDDED HARDWARE SECURITY ANALYSIS
A FRAMEWORK FOR EMBEDDED HARDWARE SECURITY ANALYSIS by Colin O Flynn Submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy at Dalhousie University Halifax, Nova Scotia
More informationThe Xirrus Wi Fi Array XS4, XS8 Security Policy Document Version 1.0. Xirrus, Inc.
The Xirrus Wi Fi Array XS4, XS8 Security Policy Document Version 1.0 Xirrus, Inc. March 8, 2011 Copyright Xirrus, Inc. 2011. May be reproduced only in its original entirety [without revision]. Page 1 TABLE
More informationPower Analysis Attacks
Power Analysis Attacks Elisabeth Oswald Computer Science Department Crypto Group eoswald@cs.bris.ac.uk Elisabeth.Oswald@iaik.tugraz.at Outline Working principle of power analysis attacks DPA Attacks on
More informationPower Analysis of Atmel CryptoMemory Recovering Keys from Secure EEPROMs
Power Analysis of Atmel CryptoMemory Recovering Keys from Secure EEPROMs Josep Balasch 1, Benedikt Gierlichs 1, Roel Verdult 2, Lejla Batina 1,2, and Ingrid Verbauwhede 1 1 ESAT/COSIC, KU Leuven 2 ICIS/Digital
More informationTowards a Software Approach to Mitigate Correlation Power Analysis
Towards a Software Approach to Mitigate Correlation Power Analysis Ibraheem Frieslaar,2, Barry Irwin 2 Modelling and Digital Science, Council for Scientific and Industrial Research, Pretoria, South Africa.
More informationSIDE CHANNEL ANALYSIS : LOW COST PLATFORM. ETSI SECURITY WEEK Driss ABOULKASSIM Jacques FOURNIERI
SIDE CHANNEL ANALYSIS : LOW COST PLATFORM ETSI SECURITY WEEK Driss ABOULKASSIM Jacques FOURNIERI THE CEA Military Applications Division (DAM) Nuclear Energy Division (DEN) Technological Research Division
More informationTowards a Software Approach to Mitigate Correlation Power Analysis
Towards a Software Approach to Mitigate Correlation Power Analysis Ibraheem Frieslaar,2, Barry Irwin 2 Modelling and Digital Science, Council for Scientific and Industrial Research, Pretoria, South Africa.
More informationLightweight DTLS Implementation in CoAP-based IoT
Lightweight Implementation in -based IoT Vishwas Lakkundi and Keval Singh Altiux Innovations Pvt. Ltd., Bangalore, India {vishwas.lakkundi, keval.singh}@altiux.com Abstract Security is emerging as a key
More informationSymmetric Crypto MAC. Pierre-Alain Fouque
Symmetric Crypto MAC Pierre-Alain Fouque Message Authentication Code (MAC) Warning: Encryption does not provide integrity Eg: CTR mode ensures confidentiality if the blockcipher used is secure. However,
More informationSensor-to-cloud connectivity using Sub-1 GHz and
Sensor-to-cloud connectivity using Sub-1 GHz and 802.15.4 Nick Lethaby, IoT, Ecosystem Manager, Texas Instruments Agenda Key design considerations for a connected IoT sensor Overview of the Sub-1 GHz band
More informationChapter 17. Wireless Network Security
Chapter 17 Wireless Network Security IEEE 802.11 IEEE 802 committee for LAN standards IEEE 802.11 formed in 1990 s, to develop a protocol & transmission specifications for wireless LANs (WLANs) Demand
More informationSecuring IoT applications with Mbed TLS Hannes Tschofenig Arm Limited
Securing IoT applications with Mbed TLS Hannes Tschofenig Agenda Theory Threats Security services Hands-on with Arm Keil MDK Pre-shared secret-based authentication (covered in webinar #1) TLS Protocol
More informationCountermeasures against EM Analysis for a Secured FPGA-based AES Implementation
Countermeasures against EM Analysis for a Secured FPGA-based AES Implementation P. Maistri 1, S. Tiran 2, P. Maurine 2, I. Koren 3, R. Leveugle 1 1 Univ. Grenoble Alpes, TIMA Laboratory, F-38031 Grenoble
More informationConcrete cryptographic security in F*
Concrete cryptographic security in F* crypto hash (SHA3) INT-CMA encrypt then-mac Auth. encryption Secure RPC some some some adversary attack attack symmetric encryption (AES). IND-CMA, CCA2 secure channels
More informationUnboxing the whitebox. Jasper van CTO Riscure North America ICMC 16
Unboxing the whitebox Jasper van Woudenberg @jzvw CTO Riscure North America ICMC 16 Riscure Certification Pay TV, EMVco, smart meter, CC Evaluation & consultancy Mobile (TEE/HCE/WBC) Secure architecture
More informationSecurity Requirements for Crypto Devices
Security Requirements for Crypto Devices Version 1.0 02 May 2018 Controller of Certifying Authorities Ministry of Electronics and Information Technology 1 Document Control Document Name Security Requirements
More informationCS408 Cryptography & Internet Security
CS408 Cryptography & Internet Security Lecture 18: Cryptographic hash functions, Message authentication codes Functions Definition Given two sets, X and Y, a function f : X Y (from set X to set Y), is
More informationExamples for the Calculation of Attack Potential for Smartcards
Examples for the Calculation of Attack Potential for Smartcards Thomas Schröder, T-Systems GEI GmbH on behalf of the JHAS working group Introduction Basis for the examples The work is based on a collection
More informationSSH Algorithms for Common Criteria Certification
The feature provides the list and order of the algorithms that are allowed for Common Criteria Certification. This module describes how to configure the encryption, Message Authentication Code (MAC), and
More informationSecureDoc Disk Encryption Cryptographic Engine
SecureDoc Disk Encryption Cryptographic Engine Security Policy Abstract: This document specifies Security Policy enforced by the SecureDoc Cryptographic Engine compliant with the requirements of FIPS 140-2
More informationWHAT FUTURE FOR CONTACTLESS CARD SECURITY?
WHAT FUTURE FOR CONTACTLESS CARD SECURITY? Alain Vazquez (alain.vazquez@louveciennes.sema.slb.com) 1/27 AV Contents Major contactless features : summary Contactless major constraints Major security issues
More informationAdvanced security notions for the SSH secure channel: theory and practice
Advanced security notions for the SSH secure channel: theory and practice Kenny Paterson - @kennyog Based on joint work with Martin Albrecht, Jean Paul Degabriele and Torben Hansen Information Security
More informationLowering the Bar: Deep Learning for Side Channel Analysis. Guilherme Perin, Baris Ege, Jasper van December 4, 2018
Lowering the Bar: Deep Learning for Side Channel Analysis Guilherme Perin, Baris Ege, Jasper van Woudenberg @jzvw December 4, 2018 1 Before Signal processing Leakage modeling 2 After 3 Helping security
More informationCountermeasures against EM Analysis
Countermeasures against EM Analysis Paolo Maistri 1, SebastienTiran 2, Amine Dehbaoui 3, Philippe Maurine 2, Jean-Max Dutertre 4 (1) (2) (3) (4) Context Side channel analysis is a major threat against
More informationSide-channel Analysis of Grøstl and Skein
2012 IEEE IEEE Symposium CS Security on Security and Privacy and Workshops Privacy Workshops Side-channel Analysis of Grøstl and Skein Christina Boura, Sylvain Lévêque, David Vigilant Gemalto 6 rue de
More information: Practical Cryptographic Systems March 25, Midterm
650.445: Practical Cryptographic Systems March 25, 2010 Instructor: Matthew Green Midterm Name: As with any exam, please do not collaborate or otherwise share information with any other person. You are
More informationSide-Channel Attack against RSA Key Generation Algorithms
Side-Channel Attack against RSA Key Generation Algorithms CHES 2014 Aurélie Bauer, Eliane Jaulmes, Victor Lomné, Emmanuel Prouff and Thomas Roche Agence Nationale de la Sécurité des Systèmes d Information
More informationCryptography for Embedded Systems. Elisabeth Oswald Reader, University of Bristol
Cryptography for Embedded Systems Elisabeth Oswald Reader, University of Bristol 1 Outline 1 Embedded devices History, role and importance, use of cryptography 2 Security challenges Nothing is ever easy.
More informationSide-Channel Countermeasures for Hardware: is There a Light at the End of the Tunnel?
Side-Channel Countermeasures for Hardware: is There a Light at the End of the Tunnel? 11. Sep 2013 Ruhr University Bochum Outline Power Analysis Attack Masking Problems in hardware Possible approaches
More informationProtocols, Technologies and Standards Secure network protocols for the OSI stack P2.1 WLAN Security WPA, WPA2, IEEE i, IEEE 802.1X P2.
P2 Protocols, Technologies and Standards Secure network protocols for the OSI stack P2.1 WLAN Security WPA, WPA2, IEEE 802.11i, IEEE 802.1X P2.2 IP Security IPsec transport mode (host-to-host), ESP and
More informationNon-Profiled Deep Learning-Based Side-Channel Attacks
Non-Profiled Deep Learning-Based Side-Channel Attacks Benjamin Timon UL Transaction Security, Singapore benjamin.timon@ul.com Abstract. Deep Learning has recently been introduced as a new alternative to
More informationDataTraveler 5000 (DT5000) and DataTraveler 6000 (DT6000) Ultimate Security in a USB Flash Drive. Submitted by SPYRUS, Inc.
Submitted by SPYRUS, Inc. Contents DT5000 and DT6000 Technology Overview...2 Why DT5000 and DT6000 Encryption Is Different...3 Why DT5000 and DT6000 Encryption Is Different - Summary...4 XTS-AES Sector-Based
More informationIntroduction to Software Countermeasures For Embedded Cryptography
Introduction to Software Countermeasures For Embedded Cryptography David Vigilant UMPC Master, 1 st December, 2017 Outline 1 Context and Motivations 2 Basic Rules and Countermeasures Examples Regarding
More informationConfiguring IPv6 First-Hop Security
This chapter describes the IPv6 First-Hop Security features. This chapter includes the following sections: Finding Feature Information, on page 1 Introduction to First-Hop Security, on page 1 RA Guard,
More informationEzetap V3 Security policy
Ezetap V3 Security policy Page 1 Document changes Date Version Description 01 Feb 2015 Draft Initial document 08 Sep 2015 0.1 Added Key management 22 sep 2015 0.2 Specified security settings configuration
More informationMasking as a Side-Channel Countermeasure in Hardware
Masking as a Side-Channel Countermeasure in Hardware 6. September 2016 Ruhr-Universität Bochum 1 Agenda Physical Attacks and Side Channel Analysis Attacks Measurement setup Power Analysis Attacks Countermeasures
More informationBCM58100B0 Series: BCM58101B0, BCM58102B0, BCM58103B0 Cryptographic Module VC0 Non-Proprietary Security Policy Document Version 0.
BCM58100B0 Series: BCM58101B0, BCM58102B0, BCM58103B0 Cryptographic Module VC0 Non-Proprietary Security Policy Document Version 0.8 Broadcom Ltd. Revision Date: 2016-05-25 Copyright Broadcom 2016. May
More informationLecture 1 Applied Cryptography (Part 1)
Lecture 1 Applied Cryptography (Part 1) Patrick P. C. Lee Tsinghua Summer Course 2010 1-1 Roadmap Introduction to Security Introduction to Cryptography Symmetric key cryptography Hash and message authentication
More informationDifferential Power Analysis of MAC-Keccak at Any Key-Length
Differential Power Analysis of MAC-Keccak at Any Key-Length Mostafa Taha and Patrick Schaumont Secure Embedded Systems Center for Embedded Systems for Critical Applications Bradley Department of ECE Virginia
More informationData Integrity. Modified by: Dr. Ramzi Saifan
Data Integrity Modified by: Dr. Ramzi Saifan Encryption/Decryption Provides message confidentiality. Does it provide message authentication? 2 Message Authentication Bob receives a message m from Alice,
More informationLegacy-Compliant Data Authentication for Industrial Control System Traffic
Legacy-Compliant Data Authentication for Industrial Control System Traffic John Henry Castellanos, Daniele Antonioli, Nils Ole Tippenhauer and Martín Ochoa Singapore University of Technology and Design
More informationFIPS Crypto In the IoT. Chris Conlon ICMC17, May 16-19, 2017 Westin Arlington Gateway Washington DC
FIPS 140-2 Crypto In the IoT Chris Conlon ICMC17, May 16-19, 2017 Westin Arlington Gateway Washington DC Outline A. B. C. D. E. Intro to wolfssl Overview of wolfcrypt FIPS FIPS 140-2 Challenges in the
More informationMemory Address Side-Channel Analysis on Exponentiation
Memory Address Side-Channel Analysis on Exponentiation Chien-Ning Chen Physical Analysis & Cryptographic Engineering (PACE) Nanyang Technological University, Singapore chienning@ntu.edu.sg Abstract. Side-channel
More informationData Integrity & Authentication. Message Authentication Codes (MACs)
Data Integrity & Authentication Message Authentication Codes (MACs) Goal Ensure integrity of messages, even in presence of an active adversary who sends own messages. Alice (sender) Bob (receiver) Fran
More informationIEEE 1588 Hardware Assist
Freescale Technology Forum, June 2007 IEEE 1588 Hardware Assist Session ID: AZ317 Satoshi Iida Applications Engineering Manager Agenda IEEE 1588 Protocol Overview Synchronization Overview Why Create Another
More informationWi-Fi Security for Next Generation Connectivity. Perry Correll Aerohive, Wi-Fi Alliance member October 2018
Perry Correll Aerohive, Wi-Fi Alliance member October 2018 1 Value of Wi-F1 The value Wi-Fi provides to the global economy rivals the combined market value of Apple Inc. and Amazon. The fact that Wi-Fi
More informationECHONET Lite SPECIFICATION. ECHONET Lite System Design Guidelines 2011 (2012) ECHONET CONSORTIUM ALL RIGHTS RESERVED
Part V ECHONET Lite System Design Guidelines i 2011 (2012) ALL RIGHTS RESERVED The specifications published by the ECHONET Consortium are established without regard to industrial property rights (e.g.,
More informationUNCLASSIFIED//FOR OFFICIAL USE ONLY INDUSTRIAL CONTROL SYSTEMS CYBER EMERGENCY RESPONSE TEAM
ADVISORY ICSA-10-019-01 ZIGBEE PSEUDORANDOM NUMBER GENERATOR VULNERABILITY January 19, 2010 OVERVIEW On January 09, 2010, a security researcher published an attack on a ChipCon (CC) implementation of ZigBee
More informationUnit 8 Review. Secure your network! CS144, Stanford University
Unit 8 Review Secure your network! 1 Basic Problem Internet To first approximation, attackers control the network Can snoop, replay, suppress, send How do we defend against this? Communicate securely despite
More informationChapter 4: outline. 4.5 routing algorithms link state distance vector hierarchical routing. 4.6 routing in the Internet RIP OSPF BGP
Chapter 4: outline 4.1 introduction 4.2 virtual circuit and datagram networks 4.3 what s inside a router 4.4 IP: Internet Protocol datagram format IPv4 addressing ICMP 4.5 routing algorithms link state
More informationHACK MY CHIP: A RED TEAM BLUE TEAM APPROACH FOR SOC SECURITY. David HELY Grenoble INP Esisar LCIS, Valence
Hack My chip: A red Team Blue Team Approach 1 HACK MY CHIP: A RED TEAM BLUE TEAM APPROACH FOR SOC SECURITY David HELY Grenoble INP Esisar LCIS, Valence david.hely@grenoble-inp.fr Hack My chip: A red Team
More informationThe IPsec protocols. Overview
The IPsec protocols -- components and services -- modes of operation -- Security Associations -- Authenticated Header (AH) -- Encapsulated Security Payload () (c) Levente Buttyán (buttyan@crysys.hu) Overview
More informationCSCE 548 Building Secure Software Entity Authentication. Professor Lisa Luo Spring 2018
CSCE 548 Building Secure Software Entity Authentication Professor Lisa Luo Spring 2018 Previous Class Important Applications of Crypto User Authentication verify the identity based on something you know
More informationSmart card Power Analysis: From Theory To Practice
Smart card Power Analysis: From Theory To Practice João Lopes and Ricardo Chaves INESC-ID, Instituto Superior Técnico, Universidade Lisboa Email: joao.c.lopes@tecnico.ulisboa.pt, Ricardo.Chaves@inesc-id.pt
More informationCryptography and Network Security Chapter 12. Message Authentication. Message Security Requirements. Public Key Message Encryption
Cryptography and Network Security Chapter 12 Fifth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 12 Message Authentication Codes At cats' green on the Sunday he took the message from
More informationData Integrity & Authentication. Message Authentication Codes (MACs)
Data Integrity & Authentication Message Authentication Codes (MACs) Goal Ensure integrity of messages, even in presence of an active adversary who sends own messages. Alice (sender) Bob (reciever) Fran
More informationDesign Considerations for Low Power Internet Protocols
Design Considerations for Low Power Internet Protocols Draft-ayers-low-power-interop-00 Hudson Ayers Paul Crews, Hubert Teo, Conor McAvity, Amit Levy, Philip Levis Motivation The Working Group will generate
More informationSecurity against Timing Analysis Attack
International Journal of Electrical and Computer Engineering (IJECE) Vol. 5, No. 4, August 2015, pp. 759~764 ISSN: 2088-8708 759 Security against Timing Analysis Attack Deevi Radha Rani 1, S. Venkateswarlu
More informationZigBee IP update IETF 87 Berlin. Robert Cragie
ZigBee IP update IETF 87 Berlin Robert Cragie robert.cragie@gridmerge.com Introduction ZigBee IP is a super specification for an IPv6 stack Umbrella specification for a set of IETF RFCs Aimed at 802.15.4
More informationFIPS SECURITY POLICY FOR
FIPS 140-2 SECURITY POLICY FOR SPECTRAGUARD ENTERPRISE SENSOR August 26, 2011 FIPS 140-2 LEVEL-2 SECURITY POLICY FOR AIRTIGHT NETWORKS SPECTRAGUARD ENTERPRISE SENSOR 1. Introduction This document describes
More informationBluefly Processor. Security Policy. Bluefly Processor MSW4000. Darren Krahn. Security Policy. Secure Storage Products. 4.0 (Part # R)
Bluefly Processor Security Policy PRODUCT NAME: PROJECT NUMBER: AUTHOR: Bluefly Processor MSW4000 Darren Krahn REVISION : 1.16 DOCUMENT REFERENCE : SP-MSW4000-01 DOCUMENT TYPE: DEPARTMENT: Security Policy
More informationA Practical, Targeted, and Stealthy attack against WPA-Enterprise WiFi
1/23 A Practical, Targeted, and Stealthy attack against WPA-Enterprise WiFi A. Cassola W. Robertson E. Kirda G. Noubir College of Computer and Information Science, Northeastern University NDSS 2013 2/23
More informationCryptographic Hash Functions. Rocky K. C. Chang, February 5, 2015
Cryptographic Hash Functions Rocky K. C. Chang, February 5, 2015 1 This set of slides addresses 2 Outline Cryptographic hash functions Unkeyed and keyed hash functions Security of cryptographic hash functions
More informationSummary on Crypto Primitives and Protocols
Summary on Crypto Primitives and Protocols Levente Buttyán CrySyS Lab, BME www.crysys.hu 2015 Levente Buttyán Basic model of cryptography sender key data ENCODING attacker e.g.: message spatial distance
More informationImplementation Tradeoffs for Symmetric Cryptography
Implementation Tradeoffs for Symmetric Cryptography Télécom ParisTech, LTCI Page 1 Implementation Trade-offs Security Physical attacks Cryptanalysis* Performance energy Throughput Latency Complexity *
More informationM2351 Security Architecture. TrustZone Technology for Armv8-M Architecture
Architecture TrustZone Technology for Armv8-M Architecture Outline NuMicro Architecture TrustZone for Armv8-M Processor Core, Interrupt Handling, Memory Partitioning, State Transitions. TrustZone Implementation
More informationFault Sensitivity Analysis
Fault Sensitivity Analysis Yang Li, Kazuo Sakiyama, Shigeto Gomisawa, Kazuo Ohta The University of Electro-Communications liyang@ice.uec.ac.jp Toshinori Fukunaga, Junko Takahashi NTT Information Sharing
More informationWiMAX Security: Problems & Solutions
(JCSCR) - ISSN 2227-328X WiMAX Security: Problems & Solutions Paul Semaan LACSC Lebanese Association for Computational Sciences Registered under No. 957, 2011, Beirut, Lebanon Abstract This paper is a
More informationTest Vector Leakage Assessment (TVLA) Derived Test Requirements (DTR) with AES
Test Vector Leakage Assessment (TVLA) Derived Test Requirements (DTR) with AES 1 Document Scope This document describes requirements and test procedures for qualifying DPA-resistant implementations of
More informationDolphin DCI 1.2. FIPS Level 3 Validation. Non-Proprietary Security Policy. Version 1.0. DOL.TD DRM Page 1 Version 1.0 Doremi Cinema LLC
Dolphin DCI 1.2 FIPS 140-2 Level 3 Validation Non-Proprietary Security Policy Version 1.0 DOL.TD.000921.DRM Page 1 Version 1.0 Table of Contents 1 Introduction... 3 1.1 PURPOSE... 3 1.2 REFERENCES... 3
More informationON PRACTICAL RESULTS OF THE DIFFERENTIAL POWER ANALYSIS
Journal of ELECTRICAL ENGINEERING, VOL. 63, NO. 2, 212, 125 129 COMMUNICATIONS ON PRACTICAL RESULTS OF THE DIFFERENTIAL POWER ANALYSIS Jakub Breier Marcel Kleja This paper describes practical differential
More informationLesson 4 RPL and 6LoWPAN Protocols. Chapter-4 L04: "Internet of Things ", Raj Kamal, Publs.: McGraw-Hill Education
Lesson 4 RPL and 6LoWPAN Protocols 1 RPL [Ipv6 Routing Protocol For Low Power Lossy Networks (LLNs)] 2 LLN A constrained nodes network Low data transfer rate Low packet delivery rate in comparison to IP
More informationTrace Augmentation: What Can Be Done Even Before Preprocessing in a Profiled SCA?
Trace Augmentation: What Can Be Done Even Before Preprocessing in a Profiled SCA? Sihang Pu 1 Yu Yu 1 Weijia Wang 1 Zheng Guo 1 Junrong Liu 1 Dawu Gu 1 Lingyun Wang 2 Jie Gan 3 Shanghai Jiao Tong University,
More informationSEL-3021 Serial Encrypting Transceiver Security Policy Document Version 1.9
SEL-3021 Serial Encrypting Transceiver Security Policy Document Version 1.9 Schweitzer Engineering Laboratories, Inc. May 21, 2007 Copyright 2005-2007 Schweitzer Engineering Laboratories, Inc. May be reproduced
More informationCS 161 Computer Security
Paxson Spring 2017 CS 161 Computer Security Discussion 6 Week of March 6, 2017 Question 1 Password Hashing (10 min) When storing a password p for user u, a website randomly generates a string s (called
More informationAdvanced Encryption Standard and Modes of Operation. Foundations of Cryptography - AES pp. 1 / 50
Advanced Encryption Standard and Modes of Operation Foundations of Cryptography - AES pp. 1 / 50 AES Advanced Encryption Standard (AES) is a symmetric cryptographic algorithm AES has been originally requested
More informationJuly 2, Diet-IPsec: Requirements for new IPsec/ESP protocols according to IoT use cases draft-mglt-ipsecme-diet-esp-requirements-00.
IPSECME Internet-Draft Intended status: Standards Track Expires: January 3, 2015 D. Migault, Ed. Orange T. Guggemos, Ed. Orange / LMU Munich July 2, 2014 Diet-IPsec: Requirements for new IPsec/ESP protocols
More information