2
\$\begingroup\$

I am thinking about building a dongle that acts as a USB or PS/2 keyboard device and is capable of doing some cryptographic things for me, e.g. provide time-based authentication codes, store passwords and things like that. However, I would like to make this thing at least a little bit secure against power consumption analysis attacks.

One thing I have in mind is to put a small capacitor on the board and have two microcontrollers; microcontroller A talks to the computer and the user, microcontroller B does the crypto. When A requests a computation using a secret key, B would make sure that it has enough power in the capacitor and then disconnect itself from A using transistors before performing the actual computation.

Does this sound like a good idea? In other words, is it likely that this will make power consumption attacks much harder without significantly degrading the usability?

Edit: I'm assuming that the opponent is inside the PC but can't get hold of the board.

\$\endgroup\$
  • 4
    \$\begingroup\$ If it's on the board it offers no security. Lift one lead, add 0.1 ohms, measure current : you have probably made the other team's life easier. \$\endgroup\$ – Brian Drummond Mar 26 '13 at 11:12
  • 1
    \$\begingroup\$ If your opponent has access to the hardware most bets are off, as Brain stated. If he has not, a simple alternative is to use one 3v3 powered controller, which is powered from the USB 5V by a constant-current + zener diode style power supply. \$\endgroup\$ – Wouter van Ooijen Mar 26 '13 at 11:28
  • 1
    \$\begingroup\$ @WoutervanOoijen Hmm, sounds as if that could work against a passive attack. Against an active attacker who lets the voltage drop to 3.29V or so, it might be a bit difficult... \$\endgroup\$ – thejh Mar 26 '13 at 11:41
  • 1
    \$\begingroup\$ A simple low-voltage cutout (probably required anyway to protect against other types of attacks) would solve that. \$\endgroup\$ – Wouter van Ooijen Mar 26 '13 at 11:48
  • 2
    \$\begingroup\$ You might make things a bit more difficult by modulating the PSU current thru an IO pin and a resistor to give a totally false representation of what the crypto microcontroller is doing or am i missing the point? \$\endgroup\$ – Andy aka Mar 26 '13 at 12:06
1
\$\begingroup\$

If you're not using custom silicon, I don't see any way to achieve really good security against power monitoring without adding some sort of battery (which you may want anyway for time-keeping) that's mounted in such a way one cannot get access to the electronics without breaking the battery connection (the board would have to receive its crypto keys after the battery is installed, and removing the battery would erase them). Once the board is protected in such fashion, there are many ways of guarding against power-supply monitoring. A simple approach might be to wire in series with the supply a PFET with source and drain "reversed" so that when the gate is high or floating it will behave as a diode. Driving the gate low momentarily, before a cryptographic computation, would then cause VDD to rise by a diode drop; if one raises the gate, the micro would be powered by the bypass and filter caps until their voltage dropped by 0.5 volts or so. External monitoring could ascertain the total current consumed by a computation, but that would likely not be meaningful.

\$\endgroup\$
  • \$\begingroup\$ Hmm...sounds like an interesting approach. However, won't this just increase the required measurement precision a bit? \$\endgroup\$ – thejh Mar 26 '13 at 15:19
  • \$\begingroup\$ @thejh: If the VDD to the processor is physically inaccessible except by removing the battery, what would one measure? I suppose all I/O would need to be guarded to ensure that they couldn't be used to source VDD to a level higher than the external supply, but that shouldn't be too difficult. \$\endgroup\$ – supercat Mar 26 '13 at 15:27
  • \$\begingroup\$ If the battery can not be removed but the battery poles are accessible the impedance of the battery can be used: simply measure the small fluctuations in the voltage across the battery. When you want to suppress this with a decoupling capacitor take care to select one that has suitable high-frequency characteristics. And another attack: place a Hall-sensor near the chip's power line. \$\endgroup\$ – Wouter van Ooijen Mar 26 '13 at 15:49
  • \$\begingroup\$ @WoutervanOoijen: Against an attack with a hall sensor, I'd need custom silicon or good shielding, right? Both sound hard given that this only is a hobby project idea... \$\endgroup\$ – thejh Mar 26 '13 at 16:00
  • \$\begingroup\$ @supercat: Hmm, I think I'm a bit confused about what you're proposing. You're proposing to use the computer's 5V as power supply, but with capacitors and the reversed PFET in between to make it harder to measure the power consumption of the chip, right? \$\endgroup\$ – thejh Mar 26 '13 at 16:03
1
\$\begingroup\$

On idea might be to pad the computations with irrelevant computations so that the information leaking via power consumption is scrambled to some extent, making it less susceptible to scrutiny. For instance, have lots of interrupts going off while the crypto is being performed, and do random stuff in the interrupt handlers. If your device can change its execution clock rate without affecting peripherals, that might be something to randomly play with also.

In a similar vein, you could have, throughout the code, blocks of instructions which have no effect, like doing some arithmetic operations on registers or memory locations which ultimately restore their values. These blocks of instructions could be of different lengths, and different such blocks could be chosen at run-time.

Perhaps the computation can be "whitened" with some decoy data mixed in so that no two executions of the same operation with the same data will yield the same power trace. Add salts, initial vectors or padding junk wherever you can.

Simple example. Say you're encrypting some 64 bit datum D. You can generate a pseudo-random 64 bit value X, and then produce the 128 bit datum consisting of X XOR D, and X. D does not appear in that datum, but can be recovered by XOR-ing the two halves together. Two different encryptions of D will then have different power profiles because they involve different 128 bit words. The attacker then cannot probe the device by giving it different but similar D's to see how changes in individual bits of D (and such) influence the power trace.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.