6
\$\begingroup\$

In a security recommendation (Mobile Operating System Protection Profile, §4.2.1 FCS_CKM_EXT.4.1), the following instructions are given to securely wipe a cryptographic key from memory:

  • For non-volatile EEPROM, the zeroization shall be executed by a single direct overwrite consisting of a pseudo-random pattern (…).
  • For (…) non-volatile flash memory, the zeroization shall be executed by a single direct overwrite consisting of a single direct overwrite with zeros (…).

In plainer English: you can erase data in flash by simply zeroing it, but for EEPROM you must overwrite with a random pattern.

I have no other information to infer what difference between EEPROM and flash is meant. I guess the technologies would be the ones in typical smartphones since this is the type of device that this security document addresses.

What is different between overwriting data in EEPROM and overwriting data in flash memory, that would explain the different requirements?

[Related: Where do these rules come from?]

\$\endgroup\$

4 Answers 4

2
\$\begingroup\$

If you speak in general terms the primary difference between flash and EE prom is simply architectural with respect to the data access, the actual write/erase mechanism is identical at the cell level. What circuits wrap around those cells for moving the bits to and from the cell, how parallel the operation is and how many happen at the same time is where the real differences lie. So an accurate statement would be , if you've implemented a FAMOS or FGMOS cell can you make a flash or an EEPROM chip from that, and the answer would be yes.

But be aware it will be hard to compare various EEPROMS to Flash devices simply because of the differences in the process technology, the process capabilities and it's wear resiliency.

EEPROMS tend to be small and so tend to be more robust and designed for longer term storage which affects the process design. On the other end you can see that there is multilevel Flash with is optimized for bit density. this is yet another optimization.

All floating gate cells are characterized by their usage of Fowler-Nordheim (F-N) Tunnelling for the injection of the charge into the floating gate through the Gate oxide. F-N tunnelling in turn is characterized by Quantum Mechanical tunnelling through a triangular potential well under high electric fields. The point here is that tunnelling is inherently damaging to the gate oxide and leaves residual evidence. The solution recommended above is to ensure that each cell is worn out the same amount so you can't go back read the evidence of what was there - when put that way it does really seem like such a good idea.

Very few people/labs have the ability to strip apart a die and read the residual damage in the floating gate device that has been erased. It is possible, certainly, but it won't be through probing the device and it would be very difficult. It would be best to capture the device with charge still in the gate (but this poses different problems in itself).

\$\endgroup\$
3
\$\begingroup\$

The goal of the erase routine is to have the charge state of each bit be independent of the previously written data. While a chip's own circuitry may be unable to distinguish a bit which is 70% charged from one which is 98% charged, or a bit which is 30% charged from one which is 2% charged, someone with sufficiently sophisticated probing equipment may be able to make such distinctions.

If a memory chip is designed in such a fashion that attempting to erase some area of memory will activate a "discharging" circuit for a fixed amount of time, then bits which used to be "charged" before the erase operation will end up with more charge afterward than bits which were not (the discharging circuitry can't drain all the charge; rather, turning it on for some number of microseconds will drain off about half the charge). Since the erase circuitry for memory chips cannot generally be controlled on a per-bit basis, and since leaving it on long enough to eliminate all detectable charge residue would stress the device, the erase circuitry is not in and of itself generally sufficient to reliably destroy information in such a way that sufficiently-sophisticated equipment could not recover it.

The ideal way to erase information on a chip would be to repeatedly write random data patterns to it and then erase them. Unfortunately, that is not always practical. For a device which would allows the area holding a key to be erased without disturbing anything else, that would be the desirable. Performing an erase and then overwriting the data is also pretty good, however. Performing an erase followed and then writing all zeroes would probably be about as good as writing random data, but simply zeroing out those bits that aren't yet written (in a single operation, and without doing the erase first) would not. Actually, the ideal approach for a single write/erase cycle might be to zero out bits in random groups, then perform an erase, and then zero out bits in different random groups, but that approach would only be work on devices which allow bytes to be programmed multiple times between erase cycles. I suspect that the use of random data rather than all zeroes is intended to force the performance of an erase cycle.

The way bits are physically written to flash devices is such that there will often be some unpredictable variations in the charge state of "zero" bits. Thus, writing zeroes to a flash device without erasing it first will probably do a better job of making the information unrecoverable than would writing zeroes to an EEPROM without erasing it first. Further, erasing a flash chip generally requires that it be programmed with all zeroes first (chips handle that operation internally). That, combined with the fact that it may not be possible to erase just the part of the chip containing a key, is probably what drives the decision to use "fill with zeroes" as the proper approach for erasing keys from flash.

\$\endgroup\$
2
\$\begingroup\$

I read a very interesting paper some time ago and managed to find a link Data Remanence in Flash Memory Devices. It should give you an idea why the above mentioned recommendation is given.

The document contains lots of details regarding how data is stored in flash/EEPROM and discusses problems that "...could seriously affect data remanence in floating-gate memories...".

... In non-volatile programmable devices, such as UV EPROM, EEPROM or Flash, bits are stored as charge in the floating gate of a transistor. After each erase operation, some of this charge remains. Security protection in microcontrollers and smartcards with EEPROM/Flash memories is based on the assumption that information from the memory disappears completely after erasing...

Invasive and non-invasive methods to extract data are discussed and in the end there are some possible countermeasures given.

To avoid data remanence attacks in secure applications, the developer should follow some general design rules that help to make data recovery from semiconductor memories harder [5]: * Cycle EEPROM/Flash cells 10–100 times with random data before writing anything sensitive to them, to eliminate any noticeable effects arising from the use of fresh cells.
* Program all EEPROM/Flash cells before erasing them to eliminate detectable effects of residual charge.
* ...

\$\endgroup\$
0
\$\begingroup\$

These requirements are for security purposes only. You don't have to overwrite with a pattern to erase either. It is saying for EEPROM that a write of zeros isn't sufficient to prevent the data being obtainable.

\$\endgroup\$
3
  • 1
    \$\begingroup\$ EEPROM chips vary enormously in how they control charge transfers during write and erase operations. It's much easier to write the spec in such a fashion as to write that both an erase and write operation be performed regardless of the exact type of EEPROM chip one is using, than it would be to identify which operations are actually necessary or optimal for which chips. \$\endgroup\$
    – supercat
    Commented Jun 11, 2013 at 19:44
  • \$\begingroup\$ Well, sure, these are security requirements, it says so on the tin. My question is what the reason for these requirements is, and specifically why flash and EEPROM have different requirements (presumably, different remanence properties). \$\endgroup\$ Commented Jun 11, 2013 at 21:26
  • \$\begingroup\$ @Gilles: My point was that it's possible that a procedure which would render information unrecoverable on one EEPROM chip (e.g. writing all 00 or all FF) might not do so on another. It's possible that on some chips writing all 00 or all FF may be "cheaper" than writing random data, and yet still render information physically unrecoverable, but it's easier for the spec to say "write random data to any EEPROM device" than to say "write random data, except on devices where writing 00 or FF would be faster and where doing so will cause any systemic charge variation to be swamped by randomess." \$\endgroup\$
    – supercat
    Commented Jun 12, 2013 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.