CHAPTER 16 Physical Tamper Resistance It is relatively easy to build an encryption system that is secure if it is working as intended and is used correctly but it is still very hard to build a system that does not compromise its security in situations in which it is either misused or one or more of its sub-components fails (or is ’encouraged’ to misbehave). this is now the only area where the closed world is still a long way ahead of the open world and the many failures we see in commercial cryptographic systems provide some evidence for this. — Brian Gladman The amount of careful, critical security thinking that has gone into a given security device, system or program is inversely proportional to the amount of high-technology it uses.1 Introduction Low-cost tamper-resistant devices are becoming almost ubiquitous. Examples I’ve discussed so far include: smartcards used as SIMs in mobile phones and as bank cards in Europe; accessory control chips used in printer toner cartridges, mobile phone batteries and games-console memory modules; the TPM chips being shipped in PCs and Macs to support hard-disk encryption, DRM and software registration; security modules used to manage bank PINs, not just in bank server farms but in ATMs and point-of-sale terminals; 483 484 Chapter 16 ■ Physical Tamper Resistance security modules buried in vending machines that sell everything from railway tickets through postage stamps to the magic numbers that acti- vate your electricity meter.
Many of the devices on the market are simply pathetic, like the banking terminals whose failures I described in section 10.1: those terminals could be trivially compromised in under a minute using simple tools, despite having been evaluated by VISA and also using the Common Criteria framework. Yet some tamper-resistant processors are getting pretty good. For example, I know of one firm that spent half a million dollars trying, and failing, to reverse- engineer the protocol used by a games console vendor to stop competitors making memory modules compatible with its equipment1. But a few years ago this was not the case.
Serious tamper resistance emerged out of an arms race between firms that wanted to lock down their products, and others who wanted to unlock them. Some of the attackers were respectable companies exercising their legal rights to reverse engineer for compatibility. Others were lawyers, reverse engineering products to prove patent infringements. There are half a dozen specialist firms that work for the lawyers, and the legal reverse engineers.
There are academics who hack systems for glory, and to push forward the state of the art. There are bad guys like the pay-TV pirates who clone subscriber cards. And finally there are lots of grey areas. If you find a way to unlock a particular make of mobile phone, so that it can be used on any network, is that a crime? The answer is, it depends what country you’re in.
There are now many products on the market that claim to be tamper- resistant, from cheap microcontrollers through smartcards to expensive cryp- toprocessors. Some of them are good; many are indifferent; and some are downright awful. It is increasingly important for the security engineer to understand what tamper resistance is, and what it can and can’t do. In this chapter I’m going to take you through the past fifteen years or so, as ever more clever attacks have been met with successively more sophisticated defenses.
It has long been important to make computers resist physical tampering, as an attacker who can get access can in principle change the software and get the machine to do what he wants. While computers were massive objects, this involved the techniques discussed in the previous few chapters — physical barriers, sensors and alarms. In some applications, a computer is still made into a massive object: an ATM is basically a PC in a safe with banknote dispensers and alarm sensors, while the sensor packages used to detect unlawful nuclear tests may be at the bottom of a borehole several hundred feet deep and backfilled with concrete. Where tamper resistance is needed purely for integrity and availability, it can sometimes be implemented using replication instead of physical protection.
A 1 Eventually the memory module was cracked, but it took a custom lab with chip testing equipment and a seven figure budget.2 History 485 service may be implemented on different servers in different sites that perform transactions simultaneously and vote on the result; and the threshold schemes discussed in section 13.4 can also provide confidentiality for key material. But tamper-resistant devices can provide confidentiality for the data too. This is one respect in which the principle that many things can be done either with mathematics or with metal, breaks down.2 History The use of tamper resistance in cryptography goes back centuries [676]. Naval codebooks were weighted so they could be thrown overboard if capture was imminent; to this day, the dispatch boxes used by British government ministers’ aides to carry state papers are lead lined so they will sink.
Codes and, more recently, the keys for wartime cipher machines have been printed in water soluble ink; Russian one-time pads were printed on cellulose nitrate, so that they would burn furiously if lit; and one U. wartime cipher machine came with self-destruct thermite charges so it could be destroyed quickly. But such mechanisms depended on the vigilance of the operator, and key material was often captured in surprise attacks. So attempts were made to automate the process.
Early electronic devices, as well as some mechanical ciphers, were built so that opening the case erased the key settings. Following a number of cases in which key material was sold to the other side by cipher staff — such as the notorious Walker family in the USA, who sold U. Navy key material to the Russians for over 20 years [587] — engineers paid more attention to the question of how to protect keys in transit too. The goal was ‘to reduce the street value of key material to zero’, and this can be achieved either by tamper resistant devices from which the key cannot be extracted, or tamper evident ones from which key extraction would be obvious.
Paper keys were once carried in ‘tattle-tale containers’, designed to show evidence of tampering. When electronic key distribution came along, a typical solution was the ‘fill gun’: a portable device that dispenses crypto keys in a controlled way. Nowadays this function is usually performed using a small security processor such as a smartcard; as with electricity meters, it may be packaged as a ‘crypto ignition key’. Control protocols range from a limit on the number of times a key can be dispensed, to mechanisms using public key cryptography to ensure that keys are only loaded into authorized equipment.
The control of key material also acquired broader purposes. In both the USA and the UK, it was centralized and used to enforce the use of properly approved computer and communications products. Live key material would only be supplied to a system once it had been properly accredited. 486 Chapter 16 ■ Physical Tamper Resistance Once initial keys have been loaded, further keys may be distributed using various authentication and key agreement protocols.
I already talked about many of the basic tools, such as key diversification, in the chapter on protocols in Part I, and I’ll have more to say on protocols later in the chapter in API attacks. Here, I’m going to look first at the physical defenses against tampering.3 High-End Physically Secure Processors An example worth studying is the IBM 4758 (Figures 16. This is important for three reasons. First, it was the first commercially available processor to have been successfully evaluated to the highest level of tamper resistance (FIPS 140-1 level 4) [938] then set by the U.
Second, there is an extensive public literature about it, including the history of its design evolution, its protection mechanisms, and the transaction set it supports [1195, 1328, 1330]. Third, as it was the first level-4-evaluated product, it was the highest profile target in the world of tamper resistance, and from 2000–2005 my students and I put some effort into attacking it.1: The IBM 4758 cryptoprocessor (courtesy of Steve Weingart) 16.3 High-End Physically Secure Processors 487 Figure 16.2: The 4758 partially opened showing (from top left downward) the circuitry, aluminium electromagnetic shielding, tamper sensing mesh and potting material (courtesy of Frank Stajano) The evolution that led to this product is briefly as follows. The spread of multi-user operating systems, and the regularity with which bugs were found in their protection mechanisms, meant that large numbers of people might potentially have access to the data being processed. The reaction of the military computing community, which I described in Chapter 9, was the Anderson report and multilevel security.
The reaction of the banking commu- nity was to focus on particularly sensitive data — and specifically on long-term cryptographic keys and the personal identification numbers (PINs) used by bank customers to identify themselves to cash machines. It was realized in the early 1980s that the level of protection available from commercial operating systems was likely to remain insufficient for these ‘crown jewels’. This led to the development of standalone security modules of which the first to be commercially successful were the IBM 3848 and the VISA security module. Both of these were microcomputers encased in robust metal enclosures, with encryption hardware and special key memory, which was static RAM designed to be zeroized when the enclosure was opened.
This was accomplished by wiring the power supply to the key memory through a number of lid switches. So whenever the maintenance crew came to replace batteries, they’d open the lid and destroy the keys. Once they’d finished, the device operators would then reload the key material. In this way, the device’s owner could be happy that its keys were under the unique control of its own staff.
488 Chapter 16 ■ Physical Tamper Resistance How to hack a cryptoprocessor (1) The obvious attack on such a device is for the operator to steal the keys. In early banking security modules, the master keys were kept in PROMs that were loaded into a special socket in the device to be read during initialization, or as strings of numbers which were typed in at a console. The PROMs could easily be pocketed, taken home and read out using hobbyist equipment. Cleartext paper keys were even easier to steal.
The fix was shared control — to have two or three PROMs with master key components, and make the device master keys the exclusive-or of all the components. The PROMs can then be kept in different safes under the control of different departments. (With the virtue of hindsight, the use of exclusive-or for this purpose was an error, and a hash function should have been used instead. I’ll explain why shortly.) However, this procedure is tedious and such procedures tend to degrade.
In theory, when a device is maintained, its custodians should open the lid to erase the live keys, let the maintenance engineer load test keys, and then re-load live keys afterwards. The managers with custodial responsibility will often give their PROMs to the engineer rather than bothering with them. I’ve even come across cases of the master keys for an automatic teller machine being kept in the correspondence file in a bank branch, where any of the staff could look them up. Prudent cryptography designers try to minimize the number of times that a key reload will be necessary, whether because of maintenance or power failure.
So modern security modules typically have batteries to back up the mains power supply (at least to the key memory). Thus, in practice, the custodians have to load the keys only when the device is first installed, and after occasional maintenance visits after that. It has been debated whether frequent or infrequent key loading is best.