Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1095 Thanks!
[Music]
um that with the
glasses
LS and uh Christian all of them um work
for of the r University
bom please welcome them with a huge
round of
[Music]
applause yeah so thank you very much
thank you for being here I'm Christian
the tall one is
[Music]
L musclean is David um so yeah we are we
are coming from buom it's a nice city
it's like two and a half hours away from
from leik
it's very close more or less um FC is a
spin-off of the University we are now um
like two and a half years old and this
is actually the very first time that we
really present insights of our
technology yeah so the research team um
behind the enclosure puff technology is
not just we3 uh the major people are um
also Kristoff P he's Professor for the
chair of embedded security at University
b as well as johanes tobish he's also
here but he's super shy so he's he don't
want to be on S that's a joke three
people are enough and um ourselves yeah
so you maybe of course know bom because
of the ru
University um specifically because of
the hor skirs Institute for it security
but you maybe also know B because of
noia and and Opel but because we don't
have noia and Opel anymore more we also
created the FC for yeah to get all the
people uh this is not true yeah it's
actually true that we have 26 professors
uh at the HGI we have more than 100
alumni and we are one of 15 startups
um where some of them are already no
startups anymore and this is a nice
ecosystem uh for us and for it
Security in bom there will also be the
max plank Institute for cyber security
and digital privacy which is pretty nice
we have the European competent Center
for it security we have the flux fingers
yeah they also here and I guess um I
guess bom is good in publishing real
world attacks and real world attacks are
also our background specifically the
real world attacks on embedded systems
yeah um and to get an idea what we are
actually doing when we are not
presenting like novel Technologies like
this are um yeah as I said
implementation attacks um for the people
who like statistics um physical unsecure
iot devices are actually the major
concern for the iot so for the internet
of things for all the connected devices
we will have in the in the near future
which is a real issue however um who
likes uh concrete examples of course we
have a lot of different attacks like
mathematic attack
um social engineering um but
specifically implementation attacks and
implementation attacks can again be
classified in different families yeah
like the active and passive ones um and
um the passive ones for like side
Channel attacks where you use just the
timing of the algorithms electromagnetic
aminations or power consumptions and
then maybe some simple analysis or even
maybe some statistical analysis you can
easily extract the keys I will show you
some very rough uh examples later yeah
and on the other side we have active
attacks yeah again the attacker has a
device and can uh maybe inject FS maybe
with lasers maybe with clock glitches
power glitches uh or reverse engineer
the entire device yeah and what is
important yeah this attacks are
independent of the algorithms or of the
mass yeah you can apply them to um
virtually all ciphers in the field
little illustration of um of um Power or
timing analysis using maybe U picoscope
or an oscilloscope um or um injection
falls in the chip concrete examples are
given here the credit comes or goes to
the to our chair to to the chair of
embedded security where um my colleagues
um analyze this kind of attacks like a
lot and here you can actually see um the
calculation of an RSA algorithms I'm not
going into the deep detail but they're
doing some exponentiations and modular
reductions and to do it more efficient
you do um you do reduce the complexity
of a multiplication to a squaring if you
can and when you do this then you think
okay this is nice makes it efficient and
faster it's actually uh a problem um
when you just take a look on the power
consumption because you can easily read
out the private key
yeah um and this is possible when the
attacker just has the device yeah and
can can probe the device a little bit
more expensive attacks are fault
injection attacks where you shoot with
um with um
maybe Focus iron Beam on the circuit
while the system is actually in
operation and then you create faults and
when you compare the results after you
know a faulty um operation you um
compare it maybe with the correct
operation and then you can also again
easily attack um such
implementations if you have more
interest in this topic yeah my colleague
F shellenberg he's also somewhere
here can't see him um he just finished
his PhD so we can call him Dr shanberg
but he's not all
to call his himself shine Dr shine right
now so he's in exactly the stage yeah
during the PHD anyway okay and uh um
he's also an expert in doing Hardware uh
reverse engineering where you use um
acid to open the chip and then analyze
what's inside maybe you find uh uh
weaknesses maybe fuse fuses or something
you can um use to to read out keys or
maybe completely reverse engineer the
system yeah another very interesting um
attack is the implementation of troan
specifically Hardware troan into the
devices and here's
um an example also of a colleague from
from buom and he implemented Hardware
troen into a high security USB drive a
high security USB stick and this is also
something um we are targeting um with
with the technology we are
presenting so with this knowledge in
background in your backhead yeah when
you are a designer of an embedded system
you have to handle it so this means you
have to create systems maybe you
remember the talk yesterday yeah about
smart home hacking yeah there a guy said
okay you know the company is all the
time complaining that it's military
grade security yeah maybe they use some
Primitives like as or something the
military is using as well but from the
physical security point of view there is
actually no military grade Security in
the market yeah not at all they're very
far away from the stuff the military is
actually doing so however um also in
this space like the physical security we
have to go closer into the area of
really physically secure the devices and
then I would say a classical developer
for iot devices
will have a very hard time to um you
know put all this stuff in the design
process like um developing side Channel
resistant algorithms um design a system
where you can not
probe um data information between two
chips yeah um let's say you have a
security element on the on the device
and also a classical
microcontroller um and you don't want to
manipulate it then you have to somehow
secure the entire system and not just a
single chip yeah so this is a huge
problem so and um for all this
applications the big question is how to
actually protect um systems like this
from physical attacks yeah coming from
real iot devices like smart home systems
or um um alarm systems or something like
this up to um Financial systems like
ATMs or maybe even satellites or other
more critical um applications up to
really high security applications and
maybe you remember the Vintage
verification talk from last year from
the CCC from our friends from Princeton
University actually from the nuclear
future labs they have also some
interesting um use cases where this
technology uh might be a nice fit
huh okay
yeah so at this point you might be
wondering isn't there anything that
exists already that protects our devices
against temper and I will give an
overview on what exists currently at the
market first of all four different
approaches to guaranteeing temporary
resilience exist um being temper
resistance in which temper is just made
difficult for the attacker um temper
evidence where any intrusion attempt
must be evident um going on uh temper
detection makes sure that temper is
detected actively reported to the user
or owner of a device and lastly the
highest highest goal which we are trying
to achieve with our solution is temper
responsiveness in which counter measures
are automatically engaged once a temper
is
detected there's one big standard uh
that at least covers how a temper
responsiveness should work in practice
which is n f 140-2 and in this this
standard four increasing levels of
anti-t temper security are given um and
we are trying to reach the highest level
which is level four and uh this is
required for all highly sensitive
environments that the US government has
servers or appliances working
in so what does level four demand um
first of all any attack must be detected
micro intrusions andmental attacks where
like a deep freeze is conducted and
basically anything that somehow
tempers with the physical Integrity of
the device secondly breaches must zero
all CSP CSP standing for critical
security parameters so your
cryptographic materials your sensitive
data all of this must be deleted in the
case of a temper thirdly um the CSP must
be separated from the main system which
is something you might already know from
red and back systems on Hardware
protection
modules and uh lastly the whole setup
must be engulfed in a complete tempor
detection and respon response envelope
we'll go into detail about that later
sadly no public benchmarks exist on
which attacks are tried out to break
around uh physical temper resistance so
um maybe there are some which are
classified um we can't access them at
the moment though so coming to temper
resence uh this is something we will
quite commonly in uh see in everyday
life um like the potting of electronic
components um which is also sometimes
done to protect against water damage um
or using Totally Secure one-way screws I
mean there's no way we could get around
this
right um well we can obviously we just
need some proprietary tools or chip away
at the electronic pting potting so this
is not really a solution however it does
protect against vandalism in public
places it's very cheap and it's widely
used um but not what we want for our
system
secondly there's temper evidence um this
is something most of you will be
familiar with as well if you try to
repair your own phone but you are not
allowed to do it uh on the upper upper
right hand you can see the typical
warranty seals that are used in
electronics so the you void your
warranty once you remove it um the first
well big issue that came up where temper
was was the main concern was uh the tyol
bottles I don't know does anybody of you
know the story behind
this uh two or three hands uh there was
a serial killer in the United States who
poisoned these uh small containers and
as a result they engulfed well they they
started using these safety
seals but same as with uh the previous
approach uh widely used cheap and
ineffective there's a very nice uh talk
on Defcon 19 which we highly recommend
where they go into detail on how to
easily circumvent these measures
one approach we want to point out
because it was mentioned last year is uh
shine bright like a glitter nail polish
uh you can very easily protect your
laptop during shipping um by just using
glitter nail polish first of all you
cover all screw holds of a laptop using
um stickers just off the shelf uh do
what you want stickers and then you
cover the rim of the sticker with nail
polish then you take a high resolution
picture of this nail polish and sign the
picture with your private key and upload
the photo so the person receiving the
laptop can make another photo and check
whether the glitter particles are the
same quite easy and very effective
however this doesn't guarantee uh any
any higher level than temper uh
evidence coming to temper detection now
this is the first step where you really
need to think about what you're doing
because um having having a temper
detection means you need some kind of
sensor that is able to detect the
opening or the tempering of the device
device um you can see on the top um is a
PCB that has a small photoelectric diode
and as soon as the case is open and the
light shines onto the diode uh the
system knows that it's being opened and
probably tempered with uh several other
methods exist as well um such as
switches that just trigger when you open
the case and so on the benefit of this
is that you don't need complex apis you
can just have a small switch that can be
read out one way switch and you're done
for
and false positives do not destroy the
critical security parameters because
there's just just a notification going
out um maybe the notification might be
wrong but that doesn't uh destroy
anything now that's what we want to
achieve temper responsiveness um current
Solutions are mostly based on measures
that are wrapped around the high
security or Hardware security module
because that's is where temper is the
most the biggest issue and um if you try
to get into the bus lanes of these
devices you will destroy that mesh and
the capacitance for example of these
meshes is different this can be Reed
measured out by a deletion circuit and
that deletion circuit then automatically
deletes any information on this device
this is state-of-the-art this is used by
almost all Hardware uh platform modules
um but there's one big issue or two big
issues uh first of all you need a
battery if the battery runs out uh as a
last dying breath the system deletes
itself which is of course not wanted if
you just want to store it on a shelf for
some months secondly you can only
protect a very tiny area um because it
quite hard to engulf a whole system in
this mesh uh due to the need for air con
uh air and heat
spreading so fips 140-2 is really hard
to obtain there are are only three
worldwide modules that fulfill this
requirement and 14 modules have the
Reach This requirement uh since I think
2005 or
something um the constant NE for power
is of course Troublesome and no offthe
shelf solution currently exists so you
can't get any modules that say Hey if
you build this into your system you are
FPS 140 dh4 level four
certified this of course makes
retrofitting existing machine heart
there are several use cases where it's
just desirable to retrofit an old
machine especially ATMs are highly
expensive having the vault in the in the
bottom of this uh ATM where the cach is
start moving it reinstalling something
that's a process you don't want to go
through if you want to just plug in a
new module that guarantees
temper so now coming to where we are at
or what we want to achieve um currently
both software and Hardware Solutions
exist that uh try to verify temper and
our solution which is symol symbolized
by this little red dot uh tries to go
for a new approach that combines heart
and software in a clever way uh while
making it easy to redeploy existing
devices after being fitted with our
solution our solution is based on
physical disorder um meaning we want to
exploit small effects that um that are
occuring during production some of you
might know that electronic circuits some
small have some small variations that
are used to uh to generate or to verify
that the system has not been tempered
with um and we go into a similar
Direction usually physical disorder is
something you don't want you want
everything that that you produce to be
exactly the same but you will never be
able to due to these microscopic effects
that you can see up
there so we're using physically based uh
physically unclonable functions I'm sure
some of you will have heard of them
could you give me a hand okay that's the
majority nice so I'll keep it brief um
you take a challenge that you throw into
some kind of random system and you get a
response out um and thus you can build a
good old challenge response pair we'll
focus on just having a weak path meaning
we have only one Challenge and one
response but we are sure that our
entropy we have in our physical
environment is sufficient the properties
are they are very easy to evaluate but
very hard to predict
so uh you need to be able to conduct an
evaluation very very quickly but be not
able to simulate the environment using
uh Advanced simulation tools and extract
the puth
response secondly they're easy to
manufacture but hard to duplicate so
even if you put this thing into your CRT
machine and really scan every layer and
try to 3D print it or something like
that you won't be able to get the
Precision you
need not to some mathem meical aspects
there exists the notation of algorithmic
temper proof um most security goals or
most security games that are played in
cryptography are based on uh having
mathematical functions that you want to
reduce your problem on and ATP extends
this model by saying okay but what if we
don't have a black box of crypto that we
have an input and an output to but what
if we can temper with all of the
internals as well and the researchers
had uh three items they wanted to have
checked and then they say okay this is
algorithmic temper proof first one there
needs to exist some kind of secure
Hardware storage in which there cannot
be is no possible way to read when the
system has been tempered with
secondly uh the device must be able to
self- destroy itself and thirdly um
there must be some kind of Hardware that
cannot be manipulated with by the by an
attacker it may be red but it not
doesn't must not be
changed and the first criteria has
already been fulfilled by some of some
colleagues from heidleberg that
presented on chess and heidleberg in
2006 um they used a small coating that
they applied to an integrated circuit
and they were able to apply sensors to
the integrated circuit that measure the
capacity of the coating so they had 30
of these sensors overall all over the
circuit board and uh then they shot a
small hole using uh Gallum beam Gallum
beam and created a 100 micrometer by 100
micrometer by 1.5 micrometer hole and
they were able to successfully detect
this and uh have this chip be
unusable this is not the resolution we
are going for because most solutions we
are aware of Target the rough military
requirement of 300 microm hole with a
300 microm diameter this is what we are
going to go for as well so now uh we're
coming to our key
idea that question will present okay
perfect so I guess we learned already a
lot yeah we learned
um um the concerns the problems we
learned the state-of-the-art solutions
we learned that um um really wrapping a
system in a mesh which can actually
detect 300 micrometer holes is kind of a
goal we want to achieve
um and this FIP standard 142 level four
tells us that we have to do this as an
complete envelope around the system and
right now this is only possible for kind
of pcbs but not for really entire
systems and the idea we are using here
are coming actually from a completely
different area but um attaches touches
like the concept of physical unclonable
functions so and what we are using are
um actually electromag magnetic waves
specifically the propagation effects of
waves when they touches
surfaces um in between uh the
transmitter and the receiver and vice
versa actually so this physical effects
are very complicated so there are
complex effects like classical uh maybe
well known effects like reflection
deflection absorption scattering
refraction and also some nonlinear
effects and later I will show you maybe
a little bit more about this details um
but this is uh the idea and actually the
channel can now um be um
characterized um by something called
Channel impulse response so here you
have an example yeah someone is sending
this function s from T and E from T is a
function the the receiver will receive
and the channel is H from T and this is
character IED by exactly the change of
the
signal and um this is so the The Source
let's say a source of entropy um which
extracts entropy out you know coming
from this physical disorder um we are
using Channel State information is
pretty much or contains pretty much the
same information just in a different way
it's actually represented in the
frequency domain and um is in an
specific um semantic that it
um fits very well for equalizers and fit
and filters um specifically on the
receiver side but for modern system also
on the um transmitter
side so we are using now this um
technology called Wireless physical
layer security and um apply it in an
enclosure so this means we use the
electromagnetic waves and send them from
inside of an enclosure in the enclosure
in the environment and estimate um a
fingerprint so the generous pulse and
response at one or maybe several
different antennas yeah and here we have
an example how such a fingerprint looks
like um just for the magnitude there
also phase information but we keep this
out maybe for
Simplicity um this enclosure can be in
this case for example an ECU so a
control module of a car but it can
actually be more or less everything so
we did this for ATMs and for a couple of
other systems we are actually not
allowed to talk about but um we can do
this uh also for very more complex
structures even if there are moving
parts and even if there are temperature
change then it will get more complicated
but we skipped this just to give you an
idea how it actually works and then a
very important part of the algorithm is
that we use this enclosure fingerprint
to generate a cryptographically usable
key yeah with a security level of let's
say 128 bit um based on an statistic
test and or a um entropy
estimator um um yeah so this is a
general idea yeah and if someone um um
tries to temper the system by maybe
drilling a small hole in the in the case
he will automatically destroy the key
yeah and maybe small spoiler yeah this
is already the destruction the
self-destruction mechan M David was
talking
about so this is the core idea yeah and
now the question is okay what kind of
wavelengths we use yeah so we use
electromagnetic waves um you maybe know
that dependent on the wavelengths you
get kind of a bigger or higher
resolution as higher the frequency is
and as smaller the wavelength is and
then you can get actually more
information out of the environment the
propagation effects are also a function
of the wavelengths and there are even
more complicated part but this is I
guess like the good Basics you have to
understand so which of the frequencies
are well suited for us so um there's of
course a very right frequency range from
very low um like 3 KZ up to terahz
technology and even up to light uh
frequency space however we are using
actually frequencies in the in the area
between 300 MHz and 60 GHz yeah so we
have a wavelength of about 1 M to let's
say up to 1 cm yeah so now the major
question is so why why is this working
Yeah we actually know this kind of the
rule of thumb that um changes of
electromagnetic wave propagations are
somehow related to an object size um um
with the with the um size of the
wavelength yeah and even if we use 30
GHz we have a size of of 1 cm and then
maybe only 1 cm change we can achieve so
what is the idea here why is this
actually working so it's working because
we are manipulating the antennas in a
way that we extend the near field of the
antennas and in this case we can
actually go from the wavelength
dependency down to a thousandth of a
wavelength dependency and when we use
let's say just ISM bands yeah which are
the only ones we actually allowed to use
yeah due to the
regulation um we go you know we come for
example for 300 433 mahz from yeah 70 CM
down to 0.7 mm resolution and when we
use 5 GHz we can even go down to 6
micrometer
resolution and this is this is good yeah
so um what can we do now so we can
actually now achieve an algorithmic
temper proof yeah why because we
generate a key so the blue key here um
from the inside and this key can only be
recovered from the inside and when the
Integrity of this enclosure um has not
been violated yeah so if nobody um
changed something from this and then we
can actually achieve the goal of um
um um read proof um um Hardware because
the key is not stored digitally yeah the
key is the environment and the physics
if you change the in physics you destroy
the key and therefore you also uh have
the feature of
self-destruction and now you can use the
key to encrypt store data uh which are
Integrity protected in the device and in
this nice combination you achieve
physical algorithmic temper proof huh
and the um interesting features here are
actually um it's a little bit more
complicated but uh you don't have
digital Keys anymore stored in the
device yeah of course um we have to make
a difference if the device is offline
and goes into the online State then it
extracts a key of the environment and
when the system is online and does some
kind of self um verification there's
another different algorithm working so
we have to we have to be a little bit
more um have to apply a little bit more
complex um mechanisms here but at the
end of the day we don't have to store
digital Keys uh we have to take care of
course that when in the online case the
system get attacked that the key get
erased very fast from the RAM and then
we of course have to think about like
freezing attacks and stuff like this
however at the end we can actually
somehow achieve um the
goal um due to the mechanism themselves
we also don't need um a battery for um
deleting or uh erasing or zeroz circuit
yeah because the data the cryptographic
security parameters are all the time
encrypted on the device if the attacker
opens the device he can find encrypted
data encrypted with the key he already
destroyed because he changed the physics
of the environment and that's it yeah
and we can show last we show you a very
nice demonstration we just prepared for
the C3 yeah where we can actually rrit
um very uh standard Hardware in this
case a single board computer using uh
very uh cheap uh
enclosures so maybe
I high level overview for a system yeah
maybe you have a host system maybe the
the computer in an ATM yeah and you
connect to the to the secure boot or
maybe even to the TPM of this host
system um um our FC test beted which uh
um
consists um a
radio with at least two antennas yeah we
learned we estimate the channel between
sender and receiver and vice versa and
uh to extract a response like the puff
response and then an algorithm or a
mechanism to extract the key out of this
fingerprint and this is the thing we can
we need to add to the system of course
um sometimes we need to add also some
kind of sealing or enclosing material
around the system this can be aluminium
foil but this can also be some kind of
small meshes like copper meshes for
example uh which um fulfill better air
conditioning uh capabilities stuff like
this and then uh still um challenge is
how to actually securely
um um bring yeah Power and the data
communication inside the system passing
the the enclosure um
material yeah so like Christian said uh
now I'm uh going to uh show how we can
build a loost proof of concept and we uh
bought a demonstrator here um so yeah
we're leaving the theoretical part uh
mostly and um going to something more
practice um first of all we going uh
going to use a physical disorder like
mentioned before uh for generating uh
some enclosure and um what we also need
is Radio enabled commodity Hardware with
at least uh two transmitters but there
also can be more um and as mentioned
before we use uh aluminium foil we have
here and we use um this cool box uh it's
a lunch box where you
can uh put in noodles or
something so uh the first uh proof of
concept demonstrator is um using a
Raspberry Pi um so uh it has connected
uh two uh narrow band radios which are
uh sending in um 868 MHz with uh 2 MHz
bandwidth and as enclosure we use um a
smaller one of these boxes and aluminum
foil but the problem is that the
resolution is not so high so we build it
another one um so demonstrator we bought
here um therefore we use an APU single
board computer um which is uh serving
our protection module um it's equipped
with antennas or four so we have a 2X
two spal um system memo system um so it
brings us a 40 MHz bandwidth at 5.5 GHz
so there's more
resolution um we just using for the
enclosure this L lunch box
so yep switching the camera
please yeah so this is our Apu um here
are the uh antennas four of them and um
the cool stuff so we put the Apu inside
uh the Box placing the antenna somewhere
and um
yeah putting in some more enclosure
Randomness uh with this um aluminum foil
putting it just over the system and um
closing the box with this
uh so we uh switch to the
demonstrator
okay
H
okay uh so we need to change the screens
[Applause]
sorry
okay
sorry okay so let's start with the
demonstration
um yep so first of all we have a Al so
we have three GIS uh for different
demonstrations okay I don't get
it
why
h
okay come on yeah okay
okay this is of course very
handy
yeah okay
okay yeah let's uh try this so the first
uh gii is just uh showing um a 3D
modulation of um what the four spal
channels actually are measuring so
that's how it looks like uh yeah you can
even really fancy um move it uh so you
see um if we don't doing anything to the
system um it's relative constant and uh
it's really typical looking um yeah for
the whole time so but what if we open
the device um when we open the device we
see there's happening very much and if
this uh we put this away so many happens
it doesn't look like before again and if
you put it uh back
here um we still see uh it's not the
same like before so we um destroyed the
uh enclosure uh the way how it was
before so this is an very primitive
attack um well we can uh of course think
about an attacker which is more clever
um we bought uh bought this Angry Birds
with us it's are uh little needles with
an tiny Angry Bird on it yeah camera
switch
maybe yeah this one it's very evil um
yeah so this is um camera switch again
please uh this needle is or this bird is
very angry and wants to prob uh maybe
some um buses in our system and wants to
go into our system so we show what
happens
um or how it looks like when this
happens um
okay so we have another demonstration uh
demonstrator uh which is
um which is is uh showing um yeah some
or which is using some metrics so we can
not just uh monitor it with our so the
changes are persistent visible so
yeah
uh
okay so first of all we are generating
some um reference values you're seeing
now um this uh shown is the cleaning
distance maybe some of you know this
metric um and uh now we are just
comparing all measures which are coming
uh from now on with the first measures
so we see there's a little variance we
are measuring um but it's more or less
very
um reliable so but what if this uh Angry
needle comes okay uh
inside uh there are huge changes in the
system so and even if I pull this uh
Angry Bird um again off the systems are
persistent um it's very good
visible uh
yeah okay so then we have a third DUI um
which is also showing this in a um good
evaluation system so how we can generate
a key of this because this were just
some metrics where you can uh look at it
uh visually um and now we going to um
yeah generate a key um first of all we
generating a reference value uh then
valid values so you see the system
works um and then we perform
attack again and uh measure again so uh
the clue idea is now that we um can uh
generate from the ref
and the um and the valid measurement uh
the same key uh yeah that didn't worked
it's okay it's it's okay um yeah so we
see so we see uh when we um measure in
the beginning we get uh different uh or
we get a bit error rate from a velop
measurement by
22% and an attack bit error rate by
47% then we are uh doing some
information reconcillation uh where we
used not the optimal uh parameters so we
corrected the bit error rate to add uh
9% and uh after this the uh strings are
hashed uh into another value so
um when the information reconcillation
doesn't really work well so we don't get
a bit arrate by
0.0 um of course we go to a bit a rate
by nearly
0.5 uh yeah
0.5 um well we can optimize this more
and more over time so uh you see the
curves uh above where the white I think
is the um reference measurement we had
and the uh green one is the vet
measurement so they are SE very similar
and the red the red one is the
measurement after the attack so the
character characteris IC really changes
a lot and um with more parameter
optimization it is possible to generate
a key um
perfectly
y
yeah
okay
what we're innocent I
swear okay
again it
does okay so uh there are some pictures
uh if the
demonstrators wouldn't have worked so I
skipped them and uh we go to the key
extraction how this works and uh what
are the design requirements for
fingerprints uh we have three design
requirements for fingerprints uh first
of all the uh key quality the key
quality is very important because when
uh if we generate a fingerprint where
every values are just zeros or ones
there isn't really a Randomness and if
this isn't uh achieved um well it's not
so good because we want uh at least
120
uh it was uh going
[Music]
away it uh yeah uh 128 uh bits of
Randomness to be extracted um the second
point which is important is uh the Rel
Rel uh reliability so if we uh measure
and measure measure over a time we don't
want uh that the system generates
different keys so we all uh always want
to get the same key generated because
when we destroy our own key with a false
positive that's very bad um the last
point which is important is sensitivity
so um we want to detect uh even the
smallest uh to to detect even the
smallest attacks and if our system um
gives us a very good key the whole time
but doesn't detect any attacks that's
very
bad yeah so uh this is reliability
versus temper
sensitivity um reliability means um when
we measure again and again we get a very
uh low bit error rate and when an attack
is
um uh happened um we just get on very
high so this wouldn't get corrected by
information reconcillation
um what we actually doing is um we have
an reference measurement um we we have
uh valid measurements they get um
quantized
uh and after this we uh do information
reconcilation the goal is of course that
um after this information reconcilation
we have the same value in um our valid
measurement and our reference
measurement because after this uh step
the values are hashed and so even one uh
wrong bit would lead to an bit error
rate by 50%
or nearly
50% um so I skipped this for because uh
time I think uh so summary um we learned
three uh three things first of all uh
that physical access enables uh major
attack
vectors um therefore uh bus probing
which uh the evil bird should
demonstrate and of course some uh some
things like uh Cen attacks power
measurement and stuff the next thing is
uh that there are no system level temper
uh protection for commodity Hardware
existing at the moment on the market so
um especially no things which are
working without
battery and the last thing uh we did was
presenting a solution we call uh
enclosure puff um that is based on
standard Hardware so it's very very
cheap and
um
yeah uh we can deploy this on uh many
systems uh which uh so there aren't uh
new systems to be uh created we can
extend uh IC security and PCB security
and it fills the um ATP
criterias so thank you very
much
are there any
questions if you do have a question
please line up on on the microphones if
you have a question on the internet just
ask on the net it's fine uh I think we
have one online question
single uh there are two
question okay okay uh there are two
questions from the internet uh the first
one is uh what kind of encl are stable
enough over a long time and in changing
environments for this approach sorry
could you repeat that what kind of
enclosures are stable enough over a long
time and in changing environments for
this approach yeah this is a very good
question yeah it's uh so the reliability
is actually um super dependent on the
application yeah so this really depends
on the environment if it's a aluminium
case it's a case of steel made of steel
It's a combination um in which
environment is it installed do we need
to secure the system during
Transportation or just after it gets
installed so it it's really application
dependent uh the answer is extremely
application dependent yeah there's no
clear
answer uh second question uh how
difficult is to distinguish between
attack and just bumping on the case of
the device also good question this is
pretty probably the easiest way to
denial of service the system you can
just pump on it yeah and this is uh it's
again uh uh the same problem than for
hsms yeah you can drop an HSM and try to
use it afterwards yeah it's the most
cases not possible anymore so this is
again something where we have to
parameterize um this triangle I mean key
quality is nothing we can really change
this is given by the physics and the the
measurement system but sensitivity and
reliability is something we have to
agree on kind of a compromise and this
is also um dependent on the
application thanks microphone number one
your question um hi thanks for the talk
uh I have a question is it possible to
have some kind of back door planted into
this kind of
system I mean like some kind of hole so
you can just plug some uh we thought
about this for a moment because if you
have a false positive and you destroy
your critical security parameters of
course this
terrible um and what we thought about
was that we could um we we initialized
the system in a secure environment and
uh it might be possible you can code it
to have a function where you can extract
the legitimate key right of the start
and store it in a somewhere safe
location um so yeah you can back it up
if that's the question but uh having a
typical back door that enables us yeah
we can just mod uh apply some kind of
temper that will go undetected that's
not something we ever built yeah
sry the question is can you have excuse
one question yeah not a back door itself
but maybe some kind of weak point some
later um someone else can do this kind
of probe and extract your keys
afterwards so you that no not that we
are that we plant it to do so no I mean
we are I mean I mean we are also very
open to search for collaboration
specifically for for um Partners to try
to attack the system I mean as I said my
shy colleague johanes he's doing nothing
else than trying to attack the system um
and until now we didn't found any um
potential useful attack yeah but I mean
of course we could add back doors but
this is nothing we will do yeah all
right microphone number two your
question hi Christian uh nice work uh uh
just few questions um how do you
calculate the secrecy capacity for the
entropy and what do you use for
quantization information reconciliation
and privacy
application so all our secrets from the
company are us so mutual information is
estimated by Kus neighbor Mutual
information estimator and then we um um
then we substract just the U Mutual
information by a potential attack from
the mutual information between uh so X
is the reference and Y is a legitimate
uh case why Z is attack yeah and this is
how we calculate the
capacity um and as I said we use a Kus
neighbor entropy estimator which is
also um so if you so all your questions
yeah are answered in my dissertation uh
for quantization we use the equal
distributed quantization scheme and for
uh information reconciliation we use a
fuzzy extractor based on classical error
correction codes yeah with a good
parameterization which doesn't work in
the demo
but yeah question thank you
yeah can you do the converse like I have
ordered thousand chips from a factory
can I show that they are actually equal
and not contain any
hidden bug so this is a question where
we really like uh people who are
sponsoring or work by sending us 1,000
chips and then we can figure this
out what we did do however is uh we
evaluated 100 different environments um
that were all equally constructed we can
talk about this in more detail later on
but we did evaluate 100 different
environments that were only slightly
different um and no two fingerprints
were even
similar yeah okay signal Angel any more
questions from the net two other
questions from the internet uh the first
one uh the method requires a precise
clock for frequency stability is there
any mitigation to compensate for high
gravity
applications I have really I didn't
really understand it sorry can you can
you repeat it uh yeah the method
requires a precise clock for frequency
stability is there any mitigation to
compensate for high quality applications
yeah so um yeah I mean this is one of
the of the biggest problems
we we need to solve um we can talk about
this topic uh offline yeah so if you
want to know how to maybe correct phase
information or stuff like this uh you
can write an email we just we we we have
this email address uh 3 35 C3 at fcda
and then we can maybe talk about this
this
offline microphone number
two hi thanks for the great work um
actually what you presented here uh was
only detection of uh problems at boot
not in the run time so actually I can
boot the system open it and prob it uh
for the for the key so what please State
your question so what uh do you have
any any counter
attacks yes yeah I mean this is a good
comment and this is something I um I
mean I said at one slide maybe you
remember that there are two protocols
one protocol when you we coming from the
offline to the online case and then one
protocol which um evaluates the
environment during
runtime um which is not part of this
presentation um I think to answer this
question properly uh it makes also sense
to talk about this maybe offline if it's
okay yeah microphone number one your
question so in your um pin demo what
have you done to make sure that the
tamper trigger is actually based on the
presence of the hole or the pin or probe
or so on rather than deformation of the
entire case um we can't actually so when
you do some to torsion of the case you
will destroy the key so depending on the
application we need maybe
mechanically um decoupled systems yeah
where maybe influencers from the outside
are not changing uh the the enclosure
inside so I would say very I was asking
the opposite I mean are you sure that
you've actually measured um the presence
of a hole rather than deformation of the
case in your tests um so in this demo
I'm not sure yeah but in our lab
environment I'm pretty sure because we
we fixed everything and there was just a
motor which is doing the whole
everything is is fixed great thanks but
yeah Angel question from the internet uh
how can I trust the system that during
production uh the physical key was not
extra EXT extracted by the manufacturer
as it is not changeable by the owner of
the system yeah this is a very good
question um and it's not a question we
can actually answer with this technology
in general I mean we can think about
Solutions uh trustworthiness by the by
the manufacturers but we could also
think about something like um the
initialization of the system is not done
in the manufacturing process but
afterwards or maybe
partly somehow but this is um I would
say this is a uh a general problem um
for for for um manufacturing there's one
solution we thought about and that is
that the system comes delivered in an
uninitialized stage and then you as the
end user um yeah you you did it you put
something in that wasn't in there before
and there are several several things you
could think about like metal meshes that
you as a user as a final user just
insert and pick yourself so this is
something the manufacturer cannot uh
cannot
guess thanks microphone number two uh
how does this system compare to the one
uh published by phov Isaac last year
which from my point of view
um or as I understood it um just
measures the Integrity of a foil that is
wrapped around instead of the uh whole
like physical sizes that that seems more
reliable to me how does your system
compare with that so maybe you saw the
reference in our slides so Vincent imla
and his group was in our reference so um
as we said um the difference is the PCB
level and the system level so when you
wrap a foil around an entire system and
this I mean the Prototype system was
like this big yeah um you will have huge
problems yeah I mean when you think
about an ATM uh to put uh uh foil around
it it will be very complicated so I
think this is the biggest uh differences
between uh like PCB or chip level
security and system level security what
we do yeah but it's still
comparable so you mean it's difficult to
fall through uh around the large
system yes exactly yeah and then heat
problems and and stuff like this okay
yeah microphone number two again I think
you were first hi yeah thank you um for
me it seems like this is really really
uh even more than usual pass temperature
sensitive how much have you looked into
that with respect to temperature yeah I
I would think would change a lot so if
you're wrapping a whole ATM that does
get warm someone bumps against it it
seems like you're going to have your
data removed like every single day yeah
so johanes is like last thing because
this is kind of his uh current um so
yeah I mean temperature stability must
be given somehow we can extract
fingerprints for different temperatures
we have a um we have a resolution of
about 1 Dee so when we change the
temperature of 1 Dee we we kind of have
to reinitialize the system we have to
take care that this is given we can do
this in the initialization phase but
this is some something important and we
did a lot of measurements with cooling
Chambers to to do exactly this yeah and
the relity stays the same I mean when
you re reinitialize the system for the
different temperatures you achieve the
reliability yeah okay thank you by the
way you're missing a site on page
21 sorry thank you very much
for all right um we out of time for this
talk um are you guys still around for
further
questions late in the building I mean
yeah okay cool um if
you well first of all thank you
[Applause]
[Music]