Recent advances in the size and performance of FPGAs, coupled with advantages in time-to-market, field-reconfigurability and lower up-front costs, make FPGAs ideally suited to a wide range of commercial and defense applications . In addition, FPGAs’ generality and reconfigurability provide important protections against the introduction of Trojan horses during semiconductor manufacturing process. As a result, FPGA applications increasingly involve highly-sensitive intellectual property and trade-secrets, as well as cryptographic keys and algorithms.
To be secure, tamper resistant cryptographic devices must be protected against DPA and related attacks. Independent testing processes are essential for validating the presence and effectiveness of these countermeasures. Testing methodologies for power analysis vulnerabilities can yield varying degrees of assurance as to the security of the device under test. While insecurity can be demonstrated conclusively, evidence of security is more open-ended. Confidence in a security evaluation depends on many factors including the comprehensiveness of the evaluation, the skill of the evaluator, the nature of the device’s design, and the difficulty of exploiting any identified vulnerabilities. This paper reviews testing strategies for power analysis and related attacks, including black box and clear box methods. The paper also examines how appropriate design architectures and evaluation approaches can be combined to yield the strongest evidence of a device’s security.
Despite the high public profile of piracy as a threat to intellectual property owners, surprisingly little useful research has been done to understand the range of technical solutions that are feasible. This paper presents results from a study sponsored by Cryptography Research, Inc. to determine how cryptographic systems can provide the most effective long-term deterrent to the piracy of digital video and other content distributed on optical media.
Although numerous products and technologies have been advertised as solutions to the problem of piracy, most commercial security systems fail catastrophically once an implementation is compromised. These designs can work in limited deployments, but any technology deployed as part of a major standard will inevitably attract extremely determined attacks – and some implementations will get broken. The long lifespan of media formats, diversity of player implementations, complexity of security/usage models, and constantly-changing risk scenarios provide attackers with numerous avenues of attack and the time and resources to explore them. As a result, effective content protection systems must be able to survive compromises and adapt to new threats.
Abstract: Cryptosystem designers frequently assume that secrets will be manipulated in closed, reliable computing environments. Unfortunately, actual computers and microchips leak information about the operations they process. This paper examines specfic methods for analyzing power consumption measurements to and secret keys from tamper resistant devices. We also discuss approaches for building cryptosystems that can operate securely in existing hardware that leaks information.
As part of Cryptography Research’s ongoing cryptosystem research activities, we have been analyzing how to improve security of portable cryptographic tokens, including smart cards. Over the past year and a half, we have been working with the smart card vendor community to address attacks we have developed including Simple Power Analysis, Differential Power Analysis, High-Order Differential Power Analysis, and other related techniques. These are technically sophisticated and extremely powerful analysis tools that can be used by a cryptanalyst to extract secret keys from cryptographic devices.