Slashdot Mirror
Stealthy Dopant-Level Hardware Trojans
DoctorBit writes "A team of researchers funded in part by the NSF has just published a paper in which they demonstrate a way to introduce hardware Trojans into a chip by altering only the dopant masks of a few of the chip's transistors. From the paper: 'Instead of adding additional circuitry to the target design, we insert our hardware Trojans by changing the dopant polarity of existing transistors. Since the modified circuit appears legitimate on all wiring layers (including all metal and polysilicon), our family of Trojans is resistant to most detection techniques, including fine-grain optical inspection and checking against "golden chips."' In a test of their technique against Intel's Ivy Bridge Random Number Generator (RNG) the researchers found that by setting selected flip-flop outputs to zero or one, 'Our Trojan is capable of reducing the security of the produced random number from 128 bits to n bits, where n can be chosen.' They conclude that 'Since the Trojan RNG has an entropy of n bits and [the original circuitry] uses a very good digital post-processing, namely AES, the Trojan easily passes the NIST random number test suite if n is chosen sufficiently high by the attacker. We tested the Trojan for n = 32 with the NIST random number test suite and it passed for all tests. The higher the value n that the attacker chooses, the harder it will be for an evaluator to detect that the random numbers have been compromised.'"
So all the NSA needs to do is kidnap your chip, microscopically re-dope it, and shove it back in your computer without you noticing!
Phew... I'm glad there are absolutely no other simpler ways for the NSA to spy on us other than re-doping chips! I'll just superglue mine into the socket so I know I'm safe.
AntiFA: An abbreviation for Anti First Amendment.
Can an entire three-letter-agency get a corporate hard-on? 'Cause if they can, this gave our favorite one the biggest boner in the known universe.
Is it just my observation, or are there way too many stupid people in the world?
I would guess that an intelligence agency figured this out a few years ago. One that can plant moles at Intel. That's why they also want to remove rdrand from Linux.
http://linux.slashdot.org/story/13/09/10/1311247/linus-responds-to-rdrand-petition-with-scorn
Several different methods of entropy should be employed? Heck what about random generator devices?
Then you'd better count up your sins!
If you modify a chip, you can make it behave differently?
What's the news here please?
Yes. A device that contains something concealed and malevolent? That's a hardware trojan right there.
You brought it inside the walls on the advertisement that it was a big wooden horse, but it has the enemy inside. Yep.
What else would you call physical access to your dopant masks? /sarcasm
Repeat after me: physical access to <insert item here> allows for a much greater security risk.
There are easy numeric methods for determining how random data is. Optical inspection would be unnecessary to discover this modification. You might even get away with generating a few megabytes of data, zipping it, and then comparing the resulting compression ratio to a known good chip.
refactor the law, its bloated, confusing and unmaintainable.
This should still be detectable. It just requires more time. One could also reduce the time by looking at the combined output of an entire batch of chips. If they all have the same mask, they will all produce the same reduced set of random numbers. So one additional meta-test of data from a lot could show they have been compromised.
I wonder if they also considered that the NIST random number test suite might also be compromised by the NSA...
"When information is power, privacy is freedom" - Jah-Wren Ryel
Well yeah it's worth being aware of the possibility. But frankly there are very much bigger risks to worry about first
Since the Ivy-bridge random number generator is supposedly "unauditable" how are these researchers able to prove anything about re-doping a black box design? Shouldn't they just look at it and spot the massive array of transistors that spells out "NSA BACKDOOR UNIT" instead of having to worry about all this subterfuge?
AntiFA: An abbreviation for Anti First Amendment.
It's the Chinese Government. Obviously this has been happening for some time...
If I were a disgruntled member of the intelligence industrial complex and knew that this was actually being done by a government agency, and I did not relish the thought of a Russian sabbatical, couldn't I surface the news by telling researcher friends of mine how to do it?
I wonder if it's possible for an attacker to mess with microcode in such a way as to trojan things like random number generation, without having any other effects that would be more easily noticed. It doesn't seem likely.
Of course, true RNG depends on things like timing keystrokes, mouse clicks, network packets, etc. The LSBs of such times probably aren't used for anything else, and could thus be tampered with more easily.
It's pretty hard to get reliable crypto when your adversaries are the SIGINT arms of some of the most powerful nations in history; they're not constrained by law, ethics, or budget; and the one in your own nation can coerce cooperation and silence. Bad deal, all around.
Edward Snowden should be canonized.
Linux uses the Ivy Bridge random number generator in the kernel, along with other sources of randomness.
That makes it OK, because as everyone knows, mixing the other sources with a predictable string makes the output even more random!
Didn't Linus completely settle this issue?
These parts would not pass the standard verification process and would be rejected from being assembled into devices.
Standard testing of ICs for functional faults includes a scan process. Per the design specification that the part was supposed to buildt a number of scan vectors are passed through the devices. These scan vectors check as much of the device as possible. The goal is to check every flop and every logic path between flops. The tests are to detect manufacturing errors. And can find single faults in devices.
Typical errors are stuck at 1 or stuck at 0, also shorts and would easily expose modifications of this sort, especially of such a scale as to radically change things.
I doubt that an altered chip would pass BIST testing.
much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
Digital ICs are treated production with scan tests guaranteed to cover around 95 to 99% of possible faults.
OT, I know... but...
I always wondered why people use condoms named after them...?
Given Hanlon's razor, an accidental, rather than malicious, error in doping would be even more likely. If the chip were inadvertently doped incorrectly, it would pass visual inspections and even software tests without awareness of the defect. How many defective dice, not merely with RNGs but also with other circuits, are already in service due to inspection failures?
Although this paper shows how insidious a threat from a well-funded adversary might be, even more it shows the need for more comprehensive inspection mechanisms to discover misdoping which might go undetected by existing standard procedures.
BTW, the paper includes a well written and readable introduction to the context of the problem. Good job.
Are tinfoil hats on special this week? It's not very likely to happen to anybody who isn't a very big target because to make such a modification have to completely understand your chip design, know how you're going to use it and judge that compromising YOUR chip design is sufficiently valuable to reap rewards.
If you consider very widely used device, there's greater likelihood of being compromised, and it would more likely be done with the cooperation of the chip designers than otherwise, in which case it is probably visible in the regular metal masks, etc. because the only people who have access to the design are complicit. When is the last time you took equipment you bought apart decapped the chips, imaged them with high resolution 3D x-rays or lapped them down layer by layer to examine whether it they had hidden features? Hell, most users never see their BOARDS.
Comment removed based on user account deletion
Then we can buy them from fabs that we trust, and they will have to more explicitly compete on the issue of trust.
There is also some possibility that buyers could inspect the manufacturing processes.
Anomalies in other computational functions are less of a concern, IMHO, because any environment with a mix of CPUs and chipsets should reveal tainted chips at least occassionally. Random number generation is an exception here.
The NIST 800-22 test has bit length parameters. The article doesn't indicate if it passed the 128 bit NIST test after they reduced the entropy to 32 bits, only that it passed *some* NIST test. From another poster it seems the standard NIST parameters used for the NIST test may not be sufficient to test that the prng exhibits the level of entropy that people are relying on it to exhibit. The lavarnd folks pass a billion bit NIST test, so it is possible to run longer versions of the test. If the reduced entropy source is still passing a higher entropy test, we have a problem with our testing method.
Your other (very valid) point is that just because data is random, doesn't mean you are secure. The data stream has to be both random and unknown to your attacker, which PI would not be. In this case they do not have a way to set the seed, or all inputs to the prng, only to limit the prng's bit length, so the attacker will not know the random sequence or even its statistics. It simply makes a brute force attack much less time consuming.
It still concerns me that a 32 bit prng might have passed a 128 bit 800-22 test. Does anyone know more about that aspect of it?
refactor the law, its bloated, confusing and unmaintainable.
Sure, it's obscure, except all our chips are being made in a country that is actively in an electroni
THE PEOPLE'S GLORIOUS REPUBLIC DENIES THESE CLAIMS.
---
ECHELON is a government program to find words like bomb, jihad, plutonium, assassinate, and anarchy.
I've considered this as well (I will be using the NIST random number test suite in the near future). However, what can they accomplish with this? I see two approaches they could have taken: 1. Flag a non-random generator as "random". However, just because I use the NIST test suite does not mean that I don't use any other test suites, that would presumably catch this. This seems high-risk from the NSA's point of view - just one publicly available test that proves NIST is gamed shows their hand. 2. Flag something that is random as "non-random". This gets truly random generators disqualified. However, if my TRNG was disqualified, I would look into why, and that would likely reveal the NSA's hand as well. Are there scenarios that I am missing?
Sometimes I doubt your committment to SparkleMotion!
Who had the bright idea to protect this with CRC 32 - for those who didn't RFA the BIST (built-in self test) verifies the output by checking a CRC 32 result for a predefined input. This allows them a feasible attack of 2^31 in order to find appropriate constants to set. Considering they've got the AES hardware right there - they should have used AES and compared to 256 bits of output. Attacking hardware should not be this easy.
This can only be used for attacks on things that can be compromised in a way such that they do not need to perform their original function perfectly anymore. A CPRNG is an ideal target, as it does not need to produce good _and_ bad number after the attack, it is sufficient if it produced bad numbers that look good. The AES whitener in the CPRNGs this was demonstrated on make this very easy and while it looks convenient, it may have been inserted in there exactly to make compromised versions of this CPRNG hard to detect. On the other hand, if you attacked, say, a hash function or a block cipher in this way, it would start producing wrong outputs, potentially for a large number of cases and not only would it fail at its original function, this would also be pretty obvious.
Still, this is a significant attack and underlines why a single source of entropy should never be fully trusted and that CPRNGs should always be open software and use multiple entropy sources that get mixed.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Sabotage would be to make something stop working. The mentioned chips will work just fine, but their RNGs will be predictable. Only the ones who caused it know and will take advantage of it. Looks like a trojan to me.
Yes you are missing a big piece. Given suitably secure block cipher, its output shouldn't be able to be distinguished from random data. In fact the Intel RDRAND instruction uses AES to distill the entropy sources. An AES encrypted block stream encrypting a simple counter would pass most random number test suites.
Yes, I know this. However, this would not require them to compromise the NIST Random number test suite - No reasonalbe test suite would be able to detect this sort of scenario anyway.
So, back to the original question: Is the NIST Random number test suite compromised? What could they gain by doing this?
Sometimes I doubt your committment to SparkleMotion!
Sabotage would be to make something stop working. The mentioned chips will work just fine, but their RNGs will be predictable. Only the ones who caused it know and will take advantage of it. Looks like a trojan to me.
If the RNGs aren't producing numbers as "random" as claimed, then it's not working. It's sabotage.
A trojan horse requires stuffing something malevolent into something you want so you're enticed to bring it in the gates.
If the RNGs aren't producing numbers as "random" as claimed, then it's not working. It's sabotage.
No, it's not. Saboteurs break machines and bring them to a halt. Check the etymology.
Intel's fabs aren't mostly in China. Indeed, most semiconductor fabrication happens in Taiwan (distinctly not the People's Republic) or the US. Wikipedia has a list. It's easy to think that everything is made in China, but to be honest, a lot of companies with expensive IP (read: semiconductor firms) avoid the country because of rampant knock-offs and corporate espionage.
If the RNGs aren't producing numbers as "random" as claimed, then it's not working. It's sabotage.
No, it's not. Saboteurs break machines and bring them to a halt. Check the etymology.
Actually, you should check the etymology. There's no evidence for the old story about people throwing their shoes into the machines.
Even if it was, there's no requirement for there to be a stoppage of production, there's just the requirement of the actors maliciously disrupting the process.
An RNG that doesn't output "random" numbers to spec is BROKEN. Anyone intentionally causing that is engaging in SABOTAGE.
This is most stupid semantics argument ive ever read.
I come from a hardware verification background, but I'm not a Design For Test (DFT) expert.
That said, I would have thought this would get caught by the test patterns that exercise the scan chains built into the device. If a given flop is fixed to a certain value (a "stuck-at" fault), then I would imagine that shows up as a fabrication failure.
As far as I know, every device gets checked before and after they are cut from the silicon wafer, so this seems like a technically very interesting attack, but one that ought to get caught by the fabrication process.
I haven't read TFA, so maybe this is covered in there?
Well, there goes the mod I plopped in, but...
1) Intel's high-end chip fabs are in Oregon, Arizona, California... not exactly close to Beijing. (They're still building some rather massive additions to their Ronler Acres fab up here in Oregon).
2) ARM chips, on the other hand (e.g. tablets and smartphone bits)? In that case I hereby petition Slashdot to introduce the "scary as fuck" mod.
Quo usque tandem abutere, Nimbus, patientia nostra?
If the RNGs aren't producing numbers as "random" as claimed, then it's not working.
Unless you have access to the AES key in the RNG chip, the numbers are effectively random. Even if an attacker knows that the numbers only jump around in for example a 32-bit subspace of the N-bit key space, they don't know which subspace, unless they break AES. On the other hand, if you do have the key, as you probably would if you are the one who tampered with the chip, then you're in a whole new position.
I guess that's the "nice" thing about the attack -- only the one who planted it can exploit it. Useful if you for instance want to spy on your countrymen, without at the same time exposing them to a foreign adversary.
Without the ability to verify anything, all trust is destroyed.. Only the mystics will prevail
“He’s not deformed, he’s just drunk!”
doomed?
I don't believe the authors attacked the Ivy Bridge RNG in the way described. They described a way, they didn't do it.
Why?
1) They show a plot of a DFFR_X1. This is a normal D type flip flop you would find in synopsis libraries and many other libraries you would use in an SoC process. These are not the flops used in the Ivy Bridge DRNG. Also the plot was from a layout program, not a micrograph.
2) The proposed attack required an average of 2.1 billion attacks (fixing k and v until you hit the right CRC). I don't think we sold 2 billion Ivy Bridges to these guys. The alternative they propose is to try it in simulation first. Running 2 billion simulations of full BIST would take a while and they don't have the code. If they had the RTL code they would be proposing other attacks.
3) They don't identify the site of the attack on the chip. They don't know where the site is.
4) They don't show RdRand output of a compromised chip. This would be trivial.
The main message of the article is sound. There are physical attacks that are hard to see optically. But the attack they describe against Ivy Bridge is hypothetical, based on the information in the CRI audit paper here: http://www.cryptography.com/public/pdf/Intel_TRNG_Report_20120312.pdf
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Trojan dopes YOU!!!
This sig is not paradoxical or ironic.
Some physical processes are random, and hardware random number generators based on them can be constructed. Does this report create a larger market opportunity for manufacturers of this type of device? And, competing such devices can be compared, assayed, validated, and combined, all apart from and much more cheaply than CPUs.
No, it's not. Saboteurs break machines and bring them to a halt. Check the etymology.
How about using the modern definition instead? Sabotage: "the act of destroying or damaging something deliberately so that it does not work correctly"
I mean, the NSA sabotaged an encryption standard, so it seems like this would be similarly sabotaging a batch of CPUs.
Sounds to me like they're sabotaging the security by breaking the underlying mechanism (with a trojan).
Similar to if you were to cut sensors for somebody's alarm without tripping any sensors or backups, etc.
to create a verifiable fast RNG. There may be other parts of the kernel that can be optimized with some HW acceleration.
nosig today
If that cool horse the Greeks gave you destroys your town instead of just sitting there looking pretty then it's not working, it's sabotage. Definitely not a Trojan horse.
Rampant carbon sequestration destroyed the Dinosaurs' tropical paradise. I'm here to help repair the damage.
This might be the death-knell of PRNGs (note: PseudoRNGs only) for serious uses and the rise of real entropy sources. That would probably be for the better if it happens. More likely nothing does.
Because what exactly are "we" going to do if you use it on all chips? If you do it by design? If you "automate" it to use different subspaces through whatever index you choose? Will "we" buy more new device than otherwise? And those would not be similarly weakened because...? Governments decide which chips are legal (FCC compliance if nothing else in the US), they choose what we can choose.
99.99% wouldn't even do anything because 99.99% are not doing anything right now against other known issues. Maybe that will change, maybe it won't. As long as it remains the case the benefits are enormous.
There's an additional bonus: you can weaken it only so much so that only a very powerful "adversary" (yourself) can take advantage even if the flaw becomes known. Or only so much that only the most powerful "adversary" (yourself) will be able to break the results using X time with future Y capability. This means it can be even more subtle and thus even harder to discover/prove.
In fixed units supercomputers improve faster than other computers, thus this "subtlety gap" becomes harder to detect at increasing relative speed. I'll repeat myself: this might be the death-knell of PRNGs (note: PseudoRNGs only) and the rise of real entropy sources (that would be good).
I.e. this or anything which amounts to the same can be tailored quite nicely to subvert a vast amount of "computers" into low-hanging fruit, and scale is the name of the game with the approaches the NSA is now known to utilize.
What can they do against a C64 user?
Can using older tech mitigate these attacks?
But we are not talking about history here but about computer engineering and in our world a trojan is not something meant to destroy anything but a means of easing access to a system so that a malevolent user can take control of it without the knowledge of the legitimate user. The etymology is irrelevant and only anecdotal in this case.
The mentioned artefact is called "hardware trojan" by analogy to a software trojan an not because it has anything to do with wooden horses or warriors of the bronze age.
-- 29A the number of the Beast
If you know where + or - doped regions *should* be on the substrate, you can build test diodes by pointing two needles on the substrate. One of the needles has a tip made of a semiconductor doped the opposite way as expected from the substrate. The other needle has no special properties (besides having a really small tip like the other).
The doped needle and the substrate would form a diode only if the substrate is doped the right way. A test current would therefore be able to pass only one way. If it passes both ways, the tested region is not properly doped.
For added security, also check for expected resistance of the ad-hoc diode.
This test could be automated using a 3-axis CNC router of the needed positioning accuracy (something, chip designers most likely could afford).
Most chips are designed in a way, that its doped areas are aligned in a very non-random pattern (like the examples in the paper). Therefore it may be even possible to test a lot of chips you have not the source code for...