Re: Smart Card - amendment

Hi all,

For some reason the acronyms RSA and ECC have come out as RA and CC,
I don't know where this filtering is occuring, but just for people
wondering what RA and CC were thats what they mean.

If anyone has any idea where or how this happened could you get back
to me.



Regards


Arash Partow

__________________________________________________
Be one who knows what they don't know,
Instead of being one who knows not what they don't know,
Thinking they know everything about all things.
http://www.partow.net




Arash Partow wrote:

> Hi,
> 
> I'd like to place my 2c worth of opinion into this discussion. What I
> have to say is more about the inner working of smart-cards and smart
> card readers and a little know type of attacked called power cryptography.
> 
> A few years ago I did a small internal research at the place I was
> working, on certain exploits that could be carried out on smart cards
> and smart card readers.
> 
> Now what Peter said about compromised hosts is very true, in fact
> there is currently no way of getting around the problem, even the pin
> number entry scheme fails in due course due to the prevailing need for
> the smart card user wanting to have themselves authenticated on that
> particular system.
> 
> 
> My fiddling with smart cards centered around a simple gemplus smart
> card reader and standard ISO-7816 c-type smart cards. I wanted to
> investigate the possibilities that were raised by cryptographers in
> the community at the time for differential power analysis techniques
> and whether or not one could ascertain bits of the private key stored
> in the smart card.
> 
> Smart cards have a closed interface meaning you can only access
> information on its  "disk" via the API that the smart card provides.
> This means you can't just go and pull its disk out and try to read it,
> you have to abide by the smart card's rules and talk to it via its OS
> 
> (btw if you did try to pull the disk out which is a very tiny thing
> that can barely be seen by a microscope you would loose all the data
> on the disk before you even had a chance to send a few electrons of
> current through it.)
> 
> 
> 
> 
> Solving the problem requires the knowledge of the following things:
> 
> 1.) The energy consumption and time taken for the smart card to do the 
> basic
>     mathematical and bitwise operations (+,-,*,/(modulo),|^&,squirt etc...)
> 
> 2.) The algorithms used in the smart card (modulo-ex (RA), CC etc..)
> 
> 3.) also if the implementations had any special optimizations that diverged
>     from mainstream implementations yet yielded similar results (a 
> possibility
>     is adding chains)
> 
> 
> 1.) to accomplish this step you need a CRO that can sample at about 4
> times the operational rate of smart card (shannon says twice the freq), I
> found 4 times to be a better proportion, its true you get a lot of
> redundancy however they can easily be eliminated through a series of
> freq and surge filters.
> 
> I found that i not only had to measure energy consumption of the
> individual operations but also the operation in group sequences of 2
> and 3 operations, meaning all combinations of the above on both integer
> and floating point entities.
> 
> from this step I began to assemble a table of signatures for
> operations which later during real analysis of the smart card going
> through its paces I could predict with a guesstimate much better than
> 50/50 from the energy consumption graph what the smart card was
> actually doing at that particular point in time.
> 
> 2.) this one is a pretty simple one, some smart cards come with their
> crypto algorithms pre encoded or pre-built into their circuitry, in
> any case the algorithm was known, but the exact implementation was not
> known. I never figured out how to blindly (aka black box method)
> figure out what the exact implementation was, however my research
> allowed for me to program my own smart card or use smart cards with
> known programming which made it a bit easier.
> 
> knowing what the programming of the algorithm is allows you to build a
> flow chart of how the smart card will work when given a particular set
> of bits(i.e.: private key), the execution pipeline in an smart card is
> very small and simple and does not contain parallel execution units
> like microprocessors, this type of architecture allows for a great
> deal of DPC to be done.
> 
> 
> i.e.: as an example lets say if the LSB was 1 (btw highly unlikely for
> composite numbers with factors which are only prime) then the first
> operation the smart card would do is an addition(+) or if it was 0 the
> first operation it would do would be a subtraction (-), if you measure
> the energy consumption for the first clock cycle of operation and did
> a best curve fit with the curves calculated in phase 1 you can
> ascertain the state of the LSB, continue the analysis and you can
> discover bit2, bit3 etc, a caveat to this is that it gets slightly more
> difficult and complicated as the algorithm proceeds, but you gotta remember
> your objective is not to discover all the bits just some of them...
> 
> 
> 
> 3.) smart cards are really weak processors of data, they can barely do
> 512kbit RA and seem to only work in a reasonable amount of time with
> CC algorithms. I think thats why many smart card implementations tend
> to use CC with smaller key sizes rather than RA with large key sizes
> one of the problems is exponentiation of very large numbers, even with
> the optimizations of adding chains for modulo exponentiation its still
> a very slow intense process for smart cards to undertake. Nevertheless
> there are optimizations, so you have to know about them, some of them
> are programming based, others are indented for the particular smart
> card processor type, I wont go into details of what optimizations I
> had to take into account to accomplish phase 2, but needless to say
> they were not that difficult to find, if you can find data sheets on
> smart card's or talk to marketing people from the smart card
> manufactures for info on their products.
> 
> 
> 
> These 3 phases allowed me to detect the first 64 bits of the 96-bit
> private key stored on the smart card I mentioned above (algo was CC
> key exchange and authentication). This is by no means an easy task it
> takes a lot of time, and automation of the phases is very difficult,
> because of back ground noise, in-consistent energy sources and a whole
> array of other ambiguities that are outside the scope of this general
> discussion. The lab conditions were near perfect, the real world is
> not so accommodating, hence for phase 1 I had to do the calculations
> 1000s for each group continually changing EM fields around the unit,
> tweaking the surge filters etc, until i could statistically say that
> the error percentage was low enough for the whole process to produce
> acceptable results. Despite all these problems its less-than-brute
> force, heaps less! and can be done within hours rather than weeks
> months or years...
> 
> 
> This type of attack in my opinion should be used in conjunction with
> other factoring and DLP algorithms not by itself, in the instance of
> factoring because you start discovering the bits from the LSB upwards,
> this allows you to construct the private key from one end,hence
> further allowing you to guide your sieving algorithms in a much more
> efficient manner.
> 
> 
> Nowadays some manufactures place "random" operations which really do
> nothing other than consume energy and processor time during the
> execution of the algorithms to obfuscate the overall energy
> consumption of the smart card. Some of these salt like implementations
> are really good using dedicated RNG hardware found on the smart card
> to decided where, when and what kind of operation to execute
> randomly, where as others just use a simple PNG and seed them with the
> smart card's processor tick or something easily accessible via the
> smart card's interface.
> 
> 
> In the lab the setup looks pretty sus, a big HP CRO next to a tiny
> smart card-reader, but as the golden rule in cryptography goes "never
> underestimate the assets and resolve your opponent may possess to
> overcome your security measures". I'm sure someone or some
> organization with enough money and time could produce a specialized
> sampler that is very small in comparison to the one I was using, build
> specialized filters for the noises that are around, have it compensate
> for differing energy levels from the power source and also have it
> WiFi enabled sending its data back to some receiver where the data is
> analyzed, and the key is computed and then copied onto a blank smart
> card etc etc...
> 
> 
> Anywayz thats been my experience with smart cards and cryptography
> analysis with them. Thanks for taking the time to read this,I would
> like to end this with a quote from my favorite villain Mr Burns:
> "I enjoyed writing this as much as you enjoyed reading it" :D
> 
> 
> 
> Regards
> 
> 
> 
> 
> Arash Partow
> 
> __________________________________________________
> Be one who knows what they don't know,
> Instead of being one who knows not what they don't know,
> Thinking they know everything about all things.
> http://www.partow.net
> 
> 
> 
> 
> 
>