Side Channels and Physical Security

1. Side Channels and Physical Security

2. Prosecutor’s Fallacy • Joe’s fingerprints found at the site of a crime • Prosecutor claims fingerprint test is 99.99% accurate • 0.01% false positive and 0.01% false negative rates • Was Joe guilty?

3. Bayesian Inference

4. Joe was innocent! • E.g., Joe was selected from 1M fingerprint database subjects

5. Outline • Side channels • Audio, RF, ... • Secure deletion • Steganography

6. Reading • Security Engineering, Ch. 15 • http://www.cl.cam.ac.uk/~rja14/Papers/SE-15.pdf • Soft TEMPEST research at Cambridge • http://www.cl.cam.ac.uk/~mgk25/ • Secure deletion • http://www.cs.auckland.ac.nz/~pgut001/

7. What are side channels? ===============/======================================================== Advisory ID: CAU-2007-0001 Release Date: 04/01/2007 Title: Window Transparency Information Disclosure Application/OS: Windows made from silica or plastics Topic: Panes used in windows are usually transparent, allowing sensitive information to be observed from the outside. Vendor Status: Not Notified Attributes: Remote, Information Disclosure Advisory URL: http://www.caughq.org/advisories/CAU-2007-0001.txt Author/Email: I)ruid <druid (at) caughq.org> ===============/========================================================

8. Side channels • Information disclosure through physical properties of the implementation • Side channel examples? • Timing • Power • RF emanations • Acoustic leaks • Get around a perfect policy and a bug-free implementation

9. Timing Attacks • Execution time of operations varies depending on data • Some code may not be executed • Some instructions may take longer • Attacker can measure timing, recover secret information

10. Example: Password checker get user_pass look up real_pass for i=1 to 8 if user_pass[i] != real_pass[i] break “secret” a b c s sa aaaaaaaaaaaaaaaa aaaaaaaaaaaaaaaa

11. Example: RSA • Decrypt: compute Cd (mod n) decrypt(C,d,n) M := C; for i = 0 to log2 d if bit i of d = 1 M := M * C mod n M := M*M mod n

12. Keystroke timings User types p a s s w o r d SSH sends p a s s w o r d

13. Keyboard acoustics User types p a s s w o r d Microphone

14. Acoustic noise

15. RF noise • Computers emit RF noise, too • Lots of it! • With high-gain antenna, can monitor activity from a distance • TEMPEST project • Study RF emanations • Certification for equipment shielding • Red black

16. Open TEMPEST Research

17. Demonstration

18. Hidden Messages

19. Hidden messages

20. Power Analysis • Computers & electronics leak information through power • Different instructions take different power • Power analysis is especially useful for smart cards • E.g. satellite decoder cards contain secret keys that users should not be able to steal • Card under user’s precise control

21. Simple Power Analysis

22. Differential power analysis • Make hypothesis of internal state • Look for power traces correlated with hypothesis state

23. Defenses? • Timing • Acoustic • RF • Power

24. Steganography • Greek for covered writing • Embed hidden messages in other communication • Example: PRESIDENT'S EMBARGO RULING SHOULD HAVE IMMEDIATE NOTICE. GRAVE SITUATION AFFECTING INTERNATIONAL LAW. STATEMENT FORESHADOWS RUIN OF MANY NEUTRALS. YELLOW JOURNALS UNIFYING NATIONAL EXCITEMENT IMMENSELY. PRESIDENT'S EMBARGO RULING SHOULD HAVE IMMEDIATE NOTICE. GRAVE SITUATION AFFECTING INTERNATIONAL LAW. STATEMENT FORESHADOWS RUIN OF MANY NEUTRALS. YELLOW JOURNALS UNIFYING NATIONAL EXCITEMENT IMMENSELY. PERSHING SAILS FROM NY JUNE I

25. Where to hide messages? • Spaces • Word lengths • How I want a drink, alcoholic of course, after the heavy chapters involving quantum mechanics. One is, yes, adequate even enough to induce some fun and pleasure for an instant, miserably brief. • Timings • Low bits of images/audio

26. Image Steganography

27. Secure Deletion • How do you make sure a file is really gone? • Must eradicate all copies • First attempt: • “rm file” • What about backups?

28. OS level issues • What does the filesystem do when you erase a file? Directory file1 File 1 contents file2 file3

29. Try #2 • Overwrite file with 0’s, *then* erase • Problems? • Copies of file in memory, cache, swap • Study finds data remains on disk weeks after it’s been erased

30. Disk level issues • Magnetic information persists after overwrite • “Ghost effects” • Overwrite many time with different patterns • Similar effects exist for RAM, too! • CITES disk scrubbing docs: • http://www.cites.uiuc.edu/security/diskscrub/dsfaq.html • Smart disks remap sectors • Sectors that have gone bad inacessible, though still readable with effort • Drive alignment issues

31. Better approach • Never write confidential data to disk • Keep crypto keys “pinned”in memory • Encrypt confidential files • Encrypting filesystems • Encrypt all data stored on a computer • BitLocker for Windows • Many products for Linux • FileVault under MacOS X • Keep key in memory, or on smart card

32. Key Points • Physical security is difficult • Many side channels available • Software / system design can help physical security • E.g. encrypted filesystems • Joe was innocent!