Fault-based attack of RSA authentication

Abstract

For any computing system to be secure, both hardware and software have to be trusted. If the hardware layer in a secure system is compromised, not only it would be possible to extract secret information about the software, but it would also be extremely hard for the software to detect that an attack is underway. In this work we detail a complete end-to-end fault-attack on a microprocessor system and practically demonstrate how hardware vulnerabilities can be exploited to target secure systems. We developed a theoretical attack to the RSA signature algorithm, and we realized it in practice against an FPGA implementation of the system under attack. To perpetrate the attack, we inject transient faults in the target machine by regulating the voltage supply of the system. Thus, our attack does not require access to the victim system's internal components, but simply proximity to it.The paper makes three important contributions: first, we develop a systematic fault-based attack on the modular exponentiation algorithm for RSA. Second, we expose and exploit a severe flaw on the implementation of the RSA signature algorithm on OpenSSL, a widely used package for SSL encryption and authentication. Third, we report on the first physical demonstration of a fault-based security attack of a complete microprocessor system running unmodified production software: we attack the original OpenSSL authentication library running on a SPARC Linux system implemented on FPGA, and extract the system's 1024-bit RSA private key in approximately 100 hours.

Application-Aware diagnosis of runtime hardware faults

“…Since programs trust the underlying hardware to correctly execute instructions, software developers rarely handle unexpected events such as hardware faults, even for widely adopted sensitive applications such as cryptographic routines. However, the effects on these applications can be dramatic when hardware infallibility is questioned, as shown in [13]. As the size of transistors decreases with technology, expected fault rates are projected to increase drastically, causing concerns on the correctness of computation by any computer system [2].…”

Using quantum key distribution for cryptographic purposes: A survey

“…Moreover, if one allows active attacks, such as attacks based on fault injection in the circuit, then a full break of AES128 has been obtained in a few seconds, with only 2 pairs of correct and faulty ciphertext [97]. Note also that implementation of asymmetric cryptographic schemes, such as RSA, are also vulnerable to side-channels attacks [98]. To increase security, dedicated counter-measure need to be deployed, as 5.1 Practical security of QKD implementations and implementation loopholes well as extra layers of hardware protections (in order to physically restrict the possibility to launch such attacks).…”

An Overview of Cryptanalysis of RSA Public key System

“…The main focus of branch prediction analysis attack is to use a spy to detect the private key. The research work was named as "The power of Simple branch prediction analysis" [15], with in the 10 iterations the authors can invent 508 out of 512 bits of an RSA key. Andrea Pellegrini and Valeria Bertacco [16] discovered the research article named as Fault Based Attack of RSA Authentication.…”