Fuming Acid and Cryptanalysis: Handy Tools for Overcoming a Digital Locking and Access Control System

Abstract

Abstract. We examine the widespread SimonsVoss digital locking system 3060 G2 that relies on an undisclosed, proprietary protocol to mutually authenticate transponders and locks. For assessing the security of the system, several tasks have to be performed: By decapsulating the used microcontrollers with acid and circumventing their read-out protection with UV-C light, the complete program code and data contained in door lock and transponder are extracted. As a second major step, the multi-pass challenge-response protocol and corresponding cryptographic primitives are recovered via low-level reverse-engineering. The primitives turn out to be based on DES in combination with a proprietary construction. Our analysis pinpoints various security vulnerabilities that enable practical key-recovery attacks. We present two different approaches for unauthorizedly gaining access to installations. Firstly, an attacker having physical access to a door lock can extract a master key, allowing to mimic transponders, in altogether 30 minutes. A second, purely logical attack exploits an implementation flaw in the protocol and works solely via the wireless interface. As the only prerequisite, a valid ID of a transponder needs to be known (or guessed). After executing a few (partial) protocol runs in the vicinity of a door lock, and some seconds of computation, an adversary obtains all of the transponder's access rights.

When Reverse-Engineering Meets Side-Channel Analysis – Digital Lockpicking in Practice

“…Note that the mathematical attacks of [20] can be fixed with a firmware update that is currently being prepared by SimonsVoss. In contrast, preventing the SCA without replacing all hardware components (locks and transponders) is very difficult in our opinion.…”

“…The mathematical properties of the SimonsVoss digital lock and access control system 3060 "G2" are investigated in [20]. Sophisticated mathematical attacks, exploiting weaknesses of the proprietary obfuscation function (see Sect.…”

“…Note that only the first six bytes of the input to O can be chosen by the adversary, since the remaining bytes of P 0 are set to zero. Due to the carry propagation properties of O (which are described in detail in [20]), these input bytes do not lead to a "full" randomization of all intermediates in the first round of the obscurity function. A straightforward CPA of the first round targeting the addition operation x i (r+1) = x i (r) + c i (r) + y i hence only allows to recover the first seven key bytes y 0 .…”

Security analysis of a widely deployed locking system

“…The cryptographic security of Generation 2 has recently been analyzed by Strobel et al [3]. The researchers reverseengineered the cryptographic primitives and found out that the random number generator in their locks allowed the derivation of transponder secrets, which can be used to create a valid transponder without having physical access to it.…”

“…In contrast to mechanical locking systems, they provide several convenient features such as more flexible access rights management, the possibility to revoke physical keys and the claim that electronic keys cannot be cloned as easily as their mechanical counterparts. While for some electronic locks, mechanical flaws have been found [1], only a few publications analyzed the cryptographic security of electronic locking systems [2,3]. In this paper, we analyzed the electronic security of an electronic locking system which is still widely deployed in the field.…”