[論文レビュー] The Unpatchable Silicon: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs

Maik Ender, Amir Moradi+1 more|arXiv (Cornell University)|May 28, 2021

Physical Unclonable Functions (PUFs) and Hardware Security被引用数 39

ひとこと要約

本論文は、FPGAを復号オラクルとして用い、CBCのもつ可変性を利用して正規の暗号化ビットストリームを偽造することで、Xilinx 7-Series FPGAs のビットストリーム暗号を完全に破壊する2つの低コスト攻撃を提案している（Virtex-6 については一部影響）。

ABSTRACT

The security of FPGAs is a crucial topic, as any vulnerability within the hardware can have severe consequences, if they are used in a secure design. Since FPGA designs are encoded in a bitstream, securing the bitstream is of the utmost importance. Adversaries have many motivations to recover and manipulate the bitstream, including design cloning, IP theft, manipulation of the design, or design subversions e.g., through hardware Trojans. Given that FPGAs are often part of cyber-physical systems e.g., in aviation, medical, or industrial devices, this can even lead to physical harm. Consequently, vendors have introduced bitstream encryption, offering authenticity and confidentiality. Even though attacks against bitstream encryption have been proposed in the past, e.g., side-channel analysis and probing, these attacks require sophisticated equipment and considerable technical expertise. In this paper, we introduce novel low-cost attacks against the Xilinx 7-Series (and Virtex-6) bitstream encryption, resulting in the total loss of authenticity and confidentiality. We exploit a design flaw which piecewise leaks the decrypted bitstream. In the attack, the FPGA is used as a decryption oracle, while only access to a configuration interface is needed. The attack does not require any sophisticated tools and, depending on the target system, can potentially be launched remotely. In addition to the attacks, we discuss several countermeasures.

研究の動機と目的

• FPGAビットストリームを安全でミッションクリティカルな展開環境で保護する重要性を動機づける。
• Xilinx 7-Seriesビットストリームの真正性と機密性を完全に侵害する実用的な攻撃を実証する。
• 限定的な機材で、さらにはリモートアクセスの可能性を示し得ることを示す。
• 影響を分析し、これらの脆弱性を緩和する対策を検討する。

提案手法

• 敵対者モデルと、JTAG/SelectMAPインタフェースおよび暗号化ビットストリームへの想定アクセスを説明する。
• AES-256 CBCモードのCBC可変性を悪用して復号済みビットストリームの内容を変更する。
• FPGAのMultiBoot (WBSTAR) メカニズムを用いて、復号済みビットストリームデータをワード単位で読み出す。
• 読出し経路を介して復号済みデータを漏洩させるマル malicious bitstreamsを構築する。
• HMACとCBCチェーンを操作して正規の暗号化ビットストリームを偽造する二つ目の攻撃を実証する。

実験結果

リサーチクエスチョン

• RQ1 Can Xilinx 7-Series bitstream encryption be defeated to fully disclose the decrypted bitstream?
• RQ2 Can an attacker use the FPGA as a decryption oracle to recover the entire bitstream with sequential word-level reads?
• RQ3 Can CBC malleability be leveraged to forge authentic encrypted bitstreams by tampering the HMAC?
• RQ4 What are viable countermeasures to preserve authenticity and confidentiality of bitstreams against these attacks?

主な発見

• The attacks yield total loss of bitstream authenticity and confidentiality for Xilinx 7-Series and partial loss for Virtex-6 devices.
• A complete Kintex-7 XC7K160T bitstream can be decrypted in 3 hours and 42 minutes using the described approach.
• The attacker can manipulate the HMAC via CBC malleability to forge legitimate encrypted bitstreams.
• The FPGA is effectively used as a decryption oracle, accessible through standard configuration interfaces (JTAG/SelectMAP), potentially enabling remote or semi-remote exploitation.
• Countermeasures are discussed, noting that patches are not feasible without silicon changes.