[论文解读] The Unpatchable Silicon: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs

Maik Ender, Amir Moradi+1 more|arXiv (Cornell University)|May 28, 2021

Physical Unclonable Functions (PUFs) and Hardware Security被引用 39

一句话总结

本文提出两种低成本攻击，完全破解 Xilinx 7-Series FPGA 的比特流加密（对 Virtex-6 部分破坏），利用 FPGA 作为解密 oracle 并结合 CBC 可篡改性来伪造真实的加密比特流。

ABSTRACT

The security of FPGAs is a crucial topic, as any vulnerability within the hardware can have severe consequences, if they are used in a secure design. Since FPGA designs are encoded in a bitstream, securing the bitstream is of the utmost importance. Adversaries have many motivations to recover and manipulate the bitstream, including design cloning, IP theft, manipulation of the design, or design subversions e.g., through hardware Trojans. Given that FPGAs are often part of cyber-physical systems e.g., in aviation, medical, or industrial devices, this can even lead to physical harm. Consequently, vendors have introduced bitstream encryption, offering authenticity and confidentiality. Even though attacks against bitstream encryption have been proposed in the past, e.g., side-channel analysis and probing, these attacks require sophisticated equipment and considerable technical expertise. In this paper, we introduce novel low-cost attacks against the Xilinx 7-Series (and Virtex-6) bitstream encryption, resulting in the total loss of authenticity and confidentiality. We exploit a design flaw which piecewise leaks the decrypted bitstream. In the attack, the FPGA is used as a decryption oracle, while only access to a configuration interface is needed. The attack does not require any sophisticated tools and, depending on the target system, can potentially be launched remotely. In addition to the attacks, we discuss several countermeasures.

研究动机与目标

• 在安全、任务关键部署中说明保护 FPGA 比特流的重要性。
• 演示能够完全破坏 Xilinx 7-Series 比特流的真实性和机密性的实用攻击。
• 显示攻击可在有限设备甚至远程访问的情况下进行。
• 分析影响并讨论对策以缓解此类漏洞。

提出的方法

• 描述对手模型以及对 JTAG/SelectMAP 接口和加密比特流的假定访问。
• 在 AES-256 CBC 模式下利用 CBC 可篡改性来改变解密后的比特流内容。
• 使用 FPGA 的 MultiBoot (WBSTAR) 机制逐字读取解密后的比特流数据。
• 构造恶意比特流，使 FPGA 通过读出路径泄露解密数据。
• 展示第二种攻击，通过操纵 HMAC 与 CBC 链来伪造合法的加密比特流。

实验结果

研究问题

• RQ1 是否可以击败 Xilinx 7-Series 的比特流加密以完全暴露经过解密的比特流？
• RQ2 攻击者是否可以利用 FPGA 作为解密 oracle，通过顺序逐字读取来恢复整个比特流？
• RQ3 是否可以利用 CBC 可篡改性通过篡改 HMAC 来伪造真实的加密比特流？
• RQ4 有哪些可行的对策可以在对抗这些攻击的同时保护比特流的真实性和机密性？

主要发现

• 对 Xilinx 7-Series 的比特流真实性和机密性造成总体损失，Virtex-6 设备部分损失。
• 如所述方法，完整的 Kintex-7 XC7K160T 比特流在 3 小时 42 分钟内即可解密。
• 攻击者可通过 CBC 可篡改性操作 HMAC 来伪造合法的加密比特流。
• FPGA 实际上被用作解密 oracle，可通过标准配置接口 (JTAG/SelectMAP) 访问，潜在实现远程或半远程利用。
• 讨论了对策，指出在没有硅片变更的情况下补丁不可行。