INSIGHTS | May 22, 2012

ST19XL18P – K5F0A Teardown

By IOActive

4 Metal, 350 nanometer fabrication process, EAL4+ smart card. A device fabricated in 2002 and yet, today the latest ST19W/N series only main differences are the ROM data bus output width into the decrypt block and the fabrication process (180nm and 150nm shrink).

The device was dipped into a HydroFluoric (HF) bath until the active shielding fell off. The result of this saved about 10 minutes of polishing to remove the surface oxide and Metal 4 (M4). This also helps begin the polishing process on the lower layers fairly evenly.

The oxide thickness of a layer once the passivation oxide is removed requires less than 2 minutes per layer to remove. We purposely stop just before the Metal 3 (M3) surface is exposed leaving the vias visibly clear (there are several gates tied to the ground of the mesh on Metal 4 (M4) as well as the active shield’s begin and end vias.

The device was very modularly placed n’ routed. The MAP consists of asymmetric and symmetric crypto functions (DES, RSA, etc).

The EEPROM control logic is actually in the lower left corner of the EEPROM block.

As Metal 3 (M3) was removed exposing the M2 layer, the device is beginning to not look so complicated.

Metal 1 (M1) shows us all the transistors. We did not polish down to the poly. Most of the gates are understandable without it for the purposes of finding the clear data bus.

Most likely, these NVM areas in Figure 7 & 8 are trimming or security violation related. No further investigation is planned on these areas (it isn’t necessary).

Strangely enough, it is now understandable why ST cannot achieve high performance on the ST19 platform. Each logic area with access to the clear data bus runs via a high-output driver that is tri-stated (hi-z) when not driven. This means that all drivers are OR-tied and only one set of 8 drivers are ever active at a time. This is a very large and cumbersome way of creating a MUX.

As time permits, the ST19W and ST19N series will be looked at. It is expected to again find this kind of pattern. Overall, finding the clear data bus took 1.5 hours once the images were created. Most of the 1.5 hours was the alignment of the layers.

INSIGHTS | March 20, 2011

Blackhat TPM Talk Follow-up

By Cesar Cerrudo

Since speaking at BlackHat DC 2009, there have been several inquiries in regards to the security of the SLE66PE series smartcard family.

Here are some issues that should be pointed out:

We have heard, “..it took 6 months to succeed..“

The reality is it took 4 months to tackle obsticles found in any <200nm device such as:

Capitance/load of probe needles when chip is running.
Powering the device inside the chamber of a FIB workstation.
Level-shifting a 1.8v core voltage following what we learned in #1 above.
Cutting out metal layers without creating electrical shorts.
Other more minute issues regarding the physical size of the die.

Upon overcoming the points above, the actual analysis required no more than approximately 2 months time.

In addition, these techniques listed above apply to all devices in the <200nm category (SecureAVR, SmartMX, ST21, ST23).

We have heard, “…you said the Infineon SLE66 was the best device out there in the market…“

The Infineon SLE66PE is a very secure device however, it (as do it’s competitors) all have their strengths and weaknesses.

Some examples of weaknesses are

Layout of all Infineon SLE50/66 ‘P’ or ‘PE’ are very modular by design
Lack of penalty if active shield is opened
Begin runtime from a CLEAR (unencrypted) ROM which is ‘invisible’ to the user
CPU core is based on a microcode/PLA type implementation
Power-on-reset always begins running from the externally supplied clock
Current design is based on a previous 600nm version designed around 1998
3 metal layer design for “areas of interest” (4th layer is the active shield)

Some examples of strengths are:

‘PE’ family used bond-pads located up the middle of the device.
ROMKey must be loaded before begin attacked (else you just see their clear ROM content).
MED is quite powerful if used properly for EEPROM content.
Mesh is consistent across the device and divided into sections.
Auto-increment of memory base address.
Mixing of physical vs. virtual address space for MED / memory fetch.

No device is perfect. All devices have room for improvement. Some things to consider when choosing a smartcard are:

Does CPU ever run on external clock?
What is the penalty for an active-shield breach?
What is the fabrication process geometry?
How many metal layers is the device?
List of labs who might have evaluated this device and their capabilities.

Lastly, just because the device has been Common Criteria certified does not mean much to an attacker armed with current tools. This is a common-oversight.

There is an ST23 smartcard device which has recently been certified EAL-6+ and the device has an active-shield with almost 1 micron wide tracks and a 1-2 micron spacing!!! This makes a person scratch there head and say, “WTH????”

We have some new content to post soon on the blog. Be sure and tune in for that. We will tweet an alert as well.

INSIGHTS | February 13, 2008

Atmel CryptoMemory AT88SC153/1608 :: Security Alert

By IOActive

A “backdoor” has been discovered by Flylogic Engineering in the Atmel AT88SC153 and AT88SC1608 CryptoMemory.

Before we get into this more, we want to let you know immediately that this backdoor only involves the AT88SC153/1608 and no other CryptoMemory devices.

The backdoor involves restoring an EEPROM fuse with Ultra-Violet light (UV). Once the fuse bit has been returned to a ‘1’, all memory contents is permitted to be read or written in the clear (unencrypted).

Normally in order to do so, you need to either authenticate to the device or use a read-once-given “secure code” as explained in the AT88SC153 datasheet and the AT88SC1608 datasheet.

For those of you who are unfamiliar Atmel’s CryptoMemory, they are serial non-volatile memory (EEPROM) that support a clear or secure channel of communications between a host (typically an MCU) and the memory. What is unique about the CryptoMemory are their capabilities in establishing the secure channel (authenticating to the host, etc).

These device includes:

High-security Memory Including Anti-wiretapping

64-bit Authentication Protocol

Secure Checksum

Configurable Authentication Attempts Counter

These device includes:

Multiple Sets of Passwords
Specific Passwords for Read and Write
Password Attempts Counters
Selectable Access Rights by Zone
High-security Memory Including Anti-wiretapping
64-bit Authentication Protocol
Secure Checksum
Configurable Authentication Attempts Counter

Section 5 of the datasheet labled, “Fuses” clearly states, “Once blown, these EEPROM fuses can not be reset.”

This statement is absolutely false. UV light will erase the fuses back to a ‘1’ state. Care must be used to not expose the main memory to the UV or else it too will erase itself.

We are not going to explain the details of how to use the UV light to reset the fuse. We have tried to contact Atmel but have not heard anything back from them.

Reading deeper into the datasheet under Table 5-1, Atmel writes, “When the fuses are all “1”s, read and write are allowed in the entire memory.”

As strange as it reads, they really do mean even if you have setup security rules in the configuration memory, it doesn’t matter. The fuses override everything and all memory areas are readable in the clear without the need for authentication or encrypted channel! The attacker can even see what the “Secure Code” is (it is not given out in the public documentation, nor with samples). Atmel was even kind enough to leave test pads everywhere so various levels of attackers can learn (entry to expert).

Our proof of concept was tested on samples we acquired through Atmel’s website. Atmel offers samples to anyone however they do not give out the “Secure code” as mentioned above.

The secure code of the AT88SC153 samples was “$D_ $F_ $7_”.
The secure code of the AT88SC1608 was “$7_ $5_ $5_”.

We are not going to show you the low nibble of the 3 bytes to make sure we don’t give the code out to anyone. This is enough proof to whoever else knows this code. That person(s) can clearly see we know their transport code which appears to be common to all samples (e.g. All die on a wafer contain the same secure code until a customer orders parts at which time that customer receives their own secure code.). A person reading this cannot guess the secure code in because there are 12 bits to exhaustively search out and you only have 8 tries ;).

Of all the other CryptoMemory products, only the AT88SC153/1608 has this backdoor. We have successfully analyzed the entire CryptoMemory product line and can say that the backdoor doesn’t exist in any other CryptoMemory part. None of the CryptoMemory parts are actually as “secure” as they make it seem. The words, “Smoke n’ Mirrors” comes to mind (It is almost always like that). In this particular category of CryptoMemory, there are two parts, the AT88SC153 and the larger AT88SC1608.

Thus the questions-

- Why has Atmel only backdoored this part (NSA for you conspiracists)?

- Who was the original intended customer supposed to be?

- Was the original intention of these devices to be used in a product that used some kind of cryptography?

If the above was true, was this device originally intended to be a cryptographic key-vault?

All these questions come to mind because the backdoor makes it so easy to extract the contents of the device they want you to trust. Some of you may be familiar with the GSM A5/1 algorithm having certain bits of the key set to a fixed value.

Judging by the wording of the documentation, Atmel gives the appearance that CryptoMemory are the perfect choice for holding your most valuable secrets.

Give us your thoughts…