4.2 Description of the First Documented Facts …
315
Although in fairness it should be noted that due to the exceptional importance
of PRNG for any cryptographic system, special tests were built into secure key to
check the quality of random numbers generated; Intel managers hired well-known
expert groups to certify these tests. The unit in its entirety actually conforms to
the requirements of ANSI X9.82 and NIST SP 800-90 standards. Moreover, it was
certified as level 2 unit (in accordance with the requirements of NIST FIPS 140-2)
[120].
However, as will be demonstrated below, neither responsible approach to development nor reputable certification managed to protect this state-of-the-art cryptographic
unit from a real danger of secret and undetectable modification.
The researchers, who had previously considered the possibility of introduction
of such time bombs by intruders from a purely theoretical point of view, suggested
various additional structures composed of small logical circuits, which had to be
somehow injected into the existing chips. For example, Samuel Talmadge King and
his co-authors presented a version of such hardware Trojan, which would provide
a remote intruder with complete control over the system, at the LEET-08 conference in 2008. By simply sending a specially configured UDP packet, the intruder
could make any changes on that computer and get unlimited access to its memory.
However, these additional logical circuits turned out to be relatively easy to detect
even with microscopic analysis of the chip’s topology, let alone specialized methods
of detection of such modifications. Therefore, the Becker’s group took a different
route.
Instead of connecting an additional circuit to the chip, they introduced their
hardware-level implants by simply modifying (changing) operating modes of certain
existing logical blocks and altering the doping level of the implanted impurities in
separate transistors of the electrical circuit, which were specially selected by means
of analysis. As a result, it actually helped to introduce the necessary modifications
in operation of the entire cryptographic unit. Moreover, this Trojan family appeared
to be fairly resistant to most previously used detection methods, including even
scanning microscopy and comparison to reference chips.
As can be seen in Fig. 4.23, the transducer consists of p-channel and n-channel
MOS transistors (upper and lower parts of the image, respectively), which are
connected by drains through the metal layer (a). The Trojan is formed by means
of controlled change in the type and impurity concentration level in the structure of
the MOS transistor, due to which the state of voltage at the positive contact (VDD)
becomes permanent and doesn’t depend on the source random numbers.
The procedure for such controlled change of the dopant type and concentration
level can be by using standard ion doping installations, which are widely used in
microelectronic production.
Thus, as a result of the work performed by these researchers, the infected third
secure key block began accumulating sequences with only 32 unique bits instead
of 128 unique bits. Naturally, cryptographic keys based on such pseudo-random
numbers are highly predictable and can be decrypted in several minutes even using
a regular home PC.
315
Although in fairness it should be noted that due to the exceptional importance
of PRNG for any cryptographic system, special tests were built into secure key to
check the quality of random numbers generated; Intel managers hired well-known
expert groups to certify these tests. The unit in its entirety actually conforms to
the requirements of ANSI X9.82 and NIST SP 800-90 standards. Moreover, it was
certified as level 2 unit (in accordance with the requirements of NIST FIPS 140-2)
[120].
However, as will be demonstrated below, neither responsible approach to development nor reputable certification managed to protect this state-of-the-art cryptographic
unit from a real danger of secret and undetectable modification.
The researchers, who had previously considered the possibility of introduction
of such time bombs by intruders from a purely theoretical point of view, suggested
various additional structures composed of small logical circuits, which had to be
somehow injected into the existing chips. For example, Samuel Talmadge King and
his co-authors presented a version of such hardware Trojan, which would provide
a remote intruder with complete control over the system, at the LEET-08 conference in 2008. By simply sending a specially configured UDP packet, the intruder
could make any changes on that computer and get unlimited access to its memory.
However, these additional logical circuits turned out to be relatively easy to detect
even with microscopic analysis of the chip’s topology, let alone specialized methods
of detection of such modifications. Therefore, the Becker’s group took a different
route.
Instead of connecting an additional circuit to the chip, they introduced their
hardware-level implants by simply modifying (changing) operating modes of certain
existing logical blocks and altering the doping level of the implanted impurities in
separate transistors of the electrical circuit, which were specially selected by means
of analysis. As a result, it actually helped to introduce the necessary modifications
in operation of the entire cryptographic unit. Moreover, this Trojan family appeared
to be fairly resistant to most previously used detection methods, including even
scanning microscopy and comparison to reference chips.
As can be seen in Fig. 4.23, the transducer consists of p-channel and n-channel
MOS transistors (upper and lower parts of the image, respectively), which are
connected by drains through the metal layer (a). The Trojan is formed by means
of controlled change in the type and impurity concentration level in the structure of
the MOS transistor, due to which the state of voltage at the positive contact (VDD)
becomes permanent and doesn’t depend on the source random numbers.
The procedure for such controlled change of the dopant type and concentration
level can be by using standard ion doping installations, which are widely used in
microelectronic production.
Thus, as a result of the work performed by these researchers, the infected third
secure key block began accumulating sequences with only 32 unique bits instead
of 128 unique bits. Naturally, cryptographic keys based on such pseudo-random
numbers are highly predictable and can be decrypted in several minutes even using
a regular home PC.