System Architecture Design

pSHIELDSystem Architecture DesignPUintensifies in the case of embedded systems, which can have many design choices and constraints thatare not easily comprehensible.In the late 1990s, side-channel attacks were introduced. Side-channels attacks are a method ofcryptanalysis that focuses on the implementation characteristics of a cryptographic algorithm in order toderive its secret keys. This advancement bridged the gap between embedded systems, a common targetof such attacks, and cryptographers. Vendors became aware and concerned by this new form of attacks,while cryptographers focused on the specifics of the implementations, in order to advance theircryptanalysis techniques.4.2.3.1 Physical SecuritySecrecy is always a desirable property. In the case of cryptographic algorithms, the secret keys of thealgorithm must be stored, accessed, used and destroyed in a secure manner, in order to provide therequired security functions. This statement is often overlooked and design or implementation flaws resultto insecure cryptographic implementations. It is well-known that general purpose computing systems andoperating systems cannot provide enough protection mechanisms for cryptographic keys.Embedded systems are commonly used for implementing security functions. Since they are completesystems, they can perform the necessary cryptographic operations in a sealed and controlledenvironment. Tamper resistance refers to the ability of a system to resist to tampering attacks, i.e.,attempts to bypass its attack prevention mechanisms. Smart cards are a well-known example of tamperresistant embedded systems that are used for financial transactions and subscription-based serviceprovision.In many cases, embedded systems used for security-critical operations do not implement any tamperresistance mechanisms. Rather, a thin layer of obscurity is preferred, both for simplicity and performanceissues. However, as users become more interested in bypassing the security mechanisms of the system,the thin layer of obscurity is easily broken and the cryptographic keys are publicly exposed.Finally, an often neglected issue is a lifecycle-wide management of cryptographic systems. While a devicemay be withdrawn from operation, the data it has stored or processed over time may still need to beprotected. The security of keys that relies on the fact that only authorized personnel has access to thesystem may not be sufficient for the recycled device.4.2.3.2 Side-channel cryptanalysisUntil the middle 1990s, academic research on cryptography focused on the mathematical properties of thecryptographic algorithms. Paul Kocher was the first to present cryptanalysis attacks on implementations ofcryptographic algorithms, which were based on the implementation properties of a system. Kocherobserved that a cryptographic implementation of the RSA algorithm required varying amounts of time toencrypt a block of data depending on the secret key used. Careful analysis of the timing differences,allowed him to derive the secret key and he extended this method to other algorithms as well. This resultcame as a surprise, since the RSA algorithm has withstood years of mathematical cryptanalysis and wasconsidered secure. These findings revealed a new class of attacks on cryptographic algorithms. The termside-channel attacks (SCA), has been widely used to refer to this type of cryptanalysis, while the termsfault-based cryptanalysis, implementation cryptanalysis, active/passive hardware attacks, leakage attacksand others have been used also. Cryptographic algorithms acquired a new security dimension, that oftheir exact implementation. Cryptographers had previously focused on understanding the underlyingmathematical problems and prove or conjecture for the security of a cryptographic algorithm based on theabstract mathematical symbols. Now, in spite of the hard underlying mathematical problems to be solved,an implementation may be vulnerable and allow the extraction of secret keys or other sensitive material.Implementation vulnerabilities are of course not a new security concept. The new concept of SCA is thateven cryptographic algorithms that are otherwise considered secure can be also vulnerable to such faults.PUD2.3.2Issue 5 Page 56 of 122