AES Bitstream Encryption in Virtex-4. How safe it is?

austin <austin@xilinx.com> writes:
> Well, we are unable to get anyone interested to try it, as they tried
> the obviously less secure 3DES, and didn't get anywhere.

I think claiming 3DES to be "obviously less secure" is a bit much.
DES has withstood far more attacks than AES.  After all that, there
are no known attacks that are significantly better than brute force, so
3DES is quite secure.

AES *might* be as secure or more, but since it hasn't had nearly as
much time to be poked and prodded by cryptographers, I wouldn't count
on it.

Of course, some clever cryptographer might come up with a new attack
against either one.

The biggest advantage of AES over 3DES is that AES is approved by the
US government now, and DES no longer is.  (I think 3DES still is for
at least some applications.)  For my own data, I prefer 3DES.

austin <austin@xilinx.com> writes:
> I knew someone would say this,
>
> Yes, there are those that think because the NSA approves a crypto
> standard, they either have a back door, or some other way around it.
>
> You give them far too much credit.
>
> They are not that smart.
>
> If there is a weakness, or a back door, then they have created a way for
> all systems they certify to be broken.
>
> They are also not that stupid.

They *are* that smart.

When the influenced the design of DES way back when, they *both* strengthened
and weakened it.

They weakened it by reducing the key length to 56 bits.  It is generally
believed that they did this because they could afford to build hardware
that would brute-force search a 56-bit key space.

The strengthened it by making design changes, the nature of which was
not obvious at the time.  Many years later, cryptographers (re)discovered
linear and differential cryptanalysis methods, and found that the NSA's
changes to the design of DES made it essentially immune to those lines
of attack.  The NSA had developed those attacks, but had not published
them, for obvious reasons.

In other words, the NSA wanted the strength of DES to be only 56 bits,
but also not to have weaknesses reducing the effective key size
signficantly below 56 bits.

When the NSA is involved in the development of any cryptosystem made
available for public use, it would be foolish to assume that they
haven't made sure that it is neither too insecure nor too secure.

Eric

On Mar 6, 5:19 am, austin <aus...@xilinx.com> wrote:
> Allan,
>
> No Altera product with poly efuse is able to meet FIPS 41, none are
> approved by the NSA.
>
> In my book, that means we see no competition (all customers that require
> FIPS 41, or NSA approval come to Xilinx).
>
> Now, if you do not require FIPS 41, or you are not interested in NSA
> compliance, then the Altera solutions are perfectly good, and useful.
> In no way do I imply they are poor solutions, however, they are not in
> compliance with the highest level standards, and they are not approved
> for generic use in US government contracts.
>
> That means, they are not a solution for banking (which requires FIPS
> 41), and other commercial markets as well.
>
> What is left?  From the "Virtex" point of view, nothing at all of import.
>
> Perhaps in the Cyclone/Spartan world, there are some good sockets they
> win (and we do too) for anti-cloning of consumer goods.
>
> I am sure they will have FIPS 41 compliant products at some point.  I am
> also sure they will eventually get NSA approval (if they can meet their
> requirements, as the US government is not allowed to play favorites, and
> must treat all fairly).  Until then, we enjoy the sockets we are getting,
>
> Austin

The reason the Xilinx parts get approval for single chip Type 1 COMSEC
applications has to do primarily with software tools changes insuring
adequate red/black separation.using the column based architecture
found in Virtex-4 LX, SX and FX.

http://www.mil-embedded.com/PDFs/NSA.Mar07.pdf

FIPS 41 is entitled "Computer Security Guidelines for Implementing the
Privacy Act of 1974" and was withdrawn in 1998.;  I think you mean
FIPS140-2 (-3 pending) "Security Requirements for Cryptographic
Modules", wherein you can use the placement tools and column
architecture for functional separation (compartmentalization).  The
FIPS 140 criteria derive from the NSAs CCEP program.

One could wonder if the market is sufficiently large or attractive
enough for Altera to make the effort.

On Mar 6, 10:54 am, austin <aus...@xilinx.com> wrote:
> Antti,
>
> Good points.  Even the best component security doesn't equate to a high
> level of system security.
>
> You are also correct to point out the Actel antifuse (basically a via
> that can be 'popped') where is 'impossible' to map all of them, and
> hence how the part is programmed.  This is only because no one has
> automated this attack:  if automated, it could be done (shave off 10
> angstroms, take a picture, repeat, then rebuild the connections).
>
> Don't forget some attackers have infinite labor, and infinite patience.
>  My favorite example is when the students took over the American Embassy
> in Iran, and then put back together all of the shredded secret documents
> ... a massive task, but just a big puzzle after all (and one that could
> be, and was, solved).
>
> Austin

There were interesting stories about Intel and a scanning  electron
beam prober during the Clipper Chip days (uses anti-fuse).  Something
about seeing the charge around a via and telling whether or not the
fuse was conducting or high impedance.  Presumably this would be
easier to automate.  There was a lot of speculation about tamper proof
chip cases.  Also something about the technology getting classified.

3 X 56 bits < 256 bits.

Note that we have AES256, and the "other" competitor only had AES128.

AES128 was not approved (for the crypto modernization program).

I am sure that tells you something.

Austin

On Thu, 06 Mar 2008 07:56:18 -0800, austin <austin@xilinx.com> wrote:

>3 X 56 bits < 256 bits.
>
>Note that we have AES256, and the "other" competitor only had AES128.
>
>AES128 was not approved (for the crypto modernization program).
>
>I am sure that tells you something.


You would not try to brute force a 128 bit AES system.
Making the brute force attack 2^128 times harder by doubling the key
size, doesn't change all that much since you wouldn't be using that
approach anyway.

(Yes, I do know that only the 256 bit key version is approved for top
secret work in the USA.  All our products support the 256 bit key size
for that reason.)


BTW, I think bitstream encryption is an excellect idea for protecting
the intellectual property that the bitstream represents.  I'm just not
sure I'd rely on it as an essential part of a security system, where
the threat model includes attacks by well funded military
organisations.

Austin, is there an appnote showing how bitstream encryption can be
used to make an HSM?  I'd be intersted in knowing how it's done.


Disclaimer: none of our products rely on bitstream encryption (from
any FPGA vendor) to protect our customers' secrets.


Regards,
Allan

Alan,

HSM?

Austin

Allan,

I presume HSM = Host Security Module?

If so, that is an application, and we do not supply any examples, nor
any IP.

Austin

On Thu, 06 Mar 2008 10:44:13 -0800, austin <austin@xilinx.com> wrote:

>Alan,
>
>HSM?
>
>Austin

google suggests High School Musical.  Hmmm.

Perhaps this would be better:
http://en.wikipedia.org/wiki/Hardware_Security_Module

It's only when you start designing products like that, that the
distinction between 128 and 256 bit AES becomes important.  (IMO)

Regards,
Allan

Hi Austin,

About the security of Virtex, I have recently read a document mentioned
that the battery charged key can still be read once the battery is removed,
since the memory already being charged for too long and a EM field will not
easily disappeared. They provided a temperature to EM field lasting
prediction as well in their report. There conclusion shows the anti-fuse
fpga is the best possible option. What do you think?

Ken

	   
					
---------------------------------------		
Posted through http://www.FPGARelated.com