AES encryption of bitstream - is my design secure?

On Aug 5, 11:23=A0am, "Nial Stewart"
<nial*REMOVE_TH...@nialstewartdevelopments.co.uk> wrote:
> > > If your design can be mimiked AES encryption seems not necessary.
> > I don't understand this statement.
>
> If someone can easily mimick the functionality of your FPGA why would
> they bother trying to de-crypt your bit-stream, they'd just re-write
> from scratch.
>
> Nial

sometimes there is need to to protect the PCB and other design
elements also
so a possibility to download a unencrypted bit file into an FPGA with
AES key set
is somewhat design risc

antti

On Wed, 5 Aug 2009 09:23:48 +0100, "Nial Stewart"
<nial*REMOVE_THIS*@nialstewartdevelopments.co.uk> wrote:

>> > If your design can be mimiked AES encryption seems not necessary.
>
>> I don't understand this statement.
>
>If someone can easily mimick the functionality of your FPGA why would
>they bother trying to de-crypt your bit-stream, they'd just re-write
>from scratch.
>
If they can mimic the functionality of the interfaces, they could learn a lot
about the system that connects to the FPGA. 

Unless that system interrogates the FPGA appropriately ("encrypt this message
with the private part of your key pair") and refuses to do anything interesting
if it gets the wrong answer.

- Brian

Rajesh Gandhi <rgandhi4086@gmail.com> wrote:

>So you are correct Gabor and Mr. Austin from Xilinx is not,
>respectfully, exactkt correct (although he gives us good answers other
>times)   It mention Trojan and it not possible to defeat encryption
>but easily possible for trojan design and JTAG to hack product, snoop
>other system parts V5 is connected to, erase Flash which create Denial
>of service, store alternate non-encrypted bit data in multi-boot.
>I was skeptical of presentation at HOST hardware security  conference
>but I believe it makes more sense now.

That's what Mr. Austin said -- the bitstream is secure but the hardware
can be used for other things.

-- 
Dave Farrance

On Aug 5, 6:37=A0am, Dave Farrance
<DaveFarra...@OMiTTHiSyahooANDTHiS.co.uk> wrote:
> Rajesh Gandhi <rgandhi4...@gmail.com> wrote:
> >So you are correct Gabor and Mr. Austin from Xilinx is not,
> >respectfully, exactkt correct (although he gives us good answers other
> >times) =A0 It mention Trojan and it not possible to defeat encryption
> >but easily possible for trojan design and JTAG to hack product, snoop
> >other system parts V5 is connected to, erase Flash which create Denial
> >of service, store alternate non-encrypted bit data in multi-boot.
> >I was skeptical of presentation at HOST hardware security =A0conference
> >but I believe it makes more sense now.
>
> That's what Mr. Austin said -- the bitstream is secure but the hardware
> can be used for other things.
>
Dear Mr.Dave,
The part said by Mr. Austin was misinformation which adds to
confusion.

>With Xilinx FPGA encryption, decryption solutions since Virtex 2, only
>one bitstream is allowed to be entered in secure mode.
>That bistream's key must be the one in the battery backed key memory,
>or the device will not program.
The device will program when there is NO ENCRYPTION.  Hence Trojan
bitstream is easy to implement.  Trojans do not need to decrypt the
bitstream,
attacker can program a bitstream into V5 or Stratix by programming on-
board FLASH
with JTAG.  All are 'wide-open' for hacking.  FPGA can be programmed
which will assist in 1)
getting passwords from users/admin/embedded 2) getting OTHER keys (not
FPGA key) in system
3) snoop system to hack and potentially unlock unpaid-for features
(turn low end product into high end product)
4) learn enough about system to build compatible plug-ins (games,
software, songs, videos, printer cartridges) which
may not be part of economic strategy.

"cant prevent hardware from being used for other things" sounds like
simple statement but many hardware products
are sold at loss or break-even or very low margin in order to make
market share.  Printers for example. Company
makes money on consumables or plug-ins to the platform.  Xbox is
example  - which is really just Intel PC sold at loss
to get market to sell games and internet service.  Was Hacked to run
linux which is embarassment for Microsoft
but also a loss of $200 for each xbox purchased to run linux.  Cisco
low end router can be made into high end router with hack patch - loss
of revenue for Cisco.

Reader who say 'if simple to mimik then u don't need encryption,
engineer will build from scratch' maybe missing the point. They are to
build a bit data by scratch that is their intent, to have their design
in place to do bad things. steal user password (not fpga key), monitor
keyboard input, monitor USB connection, insert 'time bomb' to stop
system functioning at critical time of need.
if I have embedded powerpc based fpga it maybe quiet easy for attacker
to get it to boot linux and have design which monitor keyboard input
for admin logins and store or send over internet.  The interfaces are
all standard so easy to develop.

And in end only virtex/stratix are secure, others are not.  system
security maybe not xilinx/altera problem, just mine, but i have to
develop.
Am I only one in FPGA area for this concern?

On Aug 5, 8:57=A0am, Rajesh Gandhi <rgandhi4...@gmail.com> wrote:
> On Aug 5, 6:37=A0am, Dave Farrance<DaveFarra...@OMiTTHiSyahooANDTHiS.co.u=
k> wrote:
> > Rajesh Gandhi <rgandhi4...@gmail.com> wrote:
> > >So you are correct Gabor and Mr. Austin from Xilinx is not,
> > >respectfully, exactkt correct (although he gives us good answers other
> > >times) =A0 It mention Trojan and it not possible to defeat encryption
> > >but easily possible for trojan design and JTAG to hack product, snoop
> > >other system parts V5 is connected to, erase Flash which create Denial
> > >of service, store alternate non-encrypted bit data in multi-boot.
> > >I was skeptical of presentation at HOST hardware security =A0conferenc=
e
> > >but I believe it makes more sense now.
>
> > That's what Mr. Austin said -- the bitstream is secure but the hardware
> > can be used for other things.
>
> Dear Mr.Dave,
> The part said by Mr. Austin was misinformation which adds to
> confusion.
>
> >With Xilinx FPGA encryption, decryption solutions since Virtex 2, only
> >one bitstream is allowed to be entered in secure mode.
> >That bistream's key must be the one in the battery backed key memory,
> >or the device will not program.
>

I think Austin did not lie here, he said only one bitstream is allowed
to be entered "in secure mode".  There was no representation of
the prevention of non-secured bitstreams.

> The device will program when there is NO ENCRYPTION. =A0Hence Trojan
> bitstream is easy to implement. =A0Trojans do not need to decrypt the
> bitstream,
> attacker can program a bitstream into V5 or Stratix by programming on-
> board FLASH
> with JTAG. =A0All are 'wide-open' for hacking. =A0FPGA can be programmed
> which will assist in 1)
> getting passwords from users/admin/embedded 2) getting OTHER keys (not
> FPGA key) in system
> 3) snoop system to hack and potentially unlock unpaid-for features
> (turn low end product into high end product)
> 4) learn enough about system to build compatible plug-ins (games,
> software, songs, videos, printer cartridges) which
> may not be part of economic strategy.
>
> "cant prevent hardware from being used for other things" sounds like
> simple statement but many hardware products
> are sold at loss or break-even or very low margin in order to make
> market share. =A0Printers for example. Company
> makes money on consumables or plug-ins to the platform. =A0Xbox is
> example =A0- which is really just Intel PC sold at loss
> to get market to sell games and internet service. =A0Was Hacked to run
> linux which is embarassment for Microsoft
> but also a loss of $200 for each xbox purchased to run linux. =A0Cisco
> low end router can be made into high end router with hack patch - loss
> of revenue for Cisco.
>
> Reader who say 'if simple to mimik then u don't need encryption,
> engineer will build from scratch' maybe missing the point. They are to
> build a bit data by scratch that is their intent, to have their design
> in place to do bad things. steal user password (not fpga key), monitor
> keyboard input, monitor USB connection, insert 'time bomb' to stop
> system functioning at critical time of need.
> if I have embedded powerpc based fpga it maybe quiet easy for attacker
> to get it to boot linux and have design which monitor keyboard input
> for admin logins and store or send over internet. =A0The interfaces are
> all standard so easy to develop.
>
> And in end only virtex/stratix are secure, others are not. =A0system
> security maybe not xilinx/altera problem, just mine, but i have to
> develop.
> Am I only one in FPGA area for this concern?

Your requirements for security are different from many others
who simply want their bitstream copy protected.  If you have
requirements to prevent your system from being used for other
purposes, your best bet is to make sure the part you use cannot
be re-programmed.  I believe Actel has some good solutions for
this.  Also if your volume is adequate you could consider a
part like the eASIC "structured ASIC" which straddles the
fence between FPGA and ASIC.  Altera also has their hard
wired versions of FPGA's if you prefer to start with an SRAM
FPGA and then move to a non-reprogrammable version.  At
the moment Xilinx has no similar products.

Regards,
Gabor

On Aug 5, 4:24=A0pm, gabor <ga...@alacron.com> wrote:
> On Aug 5, 8:57=A0am, Rajesh Gandhi <rgandhi4...@gmail.com> wrote:
>
>
>
>
>
> > On Aug 5, 6:37=A0am, Dave Farrance<DaveFarra...@OMiTTHiSyahooANDTHiS.co=
.uk> wrote:
> > > Rajesh Gandhi <rgandhi4...@gmail.com> wrote:
> > > >So you are correct Gabor and Mr. Austin from Xilinx is not,
> > > >respectfully, exactkt correct (although he gives us good answers oth=
er
> > > >times) =A0 It mention Trojan and it not possible to defeat encryptio=
n
> > > >but easily possible for trojan design and JTAG to hack product, snoo=
p
> > > >other system parts V5 is connected to, erase Flash which create Deni=
al
> > > >of service, store alternate non-encrypted bit data in multi-boot.
> > > >I was skeptical of presentation at HOST hardware security =A0confere=
nce
> > > >but I believe it makes more sense now.
>
> > > That's what Mr. Austin said -- the bitstream is secure but the hardwa=
re
> > > can be used for other things.
>
> > Dear Mr.Dave,
> > The part said by Mr. Austin was misinformation which adds to
> > confusion.
>
> > >With Xilinx FPGA encryption, decryption solutions since Virtex 2, only
> > >one bitstream is allowed to be entered in secure mode.
> > >That bistream's key must be the one in the battery backed key memory,
> > >or the device will not program.
>
> I think Austin did not lie here, he said only one bitstream is allowed
> to be entered "in secure mode". =A0There was no representation of
> the prevention of non-secured bitstreams.
>
>
>
>
>
> > The device will program when there is NO ENCRYPTION. =A0Hence Trojan
> > bitstream is easy to implement. =A0Trojans do not need to decrypt the
> > bitstream,
> > attacker can program a bitstream into V5 or Stratix by programming on-
> > board FLASH
> > with JTAG. =A0All are 'wide-open' for hacking. =A0FPGA can be programme=
d
> > which will assist in 1)
> > getting passwords from users/admin/embedded 2) getting OTHER keys (not
> > FPGA key) in system
> > 3) snoop system to hack and potentially unlock unpaid-for features
> > (turn low end product into high end product)
> > 4) learn enough about system to build compatible plug-ins (games,
> > software, songs, videos, printer cartridges) which
> > may not be part of economic strategy.
>
> > "cant prevent hardware from being used for other things" sounds like
> > simple statement but many hardware products
> > are sold at loss or break-even or very low margin in order to make
> > market share. =A0Printers for example. Company
> > makes money on consumables or plug-ins to the platform. =A0Xbox is
> > example =A0- which is really just Intel PC sold at loss
> > to get market to sell games and internet service. =A0Was Hacked to run
> > linux which is embarassment for Microsoft
> > but also a loss of $200 for each xbox purchased to run linux. =A0Cisco
> > low end router can be made into high end router with hack patch - loss
> > of revenue for Cisco.
>
> > Reader who say 'if simple to mimik then u don't need encryption,
> > engineer will build from scratch' maybe missing the point. They are to
> > build a bit data by scratch that is their intent, to have their design
> > in place to do bad things. steal user password (not fpga key), monitor
> > keyboard input, monitor USB connection, insert 'time bomb' to stop
> > system functioning at critical time of need.
> > if I have embedded powerpc based fpga it maybe quiet easy for attacker
> > to get it to boot linux and have design which monitor keyboard input
> > for admin logins and store or send over internet. =A0The interfaces are
> > all standard so easy to develop.
>
> > And in end only virtex/stratix are secure, others are not. =A0system
> > security maybe not xilinx/altera problem, just mine, but i have to
> > develop.
> > Am I only one in FPGA area for this concern?
>
> Your requirements for security are different from many others
> who simply want their bitstream copy protected. =A0If you have
> requirements to prevent your system from being used for other
> purposes, your best bet is to make sure the part you use cannot
> be re-programmed. =A0I believe Actel has some good solutions for
> this. =A0Also if your volume is adequate you could consider a
> part like the eASIC "structured ASIC" which straddles the
> fence between FPGA and ASIC. =A0Altera also has their hard
> wired versions of FPGA's if you prefer to start with an SRAM
> FPGA and then move to a non-reprogrammable version. =A0At
> the moment Xilinx has no similar products.
>
> Regards,
> Gabor- Hide quoted text -
>
> - Show quoted text -- Hide quoted text -
>
> - Show quoted text -

actually Austin did make a statemented that can be understood
diferently,
he said:

"That bistream's key must be the one in the battery backed key
memory,
or the device will not program. "

this is true, if the key is WRONG,
but if the bitstream has NO KEY then the device will configure ok.
and the all other on-board components are wide open for attack...

this is different for Actel where AES secure parts can not be accessed
without the AES key at all

Antti

All,

Perhaps what Raj is referring to is "one-armed bandit" mode (named
because gambling machines must have this feature).

This is when once a key is programmed into the part, the part no
longer will accept any bitstream, only a bitstream encrypted with that
key (which we do not support today for any family).

The problem with this is that once programmed with the key, the device
will never be able to be sent back for test (how do you test a part
when you don't know the key?  how do you encrypt 10,000 test bitstream
to test such a part? etc.).  How do you test it at the CM if you don't
want to tell them the key? (Cm's are known for over-building ...)

The poly efuse keys have been in V5 since day one, where we have been
evaluating the technology and planning what support is required.  We
use some of the bits for inventory.

Spartan 3A has poly efuses blown at the factory for "DeviceDNA."

Virtex 6 might be the first product where AES poly efuse key, and "one-
arm bandit mode" is supported:  but not yet!

Supporting all these features requires assurance that they all work,
the software works to program them, and the customer has the means to
do the programming.

Stay tuned:  yes;  what you hear in conferences may be true, but it
will be after we are sure these things deliver as promised.

If Raj wants to prevent "improper use by a third party," or "over-
build by contract manufacturer," or reverse engineering (cloning),
these are different problems, which require different solutions.
Encryption/Decryption may be used to solve some, but not all of them.

Thanks to those who tried to clarify what I said,  I suspect I will
need more 'clarification' for this post, too.

Austin

On Aug 5, 6:04=A0pm, austin <aus...@xilinx.com> wrote:
> All,
>
> Perhaps what Raj is referring to is "one-armed bandit" mode (named
> because gambling machines must have this feature).
>
> This is when once a key is programmed into the part, the part no
> longer will accept any bitstream, only a bitstream encrypted with that
> key (which we do not support today for any family).
>
> The problem with this is that once programmed with the key, the device
> will never be able to be sent back for test (how do you test a part
> when you don't know the key? =A0how do you encrypt 10,000 test bitstream
> to test such a part? etc.). =A0How do you test it at the CM if you don't
> want to tell them the key? (Cm's are known for over-building ...)
>
> The poly efuse keys have been in V5 since day one, where we have been
> evaluating the technology and planning what support is required. =A0We
> use some of the bits for inventory.
>
> Spartan 3A has poly efuses blown at the factory for "DeviceDNA."
>
> Virtex 6 might be the first product where AES poly efuse key, and "one-
> arm bandit mode" is supported: =A0but not yet!
>
> Supporting all these features requires assurance that they all work,
> the software works to program them, and the customer has the means to
> do the programming.
>
> Stay tuned: =A0yes; =A0what you hear in conferences may be true, but it
> will be after we are sure these things deliver as promised.
>
> If Raj wants to prevent "improper use by a third party," or "over-
> build by contract manufacturer," or reverse engineering (cloning),
> these are different problems, which require different solutions.
> Encryption/Decryption may be used to solve some, but not all of them.
>
> Thanks to those who tried to clarify what I said, =A0I suspect I will
> need more 'clarification' for this post, too.
>
> Austin

Austin

Actel has Flash based AES key, not one time AES so there
is no problem with testing

with the efuse its different story of course

its about time for Xilinx to get the efuses actually working
i have wondering this since the V5 where some early
schematic and docu did show the efuse pins

but xilinx decided to not release V5 efuses to the customers
probably because there are some bugs?

ok, time have elapsed so maybe it all fixed in V6

Antti

It may not be easy for an organization using Xilinx/Altera, with
commitments in the
infrastructure of Xilinx/Altera to switch to Actel.   One needing
SERDES and PCIe
etc and other IP may not be able to go to Actel if the IC doesn't
support it or the
IP is not freely available in the tools.

I will continue my investigation.  At the moment there doesn't seem to
be a solution for
bit data (bitstream) authentication and anti-hacking.  I read these
which maybe of help

http://mae.pennnet.com/articles/article_display.cfm?article_id=309174
http://online.wsj.com/article/SB124027491029837401.html
Altera announced this but I suspect it is no different than
Spartan3AN.
http://mae.pennnet.com/whitepapers/wp.cfm?id=1400

Those work great if I do my entire design in Spartan3AN or the Altera,
but that is not likely.

Perhaps it is perceived as Military problem only, however, I see just
as much problem for
many products in commercial area too.  But maybe the volumes of FPGA
based products are
not like Xbox, iphone, linksys router or other previous hacked
products.

Thanks for all your input, I learned a lot.  And no offence to Mr.
Austin for providing information, perhaps
my words were too strict of 'incorrect', perhaps miscommunication on
my part.  In the
end I thnk we are in fair agreement.  These are different problems
that AES/Encrypt/decrypt
does not solve.   the perception by the fpga designers, however, I
think is that it does solve
these problems.
 >If Raj wants to prevent "improper use by a third party," or "over-
>build by contract manufacturer," or reverse engineering (cloning),
>these are different problems, which require different solutions.
>Encryption/Decryption may be used to solve some, but not all of them.

But absolutely in concurrence with Mr. Austin, it does not prevent
overbuilding,
reverse engineering, cloning.  To that I add 'trojan bitstreams' used
to compromise software security.
The marketing material and articles from Xilinx/Altera (please do not
take offense) do use the
words protection from overbuilding and cloning with respect to AES
encrypted bitstreams however
that is only  the case when you program the keys yourself or have a
trusted third party program them.
  Practical on small scale of 10 or so but not practical for a 1000.
I further agree Mr. Austin that the unencrypted bitstreams are
necessary to be loaded for the CM to test my PCB with JTAG
and related methods. I Understand why, just pointing out that is the
hole in the security which enables trojans and unauthenticated
bistreams that a  system designer should address in commercial space
not just military.

Best Wishes,
Raj

Antti.Lukats@googlemail.com <Antti.Lukats@googlemail.com> wrote:
(snip)
 
> sometimes there is need to to protect the PCB and other design
> elements also
> so a possibility to download a unencrypted bit file into an FPGA with
> AES key set is somewhat design risc

If it sells more hardware, even though the use is different,
it doesn't seem bad.  Assuming that the hardware sale price
includes the price for the FPGA design, then it isn't likely
that someone will find an affordable use for the hardware.

One possibility, though, would be in a design with good economy
of scale, someone might find a way to use it for something that
didn't have the economy of scale to produce the hardware.

If someone copies the PCB, then sue for copyright infringement.

-- glen