Avoid Getting Your Crypto Broken, Now, Next Year, and In Ten Years

June 22, 2022

Story

Attackers are gearing up and quantum computers are coming; we just don’t know when. Hence, it’s time to up your game in securing your systems.

If you have to ask why your embedded computing devices or any microprocessor-based platform needs to be secured, you’ve likely been living under a rock. Especially, as the dangers of experiencing a breach can reach from lost or stolen IP to lives being at stake.

This matter becomes even more urgent as more and more devices are now connected to the Internet. And every one of those devices can serve as a potential entry point for the attacker. Once in, the attackers can gain full unauthorized access to any unprotected areas of the platform, run malicious code, or perform other nefarious actions. Such attacks on embedded or personal computing devices then often spread to other connected components and potentially cripple an entire system, building, or even industrial plant.

It is therefore highly important to get system security right to design a well-protected system. This is a puzzle containing many pieces that must be arranged properly.

We know it’s not possible to build a system that is 100% secure and protected against all known and even unknown attacks. Instead, the goal must be to maximize security and to reduce potential risks through careful threat analysis, layered security, and careful review of security components. Therefore, it’s particularly important to think ahead on how long a system will be used, how it will be kept up-to-date, and if the security of components or technologies might get weaker over time. Such a mindset helps to minimize the damage in case an attack does occur and to make complex systems more resilient.

Hardware Versus Software Security

When securing a complex system the designer can rely on software-based security, hardware-based security, or usually a combination of the two.  

Tools like password managers, firewalls, and data encryption are all examples of software security measures. Those software security features are often already integrated into operating systems, common browsers, or are easy to add or enable. And most software security is regularly and seamlessly updated to continually keep the platform up to date. However, a main downside of software security tools is that they typically share the same processing resources on a system with untrusted code. And it has been shown that the isolation of common PC-based platforms like Windows or Linux is often far from perfect either due to zero-day exploits or even due to HW-issues like Rowhammer, Spectre, and Meltdown.

These attacks allow untrusted software (worst case, some Java script on a website) to access critical memory locations to extract secrets like long-term encryption keys. Such attacks typically exploit unforeseen bugs in the underlying hardware and the complex interaction of hardware, operating systems, and application software.

A way to design more resilient systems and to allow for sound partitioning is to use hardware security. As the name suggests, hardware security is implemented with dedicated security chips that are specially designed to provide cryptographic functions and to protect keys or other secrets against attacks. As such devices have limited functionality, it is easier to vet them for security holes that may exist in large and complex software.

Moreover, hardware-based security features built in at the silicon level can protect against threats like physical attacks that are very hard to prevent using only software. Such physical attacks can be as simple as disconnecting the power supply of a device for a very short time to prevent the execution of critical code at a given moment. Devices that are sufficiently hardened counter such attacks via a mixture of security-aware coding, sensors, or digital redundancy in the hardware itself.

And of course, just using just the right technology is not sufficient. A designer also has to carefully consider human error and processes that deal with the whole lifecycle of a secured system from installation to decommissioning. But we won’t be addressing that here.

Hardware Security

As mentioned, software-based security has proven to be effective, to a point. But it can usually be breached by a sophisticated attacker who can find and exploit a vulnerability in the software, firmware, or underlying hardware of a system component.

The main advantage of hardware-based security is that cryptographic keys and other security functions are executed on a separate chip. Such chips do not share resources with untrusted and complex components, making them easier to defend. Usually, they are produced and provisioned in protected or certified production environments. This decreases the success probability of attacks on the supply chain or the insertion of “trojan horses”’ during production or distribution. Note that the manipulation of a software-security component, e.g., during shipping from the vendor to a customer, might be very hard to detect.

In addition, hardware-based security solutions are equipped with measures to detect tampering even by attackers who have full physical access to devices. This protection is also applied to the bootloader and firmware update mechanisms to make it robust against attacks that aim to inject a malicious firmware.

The Trusted Platform Module

A simple way to introduce hardware-based security into a system is to use a trusted platform module (TPM). The TPM stores encrypted information (passwords, certificates, encryption keys, etc.) and provides cryptographic and security services which can be used to measure and authenticate the complete hardware platform. The TPM comes in the form of a small security chip which is available on common PC-based computing platforms but can also be easily integrated into embedded devices, cars, or industrial equipment. This is possible as the TPM is intended to be operating-system agnostic and well supported by open-source drivers.

The TPM follows a standard developed by the Trusted Computing Group (TCG) and the latest version is TPM 2.0 which adds a lot of new features. For example, an algorithm interchangeability feature lets TPMs use different algorithms.

Overall, the TPMs provide the ability to:

• generate, store, and limit the use of cryptographic keys
• provide platform integrity by using metrics that can detect changes to past configurations
• allow platform device authentication with keys generated by the user or by the manufacturer of the TPM
• mitigate firmware, ransomware, dictionary, and phishing attacks
• protect software and licenses

Quantum Computers and Directives from the Very Top

Something else that gets added to the mix is the need to use cryptographic algorithms that are approved, accepted, and that offer long term security. This includes a current trend to move from elliptic curves of length 256 bits to curves that are longer and therefore even harder to break (e.g., 256 or even 521 bits). The same then can be seen by the move towards AES-256, RSA-4k, or SHA-384.

The main motivation is risk reduction. Some devices are used for a long time and can be in the field for 10, 15, or even 20 years. While attackers are constantly upping their game, the exchanged encrypted data may be privacy sensitive and may need to stay confidential for even longer.

However, just increasing bit lengths of keys of existing algorithms like ECC, RSA, SHA, or AES is simply not enough and a new set of challenges is beginning to emerge. A recent example is a series of Presidential Directives, executive orders, and national security memorandums that the current Presidential administration recently issued, specifically pertaining to IoT security and post-quantum cryptography.

The goal of PQC is to develop cryptographic systems that are appropriately secured against quantum computers. Such quantum computers exploit quantum mechanical phenomena to solve extremely complex mathematical problems and hopes are high for breakthroughs in chemical simulation, drug development, or material science.

However, quantum computers might also help getting past current security measures. If such advanced quantum computers are ever built, they will likely be able to break many of the public-key cryptosystems like ECC and RSA that are currently in use. The impact of this could be catastrophic, compromising the Internet and almost every network we currently use.

The U.S. government is aware of these issues and the security implications that must be dealt with. As a consequence, government organizations, universities, and many private sector individuals and companies, including Infineon Technologies, have been working diligently for many years to develop alternative cryptographic schemes that can replace vulnerable algorithms like RSA and ECC.

In a multi-year standardization process led by the National Institute of Standards and Technologies (NIST), hundreds of mathematicians have been working on new schemes and attacking each other's algorithms to root out weaknesses before mass deployment. That process is now wrapping up, with the experts nearing an agreement upon the final standards for post-quantum cryptography.

This is supported by a new President's national security memorandum that directs the U.S. government and other agencies, including the Department of Homeland Security, both individually and collectively, to move quickly to develop plans for adopting these new algorithms and for moving to post quantum crypto. And the plans will include the critical infrastructure industry. Such industries include finance, healthcare, agriculture, logistics and transportation, chemical plants, oil and gas, and others. Keep in mind that decisions are generally made by engineers within the government agencies, information security experts, and not the politicians themselves.

Its All About Managing Risk and Priorities

It’s a fair statement that its very difficult to answer the question of when an advanced quantum computer will be built. Estimates by experts range from very soon to at least 20 years from now.

But it’s clear that the whole IT industry has to somehow deal with the threat of advanced quantum computers against conventional cryptography appearing. And the situation is far from ideal; while the quantum threat is looming, we are not even having PQC standards fully finalized in standards.

The most important step organizations can take now is to understand the risks and to manage them appropriately. Such risks might range from future decryption of classified information, spoofing of identities, or falsification of long-term digital records.

However, it is important to consider that it is likely that early quantum computers will be expensive to operate and might be only available to well-funded organizations or governments. Those attackers will likely seek to go for high-value targets. Such a high value target may also include software or firmware update mechanisms of commercial-off-the-shelf components.

The RSA or ECC-based digital signatures that are commonly used to protect the authenticity of such updates seem like an ideal attack vector for large-scale adversaries with access to first quantum computers. A successful attack would enable such attackers to compromise a large number of devices by breaking the pre-quantum protection of their software update mechanisms.

An additional issue that has to be dealt with is that today’s systems are tomorrow’s legacy systems. Systems deployed now may still be in operation when the inevitable quantum computers surface or used cryptographic schemes become weaker. Then they may have to be suddenly replaced at high cost. Hence, solutions are needed now and not in ten years that close the most pressing attack vectors and offer an upgrade once new PQC standards emerge.

Essentially, there are three suggested routes to mitigating threats:

• adopt PQC solutions immediately where they are already available
• analyze existing systems to understand how to incorporate PQC standards at some predetermined date
• increase the security level for classical schemes in the hope that this can buy some time once quantum computers arrive

The Infineon OPTIGA TPM SLB 9672

The hardware-based security solution OPTIGA TPM SLB 9672 is an ideal building block to increase the security level of complex systems, it provides enhanced classical cryptographic capabilities, and marks a new milestone in the push towards PQC with a quantum-resistant firmware update mechanism (Note: this product is being shown at embedded world in the Infineon booth, Hall 4A, Booth 138).

It is compliant with the TCG 2.0 specification and certified to meet the international Common Criteria standard (ISO/IEC 15408). The OPTIGA TPM SLB 9672 is compatible with popular platforms like Windows and Linux, but also supports embedded systems (e.g., microcontrollers based on ARM CPUs). Therefore, it covers applications from servers and PCs to general embedded computing.

The new device is part of an existing family of TPMs for different market needs. First, it adds support for stronger conventional cryptographic algorithms such as RSA 3k and 4k, SHA-384, and ECC 384 and will soon support SHA-512 and ECC-521.

The important feature that allows security architects to reduce the risk of aforementioned large-scale attacks is its firmware update mechanism. The firmware update is not only signed using elliptic curves (here NIST-P521) but also by so-called XMSS signatures. XMSS is a digital signature scheme, which is quantum resistant and already standardized by NIST and other organizations. The Infineon update authority manages the ECC and XMSS keys and keeps firmware updates authentic. And while the PQC-protected firmware update mechanism marks only the beginning of a huge transition of the whole IT security industry towards PQC, it already closes an important attack vector.

Using Infineon’s GUI-based OPTIGA TPM 2.0 Explorer tool, which is available on the company’s GitHub repository, designers can initialize a TPM 2.0, display all properties, and perform a complete reset when necessary. The GUI provides immediate visual feedback, allowing commands run and responses received to be reviewed very quickly.

If the previous generation system already contains a TPM from the OPTIGA family, designing in the latest device in its QFN-32 package is a snap. It does have a different pin-out, due to internal routing of the die, but that should not be an issue during board layout. In addition, the tools are basically the same, just with the new functionality added.

To further simplify the design-in process, Infineon has released a series of evaluation boards. One board is for a PC-based system while another is aimed at Raspberry Pi developers.

---

Guillaume Raimbault is a Senior Manager of Product Marketing and Management for IoT Security in the Connected Secure Systems division at Infineon Technologies. He is in charge of the TPMs aimed at consumer/IoT and industrial applications. Guillaume holds an engineering diploma in electronics from INP - Phelma in Grenoble, France, and a master’s degree in marketing from the Grenoble Business School, France.