Microcontroller Basics

• microcontroller: small computer on a single integrated circuit
  • CPU (1..n): pipelined, mainly 32 bit, here ARM Cortex-M4, each with its own cache
    • symmetric: many equal general purpose cores
    • asymmetric: one general purpose core, rest dedicated processors
    • registers (Cortex-M4): low general purpose (r0-r7), high general purpose (r8-r12), main / process stack pointer (r13), link register (r14), program counter (r15)
  • cache: fast memory, increase performance, decrease power
  • scratch pad memory: usable by user and compiler as small, fast memory
  • interrupt unit: handles async. events, can be a simple register that triggers a specific handler or a complicated design which prioritizes certain interrupts and injects jump instructions
    • XMC4500: ERU0/1 (Event Request Unit)
  • debug: external serial debugger interface
    • UART: communication
    • JTAG: debugging and programming
  • high bandwidth bus: bus or switch matrix to connect to on chip memories, I/O, DMA, caches
  • slow bus: for config registers and slow peripherals
  • bus bridge: connects different busses, load reduction
  • memory: code and data
    • RAM: volatile, erased after power-down
      • XMC4500: PSRAM (program), DSRAM1/2 (data / communication)
    • ROM: non-volatile, mask programmed, boot code
    • Flash, EEPROM, FRAM: non-volatile, erasable
  • MMU / MPU: manages access rights, mapping between virtual and physical addresses
    • DMA: bus master for data transfer between peripherals and memory without talking to CPU
  • fast I/O: ethernet, PCIe, external memory interfaced (SD, DDRx...)
  • slow I/O:: UART, I²C, SPI, CAN...
  • accelerators: dedicated pieces of hardware (e.g. crypto)
  • AD/DA: analog-to-digital / digital-to-analog converters
  • timer: time measurement, pulse width modulation
    • XMC4500: SCU (System Control Unit), RTC (Real-Time Clock), WDT (Watchdog Timer), CCU4/8 (Capture/Compare Unit)
      • CCU: timer counts up / down based on a clock; compare mode (specify value to compare against timer), capture mode (external signal causes timer count to be stored)
  • control units: startup, power management, clock control...
  • MMI: man machine interface (displays, keypads...)
  • HSM: hardware security module, basically a TPM but more complex?
• PC vs. embedded system
  • PC: programs are loaded through OS into RAM, libraries mostly dynamically linked
  • embedded: programs reside in on-chip Flash memory / ROM and are directly executed from there, statically linked

CPU Architecture Characteristics

• Princeton / von Neumann: shared memory for code and data and common bus
• Harvard: separate code and data memories and busses
  • XMC4500: unified address space BUT separate busses for peripherals, data load (D-Code) and instruction fetch (I-Code), so modified Harvard
• addressing modes: immediate (op: data), register direct (op: reg., reg. content: data), register indirect (op: reg., reg. content: mem. addr.)
• memory-mapped I/O: peripheral control, status, and data registers mapped into regular address space (eq: von Neumann), typically for on-chip peripherals
  • +: circuitry reuse, no additional instructions required
  • -: memory bus has to connect to every peripheral (reducing max. clock frequency)
• port mapped I/O: peripheral control, status, and data registers in special address space(s), accessed via special instructions (eq: Harvard), typically for off-chip peripherals
  • +: less performance necessary (easier / smaller bus), peripheral bus does not slow down memory access
  • -: additional complexity

File Types

• ELF: executable and linkable format
  • linker: reads as input which can be linked with other objects
  • loader: interprets as executable program
• sections
  • .text: program code
  • .data: initialized data, larger than 64KB
  • .sdata: initialized data, smaller than 64KB
  • .bss: uninitialized data, larger than 64KB
  • .sbss: uninitialized data, smaller than 64KB
  • .rodata: non-volatile default initialization parameters and data
  • user-defined: _loader (loader), _wflash (flash programmer), _monitor (debugger)...
• *.o: compiled, unlinked object files, not human readable
• *.elf: compiled and linked programs, ready to execute on target architecture, may contain debug information
• *.hex: pure machine code + address information, binary encoded in hex digits, generated from the ELF file, for use by the flash programmer
• *.lst: human readable copy of parts of the ELF file, by objdump
• *.map: lists all symbols in the final program along with their memory addresses and the size of the different sections
• locator: maps compiled program into µC's Flash, RAM, and other memory regions, taking multiple factors (e.g. available memories, speeds) into account...

Pulse Width Modulation

• pulse width modulation (PWM): square wave that switches between HIGH and LOW (higher duty cycle \to$\to$ higher brightness for LEDs)
  • clock frequency: determines how fast the counter runs
  • period: 0 1 2 3 ... p, restart from 0 once p is reached
  • compare: counter is constantly compared with another value called the compare value c; when they're equal, the output changes state
  • duty cycle (XMC4500): d=1-\frac{c}{p+1}$d=1-\frac{c}{p+1}$ (larger compare value \to$\to$ smaller duty cycle, vice versa...)
    • shadow registers: if p or c change halfway through a cycle, XMC4500 first stores these new values inside shadow registers and only copies them at a safe moment (e.g. counter wraps around or reaches zero) to avoid glitches

100% duty cycle
████████████████████
--------------------> time

50% duty cycle
████____████____████
--------------------> time

20% duty cycle
██______██______██__
--------------------> time

100% duty cycle
████████████████████
--------------------> time

50% duty cycle
████____████____████
--------------------> time

20% duty cycle
██______██______██__
--------------------> time

Cortex M4

• RISC: distinct load and store instructions, lacking memory addressing modes for data processing instructions (e.g. add), fixed length instructions
• pipeline stages: Fetch, Decode, Execute
• Nested Vectored Interrupt Controller (NVIC): primary interrupt controller
  • nested: higher-priority interrupts can preempt lower ones
  • vectored handling: jumps directly to the correct Interrupt Service Routine (ISR) via a vector table, reducing latency
• Wake-up Interrupt Controller (WIC): optional add-on to NVIC; allows processor to wake up from sleep / low power mode when an interrupt occurs
• SysTick: 24-bit down-counter that can be used as a periodic timer or a simple counter; generates an interrupt when it reaches zero (and optionally reloads)

• low vs. high registers: in 16-bit Thumb encodings, 3 bits are used in instruction register fields \to$\to$ 8 accessible registers, so accessing r8-r12 needs 32-bit Thumb-2 instructions (less dense)
  • caller-saved: r0-r3, r12; may be clobbered by any subroutine
  • callee-saved: r4-r11; must be preserved during calls
  • function arguments: r0-r3, then stack
  • return value: r0 (32-bit), r1:r0 (64-bit)
• Main Stack Pointer (MSP): default stack pointer used by the Cortex-M4 for exception handlers, interrupts, and privileged/kernel code
• Process Stack Pointer (PSP): an alternative stack pointer that can be used in Thread mode for application threads or unprivileged code, set via processor control register
• combined Program Status Register (xPSR): status information
  • Application PSR (APSR): ALU flags (N, Z, C, V, Q, GE)
  • Execution PSR (EPSR): Thumb state (Cortex M4: always 1)
  • Interrupt PSR (IPSR): exception number of the currently handled exception
• bringing 32-bit literal into register: tricks needed due to limited instruction length (32 bit fixed, 16 bits in Thumb)
  • flexible operand2: 8-bit constant fits certain patterns
    • shifted anywhere within 32-bit block: 0x0003_F800 (0xFE << 10)
    • copy expanded to bits 31-0: 0xFEFE_FEFE
    • copy expanded to bits 23-16, 7-0: 0x00FE_00FE
    • copy expanded to bits 31-24, 15-8: 0xFE00_FE00
  • mov for lower 16 bits, movt for upper 16 bits
  • literal pool: literal is placed into the text section right after the current function and is loaded from there using the PC with an offset automatically calculated by the assembler (ldr r0,=0x12345678)
• jumps: b,bx
• calls: bl, blx (link register needs to be updated)

Circuitry Basics

• high-Z (high impedance): pin is almost completely disconnected from the circuit; pin becomes a floating input, so its voltage can drift, pick up noise from nearby wires, or stay at whatever voltage was last there
• pull-up / pull-down resistor: ensures that a wire will have a high logic level or low logic level, respectively, in the absence of a driving signal

Embedded Communication Standards

• Inter-Integrated Circuit (I²C): synchronous, multi-master, multi-slave, serial
  • uses: connecting low-speed peripherals like sensors, RTCs, OLED displays, ADCs / DACs to microcontrollers
• Inter-IC Sound (I²S): synchronous, specifically designed for digital audio; separates clock and data so it can maintain precise timing without jitter
  • uses: audio codecs, DACs, ADCs, microphones, amplifiers between µCs and audio chips
• Serial Peripheral Interface (SPI): synchronous, full-duplex (sim. send / receive), master-slave; very high speeds
  • uses: Flash memory, SD cards, displays, sensors, ADCs / DACs, high-speed communication between peripherals and µCs
• Controller Area Network (CAN): robust, multi-master, message-based, serial
  • uses: any system needing reliable communication in noisy environments
• Universal Asynchronous Receiver-Transmitter (UART): asynchronous, serial
  • uses: debug consoles, GPS modules, Bluetooth modules, between µCs, legacy devices
• Recommended Standard 232 (RS-232): serial
  • uses: legacy computer peripherals (modems, printers)
• Universal Serial Bus (USB): high-speed, host-device, serial
  • uses: just about anything

Universal Serial Bus (USB)

• tiered star topology: all transfers initiated by host, no device-to-device communication
  • software: bus carrying packets
  • hardware: point-to-point connections
• device classes: standardized protocol, easy, installation-free, generic services (e.g. single driver for all mass storage devices)
  • risks: autostart; device contains multiple interfaces with drivers loaded automatically (e.g. mouse and storage device simultaneously)

1. detect device and speed
2. read device descriptor
3. assign address
4. select configuration
5. read interface descriptor
6. load driver

Khattak & Koopman Code Review Checklist

Attacking UART, JTAG

• UART (4-pin): serial console; many embedded Linux systems are configured to provide a login prompt on the first serial port they detect; in practice, the console often shows boot messages and / or drops you straight into a root shell
• JTAG (14-pin a.o.): debug interface, low-level access to processor's internals via scan chain (most notably allows firmware dump); should be permanently disabled in secure products, at the cost of ease of debugging

Attacking ICs

• power: lowering power supply \to$\to$ bring analog circuitry out of operating point; glitching power supply \to$\to$ increase precision of induced errors
  • example results: bias RNG towards all 1s, glitch password comparison instruction to always pass
• clock: increase frequency \to$\to$ cause setup or hold-time violations in registers; glitching clock \to$\to$ cause errors at specific points in time; reduce frequency \to$\to$ ease observing / manipulating signals
  • example results: same as power attacks...
• lasers: open-chip; photo-current can set / reset bits
  • example result: clear lock bits
• Focused Ion Beam (FIB): can almost arbitrarily rewire chip in top metal layer
  • but: lifetime of chip severely degraded

IBM Attacker Taxonomy

• class I: outsiders, limited (publicly available) knowledge, moderately sophisticated tooling
• class II: insiders, specialized education and experience, highly sophisticated tooling
• class III: funded organizations, teams of specialists with great funding, most advanced tooling available
• class IV (update): government agencies, legal and technical ability to add backdoors to commercial products

Interrupts and Exceptions

• interrupt: external event (e.g. keyboard, clock...)
  • usage: wakeup from sleep, timer interrupt, communication peripherals, DMA
• exception: internal event, caused by condition inside processor (e.g. segmentation fault, divide by 0...)
  • usage: debugging, scheduling, processor mode switch, MPU/MMU reconfiguration

• interrupt sources: actual hardware devices or internal events that want the CPU's attention (need service? \to$\to$ activate line)
• interrupt flags: register where each bit corresponds to one interrupt source (source activates \to$\to$ set corresponding flag bit until software clears)
• interrupt mask / mask register / interrupt enable register: another register with one bit per interrupt source; mask bit decides whether the interrupt is allowed to reach the CPU (0: interrupt can proceed, 1: interrupt blocked)
• exception number: unique identifier that the CPU uses to determine exactly what kind of interrupt or exception just occurred and where to find the corresponding handler routine

Cortex M4 Interrupt Handling

1. store registers on stack (in this order!): PC, xPSR, r0-r3, r12, LR
   • PC will be overwritten as soon as possible, which is why it's stored first
2. load handler address into PC (indexed by interrupt number)
3. switch to privileged mode
4. update interrupt number in IPSR
5. store where to return to in LR: another interrupt (nested) or standard program + mode (user / privileged)

Types of Interrupts

• level triggered: active as long as the interrupt line remains at a particular level; SW needs to clear the interrupt bit in the peripheral
  • +: harder to miss, works well when multiple devices share the line
  • -: if not cleared, the CPU can get stuck repeatedly servicing the same interrupt
• edge triggered: occurs only when the signal changes state (rising / falling edge), event has to be stored in the interrupt controller (executed? \to$\to$ controller clears flag)
  • +: no need for the device to keep the line asserted
  • -: easier to miss an interrupt if the edge occurs while interrupts are disabled and the hardware doesn't latch it

Level Triggered Interrupt Line:

Low  ________________________
     |                      |
High |                      |__________

CPU sees interrupt pending the entire time.

Level Triggered Interrupt Line:

Low  ________________________
     |                      |
High |                      |__________

CPU sees interrupt pending the entire time.

Edge Triggered Interrupt Line:

Low  ________        __________
              |      |
High          |______|

              ^
          Interrupt!

Edge Triggered Interrupt Line:

Low  ________        __________
              |      |
High          |______|

              ^
          Interrupt!

• polling: CPU repeatedly checks whether a device needs attention, instead of waiting for the device to notify it
  • +: deterministic timing, behavior; faster event reaction
  • -: power waste, no parallel execution possible

Exercises

• interrupts
  1. how often does the interrupt occur? interrupts only happen when the event actually occurs: f_{IRQ}=\frac1{T_{event}}$f_{IRQ}=\frac1{T_{event}}$
     • example: event every 2 seconds \to f_{IRQ} = 0.5 Hz$\to f_{IRQ} = 0.5 Hz$
  2. CPU load from context switching: context switch on entering and leaving ISR: P_{switch}=\frac{2\cdot t_{switch}}{T_{event}}$P_{switch}=\frac{2\cdot t_{switch}}{T_{event}}$
     • example: 4 µs context switch, event every second \to \frac{8µs}{1s}=0.0008\%$\to \frac{8µs}{1s}=0.0008\%$
  3. check whether deadline met: ISR can only begin after interrupt latency: t_{latency} + t_{proc} \leq D?$t_{latency} + t_{proc} \leq D?$
     • example: 5 µs latency, 30 µs subroutine, 50 µs deadline \to 5 + 30 = 35 < 50$\to 5 + 30 = 35 < 50$
  4. overall interrupt CPU load: processing also costs CPU time: P_{process} = \frac{t_{proc}}{T_{event}}$P_{process} = \frac{t_{proc}}{T_{event}}$, P_{interrupt} = P_{switch} + P_{process}$P_{interrupt} = P_{switch} + P_{process}$
• polling: poll must detect the event early enough that processing finishes before the deadline
  1. compute slack: remaining time after processing: Slack = D - t_{proc}$Slack = D - t_{proc}$
     • example: deadline 50 µs, processing 30 µs \to$\to$ slack 20 µs (i.e. the event must be detected within 20 µs)
  2. account for polling time: polling itself takes time: T_{poll,max} = Slack - t_{poll}$T_{poll,max} = Slack - t_{poll}$
     • example: slack 20 µs, poll 2 µs \to$\to$ maximum interval 18 µs
  3. polling frequency: f_{poll} = \frac1{T_{poll,max}}$f_{poll} = \frac1{T_{poll,max}}$
     • example: maximum interval 18 µs \to$\to$ 55.6 kHz
  4. polling CPU load: every poll costs t_{poll}$t_{poll}$: P_{poll} = f_{poll} \cdot t_{poll} = \frac{t_{poll}}{T_{poll,max}}$P_{poll} = f_{poll} \cdot t_{poll} = \frac{t_{poll}}{T_{poll,max}}$
     • example: \frac2{18}=11.1\%$\frac2{18}=11.1\%$
  5. overall polling CPU load: P_{polling}+P_{process}$P_{polling}+P_{process}$

Exceptions

• exception: predefined interrupt resulting from external event (e.g. NMI), instruction (e.g. reset), fault condition (e.g. bus fault), debug event, system timer interrupt
  • fault: synchronous (precise), return address points to the instruction that caused the exception (exception handler may fix the problem and then restart the program, making it look like nothing has happened)
  • trap: synchronous (precise), return address points to the instruction after the one that has just completed
  • abort: asynchronous (imprecise), return address is not always reliably supplied, program must not continue

Boot Sequence

1. power-up, hardware reset: power-on reset and other reset events occur, hardware initializes clock sources and latches boot mode selection pins
2. CPU executes BootROM code: startup software (SSW) runs first and performs essential initializations (clock system setup, memory initialization and protection), checks reset causes
3. boot mode selection: normal boot (user application in Flash), BSL (bootstrap loader for Flash programming via UART / CAN; code loaded into PSRAM), PSRAM boot (run code already in PSRAM)...
4. application startup: transfer control to user application or BSL loader; application sets up own vector table, stack pointer, clocks, peripherals...

Memory

• cache: makes use of spatial + temporal locality, controlled by a hardware cache controller
  • +: better performance, lower power consumption
  • -: more expensive, costs chip area, attack target, timing hard to predict (worst case \to$\to$ disable caches)
• ARM privilege modes: user mode, privileged mode (recently: also hypervisor mode)
• ARM memory access types: normal, device, strongly-ordered, execute never (XN)
  • normal: reorder anything and / or perform speculative reads
  • device: preserve transaction order w.r.t. device / strongly-ordered memory
  • strongly-ordered: preserve transaction order w.r.t. all other memory operations, do not buffer memory transactions
  • execute never (XN): generate fault on execution of an instruction inside a XN region
    • stack attack prevention: avoids executing code from stack, but does not prevent code reuse attacks / overwriting return address

Memory Management

• virtual memory: splits physical memory into blocks (pages) and assigns these to processes
  • large pages: smaller translation tables, more data per page, less page faults
  • small pages: less memory fragmentation, faster paging
• memory management unit (MMU): fast address translation with TLB, access right management as MPU, bookkeeping with status bits

Sections

• virtual memory address (VMA): where the variables / contents live during execution
• load memory address (LMA): where the initial values of the .data section are stored in the program image (typically FLASH)
• stack: size can be read from *.lst, can be made larger in linker description file but must still fit in PSRAM
• heap: starts after .bss but not directly, because there is always going to be some allocater header data before the actual data; size not readable from *.lst (use debugger + memory allocation call), size limit is defined instead in linker description and must fit in DSRAM1
• FLASH vs. EEPROM
  • write speed and granularity
    • FLASH: needs to be erased in pages of 64KiB before it can be written, takes more than a second
    • EEPROM: can be written on byte-level in only a few milliseconds
  • write endurance
    • FLASH: ~10.000 write cycles
    • EEPROM: ~100.000 write cycles
  • (!) FLASH typically used for firmware updates, EEPROM used for persistent (user) data

Power off
    ↓
FLASH                      SRAM
+------------------+       +------------------+
| counter = 5      |       |      garbage     |
+------------------+       +------------------+

Power on / Reset
    ↓
Startup code runs before main()

memcpy(.data in FLASH → .data in SRAM)
memset(.bss, 0)

FLASH                      SRAM
+------------------+       +------------------+
| counter = 5      | ----> | counter = 5      |
+------------------+       +------------------+

main() starts

Power off
    ↓
FLASH                      SRAM
+------------------+       +------------------+
| counter = 5      |       |      garbage     |
+------------------+       +------------------+

Power on / Reset
    ↓
Startup code runs before main()

memcpy(.data in FLASH → .data in SRAM)
memset(.bss, 0)

FLASH                      SRAM
+------------------+       +------------------+
| counter = 5      | ----> | counter = 5      |
+------------------+       +------------------+

main() starts

Stack Frame

• previous frame: includes function arguments passed via stack
• local variables: the larger the variable, the lower the address (typically); because string variables are usually the largest, this results in the other locals being vulnerable
• endianness: describes how datatypes larger than one byte are ordered in memory
  • little endian: least significant byte in lowest address (XMC4500)
  • big endian: most significant byte in lowest address

MPU Configuration

• up to 8 regions, distinguished by priority (i.e. only one per priority level; higher-priority regions override lower-priority ones where they overlap)
  • region size: between 32 B and 4 GB
  • base address must be aligned to size: size 2^n$2^n$ B \to$\to$ lowest n$n$ address bits zero
  • R/W controlled for both privilege levels separately, X only for both together (no execute = XN flag)
• background region: privileged level, lowest priority, fallback for areas not covered (default memory map privileges)

Security Services (Assets) and Cryptography

• confidentiality: protection from unauthorized information retrieval
  • measures: access rules, data encryption, information flow control (classification of objects and subjects)
  • confinement problem: side channels
• integrity: protection from unauthorized, unnoticed modification of data / messages
  • measures: access rules (rwx / communication channel access), isolation (sandbox, VM, physical isolation...), manipulation detection (hashes, checksums...)
• availability: protection from unauthorized interference with the usability / correct function of a system
  • measures: determination of thresholds (e.g. avoid overloading), recording and controlling allocations
• accountability: ensures an entity's actions can be uniquely traced back to it
  • non-repudiation: a party cannot credibly deny having performed a specific action or sent/received specific dat
  • measures: logging, auditing, signatures
• authenticity: proof of identity of an object / subject
  • measures: rules for unique identification (password, biometrics...), methods of proving identity correctness (e.g. challenge-response, certificates...)
• privacy: protection of personal data and any data regarding the private sphere to ensure the right of self-determination
  • measures: rules for avoidance / minimization of data, data aggregation (k-anonimity), pseudonyms (identity only known to trusted third party), non-traceability (variable pseudonyms)

Symmetric Cryptography

• issues: key distribution (common secret key must be shared between every two partners before any communication takes place), key management (\frac{n(n-1)}2$\frac{n(n-1)}2$ keys needed to be shared among n$n$ partners), non-repudiation (impossible)

Asymmetric Cryptography

• fixes: key distribution, key management
• hybrid cryptography: because using asymmetric encryption for large data can be very expensive...
  • idea: use symmetric crypto for data and asymmetric crypto for ephemeral key
• digital signature: "sign" message with private key; anyone can verify with public key (does not imply encryption!)
  • goals: integrity, authenticity, non-repudiation

Cryptographic Hash Functions

• preimage resistance: given hash value h$h$, find m$m$ such that h=h(m)$h=h(m)$
• second preimage resistance: given m_1$m_1$, find m_2$m_2$ such that h(m_2)=h(m_1)$h(m_2)=h(m_1)$
• collision resistance: find two messages with the same hash value
  • birthday paradox: collision resistance requires the hash value to have twice the size that would be required to achieve preimage resistance (2^{n/2}$2^{n/2}$ for collision resistance birthday attack vs. 2^n$2^n$ for brute-force preimage resistance)

Confusion and Diffusion

• diffusion: every bit of input into the cryptographic algorithm shall affect all bits of the output
• confusion: the relation between plaintext and ciphertext shall be highly complex; known pairs of (plaintext, ciphertext) should not allow to recover the key

Memory Encryption

• memory encryption: encrypt content of main memory
  • why? protection from piracy, modification of critical parameters, feature enabling...
• non-volatile memory: data can only be read when device is powered on and fully function \to$\to$ protect with ephemeral key
  • ephemeral key: random, generated on boot; data written / read XORed with this key
    • +: fast; key changes with every power-up
    • -: known plaintext attack possible; same plaintext always encrypts to same ciphertext
• external memory encryption: before usage on chip, data must be decrypted and buffered in RAM
  • PUF (physical unclonable function): hardware-intrinsic security primitive that generates a unique, device-specific “fingerprint” based on the uncontrollable physical variations that occur during semiconductor manufacturing (e.g., tiny differences in transistor thresholds, wire delays, ring oscillator frequencies, SRAM startup patterns, etc.)
  • high speed and throughput needed? \to$\to$ block ciphers
  • same data in different sectors should yield different ciphertexts? \to$\to$ tweakable ciphers
• tweakable ciphers: use a tweak to avoid leakage
  • example: ECB, two people have same salary \to$\to$ same ciphertext
  • solution: use name as tweak

• malleability: an attacker who doesn't know the key can still make predictable changes to the plaintext by flipping bits in the ciphertext
  • specifically: changing bits in ciphertext block c_i$c_i$ completely garbles plaintext block m_i$m_i$ (which is often acceptable if it's junk data), but it predictably flips the exact same bits in the next plaintext block m_{i+1}$m_{i+1}$.

Side Channel Attacks

• fault (injection) attacks: active, semi-invasive; the attacker purposefully introduces errors (faults) during operation
  • examples: light emissions, disturbing voltage, operation outside of temperature range
  • goals: bypassing checks, extracting secrets, overwriting values
• side-channel attacks: non-invasive attacks
  • examples: timing, power, electromagnetic radiation

Advanced Encryption Standard (AES)

• substitution-permutation network (SPN): block cipher design structure, done in multiple rounds
  • substitution (S-layer): non-linear confusion step, implemented via lookup tables
  • permutation (P-layer): linear diffusion step, shuffles bits around
• Advanced Encryption Standard (AES): uses byte-oriented SPN on 128-bit blocks organized as 4x4 byte matrix
  • SubBytes: each of the 16 bytes is passed through a fixed 8-bit S-box \to$\to$ confusion
  • ShiftRows: bytes in each row of the state matrix are cyclically shifted by different offsets (0, 1, 2, 3 positions) \to$\to$ diffusion (inter-byte)
  • MixColumns: each column of the state is treated as a polynomial over GF(2⁸)$GF(2⁸)$ and multiplied by a fixed matrix \to$\to$ diffusion (column-wise)
  • AddRoundKey: key mixing

Trusted Computing

• trusted: the system works according to design and policy
• trustworthy: trusted + can be verified convincingly
• trust level: the extent to which someone can be confident that the system meets its specifications
• RSA: asymmetric crypto algorithm
  1. generate private large (~1000 bit) primes p$p$, q$q$
  2. compute public n = p \cdot q$n = p \cdot q$ (~2048 bit)
  3. compute (private) Euler's totient \phi(n) = (p-1)(q-1)$\phi(n) = (p-1)(q-1)$
  4. choose public exponent e$e$ such that \gcd(\phi(n), e)=1$\gcd(\phi(n), e)=1$
  5. compute private exponent d$d$ such that e \cdot d \equiv_{\phi(n)} 1$e \cdot d \equiv_{\phi(n)} 1$ (i.e. d$d$ modular multiplicative inverse of e$e$, see EEA)
  6. public key E = (e,n)$E = (e,n)$
  7. private key D = (d,n)$D = (d,n)$
  • encryption: send confidential message from A$A$ to B$B$
    • A$A$ knows B$B$'s public key: E_B = (e_B, n_B)$E_B = (e_B, n_B)$
    • message m$m$, treated as a number <n$<n$
    • encryption (A$A$): c = m^e \mod n$c = m^e \mod n$ (using B$B$'s public key)
    • decryption (B$B$): m = c^d \mod n$m = c^d \mod n$ (using B$B$'s private key)
  • digital signing: prove authenticity and integrity (i.e. message came from A$A$ and wasn't altered)
    • A$A$ signs with private key
    • signature: s = m^d \mod n$s = m^d \mod n$ (typically cryptographic hash, not message)
    • anyone can verify with A$A$'s public key: s^e \mod n= m?$s^e \mod n= m?$
  • authenticity problem: MITM possible if X$X$ replaces B$B$'s public key such that only X$X$ can decrypt now
    • problem: identity and public key are separated
    • solution: bind them using certificates
  • certificates: a certificate authority (CA, trusted third party) issues certificates; you need to trust the CA
    • cer(A) = \{A, E_A, sign(hash(A,E_A),D_{CA})\}$cer(A) = \{A, E_A, sign(hash(A,E_A),D_{CA})\}$
      • A$A$: identity (name)
      • E_A$E_A$: public key of A$A$
      • sign(hash(A,E_A),D_{CA})$sign(hash(A,E_A),D_{CA})$: hash of identity and public key, signed with CA's private key D_{CA}$D_{CA}$ (integrity of A$A$'s data + authenticity of CA)
    • verification: use public key of CA to verify signature
    • encryption: A$A$ verifies B$B$'s certificate with CA's public key and encrypts message with B$B$'s verified public key
    • digital signing: B$B$ verifies A$A$'s public key from CA

Device Identifier Composition Engine (DICE)

• Device Identifier Composition Engine (DICE): hardware-based root of trust (RoT; trusted, passive) specification; lightweight, scalable way to establish strong cryptographic identities, measurements, and attestation for devices
  • motivation: TPM cost increase critical for low-cost devices + space requirements prohibitive for tiny products, TPM software may need to be updated
  • DICE boot code: root of trust for measurement; may either be immutable after manufacturing or updateable (securely via manufacturer)
  • Unique Device Secret (UDS): uniqueness must be trusted, >256 bits, protection capabilities have to be sufficient (HW protection to disallow rewriting, SW protection to ensure only DICE boot code has access)
  • DeviceID: long-term, identity of hardware + root software, changes only if very early boot code or UDS changes, used for device enrollment
    • DevID certificate contains public key of manufacturer to authenticate update software
  • Alias Key / Cert: short-term, firmware-specific, changes if level 1 (firmware) changes, for authentication, attestation and encryption

Trusted Platform Module (TPM)

• trusted platform module (TPM): specialized hardware-based security chip; provides a secure, tamper-resistant environment for performing cryptographic operations and storing sensitive data, isolated from the main CPU and operating system; root of trust (trusted, passive)
  • features: true RNG, cryptographic functions (hashing, keygen, encryption, MAC...), secure storage, platform integrity measurement
  • transitive trust: each component measures the next before handing over control
  • Platform Configuration Registers (PCRs): cryptographically record system state
    • PCR_{new} = H(PCR_{old} || Measurement)$PCR_{new} = H(PCR_{old} || Measurement)$, stored in Stored Measurement Log (SML) for verification
  • verification: replay SML events, compare against TPM PCR values
  • endorsement key (EK): unique, non-migratable, manufacturer-generated
  • storage root key (SRK): top of key hierarchy; protects other keys
  • credentials: endorsement, platform, conformance
  • sealing: encrypts data bound to specific PCR values; only unsealed if in exact trusted state
  • attestation: TPM signs PCR values and logs to prove the platform's state to remote parties
  • 1.2 vs. 2.0: algorithm flexibility, hierarchy model, key derivation, always-on

Concept of Separation

• separation: separating resources used by different tasks / threads / processors / cores
  • goals: avoid resource corruption through attacks, confidentiality

Software Separation

• differences between privilege levels: available CPU instructions, control registers, memory access restrictions, different stacks
• switching via exception handler: mechanism reuse

Hardware Separation (TrustZone)

• memory address space separation: memory is split into...
  • secure memory: can only be accessed from secure world; default
  • non-secure memory: can be accessed from both worlds
  • non-secure callable: accessing API of secure functions from non-secure world; must follow special structure, otherwise fault
• switching instructions: bxns (branch exchange non secure, S \to$\to$ NS), blxns (branch and link, exchange non secure, S \to$\to$ NS), sg (secure gateway, NS \to$\to$ S)
  • S \to$\to$ NS: complete register set is pushed onto secure stack, registers cleared, link register set to special value, blxns <addr>
    • NS \to$\to$ S (return): detect special link register, unstack complete register set, bx lr
  • NS \to$\to$ S: label must be sg followed by b <addr>; stack caller saved registers on non-secure stack, bl func_a
    • S \to$\to$ NS (return): clear registers (except return), bxns lr
  • tt: test if all parameters transferred to the secure function are accessible to the non-secure caller; most secure property combining SAU + IDAU + MPC + PPC
    • Secure Attribution Unit (SAU): defines memory regions (S, NS, NS-Callable), max. 8 programmable regions
    • Implementation Defined Attribution Unit (IDAU): device specific region definitions
    • Memory Protection Controller (MPC): local region management, attached to memory devices
    • Peripheral Protection Controller (PPC): region management for complex peripherals on AXI bus