A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs
1–10 of 93 posts
Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs
#2This is not small issue. Up to 10% of FPGA's in the market can be affected.
RAID-, SATA-, NIC- controllers, Industrial control systems, mobile base stations, data centers, devices like encrypted USB sticks and HDD's. In some cases it's possible to carry the attack remotely.
Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs
#3This is not small issue. Up to 10% of FPGA's in the market can be affected. RAID-, SATA-, NIC- controllers, Industrial control systems, mobile base stations, data centers, devices like encrypted USB sticks and HDD's. In some cases it's possible to carry the attack remotely.
Depending on your viewpoint, this may actually be a boon for reverse engineering efforts to counter planned obsolescence.
Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs
#4This is not small issue. Up to 10% of FPGA's in the market can be affected. RAID-, SATA-, NIC- controllers, Industrial control systems, mobile base stations, data centers, devices like encrypted USB sticks and HDD's. In some cases it's possible to carry the attack remotely.
Only ones who need to keep firmwares secret will be affected.
There are few companies I knew who transitioned from MCUs to FPGAs solely for their obsession of keeping their "IP" from leaking, hoping that FPGA will provide more obscuration than simple encrypted MCU firmware.
Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs
#5From the paper:
> On these devices, the bitstream encryption provides authenticity by using an SHA-256 based HMAC and also provides confidentiality by using CBC-AES-256 for encryption
> We identified two roots leading to the attacks. First, the decrypted bitstream data are interpreted by the configuration logic before the HMAC validates them. Second, the HMAC key is stored inside the encrypted bitstream
Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs
#6So can I use this hack to use open source tools on these FPGAs?
Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs
#7This is not small issue. Up to 10% of FPGA's in the market can be affected. RAID-, SATA-, NIC- controllers, Industrial control systems, mobile base stations, data centers, devices like encrypted USB sticks and HDD's. In some cases it's possible to carry the attack remotely.
Only ones who need to keep firmwares secret will be affected. There are few companies I knew who transitioned from MCUs to FPGAs solely for their obsession of keeping their "IP" from leaking, hoping that FPGA will provide more obscuration than simple encrypted MCU firmware.
If the FPGA can be updated, attacker can take over the hardware and reprogram it.
If attacker gets access to the bitstream, the has complete control over the FPGA.
Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs
#8If I would really care about security, I would not pick SRAM FPGA in the first place. The are nice Flash based FPGAs out there for projects with high security requirements. They don’t need configuration devices leaking bitstream all over the place.
On the other hand is somehow sad, that popular 7 series is compromised. Though I never saw a company, that cared about bitstream security. It was best case “nice to have” feature, usually being completely ignored.
Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs
#9So can I use this hack to use open source tools on these FPGAs?
No. It means people will be able to copy FPGA's like was possible in the 2000's. It also means that the design in an FPGA could be altered by an unauthorized 3rd party without having to physically replace the device.
Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs
#10Earlier quoted context omitted.
Only ones who need to keep firmwares secret will be affected. There are few companies I knew who transitioned from MCUs to FPGAs solely for their obsession of keeping their "IP" from leaking, hoping that FPGA will provide more obscuration than simple encrypted MCU firmware.
If the FPGA can be updated, attacker can take over the hardware and reprogram it. If attacker gets access to the bitstream, the has complete control over the FPGA.
It's more like access to replace the bitsteam. It's a complicated and expensive new attack vector.