Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs

usenix.org

Post reply on HN
Print view View original

61–70 of 93 posts

Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs

#61

Post by lnsru »

duskwuff wrote: post #50
lnsru wrote: post #8

If I would really care about security, I would not pick SRAM FPGA in the first place. The are nice Flash based FPGAs out there for projects with high security requirements. They don’t need configuration devices leaking bitstream all over the place. On the other hand is somehow sad, that popular 7 series is compromised. Though I never saw a company, that cared about bitstream security. It was best case “nice to have”…

A lot of flash-based FPGAs are actually an SRAM FPGA with an internal flash die bonded to the configuration pins. The bitstream is harder to get to, but it's still available to a determined attacker.

Actel/Microsemi are very real Flash FPGAs while Altera/Intel MAX10 is SRAM FPGA with configuration Flash inside. Very nice and highly integrated chip, comfy development with it.

Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs

#62

Post by Teknoman117 »

grogenaut wrote: post #49
alexdowad wrote: post #20

Once I worked at a place which was very interested in protecting the IP inherent in their firmware. They gave me a research assignment to get an idea of how difficult it would be for an attacker to extract it as a binary given unlimited physical access to a sample device. Since I read and write Chinese, I did some searching on Chinese-language sites and found a company advertising their ability to do just that... for…

Having evaluated implemting game drm many times this nuance may or may not matter to the business. Most drm is a house of cards that a determined attacker can take out. It's still very widely used for good and bad reasons. And a lot of those reasons are not closely tied to the strength of a given implementation.

The DRM only has to function during the time where most sales occur for it to be worth it.

Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs

#63

Post by stragies »

Nokinside wrote: post #2

This is not small issue. Up to 10% of FPGA's in the market can be affected. RAID-, SATA-, NIC- controllers, Industrial control systems, mobile base stations, data centers, devices like encrypted USB sticks and HDD's. In some cases it's possible to carry the attack remotely.

Can your post be read as "In the near future, we might have the possibility of inspecting/re-programming a bunch of DMA--capable devices commonly found in systems"?

That would be great. I shudder to think what horrors may await us in USB-/Wifi-/Network-controller bit-streams/firmwares. But the sooner these things get opened, the better.

Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs

#64

Post by pmiller2 »

Teknoman117 wrote: post #62
grogenaut wrote: post #49

Earlier quoted context omitted.

Having evaluated implemting game drm many times this nuance may or may not matter to the business. Most drm is a house of cards that a determined attacker can take out. It's still very widely used for good and bad reasons. And a lot of those reasons are not closely tied to the strength of a given implementation.

The DRM only has to function during the time where most sales occur for it to be worth it.

Except that piracy doesn’t hurt sales and may actually help: https://www.engadget.com/2017-09-22-eu-suppressed-study-pira...

Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs

#65

Post by amelius »

voxadam wrote: post #37

Is there any way that the breaking of the Xlinix bitstream encryption opens the door to documenting and reverse engineering that bitstream in the same way that was done with Project IceStorm[0] for the Lattice iCE40 FPGAs? [0] Project IceStorm - http://www.clifford.at/icestorm/

It's such a sad situation. Why can't companies just provide all the necessary hardware info in the datasheet?

Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs

#66

Post by baby »

pmiller2 wrote: post #64
Teknoman117 wrote: post #62

Earlier quoted context omitted.

The DRM only has to function during the time where most sales occur for it to be worth it.

Except that piracy doesn’t hurt sales and may actually help: https://www.engadget.com/2017-09-22-eu-suppressed-study-pira...

I can see it being a spectrum.

For a big movie that people want to watch? Piracy probably hurt.

For a small indie that is in dire need of more exposure, then they're probably on youtube, but I can see how piracy could help.

If you're in the middle? Not clear.

Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs

#67

Post by ATsch »

amelius wrote: post #65
voxadam wrote: post #37

Is there any way that the breaking of the Xlinix bitstream encryption opens the door to documenting and reverse engineering that bitstream in the same way that was done with Project IceStorm[0] for the Lattice iCE40 FPGAs? [0] Project IceStorm - http://www.clifford.at/icestorm/

It's such a sad situation. Why can't companies just provide all the necessary hardware info in the datasheet?

Vendor lock-in is the primary way in which these companies make money

Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs

#68

Post by amelius »

ATsch wrote: post #67
amelius wrote: post #65

Earlier quoted context omitted.

It's such a sad situation. Why can't companies just provide all the necessary hardware info in the datasheet?

Vendor lock-in is the primary way in which these companies make money

But wouldn't an open specification be a much better value proposition for engineers?

Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs

#69

Post by ATsch »

Nokinside wrote: post #7
baybal2 wrote: post #4

Earlier quoted context omitted.

Only ones who need to keep firmwares secret will be affected. There are few companies I knew who transitioned from MCUs to FPGAs solely for their obsession of keeping their "IP" from leaking, hoping that FPGA will provide more obscuration than simple encrypted MCU firmware.

If the FPGA can be updated, attacker can take over the hardware and reprogram it. If attacker gets access to the bitstream, the has complete control over the FPGA.

This isn't a worry over device security. It's a worry about cloning. Most of the serious FPGA market is low-volume speciality devices that cost upwards 10-100k per unit, with yearly support contracts of that magnitude on top. Seismology, medical research, telecommunications... many of those products will be a raving success if they sell 1000 units. R&D is almost all of the cost and the hardware design is nothing special. You could clone these things with basically no investment if you have access to the bitstream. "Decompiled" bistream is also much more readable than assembly. That's why they're worried.

Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs

#70

Post by userbinator »

voxadam wrote: post #37

Is there any way that the breaking of the Xlinix bitstream encryption opens the door to documenting and reverse engineering that bitstream in the same way that was done with Project IceStorm[0] for the Lattice iCE40 FPGAs? [0] Project IceStorm - http://www.clifford.at/icestorm/

It'll help with encrypted bitstreams, not much else.

Besides, the lack of public RE efforts is AFAIK a political issue more than anything; the FPGA companies have been known to send lawyers at anyone who tries. The bitstream format itself is, following the layout of the FPGA itself, naturally going to be extremely regular and definitely not hard to figure out. They're really like a "worst kept secret" in the industry --- there are probably a lot of people who have already figured it out, but just don't want to attract legal attention.

Post reply on HN