A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs • Hacker News Board

Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs

#91

Post by Youden » Mon, Apr 20, 2020, 12:55 PM UTC

userbinator wrote: post #74

I wonder if everyone who works on stuff like this is pro-DRM/anti-freedom, because while I've seen plenty of DRM-breaking papers which paint a very negative view of their findings (this one included), I can't recall seeing a single one which takes the opposite view that this is another step forward for freedom and right-to-repair. Are the researchers really believing that this is a bad thing, or is it because they're…

Circumvention of DRM is illegal or at least very much frowned-upon in many jurisdictions, while research on how to produce better DRM is not.

Framing it as "we broke DRM, isn't that great?" would be like framing a paper about a more effective silencer as "we made it easier to get away with murder, isn't that great?" (when instead it could be about "we made our special forces' jobs safer").

Plus, research papers in technical fields should try to be neutral, not a place for political activism.

Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs

#92

Post by thr0w__4w4y » Mon, Apr 20, 2020, 10:05 PM UTC

userbinator wrote: post #71

alexdowad wrote: post #20

Once I worked at a place which was very interested in protecting the IP inherent in their firmware. They gave me a research assignment to get an idea of how difficult it would be for an attacker to extract it as a binary given unlimited physical access to a sample device. Since I read and write Chinese, I did some searching on Chinese-language sites and found a company advertising their ability to do just that... for…

There are quite a few Chinese (and Russian, not surprisingly...) companies who will do "MCU breaks". $10k (USD) is near the high end of the price range; price depends on complexity and newness --- less than $1k for some of the common and older parts. Mikatech is one of the better-known and older ones. They are great for maintaining legacy equipment where the original company has either discontinued support or disappe…

I've often wondered -- and perhaps you don't know the answer, or there is no one typical answer -- but, do these companies in Russia, China, etc., that one pays to break the chip, promise to not re-sell the extracted chip contents? (Or maybe we should just remember the saying "no honor amongst thieves")

I think the last time I looked into a service like this, they required that you send them multiple targets to attack because normally the attack is invasive / destructive, and they might need to "burn through a few" before they succeed. If you have any experience in this area, do you know if that still holds true?

Thanks. Sorry to punish your useful answer with more questions.

Re: A Full Break of the Bitstream Encryption of Xilinx 7-Series FPGAs

#93

Post by userbinator » Tue, Apr 21, 2020, 1:04 PM UTC

thr0w__4w4y wrote: post #92

userbinator wrote: post #71

Earlier quoted context omitted.

There are quite a few Chinese (and Russian, not surprisingly...) companies who will do "MCU breaks". $10k (USD) is near the high end of the price range; price depends on complexity and newness --- less than $1k for some of the common and older parts. Mikatech is one of the better-known and older ones. They are great for maintaining legacy equipment where the original company has either discontinued support or disappe…

I've often wondered -- and perhaps you don't know the answer, or there is no one typical answer -- but, do these companies in Russia, China, etc., that one pays to break the chip, promise to not re-sell the extracted chip contents? (Or maybe we should just remember the saying "no honor amongst thieves") I think the last time I looked into a service like this, they required that you send them multiple targets to attac…

but, do these companies in Russia, China, etc., that one pays to break the chip, promise to not re-sell the extracted chip contents?

I don't know --- I imagine a lot of the time they wouldn't even know what equipment the chip came out of, and/or it's something extremely obscure, so it would be very hard to sell the contents.

I think the last time I looked into a service like this, they required that you send them multiple targets to attack because normally the attack is invasive / destructive, and they might need to "burn through a few" before they succeed. If you have any experience in this area, do you know if that still holds true?

If it's a new MCU they've not done before, they might ask for that --- to find where the protection fuses are. It doesn't have to be the actual one you want, just an example of a protected one along with the code it contains in order to "check their answers". That will cost quite a lot more than known-extractions, however.