On the Need of Physical Security for Small Embedded Systems: A Case Study with COMP128-1 Implementations in SIM Cards

Zhou, Yuanyuan;Yu, Yu;Standaert, François-Xavier;Quisquater, Jean-Jacques
(2013) Financial Cryptography and Data Security - 17th International Conference (FC 2013) — Location: Okinawa (Japan) (1.April.2013)

Files

125_long.pdf
  • Open Access
  • Adobe PDF
  • 1.5 MB
Download

Details

Authors
Abstract
Ensuring the physical security of small embedded devices is challenging. Such devices have to be produced under strong cost constraints, and generally operate with limited power and energy budget. However, they may also be deployed in applications where physical access is indeed possible for adversaries. In this paper, we consider the case of SIM cards to discuss these issues, and report on successful side-channel attacks against several (old but still deployed) implementations of the COMP128-1 algorithm. Such attacks are able to recover cryptographic keys with limited time and data, by measuring the power consumption of the devices manipulating them, hence allowing cards cloning and communications eavesdropping. This study allows us to put forward the long term issues raised by the deployment of cryptographic implementations. It provides a motivation for improving the physical security of small embedded devices early in their development. We also use it to argue that public standards for cryptographic algorithms and transparent physical security evaluation methodologies are important tools for this purpose.
Affiliations

Citations

  • APA
  • Chicago
  • FWB

Zhou, Y., Yu, Y., Standaert, F.-X., & Quisquater, J.-J. (2013). On the Need of Physical Security for Small Embedded Systems: A Case Study with COMP128-1 Implementations in SIM Cards. In Ahmad-Reza Sadeghi (ed.), Proceedings of Financial Cryptography and Data Security - 17th International Conference (FC 2013) (p. p. 230-238). Springer-Verlag. https://doi.org/10.1007/978-3-642-39884-1_20