Extracting the Private Key from a TREZOR ... with a 70 $ Oscilloscope

[bitbouillion]

http://johoe.mooo.com/trezor-power-analysis/

Paper claims that private keys from a TREZOR device could be extracted via a side channel attack, but newer firmware fixes the vulnerability.

[1715629426]

1715629426

[1715629426]

1715629426

[1715629426]

1715629426

[criptix]

nice link and good read thanks.

so every trezor user shoulda update their firmware asap

[doof]

Good read, great to see security research in this space.  Hope you get a tip!

[Fabrizio89]

Wow, that was some crazy shit

[innocent93]

Wow that is a creative attack!

[coinfusion]

Going by the pulse widths, it seems like a few cents worth of power filtering caps in the device would have prevented seeing anything exciting on the USB port.  He mentioned removing the screen as well to clean up the signal, so I guess the device isn't even tamper-resistant? It doesn't seem to be going by the Trezor website. Too bad everything has to be made as cheaply as possible.

[Hawkix]

Adding caps will not stop anyone to measure directly at the processor pins. And the device is tamper-evident, not resistant. Nothing is. The goal is to slower and make attack more expensive.

[gmaxwell]

Going by the pulse widths, it seems like a few cents worth of power filtering caps in the device would have prevented seeing anything exciting on the USB port.  He mentioned removing the screen as well to clean up the signal, so I guess the device isn't even tamper-resistant? It doesn't seem to be going by the Trezor website. Too bad everything has to be made as cheaply as possible.

It isn't connecting to the jtag is easier than the power analysis.

But-- not quite the same, it's conceivable that a sufficiently creative attacker could do basically the same power analysis attack just by recording EMI picked up by the soundcard in the computer or via RF emissions from the device. (It's apparently quite easy to pick up noise from the trezor from across the screen with a radio receiver).  People who've tried this have been frustrated by the extreme amount of noise put off by the screen and power regulators, but sufficiently advanced DSP may overcome it.

[coinfusion]

Adding caps will not stop anyone to measure directly at the processor pins. And the device is tamper-evident, not resistant. Nothing is. The goal is to slower and make attack more expensive.

That's true, 'swhy I specified power only at the USB port.  It would allow the tamper-evident feature to do its job, as only needing non-invasive monitoring would let someone try without being noticed.  It really only needs to withstand attack long enough for its owner to notice it missing.

.... it's conceivable that a sufficiently creative attacker could do basically the same power analysis attack just by recording EMI picked up by the soundcard in the computer or via RF emissions from the device. (It's apparently quite easy to pick up noise from the trezor from across the screen with a radio receiver).  People who've tried this have been frustrated by the extreme amount of noise put off by the screen and power regulators, but sufficiently advanced DSP may overcome it.

Hmm, I wonder if it's FCC class B certified.  Seems unlikely if it's throwing out a noticeable amount of RFI, so maybe using more elaborate shielding and coupling to the detector would help passive monitoring succeed.  Might try placing it near a machine with an old taiwanese ISA-bus soundblaster clone in it; those were great at picking up noise!

[jl2012]

I always feel uneasy to connect a device with private key directly to an untrusted online computer

I hope something like a audio modem could be implemented but seems it's too slow to be practically used?

https://bitcointalk.org/index.php?topic=135423.0

[coinfusion]

It took me a while to realize that gmaxwell was talking about secretly recording the audio interference from a nearby compromized computer which would then be retrieved and decoded by the attacker at a later time.

[gmaxwell]

It took me a while to realize that gmaxwell was talking about secretly recording the audio interference from a nearby compromized computer which would then be retrieved and decoded by the attacker at a later time.

Actually, from the computer the Trezor is connected to itself (after all, the point of the Tezor is the assumption the host computer is compromised); nearby would be an even more impressive stunt--  in terms of nearby but not connected; that would better be done with a software defined radio receiver (e.g. not merely a remote compromise).

All of that is a long shot, but thats the annoyance about defense; you have to defend against all attackers, and an attacker may spend a lot of time and resources on a single valuable target.  It's quite hard to be confident that you do not have an exploitable weakness. If you're sure you're secure you're probably not being creative enough.

[Darkblock]

It took me a while to realize that gmaxwell was talking about secretly recording the audio interference from a nearby compromized computer which would then be retrieved and decoded by the attacker at a later time.

Actually, from the computer the Trezor is connected to itself (after all, the point of the Tezor is the assumption the host computer is compromised); nearby would be an even more impressive stunt--  in terms of nearby but not connected; that would better be done with a software defined radio receiver (e.g. not merely a remote compromise).

All of that is a long shot, but thats the annoyance about defense; you have to defend against all attackers, and an attacker may spend a lot of time and resources on a single valuable target.  It's quite hard to be confident that you do not have an exploitable weakness. If you're sure you're secure you're probably not being creative enough.

wooow. crazy shit. reminds me of the hollywood movie "eagle eye". But not long ago i ve read an article about some scientists from Tel Aviv University who were able to extract RSA keys from the "noise" of a CPU!!! So the above scenario, where a nearby computer "attacks" a victim within his noise-recognition area by "listening to its processor", should be practically possible. maybe we should start adding noise protection measures to our computers and trezors... LOL

[bigbitmine]

You never break into my Trezor collection.

[Blazr]

This is why I always advise people to wait a few more years before using hardware wallets to store significant amounts of Bitcoin. They are too new, untested and unstudied and due to this they may have undiscovered flaws like this, in fact my opinion is that there are many other side-channel attacks similar to this, however in a few years once they have been better studied, tested and improved and we fully understand all the security concerns involved then hardware wallets will really shine.

[user2020]

This is why I always advise people to wait a few more years before using hardware wallets to store significant amounts of Bitcoin. They are too new, untested and unstudied and due to this they may have undiscovered flaws like this, in fact my opinion is that there are many other side-channel attacks similar to this, however in a few years once they have been better studied, tested and improved and we fully understand all the security concerns involved then hardware wallets will really shine.

Did you saw this?

http://www.eliptibox.com/#!The-perfect-hardware-part-1-REDBLACK/cw4e/54fdf26b0cf24585978defdb

Looks that it is claims to be protected against all of these attucks

[medUSA]

A good read. Demonstrates how a chain is only as strong as its weakest link. This attack is so easy for someone who knows the stuff. 512bit key generation defeated by a current meter.  

[gmaxwell]

Looks that it is claims to be protected against all of these attucks

Unlikely.  Power filtering cannot help you when the leak is so gross that it makes timing differences you could darn near measure with a stopwatch.

Though the device looks pretty interesting and would be good for applications where the software is already largely protected! But the invest page makes it severely smell like a scam.

[bitbouillion]

Looks that it is claims to be protected against all of these attucks

Unlikely.  Power filtering cannot help you when the leak is so gross that it makes timing differences you could darn near measure with a stopwatch.

In the article they also write about emission from signal lines. Electronic designers have been working for decades on such problems to avoid interference with other devices and to satisfy regulatory requirements. Simple layout changes of the PCB can achieve this at marginal cost. On the other hand electromagnetic emissions can't be completely avoided and an attacker can use more sophisticated measurement and analysis methods, but a good PCB design can drive the costs for such an attack significantly up. Therefore EMI-engineering should be mandatory for the development of security hardware.

[johoe]

Going by the pulse widths, it seems like a few cents worth of power filtering caps in the device would have prevented seeing anything exciting on the USB port.  

The TREZOR definitely has some filtering caps; Beyond 10 kHz I can see no signal.  The main problem was that the bn_inverse function is noisy (several branches) and quite slow in executing (it does a thousand additions of 256 bit numbers).  One could filter these out with larger caps but it probably was never a design requirement to put the largest cap that would fit inside the casing of the TREZOR.  And of course you can always break it open.  The problem with the noisy bn_inverse function has been fixed (now, it is only used once on the z coordinate of the public key, which is even randomized).

My next project is analysing the Ledger.  This has no filtering caps worth mentioning.  It is just the secure element with a USB connector.  The oscilloscope shows much more details.  However, some of it is noise the device is producing deliberately to make these kinds of analysis more difficulty.  It also randomizes the timing.  I will probably report more of this, once the analysis is finished.  Still, even with the secure elements, you can see a lot of details of the executed code on the power line.  The producers of the Ledger are aware of this and use constant time code to compute the public from the private key.  We will see, whether they did this right.