This attack bench was develop in the context of hardware hacking project in collaboration with a research team. The goal was to demonstrate that remote side-channel attacks on power consumption could work with various encryption algorithm and attack target.
The bench provides FPGA power sensors that can be implemented on a remote fabric. It can perform attacks on the electronic board that can be located on a distant server and communicate results to an orchestrating computer. It succeeded in breaking the encryption key used by the famous OpenSSL's AES algorithm.
The main components of the bench are:
- The FPGA power consumption TDC and RO sensors
- The driver and communication C application running on the board
- The ochestrating Python software that perform computation for key breaking
The main demonstration flow with this bench goes as follows:
- Configure the board with the target encryption algorithm, could be CPU or FPGA
- Add in the fabric the malicious power sensor
- Launch power consumption acquisition
- Retrieve the data in the ochestrating application
- Compute encryption key guess and reiterate until sufficient
In the context of the bench we know the key used so we could test our guesses, this is how we know that the encryption worked.
Several challenges raised during this project, and it was really interesting to tackle each:
- Ensure correct scaling and configuration of the power sensor the attack a broad enough range of target
- Optimize board to computer communication to optimize bandwith consumption and accelerate attack
- Optimize the attack software to balance between waiting for the data and computing
The first challenge was mainly about hacking VHDL synthesis tools to manually place components in the fabric in a way that is consistent. I then implement a custom communication protocol for the power consumption that sent raw data to the computer in chunks to avoid having to many communication. Finally, the ochestrating software was using double-buffer in order to process result while acquiring new power consumption traces.
This project was one of the most rewarding for me and we achieved attacks on a various range of configuration. Thus, we won the IEEE 2022 Host SymposiumBEST hardware demo award.
The project have been used by many engineers, researchers and enthusiast since and I am still maintaining the project on GitHub.