Tutorial A5 Breaking AES-256 Bootloader - Revision history

Adewar at 13:34, 29 July 2019

2019-07-29T13:34:52Z

Show changes

Adewar: /* Continuing the Attack */

2018-10-10T20:28:45Z

‎Continuing the Attack

Adewar at 20:27, 10 October 2018

2018-10-10T20:27:33Z

Adewar at 20:24, 10 October 2018

2018-10-10T20:24:00Z

Gdeon: Update code for new SAD API

2018-08-04T04:21:26Z

Update code for new SAD API

Fheubach at 18:49, 1 May 2018

2018-05-01T18:49:54Z

Fheubach at 14:54, 1 May 2018

2018-05-01T14:54:31Z

Coflynn: /* 13th Round Key */

2017-11-07T18:12:12Z

‎13th Round Key

Coflynn: /* 13th Round Key */

2017-11-05T19:05:48Z

‎13th Round Key

Coflynn: /* 13th Round Key */

2017-11-05T19:03:14Z

‎13th Round Key

@@ Line 203: / Line 203: @@
 The next step is to program our own leakage model. The following Python code models the Hamming weight model of the 13th round S-box:
-<pre> python
+<syntaxhighlight lang="python">
 # Imports for AES256 Attack
 from chipwhisperer.analyzer.attacks.models.AES128_8bit import AESLeakageHelper
@@ Line 219: / Line 219: @@
          result = block
          return self.inv_sbox((result[bnum] ^ guess[bnum]))
-</pre>
+</syntaxhighlight>
 You can look back at the C code of the AES-256 decryption to see how this is implementing the decryption code. Note that because of the Inverse MixColumns operation, we need the entire input ciphertext -- otherwise, we would only need to operate on one byte of the ciphertext.
@@ Line 235: / Line 235: @@
 Finally, we need to convert this hypothetical key into the actual value of the 13th round key. We can do this by passing the key through ShiftRows and MixColumns to remove the effect of these two functions. This is easy to do in the Python console (assuming we had the recovered key <code>C6 BD 4E 50 AB CA 75 77 79 87 96 CA 1C 7F C5 82</code>, if you recovered a different key replace the <code>knownkey</code> value with yours):
-<pre>python
+<pre>
 >>> from chipwhisperer.analyzer.attacks.models.aes.funcs import shiftrows,mixcolumns
 >>> knownkey = [0xC6, 0xBD, 0x4E, 0x50, 0xAB, 0xCA, 0x75, 0x77, 0x79, 0x87, 0x96, 0xCA, 0x1C, 0x7F, 0xC5, 0x82]

@@ Line 200: / Line 200: @@
 [[File:A5_pp_resync_end.png|400px]]}}
-===  ===
+==== Continuing the Attack ====
 The next step is to program our own leakage model. The following Python code models the Hamming weight model of the 13th round S-box:
@@ Line 269: / Line 269: @@
 == Appendix A: Target Code ==
-<pre> python
+<syntaxhighlight lang=python>
 #!/usr/bin/python
 # -*- coding: utf-8 -*-
@@ Line 503: / Line 503: @@
          else:
              raise IOError("Failed to communicate, no response")
-</pre>
+</syntaxhighlight>
 == Appendix B: Capture Script ==
@@ Line 512: / Line 512: @@
 # Set the 'Target Module' as 'AES Bootloader' (you need to have that target on your system)
-<pre> python
+<syntaxhighlight lang=python>
 """Setup script for CWLite/1200 with XMEGA (CW303/CW308-XMEGA/CWLite target)
 specifically for Tutorial A5: the AES-256 bootloader attack
@@ Line 532: / Line 532: @@
 scope.io.tio2 = "serial_tx"
 scope.io.hs2 = "clkgen"
-</pre>
+</syntaxhighlight>
 == Appendix C: AES-256 14th Round Key Script ==

@@ Line 8: / Line 8: @@
 |capture hardware       = CW-Lite, CW-Lite 2-Part, CW-Pro
 |Target Device          =
-|Target Architecture    = XMEGA
+|Target Architecture    = XMEGA/Arm
 |Hardware Crypto        = No
 |Purchase Hardware      =
@@ Line 78: / Line 78: @@
 # Using the AES-256 key schedule, reverse the 13th and 14th round keys to determine the original AES-256 encryption key.
-== Setting up the Hardware ==
+== Building the Firmware ==
-This tutorial uses the [[CW1173 ChipWhisperer-Lite]] hardware. This hardware does not require any special setup - it should be ready to go out-of-the-box.
 Note that you '''don't need hardware''' to complete the tutorial. Instead, you can download [https://www.assembla.com/spaces/chipwhisperer/wiki/Example_Captures example traces from the ChipWhisperer Site]. Just look for the traces titled ''AVR: AES256 Bootloader (ChipWhisperer Tutorial #A5)''.
-=== Building/Programming the Bootloader ===
+{{CollapsibleSection
-{{Warningbox|Are you following this tutorial at a training event? If so ONLY use the provided hex-file with secret key already embedded, do not rebuild the firmware!}}
+{{CollapsibleSection
-The firmware that implements the bootloader is available inside the ChipWhisperer folder at <code>chipwhisperer\hardware\victims\firmware\bootloader-aes256</code>. If you've uploaded the firmware for any of the other tutorials, the process is identical:
+== Programming the Target ==
-# Open a command prompt/terminal window and navigate to this folder. Enter the command <code>make PLATFORM=X</code>, where X is the name of your target. For instance, use <code>PLATFORM=CW303</code> on the ChipWhisperer Lite. Ensure that the program is successfully compiled. The output should end with a line like
+{{CollapsibleSection
-#: <pre>Built for platform CW-Lite XMEGA</pre>
+|intro = === Programming the STM32F3 (CW303 Arm) Target ===
-# Open the ChipWhisperer Capture software and connect to your hardware. Open the programmer window (''Tools > CW-Lite XMEGA Programmer''), find the <code>.hex</code> file that you just made, and ''Erase/Program/Verify FLASH''.
+|content= Programming Arm}}
-The firmware is now loaded onto your hardware, and you can continue onto the capture process.
+{{CollapsibleSection
 == Capturing the Traces ==
@@ Line 129: / Line 155: @@
 ## Use the toolbar to quickly reset the zoom back to original
 ##: [[File:Tutorial-A5-Plot-Traces.PNG|image]]
-##: Notice that the traces are synchronized for the first 7000 samples, but become unsynchronized later. This fact will be important later in the tutorial.
+##: Notice that the traces are synchronized for the first 7000 samples (if you're attacking an XMEGA target), but become unsynchronized later. This fact will be important later in the tutorial.
 # Set up the attack in the ''Attack'' script:
 ## Make a copy of the ''attack_cpa.py'' script, call it something new (such as ''attack_aesdec14.py'')
@@ Line 138: / Line 164: @@
 ## and then also change this further down where we set the leakage model:
 ##: <pre>leak_model = AES128_8bit(InvSBox_output)</pre>
-## If you're finding the attack very slow, narrow down the attack a bit. Normally, this requires a bit of investigation to determine which ranges of the trace are important. Here, you can use the range from 2900 for 4200. The default settings will also work fine! To do this adjust the following line to look as follows:
+## If you're finding the attack very slow, narrow down the attack a bit. Normally, this requires a bit of investigation to determine which ranges of the trace are important. Here, you can use the range from 2900 to 4200 for XMEGA and from 1400 to 2600 for STM32F3 (CW303 Arm). The default settings will also work fine, so if you're using another target, you may want to attack the full range. To narrow the attack, edit the <code>attack.setPointRange(0, -1)</code> with the new range.
 ##: <pre>attack.setPointRange((2900, 4200))</pre>
 # Note that we do ''not'' know the secret encryption key, so we cannot highlight the correct key automatically. If you want to fix this, the ''Results'' settings tab has a Highlighted Key setting. Change this to Override mode and enter the key <code>ea 79 79 20 c8 71 44 7d 46 62 5f 51 85 c1 3b cb</code>.
@@ Line 164: / Line 190: @@
 Unfortunately, we cannot use the GUI to attack the 13th round key. The system has no built-in model for round 13 of the AES-256 algorithm. Instead, we can write our own script and insert a custom model into the system. See [[#Appendix D: AES-256 13th Round Key Script]] for complete script used here.
 # Open the ChipWhisperer Analyzer software again and reopen the project file (if closed).
 # Recall from the 14th round attack that the trace data becomes unsynchronized around sample 7000. This is due to a non-constant AES implementation: the code does not always take the same amount of time to run for every input. (It's actually possible to do a timing attack on this AES implementation! We'll stick with our CPA attack for now.)
@@ Line 173: / Line 200: @@
 [[File:A5_pp_resync_end.png|400px]]}}
 The next step is to program our own leakage model. The following Python code models the Hamming weight model of the 13th round S-box:
-<pre>
+<pre> python
 # Imports for AES256 Attack
 from chipwhisperer.analyzer.attacks.models.AES128_8bit import AESLeakageHelper
@@ Line 199: / Line 227: @@
 #:<pre>leak_model = AES128_8bit(AES256_Round13_Model)</pre>
 # As we did in the 14th round attack, reducing the point range can speed up the attack. For example, to use a smaller range of points, try changing the <code>setPointRange()</code> function call to
-#:<pre>self.attack.setPointRange((8000,10990))</pre>
+#:<pre>self.attack.setPointRange((8000,10990))</pre> on XMEGA or <pre>self.attack.setPointRange((6500,8500))</pre> for the STM32.
 # Start the attack! Wait for the attack to complete, and you will determine the 13th round key:
 #: [[File:Tutorial-A5-Results-Round-13.PNG|image]]
@@ Line 207: / Line 235: @@
 Finally, we need to convert this hypothetical key into the actual value of the 13th round key. We can do this by passing the key through ShiftRows and MixColumns to remove the effect of these two functions. This is easy to do in the Python console (assuming we had the recovered key <code>C6 BD 4E 50 AB CA 75 77 79 87 96 CA 1C 7F C5 82</code>, if you recovered a different key replace the <code>knownkey</code> value with yours):
-<pre>
+<pre>python
 >>> from chipwhisperer.analyzer.attacks.models.aes.funcs import shiftrows,mixcolumns
 >>> knownkey = [0xC6, 0xBD, 0x4E, 0x50, 0xAB, 0xCA, 0x75, 0x77, 0x79, 0x87, 0x96, 0xCA, 0x1C, 0x7F, 0xC5, 0x82]
@@ Line 241: / Line 269: @@
 == Appendix A: Target Code ==
-<pre>
+<pre> python
 #!/usr/bin/python
 # -*- coding: utf-8 -*-
@@ Line 484: / Line 512: @@
 # Set the 'Target Module' as 'AES Bootloader' (you need to have that target on your system)
-<pre>
+<pre> python
 """Setup script for CWLite/1200 with XMEGA (CW303/CW308-XMEGA/CWLite target)
 specifically for Tutorial A5: the AES-256 bootloader attack
@@ Line 527: / Line 555: @@
 attack.setReportingInterval(10)
 attack.setTargetSubkeys([0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15])
-attack.setPointRange((2900, 3400))
+attack.setPointRange((2900, 4200))
 self.results_table.setAnalysisSource(attack)

@@ Line 135: / Line 135: @@
 ##: <pre>from chipwhisperer.analyzer.attacks.models.AES128_8bit import AES128_8bit, SBox_output</pre>
 ##: and change that line to:
-##: <pre>from chipwhisperer.analyzer.attacks.models.AES128_8bit import AES128_8bit, InvBox_output</pre>
+##: <pre>from chipwhisperer.analyzer.attacks.models.AES128_8bit import AES128_8bit, InvSBox_output</pre>
 ## and then also change this further down where we set the leakage model:
 ##: <pre>leak_model = AES128_8bit(InvSBox_output)</pre>
@@ Line 563: / Line 563: @@
 resync_traces.enabled = True
 resync_traces.ref_trace = 0
-resync_traces.ref_points = (9100, 9300)
+resync_traces.target_window = (9100, 9300)
-resync_traces.input_window = (8900, 9500)
+resync_traces.max_shift = 200
 attack = CPA()

@@ Line 583: / Line 583: @@
 attack.processTraces()
 </syntaxhighlight>
 {{Template:Tutorials}}
 [[Category:Tutorials]]

@@ Line 17: / Line 17: @@
 Whilst the tutorial assumes you will be performing the entire capture of traces along with the attack, it is possible to download the traces if you don't have the hardware, in which case skip section [[#Setting up the Hardware]] and [[#Capturing the Traces]].
-= Background =
+== Background ==
 In the world of microcontrollers, a bootloader is a special piece of firmware that is made to let the user upload new programs into memory. This is especially useful for devices with complex code that may need to be patched or otherwise updated in the future - a bootloader makes it possible for the user to upload a patched version of the firmware onto the micro. The bootloader receives information from a communication line (a USB port, serial port, ethernet port, WiFi connection, etc...) and stores this data into program memory. Once the full firmware has been received, the micro can happily run its updated code.
@@ Line 24: / Line 24: @@
 This tutorial will work with a simple AES-256 bootloader. The victim will receive data through a serial connection, decrypt the command, and confirm that the included signature is correct. Then, it will only save the code into memory if the signature check succeeded. To make this system more robust against attacks, the bootloader will use cipher-block chaining (CBC mode). Our goal is to find the secret key and the CBC initialization vector so that we could successfully fake our own firmware.
-== Bootloader Communications Protocol ==
+=== Bootloader Communications Protocol ===
 The bootloader's communications protocol operates over a serial port at 38400 baud rate. The bootloader is always waiting for new data to be sent in this example; in real life one would typically force the bootloader to enter through a command sequence.
@@ Line 58: / Line 58: @@
 Then, after replying to the command, the bootloader veries that the signature is correct. If it matches the expected manufacturer's signature, the 12 bytes of data will be written to flash memory. Otherwise, the data is discarded.
-== Details of AES-256 CBC ==
+=== Details of AES-256 CBC ===
 The system uses the AES algorithm in Cipher Block Chaining (CBC) mode. In general one avoids using encryption 'as-is' (i.e. Electronic Code Book), since it means any piece of plaintext always maps to the same piece of ciphertext. Cipher Block Chaining ensures that if you encrypted the same thing a bunch of times it would always encrypt to a new piece of ciphertext.
@@ Line 69: / Line 69: @@
-== Attacking AES-256 ==
+=== Attacking AES-256 ===
 The system in this tutorial uses AES-256 encryption, which has a 256 bit (32 byte) key - twice as large as the 16 byte key we've attacked in previous tutorials. This means that our regular AES-128 CPA attacks won't quite work. However, extending these attacks to AES-256 is fairly straightforward: the theory is explained in detail in [[Extending AES-128 Attacks to AES-256]].
@@ Line 78: / Line 78: @@
 # Using the AES-256 key schedule, reverse the 13th and 14th round keys to determine the original AES-256 encryption key.
-= Setting up the Hardware =
+== Setting up the Hardware ==
 This tutorial uses the [[CW1173 ChipWhisperer-Lite]] hardware. This hardware does not require any special setup - it should be ready to go out-of-the-box.
 Note that you '''don't need hardware''' to complete the tutorial. Instead, you can download [https://www.assembla.com/spaces/chipwhisperer/wiki/Example_Captures example traces from the ChipWhisperer Site]. Just look for the traces titled ''AVR: AES256 Bootloader (ChipWhisperer Tutorial #A5)''.
-== Building/Programming the Bootloader ==
+=== Building/Programming the Bootloader ===
 {{Warningbox|Are you following this tutorial at a training event? If so ONLY use the provided hex-file with secret key already embedded, do not rebuild the firmware!}}
@@ Line 96: / Line 96: @@
 The firmware is now loaded onto your hardware, and you can continue onto the capture process.
-= Capturing the Traces =
+== Capturing the Traces ==
 Once the hardware is ready, we can capture some traces for our attack using the ChipWhisperer Capture software. If you somehow got to the 5th ''Advanced Tutorial'' without getting this software ready, you can follow the helpful guide at [[Installing ChipWhisperer]].
@@ Line 115: / Line 115: @@
 # Once the program is finished capturing the traces, save the project. Put it somewhere memorable and give it a nice name.
-= Finding the Encryption Key =
+== Finding the Encryption Key ==
 Now that we have our traces, we can go ahead and perform the attack. As described in the background theory, we'll have to do two attacks - one to get the 14th round key, and another (using the first result) to get the 13th round key. Then, we'll do some post-processing to finally get the 256 bit encryption key.
-== 14th Round Key ==
+=== 14th Round Key ===
 We can attack the 14th round key with a standard, no-frills CPA attack:
@@ Line 161: / Line 161: @@
 ''NOTE: if you're stuck, a full listing of the attack script is given in [[#Appendix C: AES-256 14th Round Key Script]].''
-== 13th Round Key ==
+=== 13th Round Key ===
 Unfortunately, we cannot use the GUI to attack the 13th round key. The system has no built-in model for round 13 of the AES-256 algorithm. Instead, we can write our own script and insert a custom model into the system. See [[#Appendix D: AES-256 13th Round Key Script]] for complete script used here.
@@ Line 218: / Line 218: @@
 Our hard work has rewarded us with the 13th round key, which is <code>c6 6a a6 12 4a ba 4d 04 4a 22 03 54 5b 28 0e 63</code>.
-== Recovering the Encryption Key ==
+=== Recovering the Encryption Key ===
 Finally, we have enough information to recover the initial encryption key. In AES-256, the initial key is used in the key expansion routine to generate 15 round keys, and we know the key for round 13 and 14. All we need to do now is reverse the key scheduling algorithm to calculate the ''0/1 Round Key'' from the ''13/14 Round Key''.
@@ Line 237: / Line 237: @@
 Peek into <code>supersecret.h</code>, confirm that this is the right key, and celebrate!
-= Next Steps =
+== Next Steps ==
 If you want to go further with this tutorial, [[Tutorial A5-Bonus Breaking AES-256 Bootloader]] continues working with the same firmware to find the remaining secrets in the bootloader (the IV and the signature).
-= Appendix A: Target Code =
+== Appendix A: Target Code ==
 <pre>
 #!/usr/bin/python
@@ Line 477: / Line 477: @@
 </pre>
-= Appendix B: Capture Script =
+== Appendix B: Capture Script ==
 Note you need to manually CONNECT to the CW-Lite & AES Bootloader target before running this. To do this:
@@ Line 506: / Line 506: @@
 </pre>
-= Appendix C: AES-256 14th Round Key Script =
+== Appendix C: AES-256 14th Round Key Script ==
 Full attack script, copy/paste into a file then run from within ChipWhisperer-Analyzer:
@@ Line 536: / Line 536: @@
 </syntaxhighlight>
-= Appendix D: AES-256 13th Round Key Script =
+== Appendix D: AES-256 13th Round Key Script ==
 <syntaxhighlight lang=python>

@@ Line 197: / Line 197: @@
 # Add the above function to your custom script file.
 # Change the <code>setAnalysisAlgorithm</code> in the script to use your custom functions by making the following call:
-#:<pre>leak_model = AES128_8bit(AES256_Model)</pre>
+#:<pre>leak_model = AES128_8bit(AES256_Round13_Model)</pre>
 # As we did in the 14th round attack, reducing the point range can speed up the attack. For example, to use a smaller range of points, try changing the <code>setPointRange()</code> function call to
 #:<pre>self.attack.setPointRange((8000,10990))</pre>

@@ Line 169: / Line 169: @@
 # Resynchronize the traces, see the separate 'Preprocessing' tutorial (NB: only in slides right now!)
-{{warningbox|Make sure you get a nice aligned last section of the traces, as in the above figure. You may need to adjust the "input window" or "reference points" slightly. If you do not see the nice alignment the remaining attack will fail!}}
+{{warningbox|Make sure you get a nice aligned last section of the traces, as in the below figure. You may need to adjust the "input window" or "reference points" slightly. If you do not see the nice alignment the remaining attack will fail!
 The next step is to program our own leakage model. The following Python code models the Hamming weight model of the 13th round S-box:

@@ Line 164: / Line 164: @@
 Unfortunately, we cannot use the GUI to attack the 13th round key. The system has no built-in model for round 13 of the AES-256 algorithm. Instead, we can write our own script and insert a custom model into the system. See [[#Appendix D: AES-256 13th Round Key Script]] for complete script used here.
-The ChipWhisperer Analyzer software uses the settings in the GUI to automatically adjust an attack script. Every time you change a setting in the GUI, the autogenerated script is overwritten. Fpr example, the point range is mapped directly to an API call:
+# Open the ChipWhisperer Analyzer software again and reopen the project file (if closed).
-−
-[[File:autoscript1.png|image]]
-−
-If we modified this script directly, it would be very easy for us to accidentally overwrite our custom script from the GUI. Instead, we'll use the autogenerated code to set up a base script, then add in our own attack model. To set up the base script, the procedure is as follows:
-−
 # Open the ChipWhisperer Analyzer software again and reopen the project file.
 # Recall from the 14th round attack that the trace data becomes unsynchronized around sample 7000. This is due to a non-constant AES implementation: the code does not always take the same amount of time to run for every input. (It's actually possible to do a timing attack on this AES implementation! We'll stick with our CPA attack for now.)
 #: [[File:syncproblems.png|image]]
-# Resynchronize the traces:
+# Resynchronize the traces, see the separate 'Preprocessing' tutorial (NB: only in slides right now!)
-## In the ''Attack Script Generator'' tab, enable the ''Resync: Sum of Difference'' preprocessing:
-##: [[File:resyncsad.png|image]]
-## Enable the module and configure the input points. To start, set the reference points to (9063, 9177) and the input window to (9010, 9080), but don't be afraid to change these ranges:
-##: [[File:resyncsad2.png|image]]
-## Redraw the traces and confirm we now have synchronization on the second half:
-##: [[File:resyncsad3.png|image]]
 {{warningbox|Make sure you get a nice aligned last section of the traces, as in the above figure. You may need to adjust the "input window" or "reference points" slightly. If you do not see the nice alignment the remaining attack will fail!}}
 The next step is to program our own leakage model. The following Python code models the Hamming weight model of the 13th round S-box:
@@ Line 195: / Line 175: @@
 <pre>
 # Imports for AES256 Attack
-from chipwhisperer.analyzer.attacks.models.base import ModelsBase
+from chipwhisperer.analyzer.attacks.models.AES128_8bit import AESLeakageHelper
-from chipwhisperer.analyzer.attacks.models.AES128_8bit import AESLeakageHelper, AES128_8bit
-class AES256_Model(AESLeakageHelper):
+class AES256_Round13_Model(AESLeakageHelper):
-    name = 'Our model'
      def leakage(self, pt, ct, guess, bnum):
-         knownkey = <PUT YOUR 14TH ROUND KEY YOU RECOVERED HERE>
+         #You must but YOUR recovered 14th round key here - this example may not be accurate!
-         #For example: knownkey = [0xea, 0x79, 0x79, 0x20, 0xc8, 0x71, 0x44, 0x7d, 0x46, 0x62, 0x5f, 0x51, 0x85, 0xc1, 0x3b, 0xcb]
+         calc_round_key = [0xea, 0x79, 0x79, 0x20, 0xc8, 0x71, 0x44, 0x7d, 0x46, 0x62, 0x5f, 0x51, 0x85, 0xc1, 0x3b, 0xcb]
-         xored = [knownkey[i] ^ pt[i] for i in range(0, 16)]
+         xored = [calc_round_key[i] ^ pt[i] for i in range(0, 16)]
          block = xored
          block = self.inv_shiftrows(block)
@@ Line 217: / Line 195: @@
 # Add the above function to your custom script file.
 # Change the <code>setAnalysisAlgorithm</code> in the script to use your custom functions by making the following call:
-#:<pre>leakage_object = AES128_8bit(AES256_Model)</pre>
+#:<pre>leak_model = AES128_8bit(AES256_Model)</pre>
 # As we did in the 14th round attack, reducing the point range can speed up the attack. For example, to use a smaller range of points, try changing the <code>setPointRange()</code> function call to
 #:<pre>self.attack.setPointRange((8000,10990))</pre>