Smart Card Security

Smart Card Security

1. Invasive Attacks

   • Extraction of Smart Card Chip
   • Costly
     • Equipment
     • Time
   • Ion Beam to create tracks
   • Connect Fuses, Re-enable demo/test modes

2. Semi-Invasive Attacks

   • Exposure of Chip Surface
   • Monitoring electro- magnetic emanations
   • Injecting Faults

3. Non-Invasive Attacks

   • no modification

4. Random Numbers

   • Temp affect number gen
   • Pseudo-random, Linear Feedback Shift Registers

5. Protection

   • Anomaly Sensors
   • Physical Chip Shield

6. Side Channel Analysis

   • Observe information leakage during operation
   • passive
   • Timing Analysis
     • Time to calculate RSA keys
   • Power Analysis
     • Most common
     • Resistor in series with smart card and measuring potential difference
     • SPA, Simple Power Analysis
       • Observable Patterns in Power Sample for common functions
     • DPA, Differential Power Analysis
       • Hamming weight of data being manipulated
   • Electromagnetic Analysis
     • probe on top of chip measure emanations
     • complex, requires exposed chip
     • SEMA, DEMA
   • Countermeasures
     • Constant execution of crypto functions
     • Random Delay functions
     • Randomisation/ Data Whitening
     • Randomised Execution
     • not suitable for RSA, DES/AES OK

7. Fault Analysis

   • Faults Injected
     • Varying external clocking/temprature
     • Laser and White light
     • Electromagnetic flux
     • Read/Write operations fail
     • Data Randomisation
     • Changing CPU OP codes
   • Info Leaking
   • Countermeasures
     • Checksum key values
     • Execution Randomisation
     • Execution/variable redundancy
     • baits/trap values cause error