[Cryptography] RAM memories as one source of entropy

[Joachim Strömbergson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Aloha!

Kent Borg wrote:
> That doesn't mean that there might not be other ways to get
> interesting entropy from DRAM, just that is doesn't seem to be free
> for the reading in recent hardware; you might have to do some
> hardware engineering to do it, at which point there have got to be
> better ways to add some entropy-yielding hardware to your design.

No, there seems to be quite a lot of problems. Esp with remanence and
temperature. Even though the cited papers shows some promise, there are
quite a lot of others that shows other problems. There are actually real
issues with using RAM memories that we will have to consider and design
mitigation solutions to in our Cryptech design.

The paper "Data remanence in semiconductor devices" from 2001 by Peter
Gutmann is a very good and relevant paper. He describes the remanence
effects and specifically points to the problem of having keys in SRAM
memories at fixed positions. This is something we probably should plan
to handle.
http://www.cypherpunks.to/~peter/usenix01.pdf


Sergei P. Skorobogatov has written several papers on remanence effects
and points to the need to detect that the ambient temperature for the
system to not be lower than a given level. If that happens keys should
be destroyed. This applies for all memories: "Semi-invasive attacks -- A
new approach to hardware security analysis" from 2005 is a good paper:
http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-630.pdf

But Skorobogatov also shows that just temperature detection is enough.
We really should do active zeroisation of memories when a relevant event
has been reached (temperature, breach of tamper protection, unplanned
movement of unit etc.) And external SRAM power supply connection should
be automatically shorted to ground whenever the power is off. Floating
VCC seems to drastically increase remanence.

The paper "Data Remanence Effects on Memory Based Entropy Collection for
RFID Systems" from 2011 by Nitesh Saxena and Jonathan Voris is probably
the most relevant for the discussion of using SRAM as basis for entropy.
The papers shows that the remanence effects are bad enough to make it
impractical to use in RFID tags in which the memory is also used for
other processing. The extraction of enough entropy simply takes too long
time. Esp. when the temperature drops. A good paper.
https://www.cs.columbia.edu/~jvoris/papers/ijis_11.pdf


Finally there are at least some design work being done to implement SRAM
cells with remanence protection. The paper "Security strategy of
powered-off SRAM for resisting physical attack to data remanence" from
2009 describes modified SRAM cells that reduces remanence effects. This
is not very applicable to Cryptech though since we will not be building
ASICs (though someone might use the Cryptech design to do so):
http://goo.gl/7T8Sll


Remanence can even be used as a clock the TARDIS protocol uses decay
memory decay as part of a secure protocol for embedded devices. Really
cool research!
http://goo.gl/zgeS1y

- -- 
Med vänlig hälsning, Yours

Joachim Strömbergson - Alltid i harmonisk svängning.
========================================================================
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBCAAGBQJS+KYZAAoJEF3cfFQkIuyNudAQAKtujdnXMJ0XHgUF0093sIeR
Fys4LjSiYS9rEdatCMFEWVuiH8F32O7yUJlhnqw9Mcp5SOmcjtpoObRTYxWIIHRj
TAKdub/hHb0nSyfupNd8Y1+zzO5CtX+VHC0n5Raq56RnOFC1awCfYhM6rGFtdPca
VGNBgA1rERqqY0+gfJt709JUVLWftUQD28kobjO966o+ir5GUP6c5sBMzLaPL/to
TLAjNR7MYIxDrE3+B9slF2dPdFNcpS1ZURY1e2zObBJK2n1OS6nJ/1lSnjBQ+Gh3
bvom4vAxijlZwmZ3U1FF+AWiHz36aI6VQm0Na+39T2bEDmKAvTN7MBE1t60T3LZ7
qosKSqfh6r/W6GD270n5zP6Nx1OzTgrQf+z72/PUL4niZJ+HSV4C2pCHBLHCHX/N
mYd/9lxM9f7UPnzlOcjB3cqtBSMaR91tqYQWDEWlGnA3RnLtVhKuulxSS/Ak2zTU
gGm4ZJc9n66a+3LdgZYxzHKzt3wOA5f4oEzTXGuJcx4Wu9RnS7je+qX1Fp049t/a
+eObo8NHSlOEG5W0YApRtn43iGUBZ+2A8HKYQclkpYwaaYd84VL27siuO4sYxwjo
F21klR739uPdtEgvoEfDcwQAOm3sJx0UctykYIkS3KTKuT16T5+cI/tN+Aw+9o/r
95cxu07s5q5XOq0yN+up
=KrLO
-----END PGP SIGNATURE-----