Achtung:

Sie haben Javascript deaktiviert!
Sie haben versucht eine Funktion zu nutzen, die nur mit Javascript möglich ist. Um sämtliche Funktionalitäten unserer Internetseite zu nutzen, aktivieren Sie bitte Javascript in Ihrem Browser.

Data Center Building O Show image information

Data Center Building O

Hardware Accelerated Cold-Boot Attacks

Abstract

Cooling memory prior to extraction.

Cold-boot attacks exploit the fact that DRAM contents are not immediately lost when a computer system is powered off. Instead the contents decay rather slowly, in particular if the DRAM chips are cooled to low temperatures. This effect opens an attack vector on cryptographic applications that keep decrypted keys in DRAM. An attacker with access to the target computer can reboot it or remove the RAM modules and quickly copy the RAM contents to non-volatile memory. By exploiting the known cryptographic structure of the cipher and layout of the key data in memory the resulting memory image can be searched for sections that could correspond to decayed cryptographic keys. Then, the attacker can attempt to reconstruct the original key. However, the runtime of these algorithms grows rapidly with increasing error rate and complexity of the bit error model (non-idealized asymmetric decay), which limits the practicability of the approach in software.

Main steps of a cold-boot attack.

In this project, we study how the algorithms for key search (streaming, [Rie13]) and key reconstruction (recursive branch-and-bound, [Rie14]) can be accelerated with custom computing machines. We present several FPGA-based architectures that accelerate cold-boot attacks for AES encrypted data. As special features, we A) explore hardware workers that autonomously cooperate using work stealing to allow parallel execution and full utilization of the target FPGA, B) show the advantages of instance-specific designs that target a specific hard problem instance to improve performance and finally, we C) demonstrate how instance-specific designs can be generated just-in-time such that the provided speedups outweigh the additional time required for design synthesis [Rie17].

Source Code

Source code of our software and hardware implementations as well as our evaluation data and a demo application are available online at github.com/pc2/coldboot.

Publications


Open list in Research Information System

Efficient Branch and Bound on FPGAs Using Work Stealing and Instance-Specific Designs

H. Riebler, M. Lass, R. Mittendorf, T. Löcke, C. Plessl, ACM Transactions on Reconfigurable Technology and Systems (TRETS) (2017), pp. 24:1-24:23

DOI
Abstract

Branch and bound (B&B) algorithms structure the search space as a tree and eliminate infeasible solutions early by pruning subtrees that cannot lead to a valid or optimal solution. Custom hardware designs significantly accelerate the execution of these algorithms. In this article, we demonstrate a high-performance B&B implementation on FPGAs. First, we identify general elements of B&B algorithms and describe their implementation as a finite state machine. Then, we introduce workers that autonomously cooperate using work stealing to allow parallel execution and full utilization of the target FPGA. Finally, we explore advantages of instance-specific designs that target a specific problem instance to improve performance. We evaluate our concepts by applying them to a branch and bound problem, the reconstruction of corrupted AES keys obtained from cold-boot attacks. The evaluation shows that our work stealing approach is scalable with the available resources and provides speedups proportional to the number of workers. Instance-specific designs allow us to achieve an overall speedup of 47 × compared to the fastest implementation of AES key reconstruction so far. Finally, we demonstrate how instance-specific designs can be generated just-in-time such that the provided speedups outweigh the additional time required for design synthesis.


Reconstructing AES Key Schedules from Decayed Memory with FPGAs

H. Riebler, T. Kenter, C. Plessl, C. Sorge, in: Proceedings of Field-Programmable Custom Computing Machines (FCCM), IEEE, 2014, pp. 222-229

DOI
Abstract

In this paper, we study how AES key schedules can be reconstructed from decayed memory. This operation is a crucial and time consuming operation when trying to break encryption systems with cold-boot attacks. In software, the reconstruction of the AES master key can be performed using a recursive, branch-and-bound tree-search algorithm that exploits redundancies in the key schedule for constraining the search space. In this work, we investigate how this branch-and-bound algorithm can be accelerated with FPGAs. We translated the recursive search procedure to a state machine with an explicit stack for each recursion level and create optimized datapaths to accelerate in particular the processing of the most frequently accessed tree levels. We support two different decay models, of which especially the more realistic non-idealized asymmetric decay model causes very high runtimes in software. Our implementation on a Maxeler dataflow computing system outperforms a software implementation for this model by up to 27x, which makes cold-boot attacks against AES practical even for high error rates.


FPGA-accelerated Key Search for Cold-Boot Attacks against AES

H. Riebler, T. Kenter, C. Sorge, C. Plessl, in: Proceedings of the International Conference on Field-Programmable Technology (FPT), IEEE, 2013, pp. 386-389

DOI
Abstract

Cold-boot attacks exploit the fact that DRAM contents are not immediately lost when a PC is powered off. Instead the contents decay rather slowly, in particular if the DRAM chips are cooled to low temperatures. This effect opens an attack vector on cryptographic applications that keep decrypted keys in DRAM. An attacker with access to the target computer can reboot it or remove the RAM modules and quickly copy the RAM contents to non-volatile memory. By exploiting the known cryptographic structure of the cipher and layout of the key data in memory, in our application an AES key schedule with redundancy, the resulting memory image can be searched for sections that could correspond to decayed cryptographic keys; then, the attacker can attempt to reconstruct the original key. However, the runtime of these algorithms grows rapidly with increasing memory image size, error rate and complexity of the bit error model, which limits the practicability of the approach.In this work, we study how the algorithm for key search can be accelerated with custom computing machines. We present an FPGA-based architecture on a Maxeler dataflow computing system that outperforms a software implementation up to 205x, which significantly improves the practicability of cold-attacks against AES.


Open list in Research Information System

 

Keywords

cold-boot attacks; key reconstruction; key find; AES; key schedule; branch-and-bound; FPGA; Field programmable gate arrays; hardware acceleration; work stealing in hardware; instance-specific computing; just-in- time synthesis; on-demand synthesis; cryptographic applications; bit error model; Maxeler dataflow computing system; open-source

Contact

Heinrich Riebler

Paderborn Center for Parallel Computing (PC2)

Research Associate

Heinrich Riebler
Phone:
+49 5251 60-5382
Fax:
+49 5251 60-1714
Office:
O2.158
Web:

Michael Laß

Paderborn Center for Parallel Computing (PC2)

Research Associate

Michael Laß
Phone:
+49 5251 60-1722
Fax:
+49 5251 60-1714
Office:
O2.149
Web:

Prof. Dr. Christian Plessl

Paderborn Center for Parallel Computing (PC2)

Christian Plessl
Phone:
+49 5251 60-5399
Fax:
+49 5251 60-1714
Office:
O2.167
Web:

The University for the Information Society