Cryptology ePrint Archive: Report 2010/169

Dismantling SecureMemory, CryptoMemory and CryptoRF

Flavio D. Garcia and Peter van Rossum and Roel Verdult and Ronny Wichers Schreur

Abstract: The Atmel chip families SecureMemory, CryptoMemory, and CryptoRF use a proprietary stream cipher to guarantee authenticity, confidentiality, and integrity. This paper describes the cipher in detail and points out several weaknesses. One is the fact that the three components of the cipher operate largely independently; another is that the intermediate output generated by two of those components is strongly correlated with the generated keystream. For SecureMemory, a single eavesdropped trace is enough to recover the secret key with probability 0.57 in 2^{39} cipher ticks. This is a factor of 2^{31.5} faster than a brute force attack. On a 2 GHz laptop, this takes around 10 minutes. With more traces, the secret key can be recovered with virtual certainty without significant additional cost in time. For CryptoMemory and CryptoRF, if one has 2640 traces it is possible to recover the key in 2^{52} cipher ticks, which is 2^{19} times faster than brute force. On a 50 machine cluster of 2 GHz quad-core machines this would take less than 2 days.

Category / Keywords: stream ciphers, practical cryptanalysis, smartcard security, RFID

Publication Info: to appear in ACM CCS 2010

Date: received 30 Mar 2010, last revised 30 Jun 2010

Contact author: flaviog at cs ru nl

Available format(s): PDF | BibTeX Citation

Version: 20100630:095200 (All versions of this report)

Short URL:

[ Cryptology ePrint archive ]