Paper 2013/224
On the Need of Physical Security for Small Embedded Devices: a Case Study with COMP128-1 Implementations in SIM Cards
Yuanyuan Zhou, Yu Yu, François-Xavier Standaert, and Jean-Jacques Quisquater
Abstract
Ensuring the physical security of small embedded devices is challenging. Such devices have to be produced under strong cost constraints, and generally operate with limited power and energy budget. However, they may also be deployed in applications where physical access is indeed possible for adversaries. In this paper, we consider the case of SIM cards to discuss these issues, and report on successful side-channel attacks against several (old but still deployed) implementations of the COMP128-1 algorithm. Such attacks are able to recover cryptographic keys with limited time and data, by measuring the power consumption of the devices manipulating them, hence allowing cards cloning and communications eavesdropping. This study allows us to put forward the long term issues raised by the deployment of cryptographic implementations. It provides a motivation for improving the physical security of small embedded devices early in their development. We also use it to argue that public standards for cryptographic algorithms and transparent physical security evaluation methodologies are important tools for this purpose.
Metadata
- Available format(s)
-
PDF
- Category
- Implementation
- Publication info
- Published elsewhere. this is the full version of a paper that appeared at Financial Cryptography and Data Security 2013 (FC 2013)
- Keywords
- side-channel attacksdifferential power analysisphysical securityelectronic payment security
- Contact author(s)
- yuyuathk @ gmail com
- History
- 2013-04-29: received
- Short URL
- https://ia.cr/2013/224
- License
-
CC BY
BibTeX
@misc{cryptoeprint:2013/224,
author = {Yuanyuan Zhou and Yu Yu and François-Xavier Standaert and Jean-Jacques Quisquater},
title = {On the Need of Physical Security for Small Embedded Devices: a Case Study with COMP128-1 Implementations in SIM Cards},
howpublished = {Cryptology ePrint Archive, Paper 2013/224},
year = {2013},
note = {\url{https://eprint.iacr.org/2013/224}},
url = {https://eprint.iacr.org/2013/224}
}
