Remote Timing Attacks on TPMs, AKA TPM-Fail

The presentation discusses vulnerabilities in TPM devices and how side-channel attacks can be used to recover private keys. The implementation of crypto systems is difficult and can be vulnerable to side-channel attacks.

• TPM devices can be vulnerable to side-channel attacks that can be used to recover private keys
• The implementation of crypto systems is difficult and can be vulnerable to side-channel attacks
• Different implementations of the same functionality can have different behaviors depending on the key bits

The presenter discussed how they were able to recover private keys from a VPN server using a side-channel attack. They collected timing measurements after dropping the connection and were able to recover the private key after repeating the operation multiple times. This illustrates how vulnerable TPM devices can be to side-channel attacks.

Trusted Platform Module (TPM) serves as a hardware-based root of trust that protects cryptographic keys from privileged systems and physical adversaries. These devices are generally based on a cryptographic coprocessor such as Arm SecurCore and can be found on various computing platforms such as smartphones and industrial systems. In this talk, we first discuss our work on black-box timing analysis of TPM 2.0 devices deployed on commodity computers. Our analysis reveals that some of these devices feature secret-dependent execution times. We show how this information allows an attacker to apply lattice-based techniques to recover 256-bit private keys for signatures based on elliptic curves. As a result, we can even extract private keys from a hardware TPM manufactured by STMicroelectronics, which is certified at Common Criteria (CC) EAL 4+.We further highlight the impact of these vulnerabilities by presenting a remote attack against a StrongSwan IPsec VPN that uses a TPM to generate the digital signatures for authentication. In this attack, the remote client recovers the server's private authentication key by timing only authentication handshakes.These vulnerabilities we have uncovered emphasize the difficulty of correctly implementing known constant-time techniques and show the importance of evolutionary testing and transparent evaluation of cryptographic implementations. Even certified devices that claim resistance against attacks require additional scrutiny by the community and industry, as we learn more about these attacks. As a solution, we finally present a novel technique based on Dynamic Instrumentation and Mutual Information Analysis to efficiently locate and quantify memory-based and control-flow based leakages in software. We develop a software framework named MicroWalk for side-channel analysis of binaries, which can be extended to support new classes of leakage. We show that automatic testing using our tool would have discovered these issues during the development.