TY - GEN
T1 - Cache-Attacks on the ARM TrustZone Implementations of AES-256 and AES-256-GCM via GPU-Based Analysis
AU - Lapid, Ben
AU - Wool, Avishai
N1 - Publisher Copyright: © 2019, Springer Nature Switzerland AG.
PY - 2019
Y1 - 2019
N2 - The ARM TrustZone is a security extension which is used in recent Samsung flagship smartphones to create a Trusted Execution Environment (TEE) called a Secure World, which runs secure processes (Trustlets). The Samsung TEE includes cryptographic key storage and functions inside the Keymaster trustlet. The secret key used by the Keymaster trustlet is derived by a hardware device and is inaccessible to the Android OS. However, the ARM32 AES implementation used by the Keymaster is vulnerable to side channel cache-attacks. The Keymaster trustlet uses AES-256 in GCM mode, which makes mounting a cache attack against this target much harder. In this paper we show that it is possible to perform a successful cache attack against this AES implementation, in AES-256/GCM mode, using widely available hardware. Using a laptop’s GPU to parallelize the analysis, we are able to extract a raw AES-256 key with 7Â min of measurements and under a minute of analysis time and an AES-256/GCM key with 40Â min of measurements and 30Â min of analysis.
AB - The ARM TrustZone is a security extension which is used in recent Samsung flagship smartphones to create a Trusted Execution Environment (TEE) called a Secure World, which runs secure processes (Trustlets). The Samsung TEE includes cryptographic key storage and functions inside the Keymaster trustlet. The secret key used by the Keymaster trustlet is derived by a hardware device and is inaccessible to the Android OS. However, the ARM32 AES implementation used by the Keymaster is vulnerable to side channel cache-attacks. The Keymaster trustlet uses AES-256 in GCM mode, which makes mounting a cache attack against this target much harder. In this paper we show that it is possible to perform a successful cache attack against this AES implementation, in AES-256/GCM mode, using widely available hardware. Using a laptop’s GPU to parallelize the analysis, we are able to extract a raw AES-256 key with 7Â min of measurements and under a minute of analysis time and an AES-256/GCM key with 40Â min of measurements and 30Â min of analysis.
UR - http://www.scopus.com/inward/record.url?scp=85060684173&partnerID=8YFLogxK
U2 - https://doi.org/10.1007/978-3-030-10970-7_11
DO - https://doi.org/10.1007/978-3-030-10970-7_11
M3 - منشور من مؤتمر
SN - 9783030109691
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 235
EP - 256
BT - Selected Areas in Cryptography – SAC 2018 - 25th International Conference, Revised Selected Papers
A2 - Cid, Carlos
A2 - Jacobson, Michael J.
T2 - 25th International Conference on Selected Areas in Cryptography, SAC 2018
Y2 - 15 August 2018 through 17 August 2018
ER -