Physical Security Evaluation of the Bitstream Encryption Mechanism of Altera Stratix II and Stratix III FPGAs

Abstract

To protect Field-Programmable Gate Array (FPGA) designs against Intellectual Property (IP) theft and related issues such as product cloning, all major FPGA manufacturers offer a mechanism to encrypt the bitstream that is used to configure the FPGA. From a mathematical point of view, the employed encryption algorithms (e.g., Advanced Encryption Standard (AES) or 3DES) are highly secure. However, it has been shown that the bitstream encryption feature of several FPGA families is susceptible to side-channel attacks based on measuring the power consumption of the cryptographic module. In this article, we present the first successful attack on the bitstream encryption of the Altera Stratix II and Stratix III FPGA families. To this end, we analyzed the Quartus II software and reverse engineered the details of the proprietary and unpublished schemes used for bitstream encryption on Stratix II and Stratix III. Using this knowledge, we demonstrate that the full 128-bit AES key of a Stratix II as well as the full 256-bit AES key of a Stratix III can be recovered by means of side-channel attacks. In both cases, the attack can be conducted in a few hours. The complete bitstream of these FPGAs that are (seemingly) protected by the bitstream encryption feature can hence fall into the hands of a competitor or criminal-possibly implying system-wide damage if confidential information such as proprietary encryption schemes or secret keys programmed into the FPGA are extracted. In addition to lost IP, reprogramming the attacked FPGA with modified code, for instance, to secretly plant a hardware Trojan, is a particularly dangerous scenario for many security-critical applications.

A survey on security features in modern FPGAs

“…However, this is not considered as impossible. Furthermore, attacks on the software development kits or FPGA hardware can be used to facilitate the intellectual property theft [19].…”

“…The circuit leakages (power consumption, EM, temperature or timing variations) which reflect the activity during the decryption are correlated with the input data to reconstruct the key value, it is called the side-channel analysis (SCA). Some successful side-channel attacks have be reported for Altera Stratix-II and Stratix-III [19], Microsemi ProASIC3 [20] and Xilinx Virtex-II [21] that used bitstream AES-128 encryption. These papers demonstrate that SCA techniques are incredibly efficient with an affordable cost.…”

“…These papers demonstrate that SCA techniques are incredibly efficient with an affordable cost. We can note that for the attacks against the Stratix-II and Stratix-III [19], weaknesses residing within the development software Quartus are exploited. By decompiling the Quartus DLL files, the researchers have found which key derivation technique is used for generating the real bitstream decryption key.…”

“…In this case key scrambling can just delay an attack, but it is not considered as a strong security mechanism. To ensure the key confidentiality during the transmission to the chip, in function of the Altera FPGA device, the user must supply one or two keys to the programming software [19]. The software applies a key derivation function giving the real key used for the bitstream encryption.…”

“…The one or two keys given by the user are sent to the FPGA using the same derivation function as the software. This technique is not yet flawless, since researchers were able to found the key derivation function that was used for the Stratix-II and Stratix-III by reversing the programing software Quartus II [19].…”