Block Side-Channel Analysis Attacks
Small changes in the phase of clock signals can encode power leakages. An attacker can use standard interfaces such as the JTAG port to drive clocks across targets, using them as measurement techniques for side-channel analysis attacks despite limited physical access. This article demonstrates how you can test devices for vulnerability and how to modify devices to prevent attacks.
When I’ve presented side-channel power analysis attacks, I always use an oscilloscope or ADC that measures analog voltage variations. This is logical because side-channel power analysis attacks exploit the small changes in device power when it executes different instructions or even processes different data. This made it seem like a purely analog attack. Attackers need measurement access, such as a shunt resistor or electromagnetic probe. But what if attackers could use a purely digital interface, one that is already on your board, like the JTAG interface?
Things you always thought were safe might have hidden dangers. In this case, I will show you how a a side-channel power analysis attack occurs through the JTAG interface. But first, the background.
Back in the March 2024 issue of Circuit Cellar (Issue 404, “It’s About Time: When Timing Attacks Reveal Power Usage), I recreated the work of a paper presented at CHES 2023 titled “JitSCA: Jitter-based Side-Channel Analysis in Picoscale Resolution”, by Kai Schoos, Sergej Meschkov, Mehdi B. Tahoori, and Dennis R. E. Gnad.[1] In this article, I will present an extension of my talk at CHES 2024. If you want to see the full article entitled “Phase Modulation Side Channels: Jittery JTAG for On-Chip Voltage Measurements”[2] use a link to both the original paper and my extension available in article resources.
PHASE MODULATION LEAKAGE
In my March 2024 column, I recreated the JitSCA paper to demonstrate how small changes in the phase of a clock directly leak a power trace. In the previous column, I used a basic voltage divider; here, I’m using an RF mixer component. While RF mixers are normally used to create a signal based on frequency differences, they will also give an output related to a phase difference of two signals.
Figure 1 shows a simple setup for this. In this example, the “Target PCB” is outputting a clock. The idea of the attack (as discussed in the previous column) is that as the propagation delay through the device varies with voltage, small changes in voltage get “encoded” as changes in the location of clock edges of the output clock. The changing propagation delay means that clock edges have a small amount of “jitter” present on them.
A basic phase measurement setup.
The “Attack Setup” (right) side of Figure 1 is designed to measure small variations in the location of the clock edges. To do this, use a PLL is used to “clean up” the clock signal. Doing this generates a signal with less jitter and more stable clock locations. The mixer compares the jittery signal at the RF port and the clean signal at the LO port to generate an output signal at the IF port that is related to the phase difference.
By sampling the IF port, we generate a “phase waveform” as shown in Figure 2, which compares a measurement of the IF port waveform (phase waveform) to a classic “shunt-based power analysis” waveform. The same code is running on this target, a SAM4S2A microcontroller. While it’s not the same waveform, notice the same general blocks. Performing a power analysis attack on this waveform will be successful.
A comparison between phase measurement and classic power analysis measurement shows visual parallels between the two traces.
An optical isolator captured this phase waveform on the clock path. I used an optical isolator to ensure no small voltage variations were leaking on my clock output. As we’ve seen in previous issues, even small leakages can be exploited, so I wanted to be sure what we are capturing is related to the phase difference and not just an artificial leakage. Now that you are (hopefully) convinced that slight variations in the phase of a signal can be used for performing side-channel power analysis attacks, let’s do it using purely digital interfaces on our target.
JTAG FOR PHASE LEAKAGE
When plugging in a JTAG probe to your target, you at least know the pin names TCK, TDI, TDO, and TMS. These are used to move the JTAG state machine around. I had a better overview of JTAG in previous columns but look at Figure 3 for this article. This shows the important part of JTAG: it uses the Test Data In (TDI) to send data to one of several registers, and the output of that register goes out Test Data Out (TDO). The Test Clock (TCK) pin is used to clock the data through the register.
The JTAG interface registers, including the bypass register at the bottom which allows feeding a clock through the device.
The register at the bottom of Figure 3 is the Bypass register, which is interesting to our attack. This register connects the input and output pins using a single-bit register. The device doesn’t use the bypass mode; it connects the JTAG chain together if multiple devices are present.
Because the target doesn’t monitor the register, we can “cheat” and use that register to feed a clock through the device. In this case, our setup looks like Figure 4. We are using the TCK and TDI pins to feed a clock into the device, and the clock at the TDO output has the phase encoded on each edge.
To pass a clock through the device, we need to drive both the TCK and TDI pins, and can then measure the leakage in the output TDO signal.
Doing this requires enabling the bypass mode, a normally well-documented command. To implement that, I used the ChipWhisperer-Husky, as it could bit-bang the JTAG protocol on the User IO pins. Some minor modifications to the open-source ChipWhisperer-Husky FPGA code allowed the ChipWhisperer itself to generate the required TCK and TDI clocks, removing the need for external test equipment.
Figure 5 shows the setup for this. If you want to recreate it, all the board details are available on a linked GitHub repository [3].
The ChipWhisperer-Husky is used to control the JTAG port and then monitor the phase on the returned signal.
What do the power traces look like? Figure 6 compares a shunt measurement with one captured using the JTAG power measurement technique. You’ll notice that they look very similar again but remember that the JTAG power measurement was captured without any changes needed to the target. In this example, the target power supply is very clean (since it’s the same target used for side-channel testing), but in practice, a bit of filtering or averaging can accomplish a similar result.
The phase measurement (top waveform) looks very similar to the shunt measurement (bottom waveform). In this case, the phase measurement is taken over by the JTAG port.
As a final step, I should do an attack to prove this works. Figure 7 shows the results of a correlation power analysis attack (CPA) against a standard AES implementation running on my target. While the AES encryption runs, I use my JTAG interface tool to monitor the power. If you aren’t familiar with these CPA result figures, the important part is that the correlation for the correct key is in red, and the wrong keys are in grey. As we observe more encryptions, the correct key becomes obvious (the correlation stays higher), and an attacker can “pull it out” from the noise of the wrong guesses. The approximate point this occurs here is about 8,900 traces). The important part is that, once again, we have a very strong signal that an attacker can easily exploit.
The final Correlation Power Analysis (CPA) results for all 16 bytes of my AES-128 key after 8900 encryptions observed using only the JTAG port allow me to recover the full key.
SPEEDY JTAGS AND THREAT MODELS
How much should you care about this sort of attack? First, you’d need to decide if there are sensitive secrets an attacker can leak with side-channel attacks. For example, suppose your device has an AES bootloader or password comparison function encryption key. In that case, side-channel attacks are good ways for attackers to leak those secrets.
If your device is only doing public-key signature checks, there are no secrets inside your device, so a side-channel attack isn’t in your threat model. This is the first step in deciding if this vector is relevant to you.
Once you decide that a side-channel attack is in your threat model, you should determine whether an attack with JTAG port access is specifically interesting. Remember that a side-channel power analysis attack can already be performed with low-cost electromagnetic (EM) probes and other equipment.
However, for some applications, an attack that requires only the JTAG port is incredibly damaging. An attack that requires the JTAG port means an attacker doesn’t require special skills to deploy the attack. These “commoditized” attacks concern automotive ECUs, where businesses have entered the market to make ECU security attack tools.
If the JTAG attack is a concern, you can check your device datasheet to see if the JTAG port is always on. You can also do simple tests to check how fast you can push a clock signal through the JTAG port. While the devices often have relatively low JTAG maximum clock speeds in their datasheets, many devices supported much higher frequencies in practice. These higher frequencies give an attacker better time resolution.
BLOCK PHASE LEAKAGE ATTACKS
Fundamentally, the leakage we exploit doesn’t differ from any other side-channel power analysis attack. Rather than blocking the specific measurement mode, you should ensure your device doesn’t have apparent power leakage. For example, particular cryptographic algorithm implementations use masking to make these attacks more difficult.
But if you have a situation where the specific JTAG leakage is of concern, you can also take steps to reduce this leakage. The most straightforward approach here is to disable the JTAG interface when you don’t need it. Some devices (such as the STM32) can turn off the JTAG port, which means an attacker can’t use it for these attacks. If your device has a way to do this under software control, you can turn off the interface only during specific operations.
However, many devices always have the JTAG port enabled, or you want to leave it open for failure analysis. In this case, you are more limited. While almost all devices let you restrict JTAG access, even restricted access is still too much because the attack I’ve shown above uses only the bypass mode.
More complex options use a re-timer on the JTAG signals outside the target device. This type of option still exposes the signals but means the JTAG port itself isn’t as convenient as just using a “normal” electromagnetic probe for performing the side-channel power analysis attack.
Hopefully, this article gave you a glimpse of how a newer measurement technique (phase-based leakage) can be used for ubiquitous interfaces on your embedded systems. You can likely imagine other applications of it, such as with eMMC or SD card signals, but I leave that as an exercise for the reader.
REFERENCES
[1]JitSCA: Jitter-based Side-Channel Analysis in Picoscale Resolution: https://tches.iacr.org/index.php/TCHES/article/view/10965 (CHES 2023 paper)
[2]Phase Modulation Side Channels: Jittery JTAG for On-Chip Voltage Measurements: https://eprint.iacr.org/2024/1107.pdf
[3]GitHub Repsitory to recreate the examples: https://github.com/colinoflynn/phase-modulation-sca
PUBLISHED IN CIRCUIT CELLAR MAGAZINE • SEPTEMBER 2024 #410 – Get a PDF of the issue
Sponsor this Article
Colin O’Flynn has been building and breaking electronic devices for many years. He is an assistant professor at Dalhousie University, and also CTO of NewAE Technology both based in Halifax, NS, Canada. Some of his work is posted on his website (see link above).
