diff --git a/Makefile b/Makefile index edab937..29293d6 100644 --- a/Makefile +++ b/Makefile @@ -14,34 +14,20 @@ all: thesis.pdf # We need three runs for biblatex's defernumbers %.pdf: %.tex common-packages.tex common-defs.tex main.bib version.tex - pdflatex -shell-escape -jobname $* '\def\thesispreviewmode{}\input{$<}' + pdflatex -shell-escape -jobname thesis '\def\thesispreviewmode{}\input{$<}' biber $* - pdflatex -shell-escape -jobname $* '\def\thesispreviewmode{}\input{$<}' - pdflatex -shell-escape -jobname $* '\def\thesispreviewmode{}\input{$<}' + pdflatex -shell-escape -jobname thesis '\def\thesispreviewmode{}\input{$<}' + pdflatex -shell-escape -jobname thesis '\def\thesispreviewmode{}\input{$<}' echo echo "Undefined biblatex references:" grep -A2 'Package biblatex Warning: The following entry could not be found' thesis.log | sed -n '3~4{s/(biblatex) *//;p}' || echo "" -%-oneside.pdf: %.tex common-packages.tex common-defs.tex main.bib version.tex - pdflatex -shell-escape -jobname $*-oneside '\def\thesispreviewmode{}\def\thesisoneside{}\input{$<}' - biber $*-oneside - pdflatex -shell-escape -jobname $*-oneside '\def\thesispreviewmode{}\def\thesisoneside{}\input{$<}' - pdflatex -shell-escape -jobname $*-oneside '\def\thesispreviewmode{}\def\thesisoneside{}\input{$<}' - echo - echo "Undefined biblatex references:" - grep -A2 'Package biblatex Warning: The following entry could not be found' thesis.log | sed -n '3~4{s/(biblatex) *//;p}' || echo "" - -%-final.pdf: %.tex common-packages.tex common-defs.tex main.bib version.tex abstract.tex abstract-de.tex - pdflatex -jobname $*-final -shell-escape $< - biber $*-final - pdflatex -jobname $*-final -shell-escape $< - pdflatex -jobname $*-final -shell-escape $< - -%-final-oneside.pdf: %.tex common-packages.tex common-defs.tex main.bib version.tex - pdflatex -shell-escape -jobname $*-final-oneside '\def\thesisoneside{}\input{$<}' - biber $*-final-oneside - pdflatex -shell-escape -jobname $*-final-oneside '\def\thesisoneside{}\input{$<}' - pdflatex -shell-escape -jobname $*-final-oneside '\def\thesisoneside{}\input{$<}' +#.PHONY: preview +final: + pdflatex -shell-escape $< + biber $* + pdflatex -shell-escape $< + pdflatex -shell-escape $< version.tex: thesis.tex $(addsuffix /chapter.tex,${CHAPTERS}) echo "${VERSION_STRING}" > $@ diff --git a/abstract-de.tex b/abstract-de.tex index f527db5..fd2c476 100644 --- a/abstract-de.tex +++ b/abstract-de.tex @@ -4,56 +4,38 @@ \adjustmtc \addcontentsline{toc}{chapter}{Kurzzusammenfassung} - \marginpar{This section is a translated copy of the English abstract below.} - Im Laufe der letzten Jahrzehnte habe Fortschritte in der Kryptographie sowie Techniken wie formale Verifikation den - Stand der Softwaresicherheit stetig verbessert. Gleichzeitig hat das Gebiet der Hardwaresicherheit mit diesen - Entwicklungen nicht Schritt halten können. Trotz Fortschritten in Teilgebieten wie der Resilienz gegenüber - Seitenkanalangriffen und Physical Unclonable Functions (PUFs) ist der Stand der Technik in der Hardwaresicherheit - nach wie vor auf die Verwendung mikroelektronischer Strukturen fokussiert. Solche erreichen einen Grad der Security - by Obscurity, liefern jedoch keine fundierteren Sicherheitsgarantien. Systemweite Manipulationsschutzmaßnahmen - werden nur vereinzelt in Geräten wie z.B.\ Hardware-Sicherheitsmodulen (HSMs) und Kartenzahlungsterminals - eingesetzt. Insbesondere HSMs werden aufgrund ihrer hohen Kosten und geringen Rechenleistung nur in - Nischenanwendungen wie z.B.\ der Zertifikatsausstellung im Transport Layer Security (TLS)-System sowie der - Zahlungsdatenverarbeitung eingesetzt. +\todo{Re-translate, manually check translation} +\marginpar{This section is a machine-translated copy of the English abstract below.} +Mit kryptografischen Fortschritten und Techniken wie der formalen Verifizierung, die zu immer sichererer Software +führen, rückt die Hardwareebene in den Fokus der aktuellen Computersicherheitsforschung. Der Stand der Technik in +der Hardwaresicherheit stützt sich jedoch oft noch auf den Einsatz mikroelektronischer Integration, um Sicherheit durch +Verschleierung zu erreichen, anstatt aufgrundlegendere Sicherheitsgarantien. Manchmal wird auch Manipulationsschutz auf +Systemebene eingesetzt, der jedoch aufgrund der hohen Kosten und der geringen Leistung von Geräten wie +Hardware-Sicherheitsmodulen (HSMs) nach wie vor auf Nischenanwendungen beschränkt ist. - In dieser Dissertation wird das Inertiale Hardware-Sicherheitsmodul (IHSM) vorgestellt, eine neue Architektur für - Hardware-Sicherheitsmodule. IHSMs stellen einen hoch sicheren, aktiven Manipulationsschutz bereit. - Gleichzeitig können mithilfe der IHSM-Technologie kryptographische Rechnersysteme von wesentlich größeren - Abmessungen, Gewicht und elektrischer Leistungsaufnahme geschützt werden, als es in konventionellen HSMs möglich - ist. IHSMs ersetzen die kostenintensiven und in der Herstellung aufwendigen Meshes - (Manipulationserkennungsmembranen) konventioneller HSMs durch eine Konstruktion, in der Meshes aus einfachen - Platinen aufgebaut werden. Diese Meshes rotieren schnell um das geschützte Rechnersystem, was eine unerkannte - Manipulation verhindert. IHSMs erreichen so mithilfe wensentlich einfacherer und kostengünstiger - Konstruktionstechniken ein Sicherheitsniveau, das dem konventioneller Manipulationsschutzmembranen gleicht, die in - spezialisierten Herstellungsprozessen gefertigt werden. In der Dissertation werden die Ergebnisse einer - Übersichtsstudie vorgestellt, die etwa 30 echte Implementierungen socher Meshes untersucht. In der Studie werden - Kriterien für die Entwicklung sicherer Meshes abgeleitet, anhand derer das IHSM-Konzept kontextualisiert wird. Um - die Notwendigkeit sicherer Hardware zu erörtern, wird in dieser Dissertation darüber hinaus eine Analyse einiger - problematischer Aspekte des Hardwaresicherheitskonzeptes der Deutschen elektronischen Patientenakte vorgestellt. +In dieser Arbeit stellt Jan Sebastian Götte das Inertial Hardware Security Module (IHSM) vor, eine neue Architektur für +kostengünstige Hardware-Sicherheitsmodule, die einen hohen aktiven Manipulationsschutz bieten und gleichzeitig +Rechenleistungen unterstützen, dieim Vergleich zu herkömmlichen HSMs viel größer, schwerer und leistungsstärker sind. In +einem IHSM wird das kostspielige und schwer zu beschaffende Manipulationserkennungsgitter eines herkömmlichen HSM durch +ein Mesh aus einfachen Leiterplatten ersetzt, das sich mit hoher Geschwindigkeitum die Nutzlast dreht. Da sich das Mesh +dreht, kann es nicht manipuliert werden, und die Sicherheit herkömmlicher Mesh, die in maßgeschneiderten +Fertigungsprozessen hergestellt werden, kann mit viel einfacheren und kostengünstigeren Konstruktionstechnikenerreicht +werden. Die Dissertation präsentiert Lösungen für wichtige technische Herausforderungen bei der Konstruktion von IHSMs, +darunter ein hochsymmetrischesplanares Induktionsspulendesign für die rotierende drahtlose Energieübertragung und ein +hochpräzises Überwachungssystem für kostengünstige Sicherheitsgitter. - Um den Weg für zukünftige, praktische Implementierungen der IHSM-Technologie zu bereiten, werden weiterhin Lösungen - für wichtige Schlüsselprobleme der Konstruktion von IHSMs vorgestellt. Diese Lösungen umfassen ein neues Konzept für - rotationssymmetrische Planarspulen für die drahtlose Energieübertragung an rotierende Empfänger, sowie ein - hochpräzises und dennoch kostengünstiges Überwachungssystem für Meshes. Dieses Überwachungssystem beruht auf dem - Prinzip der Zeitbereichsreflektometrie und erkennt selbst fortgeschrittene Angriffstechniken zuverlässig. In - praktischen Versuchen zeigte sich, dass das System ausreichend empfindlich ist, um mehrere identische Kopien - desselben Meshes voneinander zu unterscheiden, was auf PUF-ähnliche Eigenschaften hindeutet. +Unter Anwendung der IHSM-Technologie schließt die Dissertation mit zwei Analysen von Anwendungsfällen, die durch die +erhöhte Größe und Verlustleistungsfähigkeit von IHSMs ermöglicht werden. In der ersten Analyse wird ein IHSM-gesicherter +Relaisknoten für Quantenschlüsselverteilungssysteme (QKD) vorgeschlagen, der deren praktische Implementierung über +beliebige Entfernungen ermöglicht, wasaufgrund grundlegender physikalischer Einschränkungen vertrauenswürdige +Relaisstationen erfordert. In der Studie werden IHSMs für solchehochsicheren QKD-Relais angepasst, indem der +IHSM-Netzdurchgang mit einem sekundären manipulationssensitiven Netz gesichert wird. In diesem Aufbau wird +ein Klammerdesign vorgeschlagen, das den Durchgang durch Glasfasern mit geringen Verlusten unterstützt. - In der Dissertation werden zwei konkrete Anwendungsszenarien erläutert, die erst durch das größere Volumen und die - höhere Leistungsaufnahme möglich werden, die die IHSM-Technologie ermöglicht. Im ersten Anwendungsszenario wird eine - IHSM-geschützte Zwischenstation vorgeschlagen, um die durch physikalische Grundgesetze sonst stark eingeschränkte - erreichbare Entfernung eines Quantenschlüsselaustausch (QKD)-Systems zu vergrößern. Im Rahmen dieses - Anwendungsszenarios wird ein sekundäres Mesh vorgestellt, dass die Achsdurchführung des primären IHSM-Meshes - zusätzlich schützt. Weiterhin wird in der Fallstudie der Entwurf eines mechanischen Trägers für diese zusätzlich - geschützte Achsdurchführung vorgestellt, der das QKD-System im inneren des IHSM mit der Außenwelt über - verlustarme Glasfaserleitungen verbindet. - - In der zweiten Fallstudie wird ein Konzept vorgestellt, das mithilfe IHSM-geschützter, leistungsstarker - Serverhardware kolokierte Secure Multiparty Computation (MPC)-Berechnungen ermöglicht. Hierzu wird IHSM-Technologie - an die Anforderungen leistungsstaker Serverhardware in Größe, Leistungsaufnahme, und ableitbarer Verlustleistung - angepasst. Wird MPC praktisch eingesetzt, werden Knoten über mehrere Rechenzentren verteilt um einen Single Point of - Failure zu vermeiden. Diese Verteilung führt jedoch zu geringer Netzwerkbandbreite und hohen Latenzen zwischen den - MPC-Knoten, was die erreichbare MPC-Rechenleistung stark einschränkt. Durch den Einsatz von IHSMs können physisch - gesicherte MPC-Knoten innerhalb desselben Rechenzentrums betrieben werden, was durch die damit erreichbare höheren - Bandbreiten und geringeren Latenzen einen Leistungsbereich der MPC-Berechnungen erschließt. +Der zweite vorgeschlagene Anwendungsfall passt ein IHSM-Gehäuse an die Anforderungen hinsichtlich Größe, Leistung und +Wärmeableitung eines Hochleistungsservers an, um gemeinsam genutzte sichere Multiparty-Computing-Workloads (MPC) zu +unterstützen. MPC ist in der Praxis durch Netzwerkbandbreite und Latenzbedingungen eingeschränkt, die ohne physisch +sichere Knoten nicht vermieden werden können. Herkömmliche HSMskönnen MPC-Workloads nicht bedienen, da ihre +kryptografische Leistung um viele Größenordnungen zu gering ist. Ein durch IHSM gesicherter MPC-Knoten umgeht diese +Einschränkungen und eröffnet ein neues Leistungsspektrum. \end{otherlanguage} diff --git a/abstract.tex b/abstract.tex index 8699c6b..1b906b9 100644 --- a/abstract.tex +++ b/abstract.tex @@ -3,40 +3,33 @@ \adjustmtc \addcontentsline{toc}{chapter}{Abstract} -In the past decades, cryptographic advancements and techniques like formal verification have steadily improved software -security. Meanwhile, the field of hardware security has not kept pace. Research has made progress in subfields such as -resilience to Side-Channel Attacks (SCA) and Physical Unclonable Functions (PUFs). However, the state of the art still -often relies on microelectronic integration to achieve security by obscurity insted of more fundamental security -guarantees. While effective, system-level tamper protection is only used in few devices such as Hardware Security -Modules (HSMs) and card payment terminals. Due to the high cost and low performance of HSMs in particular, they remain -relegated to niche applications such as Transport Layer Security (TLS) certificate issuance and payment data processing. +%Through advancements in cryptography, nowadays it is feasible to construct networked computer systems that for all +%intents and purposes cannot be hacked over the network. Correctly applying cryptographic protocols and techniques such +%as formal verification, it can be ensured that a software implementation is a flawless representation of its theoretical +%model, and that the theoretical model is secure given universally accepted cryptographic assumptions. Despite -In this thesis, we introduce the Inertial Hardware Security Module (IHSM), a new architecture for low-cost hardware -security modules that provide high-level active tamper protection, while supporting computing payloads of much larger -size, weight and power dissipation compared to conventional HSMs. In an IHSM, the costly and difficult to source -tamper-sensing mesh of a conventional HSM is replaced by a mesh made from simple PCBs that is rotating at high speed -around the payload. Since the mesh is rotating at high speed, it cannot be manipulated, and the security of conventional -meshes created in bespoke manufacturing processes can be achieved using much simpler and less expensive construction -techniques. We present the results of a survey of approximately 30 real world tamper sensing mesh implementations. Based -on our findings, we deduce design criteria for secure meshes and contextualize our design. We further motivate the -necessity of secure hardware by presenting an analysis of problematic aspects in the hardware security design of -Germany's new national electronic health record system. +With cryptographic advancements and techniques like formal verification leading to increasingly secure software, the +hardware level advances into the focus of contemporary applied computer security research. However, the state of the art +in hardware security still often relies on the use of microelectronic integration to achieve security by obscurity over +more fundamental security guarantees. System-level tamper protection is sometimes used, but remains relegated to niche +applications due to the high cost and low performance of devices like Hardware Security Modules (HSMs). -To pave the way for practical implementations of IHSM technology, we present solutions to key engineering challenges in -IHSM construction. We present a design and analysis of highly symmetric planar inductors for rotating wireless power -transfer that improves self-resonant frequency by up to \qty{58}{\percent} and inductance by up to \qty{6.5}{\percent} -in our tests. Complementing this research, we present a high-fidelity, low-cost monitoring system for security meshes -that is based on the principles of Time-Domain Reflectometry (TDR), reaching \qty{184}{\pico\second} time resolution. We -validate our system and find that it is able to reliably detect several classes of advanced physical attacks. We find -that our system is sensitive enough to detect differences between identical copies of the same mesh, suggesting PUF-like -properties. +In this thesis, Jan Sebastian Götte introduces the Inertial Hardware Security Module (IHSM), a new architecture for +low-cost hardware security modules that provide high-level active tamper protection, while supporting computing payloads +of much larger size, weight and power dissipation compared to conventional HSMs. In an IHSM, the costly and difficult to +source tamper-sensing mesh of a conventional HSM is replaced by a mesh made from simple PCBs that is rotating at high +speed around the payload. Since the mesh is rotating, it cannot be manipulated, and the security of conventional meshes +created in bespoke manufacturing processes can be achieved using much simpler and less expensive construction +techniques. The thesis presents solutions to key engineering challenges in IHSM construction including a highly +symmetric planar inductor design for rotating wireless power transfer and a high-fidelity monitoring system for low-cost +security meshes. -Applying IHSM technology, we analyse two use cases that are unlocked by the increased size and power dissipation -capability of IHSMs. In the first analysis, an IHSM-secured relay node for Quantum Key Distribution (QKD) systems is -proposed, enabling their practical implementation across arbitrary distances, which requires trusted relay stations due -to fundamental physical limitations. In the study, IHSMs are adapted for such high-security QKD relays by securing the -IHSM mesh passthrough with a secondary tamper-sensing mesh. In this setup, a bracket design is proposed that supports -passing through optical fibers at low loss. +Applying IHSM technology, the thesis concludes with analyses of two use cases that are unlocked by the increased +size and power dissipation capability of IHSMs. In the first analysis, an IHSM-secured relay node for Quantum Key +Distribution (QKD) systems is proposed, enabling their practical implementation across arbitrary distances, which +requires trusted relay stations due to fundamental physical limitations. In the study, IHSMs are adapted for such +high-security QKD relays by securing the IHSM mesh passthrough with a secondary tamper-sensing mesh. In this setup, a +bracket design is proposed that supports passing through optical fibers at low loss. The second proposed use case adapts an IHSM enclosure to the size, power and thermal dissipation requirements of a high-power server to support co-located secure Multiparty Computation (MPC) workloads. In practical MPC deployments, diff --git a/ai-llm-use-disclosure.tex b/ai-llm-use-disclosure.tex index 0ac6104..67cc6b2 100644 --- a/ai-llm-use-disclosure.tex +++ b/ai-llm-use-disclosure.tex @@ -6,26 +6,25 @@ This thesis has been written during the years of 2020 - 2025. In this time, Artificial Intelligence (AI) technology including Large Language Models (LLMs) has entered widespread adoption. I have used such LLM systems in the preparation of this thesis. At the time this thesis was written, LLMs were a powerful and useful technology, but often produced -wrong output. Thus I used the following list of observations to guide my LLM use during the writing of this thesis. +wrong output. Thus, I used the following list of observations to guide my LLM use during the writing of this thesis. \begin{enumerate} \item Passing text through an LLM is an imprecise operation. Especially when large amounts of text are passed through an LLM, despite clear instructions such as ``only fix spelling errors,'' the LLM output might deviate from the source text. Therefore, the document text should never be passed through the LLM, and the LLM should be prompted to point out problems, or to produce a list of suggestions for improvements instead. - \item Contemporary LLMs are bad at summarizing text that contains novel concepts. LLM summaries of text often - converge to a re-stating of the general consensus on the text's main topic. Where the source text deviates from - conventional wisdom or makes novel points, an LLM summary will likely mis-represent those conclusions. - Additionally, LLMs are bad at capturing the point of a text. Unless extreme care is taken when prompting, it is - easy to lead an LLM to produce an inaccurate summary of a text that agrees with the prompt, but misses the gist - of the text. Therefore, extreme caution should be applied when using an LLM for summarization, and LLM output - should be checked diligently in such instances. - \item Contemporary LLMs are bad at generating text from scratch. Especially on topics of academic interest that are - novel and that do not have well-known answers that can be found in the training corpus for these models, in - general they will not produce useful text when prompted. Therefore, LLMs should never be used to generate novel - text. - \item Contemporary LLMs are bad at giving references. Prompts that ask for academic references on a topic are likely - to produce non-existing ``hallucinated'' references. The existing references an LLM is most likely to dig up + \item LLMs are really bad at summarizing text that contains novel concepts. LLM summaries of text often converge to + a re-stating of the general consensus on the text's main topic. Where the source text deviates from conventional + wisdom or makes novel points, an LLM summary will likely mis-represent those conclusions. Additionally, LLMs are + bad at capturing the point of a text. Unless extreme care is taken when prompting, it is easy to lead an LLM to + produce an inaccurate summary of a text that agrees with the prompt, but misses the gist of the text. Therefore, + extreme caution should be applied when using an LLM for summarization, and LLM output should be checked + diligently in such instances. + \item LLMs are bad at generating text from scratch. Especially on topics of academic interest that are novel and + that do not have well-known answers that can be found in the training corpus for these models, in general they + will not produce useful text when prompted. Therefore, LLMs should never be used to generate novel text. + \item LLMs are really bad at giving references. Prompts that ask for academic references on a topic are likely to + produce non-existing ``hallucinated'' references. The existing references an LLM is most likely to dig up usually occur on the first page of a web search on the topic, or are frequently cited in literature on the topic. Thus, LLMs should never be directly queried for references. When researching a new concept, a better use of an LLM is the generation of query strings for search engines like Google Scholar. diff --git a/chapter-conclusion/chapter.tex b/chapter-conclusion/chapter.tex index f11e0e8..1ec0194 100644 --- a/chapter-conclusion/chapter.tex +++ b/chapter-conclusion/chapter.tex @@ -3,29 +3,22 @@ political tool, and it confers on the field an intrinsically moral dimension.} \chapter{Conclusion} -In this thesis, we provided an examination of the field of Hardware Security Modules both from an academic perspective -and with regards to their practical implementation. We answered our first research question introduced in -Chapter~\ref{chapter-intro} on the current state of the art in Chapters~\ref{chapter-epa} and \ref{chapter-survey}, -providing a comprehensive view of practical implementations. Chapter~\ref{chapter-epa} motivates our research using the -German national digital health record system as an example that demonstrates the difficulties in achieving practical -hardware security. Besides some minor cryptographic oddities, our analysis reveals at least one essential specification -mistake that negates the hardware security of the system by unnecessarily introducing a poorly protected HSM. In -Chapter~\ref{chapter-survey}, we answer our second research question in a detailed survey of a wide range of devices -that utilize tamper-sensing meshes, distilling a set of criteria for the design of secure tamper-sensing meshes. In -Chapter~\ref{chapter-ihsm}, we propose Inertial Hardware Security Modules (IHSMs), a new approach to physical security -that combines conventional tamper-sensing meshes with physical movement. IHSMs enable bootstrapping a highly secure -system from low-security, off-the-shelf parts, thereby solving our third research question on achieving physical -security without bespoke components. We support the construction of concretely secure IHSMs by providing deep analyses -of two key engineering challenges in IHSM construction, mesh monitoring and power transfer. Solving our fourth research -question on mesh monitoring fidelity, we propose a low-cost TDR-based mesh monitoring system that exceeds the -capabilities of previous systems from academic or from patent literature. Our system is capable of monitoring large -meshes while simultaneously providing detailed results. Our TDR-based mesh monitoring system is of independent interest, -since it can also be integrated into traditional HSM designs. Solving our fifth research question on ripple reduction -for rotating Wireless Power Transfer for IHSMs, we propose a new, generalized design for high-frequency PCB inductors -with low parasitic capacitance. Beyond our IHSM application, our design provides better bandwidth and lower parasitic -capacitance compared to the state of the art without increasing implementation cost. We conclude this thesis with two -chapters elaborating on two new use cases that are made possible by IHSM technology due to its ability to protect large -payloads that have high power consumption. Together, these results answer our sixth and final research question. +In this thesis, we propose Inertial Hardware Security Modules (IHSMs), a new approach to physical security that combines +conventional tamper-sensing meshes with physical movement to bootstrap a highly secure system from low-security, +off-the-shelf parts, solving our first research question introduced in Chapter~\ref{chapter-intro}. To motivate our +research, we use the German national digital health record system as an example demonstrating the difficulties in +achieving useful hardware security in practice. Besides some minor cryptographic oddities, our analysis reveals at least +one essential specification mistake that negates the hardware security of the system by unnecessarily introducing a +poorly protected HSM. With this motivation in mind, we support the construction of concretely secure IHSMs by providing +deep analyses of two key engineering challenges in IHSM construction, mesh monitoring and power transfer. Solving our +second research question, we propose a low-cost TDR-based mesh monitoring system that exceeds the capabilities of +previous systems from academic or from patent literature. Our system is capable of monitoring large meshes while +simultaneously providing detailed results. Our TDR-based mesh monitoring system is of independent interest, since it can +also be integrated into traditional HSM designs. We additionally propose a new, generalized design for high-frequency +PCB inductors with low parasitic capacitance. Our design provides better bandwidth and lower parasitic capacitance +compared to the state of the art without increasing implementation cost. We conclude this thesis with two chapters +elaborating on two new use cases that are made possible by IHSM technology due to its ability to protect large payloads +that have high power consumption. Together, these results answer our third and final research question. The research presented in this thesis is aimed at advancing both academic research and applied engineering in hardware security. We believe that by publishing our research including its artifacts under open source licenses, we provide the @@ -58,9 +51,6 @@ directions that we consider worthwhile for future investigation. long bearing life is challenging at the high rotation speed necessary at a small overall diameter. Finally, at high speeds, precisely balancing the whole assembly to avoid vibrations that could lead to early mechanical failure is difficult. -\item Tackling motor control algorithms for IHSMs and developing tamper sensors based on counter-electromotive force as - a defense-in-depth measure. -\item Integrating the IHSM hardware concept with software research on secure enclave and cryptographic coprocessors. \item Exploring IHSM applications beyond what we outlined in this thesis. For instance, one application of recent interests would be physically securing GPUs used for AI training. The background for such work could be either export control motivations, or a concern for security and privacy of user input, training data, or even trained diff --git a/chapter-epa/chapter.tex b/chapter-epa/chapter.tex index 2965e9d..53e92a3 100644 --- a/chapter-epa/chapter.tex +++ b/chapter-epa/chapter.tex @@ -7,41 +7,39 @@ } \chaptertitle{The German ePA: A Motivating Counter-Example} -\label{chapter-epa} \todo{FIXME: Proper citation here} -\sourceattrib{This part is based on a short paper written by Jan Sebastian Götte and presented by Jan Sebastian Götte at -the HS3 workshop at ESORICS 2025~\cite{gotteGermanyRollingOut2026}.} +\sourceattrib{This part is based on a short paper written by me and presented by me at the HS3 workshop at ESORICS +2025.} Looking at the landscape of computer security solutions, we are presented with a wide variety of vendors and products that may give the impression that hardware security is a solved problem. Vendors sell various claims rangning from -\emph{``You don't need hardware security, just do it in the cloud!''}~\cite{ +\emph{You don't need hardware security, just do it in the cloud!}~\cite{ utimacoWhatCloudHSM2025, microsoftOverviewAzureCloud, ibmCloudHSM2016, amazonAWSCloudHSM, googleCloudHSMCloud2025, WhatCloudHSM} -to \emph{``Buy our HSM and you will be secure!''}~\cite{utimacoUseCases,thalesLunaNetworkHardware}. In +to \emph{Buy our HSM and you will be secure!}~\cite{utimacoUseCases,thalesLunaNetworkHardware}. In practice, things are not as easy and even well-intentioned projects still often go awry on the hardware security dimension. To motivate our research into physical security in this thesis, in this chapter we will have a look at one such project that was done by capable people with the best intentions, yet it resulted in a hardware security design that is dangerously inadequate for the purpose. Beginning May 2025, after several delays, Germany has started the nation-scale rollout of its new electronic medical -record system, named ePA (short for \emph{elektronische Patientenakte}, ``electronic patient -record'')~\cite{kochNochVieleUnklarheiten2025}. The system aims to create a national database accessible to all -healthcare providers that holds the complete electronic medical records of all publically insured people living in -Germany. The system aims to replace paper-based workflows that are error-prone and lead to healthcare providers often -only having access to a subset of patient's medical records. Data in scope for the system includes medical letters, -laboratory results, and medical imaging files. +record system, named ePA (short for \emph{elektronische Patientenakte}, ``electronic patient record''). The system aims +to create a national database accessible to all healthcare providers that holds the complete electronic medical records +of all publically insured people living in Germany. The system aims to replace paper-based workflows that are +error-prone and lead to healthcare providers often only having access to a subset of patient's medical records. Data in +scope for the system includes medical letters, laboratory results, and medical imaging files. Due to Germany's mandatory health insurance laws, the system's user base encompasses the majority of all German -residents, approximately 90\%. People who have replaced their public health insurance with private insurance as of now -are not subject to the system. In Germany, by law private health insurance is only available to people from the top 10th -percentile of household income. This means that the system disproportionally affects people who have low income, -creating an equity issue. While it is possible to opt out from the use of the new digital record, the process of opting -out is difficult. Additionally, the government and health insurance providers have publically depicted the system in a -one-sidedly positive way, meaning that it is unlikely the majority of people subject to the system have a comprehensive +residents. People who have replaced their public health insurance with private insurance as of now are not subject to +the system. In Germany, by law private health insurance is only available to people from the top 10th percentile of +household income. This means that the system disproportionally affects people who have low income, creating an equity +issue. While it is possible to opt out from the use of the new digital record, the process of opting out is difficult. +Additionally, the government and health insurance providers have publically depicted the system in a one-sidedly +positive way, meaning that it is unlikely the majority of people subject to the system have a comprehensive understanding of the system's benefits and risks that would be necessary for an informed decision. While there has been loud criticism of the system's security from civil society organizations such as digital rights @@ -50,7 +48,7 @@ been demonstrated practically, this criticism has largely been ignored by the po that despite this civil society outrage and the system's large scale, it has received little attention from the academic cryptography and information security community. -In this chapter, we aim to highlight some unconventional cryptographic engineering decisions in the system. In +In this chapter, we aim to point out some unconventional cryptographic engineering decisions in the system. In particular, we point out that the system's core per-user secrets are kept in a rudimentary key escrow system whose security is based on engineering assumptions, not on cryptographic principles. Furthermore, we observe that by specification, the individual user keys of the system are derived from a per-user cleartext salt based on a system-wide @@ -62,35 +60,40 @@ long-term secret with only 256 bits of entropy\footnote{ The current standard only requires one escrow service, and drops the entropy requirement of the root keys from 512 bits to 256 bits. The apparent reason for the long-term nature of these keys is that they are updated manually. }. Finally, we note that according to specification, the only physical security requirement for the protection of this -highly sensitive secret is a ``hard, opaque potting material'', with no tamper detection and response required. +highly sensitive secret is a ``hard, opaque potting material'', with no tamper detection and response required. We +belive that Inertial HSMs provide a path forward for systems like this, enabling physical security in applications that +currently rely on insecure, legacy systems. Even if for regulatory reasons a poorly secured conventional HSM without +active tamper sensing is chosen, it would be conceivable to construct an IHSM enclosure \emph{around} this conventional +HSM, in effect retrofitting the missing active tamper-sensing envelope. We base our analysis of the ePA on the system's publicly available standards in their latest version as of the writing of the paper underlying this chapter in April 2025, describing version 3.0 of the healthcare record system \cite{ gematikSpezifikationAktensystemEPA2025, gematikUbergreifendeSpezifikationVerwendung2024, -}. We note that hypothetically, the implementation might deviate from these standards and be more secure. The reference -implementation provided by the specification authority \cite{GithubRepositoryERPFD} follows the specified minimum -requirements closely. As of now, there is no meaningful way for either the public or for researchers such as us to -ascertain the concrete implementation security of the system. +}. We note that the implementation might well deviate from these standards and be more secure---however, with the +system's history of flaws, we believe this is unlikely to be the case. The reference implementation provided by the +specification authority \cite{GithubRepositoryERPFD} follows the specified minimum requirements closely. As of now, +there is no meaningful way for either the public or for researchers such as us to ascertain the concrete implementation +security of the system. \section{The Design of ePA} -ePA is embedded into Germany's national public healthcare backend system ``Telematikinfrastruktur'' (abbreviated TI; -German for ``telematics infrastructure''). TI is a highly complex system, and a detailed description would exceed the -limits of this analysis. Briefly put, TI consists of a shared demilitarized zone (DMZ) that parties like insurance -providers and healthcare providers connect to through a VPN. At the client location, usually an individual doctor's -office or a hospital, this VPN connection is terminated by a specialized VPN appliance named ``Konnektor'' that -simultaneously acts as a trusted component inside the client network hosting some software for purposes such as -authentication. The Konnektor contains several smart cards that store keys used for authentication. Konnektor devices -are offered by several vendors and healthcare providers like doctor's offices are indivudally responsible for purchasing -and maintaining a Konnektor. +ePA is embedded into Germany's national public healthcare backend system ``Telematikinfrastruktur'' (TI). TI is a highly +complex system, and a detailed description would exceed the limits of this analysis. Briefly put, TI consists of a +shared demilitarized zone (DMZ) that parties like insurance providers and healthcare providers connect to through a VPN. +At the client location, usually an individual doctor's office or a hospital, this VPN connection is terminated by a +specialized VPN appliance named ``Konnektor'' that simultaneously acts as a trusted component inside the client network +hosting some software for purposes such as authentication. The Konnektor contains several smart cards that store keys +used for authentication. Konnektor devices are offered by several vendors and healthcare providers like doctor's offices +are indivudally responsible for purchasing and maintaining a Konnektor. % FIXME: Is there a threat/trust model of the system that you could summarise in a few sentences? Every person enrolled in the system as well as every healthcare professional providing services under it is issued an ID card that contains a smart card with keys to authenticate towards the central infrastructure. The primary use of these -smart cards previously was to automatically provide personal information such as name, birth date, address and insurance -enrollment status when an enrolled person visits a healthcare provider. +smart cards up to now is that when an enrolled person visits a healthcare provider, they will insert their ID card into +a terminal so the healthcare provider can automatically fetch their personal information such as name, birth date, +address and enrollment status from their insurance provider. ePA is implemented inside the TI system. Its centralized services are accessed by healthcare providers through the TI's VPN, and by patients through proxy servers connected to TI's VPN. Patient records are encrypted and decrypted inside @@ -100,8 +103,8 @@ approved implementations of this server-side infrastructure. With the current version of the specificatoin, the overall architecture of ePA heavily relies on Trusted Execution Environments (TEEs). Data processing on the server side is done in plaintext inside TEEs, with some cryptographic key -management delegated to a Hardware Security Module (HSM). While attacks on the TEEs are considered in the system, the -HSMs are assumed to be perfectly secure, and the system does not include mitigations for a compromised HSM. The primary +management delegated to a Hardware Security Module. While attacks on the TEEs are considered in the system, the HSMs are +assumed to be perfectly secure, and the system does not include mitigations for a compromised HSM. The primary motivation for plaintext processing seems to be to enable large-scale data analysis for research purposes without requiring consent or cooperation of the people whose records are being processed~\cite{gematikWhitepaperDatenschutzUnd2025}. @@ -114,25 +117,23 @@ unclear on the exact mechanism of key derivation, in previous versions of the st random salt, and the healthcare ID number of the enrolled person was used in SHA256-HKDF. The specification requires that a new root key is generated once a year, but as far as we can tell, record key rollover is not done automatically but is only meant to be done when the \emph{user} requests it, and old root keys must be retained forever to ensure old -records can be accessed. Through this lack of automatic key rollover combined with the need to retain root keys -indefinitely, attack surface is maximized and incremental compromises of the system over long time spans become possible. +records can be accessed. -\subsection{Previous Analyses} +\subsection{Related Work} -\emph{gematik}, the state-owned company specifying the system, commissioned several security assessments of the system -relating to the key escrow service. -\citeauthor{fischlinKryptographischeAnalyseSpezifikation2021}~\cite{fischlinKryptographischeAnalyseSpezifikation2021} -focuses on the cryptographic dimension of the key escrow service used in an older version of the standard, and is now -obsolete. \textcite{slanySicherheitsanalyseZurSicherheit2020} approaches the system at a higher level, and focuses on -the cryptography of the inner protocol layers spoken between the system's components. Industry research organization +The state-owned company specifying the system commissioned several security assessments of the system relating to the +key escrow service. \textcite{fischlinKryptographischeAnalyseSpezifikation2021} focuses on the cryptographic +dimension of the key escrow service used in an older version of the standard, and is now obsolete. +\textcite{slanySicherheitsanalyseZurSicherheit2020} approaches the system at a higher level, and focuses on the +cryptography of the inner protocol layers spoken between the system's components. Industry research organization Fraunhofer SIT was comissioned for a structured, theoretical assessment of attack paths to the system -\cite{fraunhofersitAbschlussberichtSicherheitsanalyseGesamtsystems2024}. We are not currently aware of independent -academic security research on the system. +\cite{fraunhofersitAbschlussberichtSicherheitsanalyseGesamtsystems2024}. We are not currently aware of +independent academic security research on the system. The design and operation of the system have been independently described in detail by civil society activists, who have -demonstrated several successful attacks on the system. \textcite{tschirsichHackerHinOder2019} demonstrated how they +demonstrated several successful attacks on the system. \textcite{tschirsichHackerHinOder0100} demonstrated how they could trivially acquire each of the smartcards as well as the Konnektor necessary for accessing the system. -\textcite{tschirsichKonnteBisherNoch2024} summarize the history of attacks demonstrated on the system and show multiple +\textcite{tschirsichKonnteBisherNoch0100} summarize the history of attacks demonstrated on the system and show multiple practical attacks on various parts of the system's implementation. \section{Concerning Cryptographic Engineering Choices} @@ -142,11 +143,11 @@ by no means an exhaustive list, and is only meant to underscore why we believe t \subsection{Use of Key Escrow} -Key escrow describes a concept that was originally devised during the 1990ies out of a fear that the widespread -availability of strong encryption would stifle the ability of law enforcement agencies to wiretap communications in the -prosecution of crime. At the core of the concept rests the idea that a trusted \emph{key escrow} service should hold a -copy of every private key in use. In case the government wants to access one of these keys, the key escrow service can -provide this access\textcite{andersonSecurityEngineeringGuide2020,jarvisCryptoWarsFight2020}. +First, the system's general approach of using a key escrow service instead of securely storing the keys inside the +system's already existing smart card infrastructure is concerning, given that this key escrow service poses a +centralized security risk. The system's designers made this decision since it was deemed important that access to an +encrypted record can be restored quickly after an insurance ID card is lost, without requiring the cooperation of the +healthcare providers holding the primary copies of the person's medical records. While key escrow services have been a topic of political debate in decades past, in the cryptographic community, consensus generally is that they are a bad idea since they pose a centralized target for attack, and increase attack @@ -157,16 +158,8 @@ surface \cite{ rogawayMoralCharacterCryptographic2015, }. -Our first concern is the system's general approach of using a key escrow service instead of securely storing the keys -inside the system's already existing smart card infrastructure. Like any other key escrow system, this key escrow -service poses a centralized security risk. The system's designers made this decision since it was considered important -that when an encrypted record must be restored after an insurance ID card is lost, it can be re-created without the -cooperation of the healthcare providers holding the primary copies of the person's medical records. - \subsection{Cryptographic Design} -\todo{Feedback from HS3 reviewer: I feel that this section is a mix-up of critique on the cryptographic design and the - approach to privacy protection and data minimisation. How are they linked? I'm missing some discussion here.} The system's overall cryptographic design is intentionally kept simple. The standard explicitly mentions that symmetric primitives have been preferred over asymmetric primitives in the core key escrow functions due to the risk of an attack on asymmetric primitives in the long term. Notably, other advanced cryptographic techniques such as secret sharing @@ -181,25 +174,28 @@ For instance, the system leaks a person's insurance ID number to the key escrow requested. Along with the timing and frequency of these requests, this leaks information on the person's condition to the key escrow service in an identifiable way. +% TODO I feel that this section is a mix-up of critique on the cryptographic design and the approach to privacy +% protection and data minimisation. How are they linked? I'm missing some discussion here. + \subsection{A Realistic Attacker Model} -We observe that the system as a whole does not appear to be designed to defend against well-resourced adversaries. A -series of demonstrated practical attacks on the system, none of which required advanced capabilities, confirm this -impression. In \textcite{tschirsichKonnteBisherNoch2024} summarize a series of successful attacks. Attacks include -social engineering resulting in access to copies of smartcards enabling accessing patient records, using misconfigured -Konnektor VPN appliances with their local network DMZ and authentication interface exposed on the public internet, -circumventing video-based authentication processes resulting in duplicate file keys being provided, classis SQL -injection on a backend service maintaining an authentication database, accessing all national patient records through -brute-force enumeration of weak identifiers, and several more. +We observe that the system as a whole does not appear to be designed to defend against well-resourced adversaries. The +series of practical attacks that have been demonstrated on the system confirm this impression. In +\textcite{tschirsichKonnteBisherNoch0100} summarize a series of successful attacks. Attacks include social engineering +resulting in access to copies of smartcards enabling accessing patient records, using misconfigured Konnektor VPN +appliances with their LAN DMZ and authentication interface exposed on the public internet, circumventing video-based +authentication processes resulting in duplicate file keys being provided, classis SQL injection on a backend service +maintaining an authentication database, accessing all national patient records through brute-force enumeration of weak +identifiers, and several more. -We believe that a system like this must be designed to withstand well-resourced adversaries such as foreign secret +We believe that a system like this must be designed to withstand well-resourced adversaries such as enemy secret services, since the medical data stored in such as information on chronic illness, sexually transmittable disease or severe food allergies has intelligence value. Repeated breaches of national digital infrastructure such as the 2015 breach of the US Office of Personnel Management \cite{barrettUSSuspectsHackers2015} or the 2024 compromise of US telecommunications wiretapping systems \cite{mennChineseGovernmentHackers2024} demonstrate that such state-sponsored attacks on national digital infrastructure are a realistic concern. A possible scenario in the ePA system would be an -foreign secret service gaining access to one of the HSMs storing the systems' root secrets, extracting the root secret -by an advanced physical attack, then being able to decrypt captured encrypted health records at will. Similarly, a +enemy secret service gaining access to one of the HSMs storing the systems' root secrets, extracting the root secret by +an advanced physical attack, then being able to decrypt captured encrypted health records at will. Similarly, a nation-state adversary might have access to an exploit allowing the compromise of the system's TEEs, which would enable the extraction of any patient records being processed in plaintext inside these TEEs. @@ -207,20 +203,19 @@ the extraction of any patient records being processed in plaintext inside these Physical security has received some consideration in the system's specification. First, smart cards are used extensively for authentication. Second, Hardware Security Modules are used in key locations of the system to process some -cryptographic secrets. The core of the system's key escrow service is implemented inside an HSM that is part of a -redundant HSM cluster. However, it is notable that the actual security level required for this HSM is only FIPS 140-2 -level 3 \cite{usnationalinstituteofstandardsandtechnologySecurityRequirementsCryptographic2002}. FIPS 140-2 is a US -government standard that used to be popular for the specification of HSMs. However, not only has FIPS 140-2 been made -obsolete by FIPS 140-3 in 2019 \cite{usnationalinstituteofstandardsandtechnologySecurityRequirementsCryptographic2019}, -its security level 3 mostly provides logical separation of cryptographic functions from other logic and is not very -meaningful in the context of physical attacks. The only physical requirement of FIPS 140-2 level 3 is that the HSM has a -hard, opaque coating. This coating is specified to be tamper-evident, but notably no active tamper detection or response -features are required by this standard~\cite{andersonSecurityEngineeringGuide2020}. In contrast to the newer FIPS 140-3 -standard and the related ISO/IEC 19790 \cite{ISOIEC19790} as well as ISO/IEC 24759 \cite{ISOIEC24759} standards, FIPS -140-2 does not make any particular requirements regarding resistance to side-channel attacks. The lack of tamper -response, unspecified resistance to side-channel attacks and the fact that the ePA specification only requires the -long-lived key escrow root key inside the HSM to have 256 bits of entropy lead to an unsatisfactory overall -constellation. +cryptographic secrets. The core of the system's key escrow service is implemented inside an HSM. However, it is notable +that the actual security level required for this HSM is only FIPS 140-2 level 3 +\cite{usnationalinstituteofstandardsandtechnologySecurityRequirementsCryptographic2002}. FIPS 140-2 is a US government +standard that used to be popular for the specification of HSMs. However, not only has FIPS 140-2 been superseded by FIPS +140-3 since 2019 \cite{usnationalinstituteofstandardsandtechnologySecurityRequirementsCryptographic2019}, its security +level 3 mostly provides logical separation of cryptographic functions from other logic and is not very meaningful in the +context of physical attacks. The only physical requirement of FIPS 140-2 level 3 is that the HSM has a hard, opaque +coating. This coating is specified to be tamper-evident, but notably no active tamper detection or response features are +required by this standard~\cite{andersonSecurityEngineeringGuide2020}. In contrast to the newer FIPS 140-3 standard and +the related ISO/IEC 19790 \cite{ISOIEC19790} as well as ISO/IEC 24759 \cite{ISOIEC24759} standards, FIPS 140-2 does not +make any particular requirements regarding resistance to side-channel attacks. The lack of tamper response, unspecified +resistance to side-channel attacks and the fact that the ePA specification only requires the long-lived key escrow root +key inside the HSM to have 256 bits of entropy lead to an unsatisfactory overall constellation. \section{Conclusion} @@ -247,7 +242,5 @@ that better accomodate real-world use cases. We believe that Inertial HSMs can address this use case by cleanly separating the physical security primitive into a retargetable design that can be applied to entire servers if needed, and augment or replace technology like conventional -HSMs or trusted execution environments to provide high-level hardware security. Before introducing IHSMs in -Chapter~\ref{chapter-ihsm}, in the following chapter, we will first complement this chapter's outlook on the state of -the art in hardware security with a survey of tamper sensing meshes in a wide range of real world devices. +HSMs or trusted execution environments to provide high-level hardware security. diff --git a/chapter-hsms/chapter.tex b/chapter-hsms/chapter.tex index fc4be09..d4bb6f6 100644 --- a/chapter-hsms/chapter.tex +++ b/chapter-hsms/chapter.tex @@ -14,7 +14,7 @@ being used in the late 19\textsuperscript{th} century, around the widespread com active tamper sensing meshes are used in a wide array of devices ranging from card payment terminals to atomic bombs. In this chapter, we will start with a brief history of tamper sensing meshes. Complementing our historical analysis, we -will present the results of a survey of a range of real-world devices that use tamper sensing meshes and we will examine +will present the results of a survey of a range of real-world devices that use tamper sensing meshes and we will analyze their implementation. We will analyze the gaps left by the current state of the art in commercial practice, and evaluate how Inertial HSMs could close these gaps to make secure hardware accessible to a wider range of applications. The contributions in this chapter are as follows: @@ -27,8 +27,8 @@ contributions in this chapter are as follows: illustrating them. \item From our sample, we extract several design patterns that can be applied to increase the security of a design. \item We note security flaws in several of our samples. - \item We provide the results of Computed Tomography (CT) imaging of multiple samples, and we evaluate their impact - on tamper sensing mesh security. + \item We provide the results of CT measurements of multiple samples, and we evaluate their impact on tamper sensing + mesh security. \end{itemize} \section{The History of Tamper Sensing Meshes} @@ -70,9 +70,9 @@ the widespread adoption of cryptography in commercial applications~\cite{ One early practical uses of tamper sensing meshes for information security as opposed to the security of some physical good is documented in notes on a series of lectures given by Dr.~David~G. Boak, a specialist in communications security and signal intelligence at the US National Security -Agency~\cite{boakHistoryUSCommunications1981,boakHistoryUSCommunications1973}. In this lecture series, Boak mentions -that around World War \RN{2}, the US became concerned about the security of their ciphering machines, which at the time -were large, fridge-sized electro-mechanical contraptions. Initially, simple safes were used to protect those +Agency~\cite{nsaHistoryUSCommunications1973,nsaHistoryUSCommunications1981}. In this lecture series, Boak mentions that +around World War \RN{2}, the US became concerned about the security of their ciphering machines, which at the time were +large, fridge-sized electro-mechanical contraptions. Initially, simple safes were used to protect those devices---however, as Boak notes, the US was well aware that they could not build a safe that a well-equipped specialist could not break open within an hour. As a solution, the NSA started development on what we would today call a Hardware Security Module by encapsulating a crypto coprocessor in a tamper sensing envelope. Boak observes that as a tamper @@ -111,29 +111,24 @@ history of nuclear material passing through these facilities. When using sensors to monitor treaty compliance, the IAEA has to consider the possibility of a host state tampering with its sensors to abuse nuclear material without being noticed. Historically, the IAEA has responded to this threat by the -extensive use of tamper-indicating enclosures and of seals\footnote{ - Note that in IAEA terminology, both tamper detection and tamper evidence are combined into the term ``tamper - indication''. The IAEA distinguishes between active tamper indication, which we conventionally call tamper - detection, and passive tamper indication, which we conventionally call tamper evidence. Tamper indicating devices - include seals, but also the aforementioned uniquely characterizable enclosures, which IAEA terminology calls - intrinsically tamper-indicating. An example for an active tamper indicating device would be a seismic sensor at the - bottom of a borehole that has been back-filled with concrete such that any attempt to reach the sensor would be - well-visible in the sensor's own readings~\cite{simmonsHowInsureThat1988}. -}. In both systems, the approach taken is that the enclosure or seal is treated similarly to what these days, in -computing we call a Physical Unclonable Function (PUF). The concept of a PUF centers on electronic component -manufactured such that random manufacturing variations can later be measured by the finished circuit. The core idea is -that since these manufacturing variations are random, they can be used as a source for cryptographic entropy. -Furthermore, the concept is based on the assumption that these manufacturing variations cannot be controlled, hence -making the device \emph{unclonable}. +extensive use of tamper-indicating enclosures and of seals. In both systems, the approach taken is that the enclosure or +seal is treated similarly to what these days, in computing we call a Physically Uncloneable Function. The enclosure or +seal is manufactured in a process that leaves an unpredictable and uncontrollable pattern of manufacturing variations +such as surface imperfections. A process used in the IAEA is to package devices in aluminium enclosures passivated in a +bright color, which leaves a random, microscopic pattern of pits in the surface from the etching step. Before such a +device is deployed in the field, it is precisely measured from all sides. Later on, after field deployment, its +integrity can then be checked by comparing its current state to these initial measurements. The underlying assumption is +that drilling or cutting into something like a metal enclosure will leave detectable traces, and that perfectly +replicating an object including features such as minute surface imperfections is infeasible even to a nation +state~\cite{iaea2011}. -Similar to a PUF, in the IAEA's application an enclosure or seal is manufactured in a process that leaves an -unpredictable and uncontrollable pattern of manufacturing variations such as surface imperfections. A process used in -the IAEA is to package devices in aluminium enclosures passivated in a bright color, which leaves a random, microscopic -pattern of pits in the surface from the etching step. Before such a device is deployed in the field, it is precisely -measured from all sides. Later on, after field deployment, its integrity can then be checked by comparing its current -state to these initial measurements. The underlying assumption is that drilling or cutting into something like a metal -enclosure will leave detectable traces, and that perfectly replicating an object including features such as minute -surface imperfections is infeasible even to a nation state~\cite{iaea2011}. +In IAEA terminology, both tamper detection and tamper evidence are combined into the term ``tamper indication''. The +IAEA distinguishes between active tamper indication, which we conventionally call tamper detection, and passive tamper +indication, which we conventionally call tamper evidence. Tamper indicating devices include seals, but also the +aforementioned uniquely characterizable enclosures, which IAEA terminology calls intrinsically tamper-indicating. An +example for an active tamper indicating device would be a seismic sensor at the bottom of a borehole that has been +back-filled with concrete such that any attempt to reach the sensor would be well-visible in the sensor's own +readings~\cite{simmonsHowInsureThat1988}. With smarter electronics becoming more affordable in both monetary and in power budget, over the decades, other active tamper sensors have received attention as well. The IAEA reports on attempts at burying sensors such as piezoelectric @@ -153,12 +148,12 @@ and ATMs to the ATM pin pads themselves, which encrypt the customer's PIN right of card payment terminals. HSMs are used for highly sensitive operations even outside of the financial industry, although their adoption is -hampered by their high cost. In this chapter, we will analyze a commercial HSM that was used in the key management -infrastructure of a premium TV provider as one example of such uses. Examples of other applications include mail -franking machines, where they are used to protect the credit counter and franking data, with one such unit analyzed in -this chapter. Furthermore, we have identified several models of key safes that in Germany are mounted externally on -public buildings to provide keys to emergency services, and which include tamper sensing meshes on their door and -interior walls to detect attempts at drilling into them~\cite{SD04203RB25D5, +hampered by their high cost. These applications include key management in the TLS certificate infrastructure. In this +chapter, we will analyze a commercial HSM that was used in the key management infrastructure of a premium TV provider. +Other applications include mail franking machines, where they are used to protect the credit counter and franking data, +with one such unit analyzed in this chapter. Furthermore, we have identified several models of key safes that in Germany +are mounted externally on public buildings to provide keys to emergency services, and which include tamper sensing +meshes on their door and interior walls to detect attempts at drilling into them~\cite{SD04203RB25D5, krusesicherheitssystemeDatenblattKRUSEFWSchlusseldepot2018}. Finally, we have found a processing unit used in a series of mid-2000s era slot machines in Germany that includes a tamper sensing mesh, presumably to prevent modification or cloning. This device will also be analyzed later in this chapter. @@ -201,13 +196,6 @@ basic construction and layout has not changed much since the early 1990ies~\cite macphersonImprovementsSecurityEnclosures1993, macphersonTamperRespondentEnclosure1999}. -Concluding this brief history of tamper sensing meshes, we find that they were initially developed for sensitive -military applications, and their use in civil applications is a recent phenomenon. The implementation of tamper sensing -meshes in civil applications was likely catalyzed by two advancements in electronics. First, electronic components -became less expensive and more integrated reducing the cost overhead of tamper sensing circuits. Second, the mass-scale -adoption of PCB and FPC production processes enabled their use as inexpensive, high-resolution substrates for such -meshes. - \subsection{Monitoring Circuit Approaches} Tamper sensing meshes are most effective when they are continuously monitored using a backup power supply while the rest @@ -225,7 +213,7 @@ To achieve low power consumption, a popular technique known since at least 1902~\cite{suttonElectricallyprotectedStructure1902} and still used today~\cite{cesanaTamperResistantCard2001,razaghiCircuitBoardHold2019} is to measure the deviation of the mesh's end-to-end ohmic resistance from its baseline value. This measurement can be implemented either by directly comparing a -mesh trace's resistance with a reference resistor, or using a Wheatstone bridge. Bridge circuits were already used +mesh trace's resistance with a reference resistor, or using a wheatstone bridge. Bridge circuits were already used in early tamper sensing mesh implementations~\cite{ ElektrischeSicherheitseinrichtungSchutze1932, hamPrintedcircuitTypeSecurity1971, @@ -237,29 +225,34 @@ in early tamper sensing mesh implementations~\cite{ Besides tamper sensing meshes, environmental sensors such as temperature or light sensors are frequently used as a secondary line of defence in HSMs and similar devices. By placing such sensors in the device and verifying the device is within its nominal operating environment, tampering can be made less convenient. Modern security standards often mandate -the implementation of at least a temperature sensor to prevent cold-boot attacks on a device~\cite{ - usnationalinstituteofstandardsandtechnologySecurityRequirementsCryptographic2019, - ISOIEC19790}. -A multitude of other sensors have been proposed, including vibration sensors, light sensors, -magnetometers, and radiation sensors such as X-ray sensors have been proposed. While the implementation cost of most -sensor types is low, each additional environmental sensor comes with an increased false alarm -rate~\cite{andersonSecurityEngineeringGuide2020}. +the implementation of at least a temperature sensor to prevent cold-boot attacks on a device. A multitude of other +sensors have been proposed, including humidity sensors, vibration sensors, light sensors, magnetometers, and radiation +sensors such as X-ray sensors have been proposed. While the implementation cost of most sensor types is low, each +additional environmental sensor comes with an increased false alarm rate. Anecdotally, we have heard of light sensors +being removed from a datacenter HSM product because they caused frequent false alarms despite extensive efforts like +custom injection-molded plastic light baffles at all air vents of the device designed to prevent ingress of outside +light. +% FIXME citations? \section{A Survey of Meshes in the Wild} -In this section, we will examine a large sample of recent devices that include tamper sensing meshes to gain an +Concluding the brief history of tamper sensing meshes above, we find that they were initially developed for sensitive +military applications, and their use in civil applications is a recent phenomenon. The implementation of tamper sensing +meshes in civil applications was likely catalyzed by two advancements in electronics. First, electronic components +became less expensive and more integrated reducing the cost overhead of tamper sensing circuits. Second, the mass-scale +adoption of PCB and FPC production processes enabled their use as inexpensive, high-resolution substrates for such +meshes. In this section, we will examine a large sample of recent devices that include tamper sensing meshes to gain an understanding of how they are implemented, and what security level they are targeted towards. Since we were unable to -acquire a nuclear weapon for our research, we limited our survey to commercial devices. While we analyzed devices across -a broad spectrum of applications, our survey includes a large variety of card payment terminals, which represent the -most varied class of device incorporating such meshes. +acquire a nuclear weapon for our research, we limited our survey to commercial devices with a focus on card payment +terminals, which represent the most varied class of device incorporating such meshes. \subsection{Specimen Selection} Given their niche applications and high cost, devices incorporating tamper sensing meshes tend to be hard to find. For this survey, we chose 30 total devices including 23 different models of card payment terminals, and 7 other devices. -Some devices were procured by intercepting electronic waste, while most were sourced from ebay in Februrary and March -2025. The majority of these were sold by electronic waste recycling companies. A complete list of our specimens can be -found in Table~\ref{tab_hsm_survey_sample_list}. External photos of each device are shown in +Some devices were procured by dumpster diving, while most were sourced from ebay. The majority of these were sold by +electronic waste recycling companies. A complete list of our specimens can be found in +Table~\ref{tab_hsm_survey_sample_list}. External photos of each device are shown in Figure~\ref{fig_hsm_survey_sample_pics} and internal photos are shown in Figure~\ref{fig_hsm_survey_sample_internal_pics}. In the following sections, we will go into detail on the classes of devices we selected for this study. @@ -360,11 +353,12 @@ skimming that aim to exfiltrate card data and PINs entered by the customer. The Council (PCI SSC), an association of all major western credit card network operators assumes the role of the de-facto standardization organization in the card payment space. Due to the international scale of the large credit card networks, almost all payment terminals on the market irrespective of their country of origin are certified under PCI SSC -standards. Adding on to PCI's ecosystem impact, its security standards are thought out well. +standards. Adding on to PCI's ecosystem impact, its security standards are thought out well and provide a higher level +of security than one might expect from an industry association. One reason for the high level of physical security standards in card payment applications both on the client side (payment terminals) and on the server side (HSM appliances) is that the finance industry has been reluctant to adopt -modern cryptography. Not only are modern cryptographic protocols like secure Multiparty Computation (MPC) or +modern cryptography. Not only are modern cryptographic protocols like Secure Multiparty Computation (SMPC) or Zero-Knowledge Proofs (ZKPs) not commonly used. Even asymmetric cryptography has only been adopted reluctantly, and ancient ciphers such as Triple DES are still commonly referenced in industry standards~\cite{pcisecuritystandardscouncilPaymentCardIndustry2025}. As a result, increased hardware security is @@ -379,19 +373,19 @@ terminals are cost-sensitive devices, which is reflected in the construction of When credit card payments are handled on the web as opposed to in a physical store, HSMs are used in data centers to handle plaintext payment data such as credit card numbers. Such HSM appliances are usually standalone rackmount devices and are used across application domains. Depending on the application, these HSMs can be programmed with custom code, or -can be used as coprocessors through an API~\cite{LunaNetworkHSM}. In practice, the standalone appliances are just -low-end computers in a rackmount enclosure that expose the API of an internal HSM add-in card to the network. In this -survey, we obtained two devices labelled as HSMs. We were only able to procure two such devices since they are -expensive, and we found that even used specimens of older models are usually listed for several hundreds to several -thousands of Euro. Unfortunately, one of the devices we obtained did not contain any security meshes in its case, and -thus would not provide adequate protection against advanced attacks. The other specimen we procured was a 2011 model -Utimaco CryptoServer LAN. Our unit was a white-label variant procured by premium TV encryption technology provider -Irdeto, presumably used in Germany to produce cryptographic key streams for TV signal encryption. We bought the device -from a recycling company specialized on datacenter components. The device was sold with any HDDs removed. The device -consisted of an older mainboard for embedded applications containing an Intel Core 2 Duo-brand processor and 2 GiB of -DDR2 RAM, which was connected to the HSM add-in card through PCI. The device contained a small Lithium backup battery on -the add-in card, and another, larger battery in an enclosure at the front of the device that was connected to the card -through a cable. The device did not contain any obvious case intrusion sensors. +can be used as coprocessors through an API. In practice, the standalone appliances are just low-end computers in a +rackmount enclosure that expose the API of an internal HSM add-in card to the network. In this survey, we obtained two +devices labelled as HSMs. We were only able to procure two such devices since they are expensive, and even used +specimens of older models are usually listed for several hundreds to several thousands of EUR. Unfortunately, one of the +devices we obtained did not contain any security meshes in its case, and thus would not provide adequate protection +against advanced attacks. The other specimen we procured was a 2011 model Utimaco CryptoServer LAN. Our unit was a +white-label variant procured by premium TV encryption technology provider Irdeto, presumably used in Germany to produce +cryptographic key streams for TV signal encryption. We bought the device from a recycling company specialized on +datacenter components. The device was sold with any HDDs removed. The device consisted of an older mainboard for +embedded applications containing an Intel Core 2 Duo-brand processor and 2 GiB of DDR2 RAM, which was connected to the +HSM add-in card through PCI. The device contained a small Lithium backup battery on the add-in card, and another, larger +battery in an enclosure at the front of the device that was connected to the card through a cable. The device did not +contain any obvious case intrusion sensors. \subsubsection{ATM Encrypting Pin Pads} @@ -613,7 +607,6 @@ list, we will address several common structural features that we observed across \label{hsm_fig_materials} \end{figure} -\todo{FIXME: Add scale / structure size to photos?} Regular Printed Circuit Boards are frequently used to implement tamper sensing meshes as shown in Figure~\ref{hsm_fig_materials_pcb_rigid}. PCB production is a highly advanced, large-scale industry and PCBs are inexpensive, commodity products. PCBs can be manufactured with many layers, at almost arbitrary total thickness, and @@ -707,11 +700,11 @@ across the contact as shown in Figure~\ref{hsm_fig_connector_elastomeric}, but t soldering. Hand soldering increases unit cost over mechanized soldering techniques such as wave soldering or reflow soldering. -FPCs are suitable for use with standard FPC connectors as shown in Figure~\ref{hsm_fig_connector_fpc}. These connectors -mate directly to a contact area on the FPC, called \emph{gold fingers} in industry terms. Both FPCs and rigid PCBs can -be used with standard board-to-board stacking connectors such as the one visible in the center of -Figure~\ref{hsm_fig_connector_stack}, but their use on FPCs requires a stiffener on the FPC's back side to ensure the -solder joints don't break from mechanical stress when connecting or disconnecting. +FPCs are suitable for use with standard Zero Insertion Force (ZIF) FPC connectors as shown in +Figure~\ref{hsm_fig_connector_fpc} that directly mate to a contact area, called \emph{gold fingers} in industry terms, +on the FPC. Both FPCs and rigid PCBs can be used with standard board-to-board stacking connectors such as the one +visible in the center of Figure~\ref{hsm_fig_connector_stack}, but their use on FPCs requires a stiffener on the FPC's +back side to ensure the solder joints don't break from mechanical stress when connecting or disconnecting. In our survey, we frequently found elastomeric connectors used to connect to both flexible and rigid tamper sensing mesh assemblies. Elastomeric connectors such as the one shown in the center of Figure~\ref{hsm_fig_connector_elastomeric} are @@ -809,7 +802,7 @@ Thermoforming is a cheap industry standard process, but applied to flexible circ only 2.5-dimensional structures can be created since the starting product is always a planar sheet. Second, the sheet cannot be cut or contain slots or large holes before forming since it needs to be kept under a constant tension from all sides to ensure it evenly stretches into the mold. Finally, the depth achievable in such a process is rather limited, -with no sample in our survey exceeding \qty{2}{\milli\meter}.\todo{Get proper number} Higher depths would require +with no sample in our survey exceeding \qty{2}{\milli\meter}\todo{Get proper number}. Higher depths would require extensive deformation of the mesh circuit's plastic substrate, which could lead to tears in the mesh traces since the particle-based conductive inks used for screen-printed electronics are inelastic. Among our samples, we saw two instances of thermoformed meshes. First, all recent Ingenico terminals (\sampleno{H06,H13,H23,H24}) integrated an ink @@ -847,7 +840,7 @@ access by probes. \label{fig_ingenico_forming} \end{figure} -Specimen~\sampleno{H12}, shown in Figure~\ref{hsm_fig_3d_struct_vacuum_form}, displays one further design defect. The mesh +specimen~\sampleno{H12}, shown in Figure~\ref{hsm_fig_3d_struct_vacuum_form}, displays one further design defect. The mesh shown does not extend to the edges of the plastic cover it has been molded into. When this cover is placed on top of a PCB to protect components on the PCB from tampering, this leaves a large gap between the bottom edge of the mesh and the PCB surface, through which probes can be inserted to access either the payload circuit or the mesh monitoring circuitry. @@ -935,69 +928,15 @@ terminal. While a similar result could also be achieved by milling a slot into t PCB, the economics of PCB manufacturing are such that it may be more cost-effective to bond two standard-thickness PCBs on top of one another instead. -Figure~\ref{hsm_fig_3d_sandwich_lid} shows an advanced construction technique that uses a custom PCB with a large indent -milled into its underside soldered on top of a base PCB to create a protected cavity on top of the base PCB. This PCB -lid shows a complex internal structure. It is built up in a custom stackup with a total of six layers: A ground plane -filling the top layer, then two orthogonal planar mesh layers covering the inside of the lid above the cavity. Below -this standard mesh stackup are two that are used to create a via fence structure similar to that shown in +Figure~\ref{hsm_fig_3d_sandwich_lid} finally shows an advanced construction technique that uses a custom PCB with a +large indent milled into its underside soldered on top of a base PCB to create a protected cavity on top of the base +PCB. This PCB lid shows a complex internal structure. It is built up in a custom stackup with a total of six layers: A +ground plane filling the top layer, then two orthogonal planar mesh layers covering the inside of the lid above the +cavity. Below this standard mesh stackup are two that are used to create a via fence structure similar to that shown in Figure~\ref{hsm_fig_3d_sandwich_via_fence} in an attempt to protect the sides around the central cavity. Below these two via fence layers, at the bottom of the PCB is one more layer containing the pads connecting it to the base PCB. -\subsubsection{CT Imaging} - -\begin{figure} - \centering - \begin{subfigure}[t]{0.45\textwidth} - \centering - \includegraphics[width=\linewidth]{mesh_contact_joint.pdf} - \caption{CT section cut with part of a mesh layer and the crimped metal mesh contacts visible.} - \label{hsm_fig_ingenico_potted_ct_cut} - \end{subfigure} - \quad - \begin{subfigure}[t]{0.45\textwidth} - \centering - \includegraphics[width=\linewidth]{mesh_geom.pdf} - \caption{CT 3D reconstruction of the mesh's trace geometry.} - \label{hsm_fig_ingenico_potted_ct_3d} - \end{subfigure} - \quad - \begin{subfigure}[t]{0.45\textwidth} - \centering - \includegraphics[width=\linewidth]{ingenico_hsm_module.jpg} - \caption{Photo of the HSM module seated on the payment terminal's main PCB.} - \label{hsm_fig_ingenico_potted_seated} - \end{subfigure} - \caption[Potted module CT images]{Optical photograph and CT pictures of a potted HSM module - (specimen~\sampleno{H18}).} - \label{hsm_fig_ingenico_potted} -\end{figure} - -% FIXME put the CT people in the acknowledgements! Also the microwave people! -Hardware manufacturers implementing security meshes often attempt to keep the meshes' layouts hidden as a way of -security by obscurity. In practice, this can take the form of opaque potting compounds (cf. -Figure~\ref{hsm_fig_ingenico_potted_seated}), opaque cover layers (cf. Figure~\ref{hsm_fig_materials_gold_lds}), and -burying the mesh beneath other features such as PCB ground planes (cf. Figure~\ref{hsm_fig_3d_sandwich_lid}, e.g.\ -specimens~\sampleno{H03}, \sampleno{H17} and \sampleno{H32}). To circumvent such attempts, an obvious attack vector is -to use radiographical imaging techniques such as X-ray or CT imaging. To evaluate CT imaging as an attack method, we -experimentally imaged the potted HSM module of specimen~\sampleno{H18}, an Ingenico payment terminal, using an -industrial CT. Figure~\ref{hsm_fig_ingenico_potted} shows the module we analyzed and two images exported from the -resulting CT scan data. Figure~\ref{hsm_fig_ingenico_potted_ct_cut} shows a horizontal cut across part of the module. In -this cut, we can clearly identify a mesh layer with multiple traces, four solid metal contacts crimped to the mesh foil, -and two unused contact pads and mesh traces in the lower part of the picture. An attacker would be able to use this -information to target the metal contacts with a tool like a needle probe. From the CT scan we were able to measure that -the mesh of the device has a pitch of \qty{1.0}{\milli\meter}. Thus, even inserting a thin needle probe right through -one of the mesh's traces should be possible without breaking the trace. - -Figure~\ref{hsm_fig_ingenico_potted_ct_3d} shows a 3D reconstruction of the mesh's conductor layout. While the -reconstruction is slightly noisy due to the limited scan time available, it contains ample detail to reconstruct the -mesh's layout and conductor count, and even to derive conductor dimensions in order to calculate resistance and other -electronic parameters. The mesh's foil is wrapped around the circuit board forming a pillow shape, which is clearly -reflected in the reconstructed 3D mesh geometry. This information could be used to guide a CNC milling machine to -selectively ablate the device's potting precisely down to the mesh's conductors to enable direct patching attacks on the -mesh. - - -\subsubsection{Results summary} +\subsubsection{Tabular results} Below is a table representing which features discussed in the sections above we found in which of our samples. Overall, we commonly found a combination of a rigid PCB mesh in the specimen's main PCB and and flexible meshes formed into a lid @@ -1030,7 +969,7 @@ reverse engineering. \newcolumntype{M}{>{\centering\arraybackslash}p{4mm}} \setlength{\tabcolsep}{0pt} \begin{tabular}{ll|MMMMM|MMMM|MMMMM|MMMMM|MMMMM|MMM|MM} - &&\multicolumn{29}{c}{\textbf{Specimen}}\\ + &&\multicolumn{29}{c}{\textbf{Mesh}}\\ \textbf{Feature} & \textbf{Figures} & 1 & 2 & 3 & 4 & 5 & 6 & 8 & 9 & 10 & 11 & 12 & 13 & 14 & 15 & 16 & 17 & 18 & 19 & 20 & 21 & 22 & 23 & 24 & 25 & 27 & 28 & 30 & 31 & 32 \\\hline @@ -1196,12 +1135,64 @@ Integrated contact pads & \ref{hsm_fig_connector_fpc} & & & \\ % 30 - 32 \end{tabular} - \caption[Feature matrix of all specimens analyzed.]{Feature matrix of all specimens analyzed. Dots indicate presence - of a feature. The figures column lists which figures above contain examples of a particular feature.} + \caption{Feature matrix of all specimens analyzed.} \label{tab_hsm_survey_sample_results} \end{table} \end{landscape} +\subsubsection{CT Imaging} + +\begin{figure} + \centering + \begin{subfigure}[t]{0.45\textwidth} + \centering + \includegraphics[width=\linewidth]{mesh_contact_joint.pdf} + \caption{CT section cut with part of a mesh layer and the crimped metal mesh contacts visible.} + \label{hsm_fig_ingenico_potted_ct_cut} + \end{subfigure} + \quad + \begin{subfigure}[t]{0.45\textwidth} + \centering + \includegraphics[width=\linewidth]{mesh_geom.pdf} + \caption{CT 3D reconstruction of the mesh's trace geometry.} + \label{hsm_fig_ingenico_potted_ct_3d} + \end{subfigure} + \quad + \begin{subfigure}[t]{0.45\textwidth} + \centering + \includegraphics[width=\linewidth]{ingenico_hsm_module.jpg} + \caption{Photo of the HSM module seated on the payment terminal's main PCB.} + \label{hsm_fig_ingenico_potted_seated} + \end{subfigure} + \caption[Potted module CT images]{Optical photograph and CT pictures of a potted HSM module + (specimen~\sampleno{H18}).} + \label{hsm_fig_ingenico_potted} +\end{figure} + +% FIXME put the CT people in the acknowledgements! Also the microwave people! +Hardware manufacturers implementing security meshes often attempt to keep the meshes' layouts hidden as a way of +security by obscurity. In practice, this can take the form of opaque potting compounds (cf. +Figure~\ref{hsm_fig_ingenico_potted_seated}), opaque cover layers (cf. Figure~\ref{hsm_fig_materials_gold_lds}), and +burying the mesh beneath other features such as PCB ground planes (cf. Figure~\ref{hsm_fig_3d_sandwich_lid}, e.g.\ +specimens~\sampleno{H03}, \sampleno{H17} and \sampleno{H32}). To circumvent such attempts, an obvious attack vector is +to use radiographical imaging techniques such as X-ray or CT imaging. To evaluate CT imaging as an attack method, we +experimentally imaged the potted HSM module of specimen~\sampleno{H18}, an Ingenico payment terminal, using an +industrial CT. Figure~\ref{hsm_fig_ingenico_potted} shows the module we analyzed and two images exported from the +resulting CT scan data. Figure~\ref{hsm_fig_ingenico_potted_ct_cut} shows a horizontal cut across part of the module. In +this cut, we can clearly identify a mesh layer with multiple traces, four solid metal contacts crimped to the mesh foil, +and two unused contact pads and mesh traces in the lower part of the picture. An attacker would be able to use this +information to target the metal contacts with a tool like a needle probe. From the CT scan we were able to measure that +the mesh of the device has a pitch of \qty{1.0}{\milli\meter}. Thus, even inserting a thin needle probe right through +one of the mesh's traces should be possible without breaking the trace. + +Figure~\ref{hsm_fig_ingenico_potted_ct_3d} shows a 3D reconstruction of the mesh's conductor layout. While the +reconstruction is slightly noisy due to the limited scan time available, it contains ample detail to reconstruct the +mesh's layout and conductor count, and even to derive conductor dimensions in order to calculate resistance and other +electronic parameters. The mesh's foil is wrapped around the circuit board forming a pillow shape, which is clearly +reflected in the reconstructed 3D mesh geometry. This information could be used to guide a CNC milling machine to +selectively ablate the device's potting precisely down to the mesh's conductors to enable direct patching attacks on the +mesh. + \section{Discussion} In our survey, we have seen the technological state of the art to which tamper-sensing meshes have evolved since the diff --git a/chapter-hsms/pres-harris.tex b/chapter-hsms/pres-harris.tex deleted file mode 100644 index c0daedc..0000000 --- a/chapter-hsms/pres-harris.tex +++ /dev/null @@ -1,493 +0,0 @@ -\documentclass[aspectratio=169]{beamer} -\usetheme{default} -\usepackage[T1]{fontenc} -\usepackage{textcomp} -\usepackage{graphicx} -\usepackage{subcaption} -\usepackage{siunitx} -\usepackage{booktabs} -\usepackage{array} -\usepackage{ragged2e} -\usepackage{colortbl} -\usepackage{pdflscape} -\usepackage[percent]{overpic} -\usepackage[backend=biber,style=numeric,sorting=none]{biblatex} -\addbibresource{../main.bib} - -\graphicspath{{figures}} - -% Define custom commands if not already defined -\newcommand{\surveypic}[2]{ - \begingroup - \setlength{\fboxsep}{0.2mm} - \begin{overpic}[percent,height=10mm]{#2} - \put(100,85){\makebox[0pt][r]{\colorbox{white}{\footnotesize H#1}}} - \end{overpic} - \endgroup - } -\newcommand{\sampleno}[1]{#1} - -\title{Tamper-Sensing Meshes in the Wild} -\author{\textbf{Jan Sebastian Götte} \& Björn Scheuermann\\TU Darmstadt\\contact: \texttt{research@jaseg.de}} -\date{2026-03-24} - -\begin{document} - -\begin{frame} -\titlepage -\end{frame} - -\begin{frame}{What is a Tamper Sensing Mesh?} -\begin{itemize} -\item Embedded looped conductor covering a surface -\item Detects physical intrusion - \begin{itemize} - \item Drills, saws, lasers etc. - \end{itemize} -\item Triggers some tamper response - \begin{itemize} - \item Deleting keys - \item Raising alarms - \item Explosions? - \end{itemize} -\item Widely used in HSMs, payment terminals, ATMs, nuclear weapons -\end{itemize} -\end{frame} - -\begin{frame}{The History of Tamper-Sensing Meshes} -\begin{itemize} -\item \textbf{1870}: First patents using literal wire meshes to protect bank vaults~\cite{ImprovementProtectingSafes1870,ImprovementElectromagneticEnvelopes1870} -\item \textbf{1902}: Multi-layer, orthogonal meshes documented~\cite{suttonElectricallyprotectedStructure1902} -\item \textbf{1971}: Printed circuit technology adopted~\cite{hamPrintedcircuitTypeSecurity1971} -\item \textbf{1990s}: Widespread commercial adoption with cryptographic applications -\end{itemize} - -Other, hard to date examples: NSA use for protecting ciphering machines~\cite{boakHistoryUSCommunications1973,boakHistoryUSCommunications1981}, US use in nuclear weapons~\cite{carterManagingNuclearOperations1987} -\end{frame} - -\begin{frame}{Commercial Applications Today} -\begin{itemize} -\item Datacenter HSMs (Key management, payment processing) -\item Card Payment Terminals (PIN encryption) -\item ATM Encrypting Pin Pads (PIN encryption) -\item Key Safes for Emergency services access (Germany only?) -\item Mail Franking Machines (credit counter) -\item Slot Machines (likely for DRM) -\end{itemize} -\end{frame} - - -\begin{frame}{Our Survey} -\textbf{Sample Size}: 30 devices - -\textbf{Device Types}: -\begin{itemize} - \item 23 Card payment terminals (Verifone, Ingenico, SumUp, etc.) - \item 3 ATM Encrypting Pin Pads (NCR, Sagem) - \item 2 HSM modules (SafeNet, Utimaco) - \item 1 Franking machine - \item 1 German slot machine CPU -\end{itemize} -\end{frame} - -\begin{frame}{Mesh Materials and Structure Sizes Observed} -\begin{itemize} - \item \textbf{Rigid PCB (FR-4):} Photolithographic etching, \SIrange{100}{200}{\micro\meter} - \item \textbf{Polyimide/Copper FPC:} Photolithographic etching, \SIrange{100}{200}{\micro\meter} - \item \textbf{Silver ink FPC:} Screen printing, \SIrange{500}{3000}{\micro\meter} - \item \textbf{Carbon ink FPC:} Screen printing, \SIrange{500}{3000}{\micro\meter} - \item \textbf{Gold laser direct structuring:} Laser Direct Structuring, \SIrange{50}{200}{\micro\meter} - \item \textbf{IBM/Gore mesh:} Printed, \SIrange{200}{1500}{\micro\meter} -\end{itemize} -\end{frame} - -\begin{frame}{Survey Specimens - External Photos} -\begin{figure} - \centering - \footnotesize - \begin{tabular}[c]{cccccc} - \surveypic{02}{survey_diag_S02.jpg}& - \surveypic{03}{survey_diag_S03.jpg}& - \surveypic{04}{survey_diag_S04.jpg}& - \surveypic{05}{survey_diag_S05.jpg}& - \surveypic{06}{survey_diag_S06.jpg}& - \surveypic{08}{survey_diag_S08.jpg}\\ - \surveypic{09}{survey_diag_S09.jpg}& - \surveypic{10}{survey_diag_S10.jpg}& - \surveypic{11}{survey_diag_S11.jpg}& - \surveypic{12}{survey_diag_S12.jpg}& - \surveypic{13}{survey_diag_S13.jpg}& - \surveypic{14}{survey_diag_S14.jpg}\\ - \surveypic{15}{survey_diag_S15.jpg}& - \surveypic{16}{survey_diag_S16.jpg}& - \surveypic{17}{survey_diag_S17.jpg}& - \surveypic{18}{survey_diag_S18.jpg}& - \surveypic{19}{survey_diag_S19.jpg}& - \surveypic{20}{survey_diag_S20.jpg}\\ - \surveypic{21}{survey_diag_S21.jpg}& - \surveypic{22}{survey_diag_S22.jpg}& - \surveypic{23}{survey_diag_S23.jpg}& - \surveypic{24}{survey_diag_S24.jpg}& - \surveypic{25}{survey_diag_S25.jpg}& - \surveypic{27}{survey_diag_S27.jpg}\\ - \surveypic{28}{survey_diag_S28.jpg}& - \surveypic{29}{survey_diag_S29.jpg}& - \surveypic{30}{survey_diag_S30.jpg}& - \surveypic{31}{survey_diag_S31.jpg}& - \surveypic{32}{survey_diag_S32.jpg}& - \\ - \end{tabular} -\end{figure} -\end{frame} - -\begin{frame}{Survey Specimens - Internal Photos} -\begin{figure} - \centering - \footnotesize - \begin{tabular}[c]{cccccc} - \surveypic{01}{survey_internal_09_S01.jpg}& - \surveypic{02}{survey_internal_20_S02.jpg}& - \surveypic{03}{survey_internal_11_S03.jpg}& - \surveypic{04}{survey_internal_03_S04.jpg}& - \surveypic{05}{survey_internal_10_S05.jpg}& - \surveypic{06}{survey_internal_08_S06.jpg}\\ - \surveypic{08}{survey_internal_24_S08.jpg}& - \surveypic{09}{survey_internal_13_S09.jpg}& - \surveypic{10}{survey_internal_23_S10.jpg}& - \surveypic{11}{survey_internal_17_S11.jpg}& - \surveypic{12}{survey_internal_19_S12.jpg}& - \surveypic{13}{survey_internal_02_S13.jpg}\\ - \surveypic{14}{survey_internal_00_S14.jpg}& - \surveypic{15}{survey_internal_04_S15.jpg}& - \surveypic{16}{survey_internal_05_S16.jpg}& - \surveypic{17}{survey_internal_22_S17.jpg}& - \surveypic{18}{survey_internal_21_S18.jpg}& - \surveypic{19}{survey_internal_26_S19.jpg}\\ - \surveypic{20}{survey_internal_12_S20.jpg}& - \surveypic{21}{survey_internal_15_S21.jpg}& - \surveypic{22}{survey_internal_16_S22.jpg}& - \surveypic{23}{survey_internal_07_S23.jpg}& - \surveypic{24}{survey_internal_06_S24.jpg}& - \surveypic{25}{survey_internal_25_S25.jpg}\\ - \surveypic{27}{survey_internal_18_S27.jpg}& - \surveypic{28}{survey_internal_14_S28.jpg}& - \surveypic{30}{survey_internal_29_S30.jpg}& - \surveypic{31}{survey_internal_27_S31.jpg}& - \surveypic{32}{survey_internal_28_S32.jpg}& - \\ - \end{tabular} -\end{figure} -\end{frame} - -\begin{frame}{Mesh Trace Layouts} -\begin{columns}[T] -\begin{column}{0.5\textwidth} - \centering - \begin{overpic}[width=.45\textwidth]{hsm_mesh_offset.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries A}} - \end{overpic} - \hspace{1mm} - \begin{overpic}[width=.45\textwidth]{hsm_mesh_orthogonal.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries B}} - \end{overpic} - - \vspace{5mm} - - \begin{overpic}[width=.45\textwidth]{hsm_utimaco_mesh_gore.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries C}} - \end{overpic} - \hspace{1mm} - \begin{overpic}[width=.45\textwidth]{hsm_mesh_stack_epp.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries D}} - \end{overpic} -\end{column} -\begin{column}{0.45\textwidth} - \raggedright - \textbf{A:} Offset layers (H12) - - \textbf{B:} Orthogonal patterns (H14) - - \textbf{C:} Orthogonal + area pattern (H30) - - \textbf{D:} Spaced layers (H28) -\end{column} -\end{columns} -\end{frame} - -\begin{frame}{Mesh Materials and Manufacturing} -\centering -\begin{tabular}{lll} - \begin{overpic}[width=.22\textwidth]{trace_material_copper_pcb.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries A}} - \end{overpic} - & - \begin{overpic}[width=.22\textwidth]{trace_material_copper_flex.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries B}} - \end{overpic} - & - \begin{overpic}[width=.22\textwidth]{trace_material_silver.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries C}} - \end{overpic} - \\[3mm] - \begin{overpic}[width=.22\textwidth]{trace_material_contact_gold_lds.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries D}} - \end{overpic} - & - \begin{overpic}[width=.22\textwidth]{trace_material_carbon.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries E}} - \end{overpic} - & - \begin{tabular}[b]{@{}l@{}} - \textbf{A:} Rigid PCB (H10) \\ - \textbf{B:} Flexible PCB (H15) \\ - \textbf{C:} Silver ink (H14) \\ - \textbf{D:} Laser Direct Structuring (H32) \\ - \textbf{E:} Carbon ink (H30) - \end{tabular} -\end{tabular} -\end{frame} - -\begin{frame}{Mesh Connection Methods} -\centering -\begin{tabular}{ccc} - \begin{overpic}[width=.20\textwidth]{connector_castellated_edge.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries A}} - \end{overpic} - & - \begin{overpic}[width=.20\textwidth]{connector_elastomeric.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries B}} - \end{overpic} - & - \begin{overpic}[width=.20\textwidth]{connector_rf_gasket.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries C}} - \end{overpic} - \\[2mm] - \begin{overpic}[width=.20\textwidth]{connector_zif_fpc_2.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries D}} - \end{overpic} - & - \begin{overpic}[width=.20\textwidth]{connector_stacking.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries E}} - \end{overpic} - & - \begin{overpic}[width=.20\textwidth]{connector_metal_dome.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries F}} - \end{overpic} -\end{tabular} - -\vspace{3mm} - -\small -\textbf{A:} Direct soldering (H05) \quad -\textbf{B:} Elastomeric connector (H31) \quad -\textbf{C:} EMI gasket (H14) \\ -\textbf{D:} FPC connector (H20) \quad -\textbf{E:} Stacking connector (H17) \quad -\textbf{F:} Tactile dome (H06) -\end{frame} - -\begin{frame}{3D Mesh Construction Styles} -\centering -\begin{tabular}{lll} - \begin{overpic}[width=.22\textwidth]{hsm_3d_style_fold_overlap.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries A}} - \end{overpic} - & - \begin{overpic}[width=.22\textwidth]{hsm_3d_style_fold_no_overlap.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries B}} - \end{overpic} - & - \begin{overpic}[width=.22\textwidth]{3d_construction_lds_top.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries C}} - \end{overpic} - \\[3mm] - \begin{overpic}[width=.22\textwidth]{hsm_3d_style_vacform.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries D}} - \end{overpic} - & - \begin{overpic}[width=.22\textwidth]{3d_construction_cards_standalone.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries E}} - \end{overpic} - & - \begin{tabular}[b]{@{}l@{}} - \textbf{A:} Folded with overlap (H03) \\ - \textbf{B:} Folded without overlap (H14) \\ - \textbf{C:} Laser Direct Structuring (H32) \\ - \textbf{D:} Thermoformed (H12) \\ - \textbf{E:} House-of-Cards (H08) - \end{tabular} -\end{tabular} -\end{frame} - -\begin{frame}{Thermoforming Example} -\begin{columns}[T] -\begin{column}{0.48\textwidth} - \centering - \includegraphics[width=.6\textwidth]{survey_formed_mesh_before.jpg}\\ - \small Before removing lacquer -\end{column} -\begin{column}{0.48\textwidth} - \centering - \includegraphics[width=.6\textwidth]{survey_formed_mesh_after.jpg}\\ - \small After removing lacquer -\end{column} -\end{columns} -\vspace{3mm} -\centering -\small Formed cavities in printed foil mesh specimen H24 -\end{frame} - -\begin{frame}{Sandwich-Style Construction} -\begin{columns}[T] -\begin{column}{0.5\textwidth} - \centering - \begin{overpic}[width=.45\textwidth]{3d_construction_offset_mesh_delayered_contrast_improved.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries A}} - \end{overpic} - \hspace{1mm} - \begin{overpic}[width=.45\textwidth]{3d_construction_via_stitch_mesh_delayer_2.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries B}} - \end{overpic} - - \vspace{3mm} - - \begin{overpic}[width=.45\textwidth]{3d_construction_planar_stack.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries C}} - \end{overpic} - \hspace{1mm} - \begin{overpic}[width=.45\textwidth]{3d_construction_cavity_2.jpg} - \put(5,92){\colorbox{white}{\footnotesize\bfseries D}} - \end{overpic} -\end{column} -\begin{column}{0.45\textwidth} - \raggedright - \textbf{A:} Obstacle mesh coupons (H17) - - \textbf{B:} Via-fence meshes (H24) - - \textbf{C:} Planar sandwich stack (H24) - - \textbf{D:} PCB lid with cavity (H14) -\end{column} -\end{columns} -\end{frame} - -\begin{frame}{Security Issues Observed} -\begin{itemize} - \item Incomplete mesh coverage - \item Meshes not overlapping at edges leaving gaps for probe insertion - \item Gaps at mesh-PCB interfaces - \item Thermoformed cavities with enlarged structure size at corners - \item In one case, an opaque lacquer was easily removed with acetone (without damaging the mesh!) - \item Trace patterns visible through cover layers due to surface unevenness -\end{itemize} -\end{frame} - -\begin{frame}{Design Recommendations (1/2)} - \begin{itemize} - \item Commodity PCB manufacturing process design rules in the \SIrange{100}{200}{\micro\meter} range are better than the state of the art in mesh structure size - \item Avoid ink printing processes or thermoforming because of their large structure size - \item Carefully think about your literal corner cases (and edges)! - \begin{itemize} - \item Overlap meshes where possible. - \end{itemize} - \item Use potting and cover layers, but verify that they work - \begin{itemize} - \item Check that you \emph{actually} can't see what's below - \item Test their chemical resistance (and that of your mesh) - \end{itemize} - \end{itemize} -\end{frame} - -\begin{frame}{Design Recommendations (2/2)} - \begin{itemize} - \item Mixing tough potting or enclosure materials and fragile mesh materials makes life harder for an attacker - \begin{itemize} - \item Consider using steel instead of plastic (also helps against X-ray inspection!) - \item Use thin substrates and thin conductive layers for the mesh - \item Balance adhesion so removing potting / cover layers tears away traces below - \end{itemize} - \item Overlap mesh layers at a 50\% structure size offset - \item Space (some) mesh layers apart in Z direction to constrain attack tools - \item Use a pressure-sensitive connection method like tactile domes or elastomeric conncetors - \end{itemize} -\end{frame} - -\begin{frame} -\centering -\Huge Thank you! - -\vspace{1cm} - -\Large Questions? - -\texttt{research@jaseg.de} -\end{frame} - -\begin{frame} -\centering -Long-form version of this presentation in my thesis (pre-release, to be published this summer): - -\url{https://jaseg.de/thesis-final-web.pdf} - -\includegraphics{thesis_qr.png} -\end{frame} - -\begin{frame}{Specimen List (1/2)} -\footnotesize -\begin{tabular}{c>{\RaggedRight\arraybackslash}p{25mm}>{\RaggedRight\arraybackslash}p{35mm}ll} -\toprule -\textbf{ID} & \textbf{Device} & \textbf{Manufacturer} & \textbf{Type} & \textbf{Year} \\ -\midrule -H01 & PED & Verifone & VX 570 & ca. 2010 \\ -H02 & Slot machine & Merkur / ADP & Sam 12 EC2 & ca. 2012 \\ -H03 & EPP & Sagem & USA1315-4240 & 2014 \\ -H04 & EPP & Sagem & USA1316-5120 & 2007 \\ -H05 & PED & Xac & xAPT-103 & 2014 \\ -H06 & PED & Ingenico & iCT250-11T1860A & 2016-17 \\ -H08 & PED & Sagem & NOR4100-4220 & 2012 \\ -H09 & PED & Hypercom & M4230 & 2010 \\ -H10 & PED & Worldline & YOMANI XR & 2016 \\ -H11 & PED & Banksys & C-ZAM Smash & 2004 \\ -H12 & PED & Hypercom & Optimum P2100 & 2010 \\ -H13 & PED & Ingenico & iCT 220-11T2938A & 2016 \\ -H14 & PED & Verifone & H5000 & 2016 \\ -H15 & PED & Verifone & MX 925 & 2018 \\ -H16 & PED & Verifone & V200c CTLS & 2021 \\ -H17 & PED & Verifone & VX 680 & 2014 \\ -\bottomrule -\end{tabular} -\end{frame} - -\begin{frame}{Specimen List (2/2)} -\footnotesize -\begin{tabular}{c>{\RaggedRight\arraybackslash}p{25mm}>{\RaggedRight\arraybackslash}p{35mm}ll} -\toprule -\textbf{ID} & \textbf{Device} & \textbf{Manufacturer} & \textbf{Type} & \textbf{Year} \\ -\midrule -H18 & PED & Ingenico & i7910 & 2010 \\ -H19 & PED & Banksys & XENTA & 2004-2011 \\ -H20 & PED & Verifone & VX 520 3G & 2017 \\ -H21 & PED & Verifone & V400m Plus 4G & 2018 \\ -H22 & PED & Ingenico & Move 3500 & 2020 \\ -H23 & PED & Ingenico & iPP 350-11T1718A & 2015 \\ -H24 & PED & Ingenico & iWL255-01T2117A & 2016 \\ -H25 & Franking Mach. & Neopost & IJ-25 & ca. 2001 \\ -H27 & PED & Sumup & AIR1E205 & 2021 \\ -H28 & EPP & NCR & 5814 UEPP & 2019 \\ -H29 & HSM & SafeNet & VBD-05 & 2018 \\ -H30 & HSM & Irdeto & Mayflower & 2011 \\ -H31 & PED & SumUp & SumUp 3G & 2019 \\ -H32 & PED & SumUp & SumUp Air & 2022 \\ -\bottomrule -\end{tabular} -\vspace{3mm} - -\tiny PED: Pin Entry Device; EPP: Encrypting Pin Pad; HSM: Hardware Security Module -\end{frame} - -\begin{frame}[allowframebreaks]{References} -\printbibliography[heading=none] -\end{frame} - -\end{document} diff --git a/chapter-ihsm/chapter.tex b/chapter-ihsm/chapter.tex index 68a0f41..780eaee 100644 --- a/chapter-ihsm/chapter.tex +++ b/chapter-ihsm/chapter.tex @@ -16,8 +16,8 @@ \section{Introduction} -\sourceattrib{This part is adapted from a paper written by Jan Sebastian Götte and Prof.\ Dr.\ Björn Scheuermann and -presented by Jan Sebastian Götte at CHES 2022~\cite{gotteCantTouchThis2022}.} +\sourceattrib{This part is adapted from a paper written by me and presented by me at CHES +2022~\cite{gotteCantTouchThis2022}.} While information security technology has matured a great deal in the last half-century, physical security did not keep up with the pace of the remainder of this industry. Given the right skills, physical access to a computer still often allows full compromise. The physical security of modern server hardware hinges on what lock you put on the room it is @@ -74,7 +74,8 @@ This chapter contains the following contributions: \label{prototype_picture} \end{figure} -In Section~\ref{sec_ihsm_construction} we will elaborate the principles of our Inertial HSM approach. We will +In Section~\ref{sec_related_work}, we will give an overview of the state of the art in HSM physical security. On this +basis, in Section~\ref{sec_ihsm_construction} we will elaborate the principles of our Inertial HSM approach. We will analyze its weaknesses in Section~\ref{sec_attacks}. Based on these results we have built a proof-of-concept hardware prototype. In Section~\ref{sec_proto} we will elaborate on the design of this prototype. In Section~\ref{sec_accel_meas} we present our characterization of an automotive MEMS accelerometer IC as a rotation sensor in this proof-of-concept @@ -85,9 +86,12 @@ prototype. We conclude this chapter with a general evaluation of our design in S % summaries of research papers on HSMs. I have not found any actual prior art on anything involving mechanical motion % beyond ultrasound. -As we elaborated in Chapter~\ref{chapter-survey}, HSMs are an old technology that traces back decades in its electronic -realization. Today's common approach of monitoring meandering electrical traces on a fragile foil that is wrapped around -the HSM essentially transforms the security problem into the challenge to +In this section, we will briefly explore the history of HSMs and the state of academic research on active tamper +detection. + +HSMs are an old technology that traces back decades in its electronic realization, initially being conceived by the US +NSA during the second world war~\cite{boak1973}. Today's common approach of monitoring meandering electrical traces on a +fragile foil that is wrapped around the HSM essentially transforms the security problem into the challenge to manufacture very fine electrical traces on a flexible foil~\cite{isaacs2013, immler2019, andersonSecurityEngineeringGuide2020}. There has been some research on monitoring the HSM's interior using e.g.\ electromagnetic radiation~\cite{tobisch2020, kreft2012} or ultrasound~\cite{vrijaldenhoven2004} but none of this @@ -98,6 +102,22 @@ difference is that an HSM continuously monitors itself whereas a physical seal o requires someone to examine it. This examination can be done by eye in the field, but it can also be carried out in a laboratory using complex equipment. An HSM in principle has to have this examination equipment built-in. +Physical seals are used in a wide variety of applications. The most interesting ones from a research point of view that +are recorded in public literature are those used for the monitoring of nuclear material under the International Atomic +Energy Authority (IAEA). Most of these seals use the same approach that is used in Physically Unclonable Functions +(PUFs), though their development predates that of PUFs by several decades. The seal is created in a way that +intentionally causes large, random device-to-device variations. These variations are precisely recorded at deployment. +At the end of the seal's lifetime, the seal is returned to a lab and closely examined to check for any deviations from +the seal's prior recorded state. The type of variation used in these seals includes random scratches in metal parts and +random blobs of solder (IAEA metal cap seal), randomly cut optical fibers (COBRA seal), the uncontrollably random +distribution of glitter particles in a polymer matrix (COBRA seal prototypes) as well as the precise three-dimensional +surface structure of metal parts at microscopic scales (LMCV)~\cite{iaea2011}. + +The IAEA's equipment portfolio does include electronic seals such as the EOSS. These devices are intended for remote +reading, similar to an HSM. They are constructed from two components: A cable that is surveilled for tampering, and a +monitoring device. The monitoring device itself is in effect an HSM and uses a security mesh foil like it is used in +commercial HSMs. + The self-destruct built into an HSM serves as a strong tamper deterrent. For illustration, compare an HSM to a computer inside a locked safe when opposing a well-funded attacker with plenty of time. In~\cite{boak1973}, Boak asserts that absent an HSM's capability to self-destruct, the best safes can only withstand brute force attacks by an expert for @@ -241,9 +261,9 @@ security barrier. In industry, mesh membranes are commonly used for tamper dete systems for a variety of use cases ranging from low-security payment processing to high-security certificate management. From this, we can conclude that a properly implemented mesh \emph{can} provide a practical level of security. In contrast to this industry focus, academic research has largely focused on ways to fabricate enclosures that embed -characteristics of a PUF as a means of tamper detection~\cite{tobisch2020,immler2019}. By using stochastic properties of -the enclosure material to form a PUF, such academic designs leverage signal processing techniques to improve the -system's security level by a significant margin. +characteristics of a Physically Unclonable Function as a means of tamper detection~\cite{tobisch2020,immler2019}. By +using stochastic properties of the enclosure material to form a PUF, such academic designs leverage signal processing +techniques to improve the system's security level by a significant margin. In our research, we focus on security meshes as our IHSM's tamper sensors. The cost of advanced manufacturing techniques and special materials used in fine commercial meshes poses an obstacle to small-scale manufacturing and @@ -323,16 +343,12 @@ shaft penetrates the mesh to simplify mechanical construction. The spinning mesh must be designed to cover the entire surface of the payload, but it suffices if it sweeps over every part of the payload once per rotation. This means we can design longitudinal gaps into the mesh that allow outside air to flow through to the payload. In traditional boundary-sensing HSMs, cooling of the payload processor is a serious -issue since any air duct or heat pipe would have to penetrate the HSM's security boundary~\cite{ - petriePartIITechnical, - curetHardwareSecurityModule2025, - zhangTamperrespondentAssembliesPorous2023, - dragoneVentedTamperrespondentAssemblies2020}. -This problem can only be solved with complex and costly siphon-style constructions, so in commercial systems, heat -conduction is used exclusively~\cite{isaacs2013}. This limits the maximum power dissipation of the payload and thus its -processing power. Using longitudinal gaps in the mesh, our setup allows direct air cooling of regular heatsinks. This -unlocks much more powerful processing capabilities that greatly increase the maximum possible power dissipation of the -payload. In an evolution of our design, the spinning mesh could even be designed to \emph{be} a cooling fan. +issue since any air duct or heat pipe would have to penetrate the HSM's security boundary. This problem can only be +solved with complex and costly siphon-style constructions, so in commercial systems, heat conduction is used +exclusively~\cite{isaacs2013}. This limits the maximum power dissipation of the payload and thus its processing power. +Using longitudinal gaps in the mesh, our setup allows direct air cooling of regular heatsinks. This unlocks much more +powerful processing capabilities that greatly increase the maximum possible power dissipation of the payload. In an +evolution of our design, the spinning mesh could even be designed to \emph{be} a cooling fan. Conventional HSMs are limited by the construction of their security meshes which rely on plastics as their main structural material. The security mesh has to fit the highest components inside the HSM. Since creating a security mesh @@ -565,8 +581,7 @@ acceleration is $a=\omega^2 r$. In our example, this results in a minimum angula \frac{1}{2\pi}\sqrt{\frac{a}{r}} = \frac{1}{2\pi}\sqrt{\frac{\SI{1000}{\meter\per\second^2}}{\SI{100}{\milli\meter}}} \approx \SI{16}{\hertz} \approx \SI{1000}{rpm}$. From this, we can conclude that even at moderate speeds of $\SI{1000}{rpm}$ and above, a manual attack is no longer possible and any attack would have to be carried out using some -kind of mechanical tool. Literature supports this conclusion, with loss of orientation reported as early as at -\SI{70}{rpm} in an observer located on the axis of rotation~\cite{fowlerInvestigationFlowProcesses1966}. +kind of mechanical tool. \begin{figure} \center @@ -961,7 +976,7 @@ the fly, without stopping the rotor. \section{Conclusion} \label{sec_conclusion} -In this chapter, we introduce Inertial Hardware Security Modules (IHSMs), a novel concept for the construction of +In this chapter, we introduced Inertial Hardware Security Modules (IHSMs), a novel concept for the construction of advanced hardware security modules from simple components. We analyzed the concept for its security properties and highlighted its ability to significantly strengthen otherwise weak tamper detection barriers. We validated our design by creating a proof-of-concept hardware prototype. In this prototype, we have demonstrated practical solutions to the @@ -986,6 +1001,5 @@ Chapter~\ref{chapter_sampling_mesh_mon}, we will introduce a low-cost tamper sen Time Domain Reflectometry. Using this approach, we can further strengthen the security of meshes created using simple manufacturing processes in an IHSM. In Chapter~\ref{chapter-nice-coils}, we approach the question of a rotation-invariant wireless inductive power supply for an IHSM and provide a planar inductor layout that minimizes -voltage ripple with IHSM rotation. In Chapters~\ref{chapter-qkd} and \ref{chapter-smpc}, we will analyze two use cases -benefitting from IHSMs and tailor the IHSM concept to their requirements. +voltage ripple with IHSM rotation. diff --git a/chapter-introduction/chapter.tex b/chapter-introduction/chapter.tex index c937884..544f9df 100644 --- a/chapter-introduction/chapter.tex +++ b/chapter-introduction/chapter.tex @@ -8,12 +8,49 @@ \chaptertitle{Introduction} \label{chapter-intro} +% New draft: +% +% Passionate statement about democracy and academic freedom +% +% We live in times of rising fascist and authoritarian sentiment worldwide. While computer science and cryptography are +% often portrayed as politically neutral technologies, their practice is a political act and can have grave real-world +% consequences. +% maybe: Within mathematics and computer science, the field of cryptography is unique in that it smainstream views +% link to cypherpunks, hackers +% Hardware Security Modules (HSMs) are an example of such a political technology. The core function of HSMs is to +% protect cryptographic secrets against \emph{any} physical attack. Even though they are widely used in finance and +% business applications, in their design, they curiously embody the radical idiology of the cypherpunk and hacker +% movements. +% +% We believe physically secure devices like HSMs can be a keystone technology in the creation of secure systems for +% communication and computation in a free, democratic society. However, while current state-of-the art commercial +% devices can be expected to resist a fascist police force or even some authoritarian states' secret services, their +% physical security is still lacking due to misaligned ecosystem incentices. As Anderson put it, +% todo cite: betrusted +% +% +% Meanwhile in academia, +% In this thesis, we aim to significantly advance the field of hardware security module construction. We publish all +% designs, code and data as open source to create the groundwork for future research, and sow the seeds for a new +% generation of secure hardware that will be able to resist a rising tide of fascist and authoritarian movements. +% +% +% +% Research questions: +% 1. can hsm w/o proprietary mesh? +% 2. how do meshes look like in practice? +% 3. can we improve monitoring? +% 4. can we solve power transfer issue +% 5. applications +% + \emph{No Gods, No Masters} is an anarchist slogan originating in the 19\textsuperscript{th} century that expresses a -rejection of authorities~\cite{broussaisOriginesDeviseAnarchiste2022,guerinNoGodsNo2005,blomNoGodsNo2025}. Despite its -origin in a different era, it encapsulates an approach that is commonly followed in modern cryptography. In -cryptography, it is considered best practice to have the least amount of parties possible involved in any computation. -Most cryptographic problems are easily solved by involving a trusted third party (TTP). Yet, cryptographers have time -and again vocally rejected attempts to involve third parties in cryptographic protocols~\cite{ +rejection of authorities~\cite{broussaisOriginesDeviseAnarchiste2022,guerinNoGodsNo2005,blomNoGodsNo2025}. In modern +cryptography, it is generally seen as best practice to have the least amount of parties possible involved in any +computation. +Most cryptographic problems are easily solved by involving a trusted third party (TTP). +Yet, cryptographers have time and again vocally rejected attempts to involve third parties in cryptographic +protocols~\cite{ abelsonRisksKeyRecovery1997, abelsonKeysDoormats2015, andersonSecurityEngineeringGuide2020, @@ -35,8 +72,8 @@ and even general computation~\cite{ aumannSecurityCovertAdversaries2010, chorPrivateInformationRetrieval} in a decentralized way that avoids trusted authorities. -While politically, the anarchist blanket rejection of authority represents a fringe viewpoint, in cryptography it has a -long tradition originating with the Cypherpunk and Hacker movements~\cite{ +While politically, this blanket rejection of authority represents a fringe viewpoint, in cryptography it has a long +tradition originating with the Cypherpunk and Hacker movements~\cite{ andersonCypherpunkEthicsRadical2022, hughesCypherpunksManifesto, jarvisCryptoWarsFight2020, @@ -49,9 +86,7 @@ systems are still routinely compromised~\cite{ goldmanUnrestrainedChineseCyberattackers2025, scott-railtonWhoseAuthorityPegasus2024, quintinSomethingRememberUs2024, - marczakGraphiteCaughtFirst2025, - PredatorFilesTechnical2023, - PakistanMassSurveillance2025}. + marczakGraphiteCaughtFirst2025}. A fundamental flaw of any practical cryptographic system is that secure algorithms have to run on hardware, and even today, average computing hardware provides little physical security~\cite{ gotzfriedCacheAttacksIntel2017, @@ -60,11 +95,11 @@ today, average computing hardware provides little physical security~\cite{ moghimiTPMFAILTPMMeets2020}. \emph{Hardware Security Modules} are a class of devices specifically designed to execute cryptographic algorithms while providing strict physical security guarantees, but these systems are expensive, -and their physical security is often questionable~\cite{ +and their physical security is often questionable (cf.~Chapter~\ref{chapter-survey})~\cite{ obermaier2018, - andersonSecurityEngineeringGuide2020}, -which we will elaborate further in Chapter~\ref{chapter-survey}. \textcite{andersonSecurityEngineeringGuide2020} writes -on HSM security: + andersonSecurityEngineeringGuide2020}. +As \textcite{andersonSecurityEngineeringGuide2020} writes on HSMs and their security standards: +% FIXME page numbers \begin{quote} Security economics remains a big soft spot, with security chips being in many ways a market for lemons. A banker @@ -75,6 +110,7 @@ on HSM security: understand that level 3 can sometimes be defeated with a Swiss army knife. The buying incentive there is compliance, and where real security clashes with operations it’s not surprising to see weaker standards designed to make compliance easier. + \begin{flushright} \textit{\textcite{andersonSecurityEngineeringGuide2020} p. 629} \end{flushright} @@ -92,101 +128,74 @@ cryptographic engineering is Kerckhoffs' principle\footnote{ as well as a translation of the cited part from French. The original source is \textcite{kerckhoffsCryptographieMilitaire1883}. }, named after Dutch military cryptographer Auguste Kerckhoffs. Kerckhoffs' principle expresses that the security of a -cryptographic system should only depend on the secrecy of its keys, not on the secrecy of its design. Existing -commercial designs routinely contravene Kerckhoff's principle by applying the widespread industry practice of -\emph{Security by Obscurity}. Even in academic related work, the principle is sometimes violated by omitting -implementation and methodological details in the interest of patents and commercial exploitation. By publishing all -details of our research into HSMs and their components, we provide the foundation for future independent research. +cryptographic system should only depend on the secrecy of its keys, not on the secrecy of its design. In this way, +Kerckhoff's principle states the opposite of the widespread industry practice of \emph{Security by Obscurity}, which +aims to achieve security by making it sufficiently costly to cryptoanalyze a system that the attempt becomes +unattractive. All existing commercial HSM designs as well as some existing academic related work violate this principle +by keeping details of their implementation such as the precise mesh dimensions and manufacturing methods secret. By +publishing all details of our research into HSMs and their components, we provide the foundation for future independent +research. -Beyond applying Kerckhoffs' principle, publishing our design also enables independent replication. Our design is -based entirely on standard components and does not require bespoke manufacturing processes. Both commercial and academic -existing HSM tamper sensing designs require bespoke manufacturing methods or custom integrated circuits -(ICs)~\cite{ - obermaierPUFfilmMethodProducing2023, - immler2019, - garbTamperSensitiveDesignPUFBased, - immlerBTREPIDBatterylessTamperresistant2018}. Custom ICs require a large up-front financial commitment to produce. -Bespoke manufacturing methods may require custom machines, training, and specialty materials, also incurring a high -startup cost. This creates a single point of failure in the manufacturer, and opens up an opportunity for a hardware -supply-chain attack~\cite{harrisonSoKSecurityArchitects2025}. Such supply chain attacks can be mitigated by -independently manufacturing our design. +Complementary to Kerckhoff's principle is the principle of least authority, which describes that in a secure system each +component should only have access to the smallest set of capabilities necessary to fulfill its purpose. Applying both to +a cryptographic system means that the system's design should be transparent and not include any hidden components or +opaque parts that cannot be inspected, and that the system's keys should be scoped to place the least amount of trust +possible in each participating party. Existing HSMs are an example of a violation of the principle of least authority +since they elevate the HSM manufacturer to a single point of failure. The tamper sensing mesh foils used in conventional +HSMs are made in proprietary, bespoke processes, and cannot be manufactured independently. Our proposed design can be +replicated from standard components and eliminates this issue. -%%% -\section{A Note on Hardware Security Module Terminology} +\section{Research Questions and Contributions} -In this thesis, we use the term \emph{Hardware Security Module (HSM)} to refer to a security device that has the -following three properties. +Based on the current state of the field of hardware security, we deduce three overarching research questions for this +thesis that progress from theory to practical deployment. \begin{enumerate} -\item A HSM targets the prevention of any conceivable physical attack. In particular, this includes intrusion attempts - such as careful drilling or cutting into the device from any direction. -\item A HSM includes tamper sensors that when triggered result in an active tamper response, usually deleting all - cryptographic secrets and rendering the device inoperable. -\item A HSM's tamper sensing and response subsystem is continuously powered from a backup power supply, usually a - battery. Loss of power triggers the tamper response. + \item Can we achieve physical security without relying on conventional tamper-sensing meshes? + \item Can we monitor tamper-sensing meshes at a higher detail level than the state of the art of a single, scalar + measurement? + \item Can we create the support components necessary to integrate a system that provides a practical security + guarantee? \end{enumerate} -This use of the term \emph{HSM} aligns with common usage of the term both in the academic literature and in everyday -conversation. Particularly the requirement of active tamper detection and response is crucial to distinguish a HSM from -simpler devices such as TPMs, smart cards or secure enclaves in SoCs. Note that our use of the term HSM is slightly -different from its use in government standards, from its use in the PCI SSC (Payment Card Industry Security Standards -Council) standards, and from its industry use. +To answer our first research question, we propose the Inertial Hardware Security Module (IHSM), a new type of HSM that +extends the high level of protection offered by the modern cryptographic software stack down to the hardware level, +enabling secure computation in insecure places. -In industry, the term HSM is often used for solutions that are only logically segregated and that do not include any -particular defense against hardware attacks. Our conjecture is that this is a consequence of the standardization -landscape, where for applications outside of card payment processing the US FIPS -140-22~\cite{usnationalinstituteofstandardsandtechnologySecurityRequirementsCryptographic2002} standard was central to -the industry. Despite encompassing both devices that include active tamper detection and response, FIPS 140-2 did not -draw a distinction in its terminology between the two classes. +To answer our second question, we propose improvements to the state of the art in HSM tamper sensors such as the use of +low-cost, embeddable Time-Domain Reflectometry (TDR) that not only improve the security of IHSMs, but that can even be +applied to conventional HSMs. -\subsection{Use in government standards} +Finally, we answer our last research question by showing in two case studies how an end-to-end design of an IHSM-secured +data processing system could look like. Both case studies concern scenarios that IHSMs unlock that were previously +infeasible using conventional HSMs: Datacenter-scale Secure Multiparty Computation (SMPC) and long-range Quantum Key +Distribution (QKD) networks. As part of this effort we provide a solution adapting and improving upon the state of the +art in wireless power transfer to supply a rotating inertial HSM with a clean, stable power supply. -Under the still widely used US national standard FIPS 140 in in its 2002 version -2~\cite{usnationalinstituteofstandardsandtechnologySecurityRequirementsCryptographic2002}, a HSM would be called a -\emph{Multiple-Chip Cryptographic Module} that conforms to the standard's \emph{Security Level} 4 out of 4. Interesting -to note are that only level 4 requires any active tamper detection and response, so devices compliant only up to levels -3 and below do not align with our HSM definition. Futher of note is that according to the standard, a single-chip -solution does not require any tamper detection and response either to meet the standard's security level 4, which is in -misalignment with our definition. The standard's 2019 updated version FIPS -140-3~\cite{usnationalinstituteofstandardsandtechnologySecurityRequirementsCryptographic2019} defers to the -international standards ISO/IEC 19790 and 24759. +We chose to publish all of our research as open source and unencumbered by patents to enable widespread adoption. IHSMs +can be custom built with only basic manufacturing capabilities at small scale and enable the deployment of secure +computation in insecure places even to small organizations such as university research departments, NGOs and small +businesses. -ISO/IEC 19790~\cite{ISOIEC19790} and ISO/IEC 24759~\cite{ISOIEC24759} call what we call a HSM a \emph{Hardware -Cryptographic Module} corresponding with the standards \emph{Security Level 4}. However, these standards only require -active tamper detection and response when cryptographic secrets are transmitted in plaintext between chips. +%\section{Cryptographic Principles and Physical Reality} -\subsection{Use in card payment processing (PCI SSC) standards} +%Let's take a basic videoconferencing system as an example. In our example system's deployment, users log on to a central +%conference server, which receives and distributes the users' video streams. Allowing backdoor access to the video +%streams to some third party like a datacenter operator or a state would violate Kerckhoffs' principle since it would +%have to be hidden from the systems' participants, who would therefore not have a complete view of the systems' deployed +%architecture. The principle of least authority would also be violated since in almost all cases, such a backdoor access +%system would not see legitimate use. As a result, it would possess capabilities that almost never would be essential to +%the proper function of the videoconference system. -The Payment Card Industry Security Standards Council (PCI SSC) is an association of credit card network operators that -defines standards for all layers of card payment processing, from card payment terminals in stores to the handling of -payment data in online shop backend systems. - -PCI SSC terminology aligns with our definition and with common everyday use of the term HSM. In PCI SSC terminology, a -HSM is a crytographic device that has active tamper detecion and response circuitry. However, PCI SSC terminology -differs from our use of the term HSM in one nuance: In PCI SSC terminology, a HSM is specifically a datacenter device -used for backend processing of payment data. The general class of ``hardware devices performing some security function -with or without particular physical security requirements'' that ISO/IEC 19790 and other standards call a \emph{Hardware -Cryptographic Module}, in PCI SSC terminology is termed \emph{Secure Cryptographic Device (SCD)} in more recent standard -versions, which was updated from the previous term \emph{Tamper-Resistant Security Module (TRSM)}. Other than HSMs, PCI -SSC includes smartcards and card payment terminals in this category. Card payment terminals, referred to as -\emph{Pin-Entry Device (PED)} in PCI SSC standards, have to include a surprising amount of active tamper detection and -response functionality including partial coverage of areas like their main cryptographic processor and smart card reader -by battery-backed tamper-sensing meshes. Under our definition, these devices can be classified as a type of HSM. - -\subsection{Tamper-Sensing Meshes} - -In this thesis, we use the terms \emph{Tamper-Sensing Mesh} and \emph{Security Mesh} synonymous. We use both terms to -refer to any electrical circuit whose path is laid out to cover a surface with the intent of detecting attempts at -drilling, cutting or otherwise manipulating this surface. While the term \emph{Security Mesh} is more concise, it is -less clear to people unfamiliar with the matter. It is also polysemous, and depending on context can also refer to woven -or stamped metal meshes used as fences or as screens in front of windows to prevent break-ins. As a result, it is harder -to use in online searches, and when using Large Language Models (LLMs), it frequently leads to amusing hallucinations. - -% FIXME note leo: Das ganze wirkt wie ein guter baustein für eine Einleitung. Für einen Terminologie übersicht ist es -% ansonsten auch eigentlich zu lang. -% Splitte das vielleicht auf, ein paar mehr details in den Abstract um die HSM definition etwas zu präzisieren, den rest -% in die Intro? -%%% +%In their design, almost all modern software -- especially open source -- cleanly applies these principles. However, the +%practical reality after deployment almost always deviates from them. While backdoors are vanishingly rare in modern +%open-source software, practical deployments usually are vulnerable to physical attacks. Computer hardware generally is +%not designed with a local attacker with advanced physical attack capabilities in mind since no mitigation can fully +%prevent them---such attacks usually can only be detected, or at best slowed down. As a result, commonplace attacks +%against modern software often involve taking over the hardware at some point in the chain. Even End-to-End-Encrypted +%(E2EE) communication systems can be compromised if one of the encrypted channel's endpoints can be physically +%compromised. Corresponding \emph{digital forensics} capabilities are commonplace among state actors, and are available +%as a turnkey solution on the market. \section{Inertial Hardware Security Modules} @@ -209,110 +218,26 @@ IHSMs are a new design approach that utilizes mechanical motion to create secure components. IHSMs solve the issue of creating an impenetrable tamper-sensing envelope by replacing the bespoke tamper-sensing mesh foil with a set of simple, rigid meshes made from commodity Printed Circuit Boards (PCBs) that are rotating at high speed. In motion, these simple PCB tamper-sensing meshes are as secure as the much more sophisticated -bespoke foils used in conventional HSMs against an attacker with access to commercially available tools, yet they are -simpler and less expensive to manufacture. To verify that the mesh is rotating correctly, an accelerometer is placed on -the rotating mesh, and its centrifugal force reading is used to validate its path of motion. +bespoke foils used in conventional HSMs, yet they are simpler and less expensive to manufacture. To verify that the mesh +is rotating correctly, an accelerometer is placed on the rotating mesh, and its centrifugal force reading is used to +validate its path of motion. IHSMs enable the protection of much larger payloads compared to conventional mesh designs, and they can support larger power dissipation. Combined with their low cost, this enables the implementation of high-level hardware security in applications that previously would not have been possible to secure. -To the best of our knowledge, IHSMs are the first fully open source, replicable HSM with advanced tamper sensing -features. Across application domains, IHSMs can be applied to gain resistance to physical attacks in scenarios where -conventional HSMs were not used because of cost, computing power or implementation effort. Where conventional HSMs come -as fully integrated devices that only expose limited APIs to their users, IHSMs at their core are just an enclosure that -the user can put whatever hardware they need into, adapting the tamper response to their application's needs. Since the -simpler tamper-sensing mesh construction of IHSMs scales to larger payload volumes, entire servers can be -protected---something that is impossible with conventional HSMs. Since the mesh in an IHSM is constantly moving, unlike -a mesh in a conventional HSM, it does not have to entirely cover the payload. Instead, it can have gaps that allow for -air flow between outside and inside, enabling active cooling of the IHSM's payload. This cooling capability increases -computing power by increasing feasible payload power dissipation by orders of magnitude~\cite{kordyban1998}. +IHSMs are the first fully open source HSM with advanced tamper sensing features. Across application domains, IHSMs can +be applied to gain resistance to physical attacks in scenarios where conventional HSMs were not used because of cost, +computing power or implementation effort. Where conventional HSMs come as fully integrated devices that only expose +limited APIs to their users, IHSMs at their core are just an enclosure that the user can put whatever hardware they need +into, adapting the tamper response to their application's needs. Since the simpler tamper-sensing mesh construction of +IHSMs scales to larger payload volumes, entire servers can be protected---something that is impossible with conventional +HSMs. Since the mesh in an IHSM is constantly moving, unlike a mesh in a conventional HSM, it does not have to entirely +cover the payload. Instead, it can have gaps that allow for air flow between outside and inside, enabling active cooling +of the IHSM's payload. This cooling capability sharply increases computing power by increasing feasible payload power +dissipation by two orders of magnitude. -\section{Research Questions and Contributions} - -Based on the current state of the field of hardware security, we deduce six overarching research questions for this -thesis that progress from theory to practical deployment. - -\begin{enumerate} - \item What is the state of the art in commercial tamper sensing mesh implementations? - \item What are criteria and approaches for the design of secure tamper sensing meshes? - \item Can we achieve physical security without relying on a conventional tamper-sensing meshes that requires a - bespoke manufacturing process? - \item Can we monitor tamper-sensing meshes at a higher detail level than the state of the art of a single, scalar - measurement? - \item Can we improve the ripple voltage performance of Wireless Power Transfer (WPT) through rotating joints to - adapt it to IHSM applications? - \item What applications does our IHSM technology open up through its increase in power dissipation and size - capabilities? -\end{enumerate} - -We answer our first research question in two parts. In Chapter~\ref{chapter-epa}, we analyze the hardware security -design of Germany's new national electronic health record system. Our analysis unveils a combination of problematic -choices resulting from conflicting constraints and lack of awareness. In Chapter~\ref{chapter-survey}, we present the -results of a survey across approximately 30 real world tamper sensing mesh implementations, analyzing common design -features. - -The second half of our survey in Chapter~\ref{chapter-survey} answers our second research question. From our analysis of -a large corpus of devices, we deduce a list of design criteria that can be applied to increase the security of any -tamper sensing mesh implementation. To answer our third research question, in Chapter~\ref{chapter-ihsm} we propose the -Inertial Hardware Security Module (IHSM), a new type of HSM that extends the high level of protection offered by the -modern cryptographic software stack down to the hardware level, enabling secure computation in insecure places. IHSMs -can be built from basic, off-the-shelf components and do not require bespoke manufacturing processes. To answer our -fourth research question, in Chapter~\ref{chapter_sampling_mesh_mon} we propose improvements to the state of the art in -HSM tamper sensors based on the use of low-cost, embeddable Time-Domain Reflectometry (TDR). Our improvements can be -applied to both IHSMs and to conventional HSMs. IHSMs come with unique power supply constraints since their rotating -mesh must be continuously powered. A straightforward solution utilizes Wireless Power Transfer using planar inductors, -but existing WPT designs exhbit a ripple voltage due to an asymmetry of conventional planar inductors. This leads to our -fifth research question, which we solve in Chapter~\ref{chapter-nice-coils} with the design and experimental evaluation -of a new, generalized class of \emph{twisted} planar inductors that reduces voltage ripple in rotating shaft setups. -A finding of independent interest is that compared to conventional two-layer planar inductors, in our experiments our -proposed inductor design improved self-resonant frequency by up to \qty{50}{\percent} and increased inductance by up to -\qty{6.5}{\percent}. Finally, we answer our last research question by showing in two case studies how an end-to-end -design of an IHSM-secured data processing system could look like. Both case studies concern scenarios that IHSMs unlock -that were previously infeasible using conventional HSMs: In Chapter~\ref{chapter-qkd}, we explore how IHSMs enable -long-range Quantum Key Distribution (QKD) networks using trustable physically secured relay nodes and in -Chapter~\ref{chapter-smpc} we elaborate how datacenter-scale Secure Multiparty Computation (SMPC) clusters can be -created using IHSM enclosures with commercial server hardware. - -\section{Contributions} - -Through this thesis, we make contributions advancing the state of hardware securty across several related sub-fields. -Our contributions include: - -\begin{enumerate} - \item We conduct the first large-scale survey of tamper sensing measures in the real world, analyzing approximately - 30 devices. - \item From our real world observations, we systematize tamper sensing mesh construction techniques and we provide a - list of criteria improving mesh security. - \item We experimentally analyze the impact of Computed Tomography (CT) imaging on mesh security. - \item We propose the IHSM, a new concept for HSM design based on a rotating mesh that increases payload size and - power dissipation capacity while simultaneously allowing for simpler meshes constructed from standard - components. - \item We show experimental results on IHSM mesh performance obtained with a prototype IHSM. - \item We introduce an algorithm for the automatic layout of tamper-sensing meshes and its implementation on top of a - popular, open-source Electronic Design Automation (EDA) tool. - \item We introduce a high-fidelity mesh monitoring approach that uses Time-Domain Reflectometry (TDR). - \item We show a low-cost implementation of our TDR monitoring approach. - \item We evaluate the performance of our TDR monitoring implementation and demonstrate its response to a large - set of attacks. We show that it reliably distinguishes identical copies of the same mesh specimen, suggesting - PUF-like behavior. - \item We introduce a generalized design approach for low-loss planar inductors that out-peform prior approaches in - parasitic capacitance, self-resonant frequency and rotational symmetry. - \item We apply our design approach to the problem of Wireless Power Transfer to the rotating mesh of an IHSM. - \item We conduct an exhaustive experimental evaluation of the rotational symmetry of a large set of planar WPT - inductors created using our approach. - \item We analyze physically secure Quantum Key Distribution relays as an IHSM use case and develop a low-loss fiber - optic passthrough that supports an additional, secondary, independently rotating mesh shielding the shaft - passthrough of the IHSM's primary mesh. - \item We explore IHSMs for co-located high performance Multiparty Computation (MPC) setups. We demonstrate a - fan-driven IHSM mesh concept for high-availability scenarios that removes motors as a single point of failure - while providing sufficient airflow for cooling high-power server components. -\end{enumerate} - -We chose to publish all of our research as open source and unencumbered by patents to enable widespread adoption. IHSMs -can be custom built with only basic manufacturing capabilities at small scale and enable the deployment of secure -computation in insecure places even to small organizations such as university research departments, NGOs and small -businesses. +\section{Conclusion} Looking at the practice of applied hardware security, we observe that despite ample availability of commercial solutions promising easy hardware security, clearly there is still a lack of solutions that provide the adaptability necessary for diff --git a/chapter-nice-coils/chapter.tex b/chapter-nice-coils/chapter.tex index a2d61d1..4c5ebac 100644 --- a/chapter-nice-coils/chapter.tex +++ b/chapter-nice-coils/chapter.tex @@ -22,9 +22,8 @@ any misalignment or contamination by dust can increase wear and cause intermitta An IHSM's data link can easily be realized using optical communication. Although power transfer using light is also possible---and we have in fact demonstrated it in our first prototype IHSM---it comes at the disadvantage of a heavy rotating assembly since large solar cells are needed, and it has poor end-to-end efficiency. For the large-scale meshes -needed in a high-performance IHSM such as one tailored to SMPC applications as we will propose later in -Chapter~\ref{chapter-smpc}, we engineered a better solution: A rotation-invariant inductive Wireless Power Transfer -link. +needed in a high-performance IHSM tailored to SMPC applications, we engineered a better solution: A rotation-invariant +inductive Wireless Power Transfer link. While Wireless Power Transfer (WPT) is widely used and can be implemented in many different ways~\cite{ awuahNovelCoilDesign2023, @@ -121,16 +120,15 @@ rotation ripple at low turn counts. \subsection{Twisted inductors} -To solve these issues, in this chapter we propose a layout for circular PCB inductors that uses a number of -series-connected interleaved spirals to achieve a topological equivalent to a torus knot from mathematical knot theory. -Our layout twists the inductor's windings around one another by connecting the interleaved spiral segments with a ring -of vias each on the inside and outside of the inductor's windings. Our approach provides better performance beyond our -particular use case, and improves over conventional contemporary planar inductors applying similar principles to those -which inspired the polygonal basket-woven air coils used in early radio sets. We show that we can layout a twisted -inductor for any number of layer inversions that is co-prime to the inductor's turn count. Our approach opens up a -design space for inductor layouts that interpolate between planar spiral inductors on one end, and planar toroidal -inductors on the other end. Our approach thus generalizes a super-set to a number of previous approaches to the design -of planar inductors. +To solve these issues, we propose a layout for circular PCB inductors that uses a number of series-connected interleaved +spirals to achieve a topological equivalent to a torus knot from mathematical knot theory. Our layout twists the +inductor's windings around one another by connecting the interleaved spiral segments with a ring of vias each on the +inside and outside of the inductor's windings. Our approach provides better performance beyond our particular use case, +and improves over conventional contemporary planar inductors applying similar principles to those which inspired the +polygonal basket-woven air coils used in early radio sets. We show that we can layout a twisted inductor for any number +of layer inversions that is co-prime to the inductor's turn count. Our approach opens up a design space for inductor +layouts that interpolate between planar spiral inductors on one end, and planar toroidal inductors on the other end. Our +approach thus generalizes a super-set to a number of previous approaches to the design of planar inductors. We observe that in high-frequency applications, a moderate number of layer inversions increases the spacing between the beginning and end of the inductor's conductor, where the majority of the inductor's AC current flows. This decreases the @@ -156,10 +154,6 @@ Our contributions on this matter include: \section{Related Work} -In this section we will give an overview on related work from two primary angles. First, we will approach our question -from the application side, examining literature on Wireless Power Transfer. To conclude, we will then consider our -inductor design question from the fundamentals of inductor design. - \subsection{Inductive WPT in Practice} Inductive WPT has been proposed in a large number of @@ -277,11 +271,11 @@ voltage differential. The connecting order of turns was optimized at the assembly level by stacking coils in a particular way~\cite{flemingPrinciplesElectricWave1910} and at the component level by winding coils in a particular way to minimize the voltage differential between adjacent turns---a technique that is still used to this -day~\cite{lopeFirstSelfresonantFrequency2021}. The main winding optimization in the first category concerns winding the +day~\cite{lopeFirstSelfResonant2021}. The main winding optimization in the first category concerns winding the turns of a cylindrical multilayer inductor not layer by layer, but instead layering them diagonally, effectively connecting adjacent turns in a diagonal zigzag pattern. Then as now, wound inductors applying this technique were not feasible to manufacture reliably by machine, but the technique can be closely replicated in PCB inductors as shown in -\textcite{leePrintedSpiralWinding2011}. The main limiting factors in a PCB implementation are the requirement for a +\textcite{leePrintedSpiralWinding2011a}. The main limiting factors in a PCB implementation are the requirement for a large number of vias inside the inductor's turns limiting the achievable turn count\footnote{In PCBs, as opposed to integrated circuits (ICs), vias limit the achievable turn count when they need to be placed in-line inside the turns as opposed to on the inside or outside because a PCB's minimum trace/space widths are usually much smaller than the @@ -379,7 +373,7 @@ two core observations: \end{description} Setting the inversion count to $k=1$ in our proposed scheme yields the conventional two-layer counterwound -scheme~\cite{lopeFirstSelfresonantFrequency2021,sproHighVoltageInsulationDesign2021,leePrintedSpiralWinding2011}. +scheme~\cite{lopeFirstSelfResonant2021,sproHighVoltageInsulationDesign2021,leePrintedSpiralWinding2011a}. \begin{figure} \begin{center} diff --git a/chapter-qkd/chapter.tex b/chapter-qkd/chapter.tex index 1bb3542..a04a423 100644 --- a/chapter-qkd/chapter.tex +++ b/chapter-qkd/chapter.tex @@ -57,7 +57,7 @@ requirements of a QKD system. \end{figure} In this chapter, we present several designs and a mechanical prototype adapting the Inertial Hardware Security Module -(IHSM) concept that we developed in Chapter~\ref{chapter-ihsm} to a QKD relay node. IHSMs replace the tamper sensing +(IHSM) concept first proposed by \textcite{gotteCantTouchThis2022} to a QKD relay node. IHSMs replace the tamper sensing security mesh foil that is wrapped around the payload in conventional HSMs by a tamper-sensing cage made from conventional circuit board material by spinning this cage at a high speed. On its own, circuit board material provides lower tamper security than the tamper sensing foils made using bespoke manufacturing processes that are used in @@ -242,15 +242,14 @@ common fibers is usually in the range of \subsection{Multi-fiber passthrough design} -To approach the security of the data and power connections passing through the IHSM's unprotected shaft, in our -introduction of the IHSM concept in Chapter~\ref{chapter-ihsm} we listed some shielding methods that use an -independently rotating secondary tamper sensing mesh on the inside of the primary mesh, located right next to the -primary mesh's axis opening. This secondary mesh makes accessing the payload using probes inserted through the shaft -much more difficult. In our introduction in Chapter~\ref{chapter-ihsm}, we only presented conceptual drawings of these -schemes, and focused on electrical signals. In this chapter, building on these concepts, we present mechanical designs -of three variations of a fiber passthrough for IHSMs that are adapted to the limited bending radius of optical fiber: A -simple disc cover, offset labyrinth meshes, and interlocking gear meshes. We present a mechanical prototype of our -offset labyrinth mesh design. +To approach the security of the data and power connections passing through the IHSM's unprotected shaft, +\textcite{gotteCantTouchThis2022} list some shielding methods that use an independently rotating secondary tamper +sensing mesh on the inside of the primary mesh, located right next to the primary mesh's axis opening. This secondary +mesh makes accessing the payload using probes inserted through the shaft much more difficult. +\textcite{gotteCantTouchThis2022} only present conceptual drawings of these schemes, and focus on electrical signals. In +this chapter, building on these concepts, we present mechanical designs of three variations of a fiber passthrough for +IHSMs that are adapted to the limited bending radius of optical fiber: A simple disc cover, offset labyrinth meshes, and +interlocking gear meshes. We present a mechanical prototype of our offset labyrinth mesh design. \subsection{Simple disc cover} @@ -462,11 +461,11 @@ the amount of inter-mesh space necessary for power and data feedthroughs as well meshes, on the other hand, this pitch increases by the offset distance. Even for a small offset this quickly adds up to an unwieldy total mesh size. -We conceptually introduce a solution to this problem that allows for larger offsets using a design where the two meshes -interlock like gears. This does mean that the two meshes' rotation must be synchronized, but it increases the design -space of offset labyrinth meshes. For instance, in a gear setup, the wide sides of the inter-mesh zones can be aligned -to lie on the same side, so fiber passthrough can be realized more easily even without the need to spiral the fiber -around the axes of rotation. +In this section, we conceptually introduce a solution to this problem that allows for larger offsets using a design +where the two meshes interlock like gears. This does mean that the two meshes' rotation must be synchronized, but it +increases the design space of offset labyrinth meshes. For instance, in a gear setup, the wide sides of the inter-mesh +zones can be aligned to lie on the same side, so fiber passthrough can be realized more easily even without the need to +spiral the fiber around the axes of rotation. \subsection{Mesh synchronization} @@ -475,33 +474,78 @@ In this setup, the mesh tabs act like gear teeth. Depending on the ratio between meshes do not have to rotate at the same rate of rotation and harmonic ratios are possible. Additionally, unlike actual gears which need to constantly maintain an area of contact, both co-rotating and counter-rotating setups are possible. +\section{Physical attacks and countermeasures} +\label{sec_attacks} +In this section we will consider possible ways to attack an IHSM-secured QKD relay, as well as potential +countermeasures. + +\subsection{Attacks on the IHSM mesh} + +There are two ways an attacker could attack the mesh itself if an adequate speed of rotation such as \qty{1000}{\rpm} is +used~\cite{gotteCantTouchThis2022}: Either, an attacker would have to slow down the mesh so they can perform a manual +attack, or they would have to use a robot. The first class of attack would require the attacker to falsify the readings +of the centrifugal accelerometer. MEMS accelerometers are complex devices, and the simplest way to falsify its readings +would be to attach a circuit to the accelrometer's data bus that overrides the measurement result data. Creating such a +circuit is easy, the challenge the attacker would have to overcome would be to access this bus and attach this circuit +to the mesh in motion without stopping or disturbing it. At high speeds, this would necessarily require a custom attack +robot. + +\subsection{Contactless attacks on the payload} + +Contactless attacks such as electromagnetic (EM) side-channel attacks or optical fault injection attacks on the payload +could conceivably be conducted from the outside of the mesh. The efficacy of EM side-channel as well as fault injection +attacks decays quickly with increased distance between probe and target, and they can be counteracted by simply placing +the QKD relay's components such that they are spaced apart from the mesh. Optical attacks, on the other hand can be +carried out even at a distance using appropriate focusing optics. The easiest way to prevent such attacks would be to +place the payload into an opaque enclosure inside the mesh. + +An additional variant of optical attacks would be using a laser to cut or drill into the payload. Such attacks can be +impeded through several defense-in-depth measures. First, the payload QKD relay should be designed such that destroying +any part of it such as connecting wires or fibers causes it to fail secure. Irrespective of attacks, this is a +reasonable design objective anyway given that components could fail, and a component failure should never put the device +in an insecure state. Further, similar to other optical attacks, a shield can be used to prevent laser cutting or +drilling attacks as well with the only difference being the kind of shield. To prevent laser cutting or drilling, a +thick metal shield can be used. The large thermal mass, high thermal conductivity and reflective surface of such a +shield makes it difficult to cut. There are lasers such as pulsed Nd:YAG lasers that can cut even thick steel, but these +this cutting produces a large amount of metal plasma and debris, which would likely destroy the payload in the process. + +To make sure any active laser attack is quickly detected, as a final line of defense, both mesh and payload should +include wideband optical sensors in their array of environmental tamper sensors. For instace, high-power pulsed lasers +do not deposit much heat into their target because the surface of the target is vaporized by the laser pulse too +quickly, and thus might not trigger a simple temperature alarm inside the payload. In contrast, optical sensors even +outside of the laser's wavelength range would have no trouble detecting the light emitted from the metal plasma created +by the laser's pulses on impact with the payload. + +\subsection{Fast, mechanical attacks on the payload} + +A final class of attacks are mechanical attacks where an attacker mechanically compromises the IHSM QKD relay so quickly +that the tamper alarm mechanism has no time to act. An instance of such an attack would be using a gun to fire a bullet +at the payload, aiming to selectively destroy parts of it that are involved in tamper alarm response before they can +act. This class of attack can be counteracted in similar ways as the previously mentioned optical attacks. Destruction +of parts of the payload should never let it fall into an insecure state, meaning that such an attack alone should never +be enough to compromise the QKD relay. There is little one can do to prevent destruction of the payload by projectile or +by explosive, but a thick metal shield around the payload would make it more difficult to selectively target part of it +using a projectile. + \section{Outlook} \label{sec_outlook} \subsection{Achievable security guarantees} -Like conventional HSMs, Inertial HSMs are only ever an engineering answer to a security question. In contrast with -cryptographic solutions that in some cases can achieve provable, information-theoretic security, an IHSM's security +Like conventional HSMs, Inertial HSMs are only ever an engeineering answer to a security question. In contrast with +cryptographic solutions that can achieve provable, information-theoretic security in some cases, an IHSM's security rests upon an assumption on the engineering capabilities of an attacker. In contrast to conventional HSMs, which achieve this engineering assumption through the manufacture of hard-to-manipulate tamper sensing meshes, Inertial HSMs achieve it by rotating their tamper sensing mesh. In a conventional HSM, increasing the security of the tamper sensing mesh requires fine-tuning a bespoke manufacturing process. In contrast, increasing the security of an IHSMs simply requires making the rotor faster. -While QKD systems provide theroetically impervious security guarantees based on fundamental laws of physics, they too -are engineered systems embedded into a macroscopic world. As such, while the physics at their core might be sound -similar to how the cryptography at the heart of a HSM might be provable, like HSMs they also cannot side-step requiring -engineering solutions to security questions at the system level. As such, IHSMs complement QKD implementations, and -provide the system-level security barrier necessary for the protection of a QKD node's quantum components. - \subsection{Trust bootstrapping} -When considering the security of a system, we often assume a steady state, where the system is already secure at the -start and then needs to resist some attack. A key question in any practical trusted hardware deployment is how to -bootstrap this initial trust in a new device when faced with the possibility of supply-chain attacks. Conventional HSMs -are only manufactured by a single manufacturer, and the common solution is to just trust that manufacturer. The HSM's -manufacturer can factory-provision an identity key to the HSM that can be used to ascertain the HSM's integrity during -shipping to the customer. +A key question in any trusted hardware deployment is how to bootstrap trust in a new device when faced with the +possibility of supply-chain attacks. Conventional HSMs are only manufactured by a single manufacturer, and the common +solution is to just trust that manufacturer. The HSM's manufacturer can factory-provision an identity key to the HSM +that can be used to ascertain the HSM's integrity during shipping to the customer. One of the key components of IHSM technology is that it does not require specialized components, or potting of the payload. While an IHSM could be manufactured and sold as a complete unit like a conventional HSM, their more modular diff --git a/chapter-sampling-mesh-monitor/chapter.tex b/chapter-sampling-mesh-monitor/chapter.tex index 24c7082..4f9fae6 100644 --- a/chapter-sampling-mesh-monitor/chapter.tex +++ b/chapter-sampling-mesh-monitor/chapter.tex @@ -6,8 +6,8 @@ it.} \section{Introduction} -\sourceattrib{This part is adapted from a paper written by Jan Sebastian Götte and Prof.\ Dr.\ Björn Scheuermann that -will be presented by Jan Sebastian Götte at CHES 2026~\cite{gotteHighFidelitySecurity2026}.} +\sourceattrib{This chapter is adapted from a paper written by me that will be presented by me at CHES +2026~\cite{gotteHighFidelitySecurity2026}.} Security meshes continue to be the state of the art for tamper sensing in applications where sophisticated physical attacks such as attempts at drilling or sawing through the device's enclosure to place probes must be prevented. Common applications for such meshes include Hardware Security Modules (HSMs) used to store and process cryptographic keys @@ -19,18 +19,15 @@ two or more conductive traces that are laid out in a meandering pattern to cover electrically monitors these traces to detect attempts at penetrating this surface. As is often the case with security technologies, in practice a tension exists between the level of security offered by a -particular security mesh implementation and its implementation cost. In Chapter~\ref{chapter-survey}, we have examined a -broad range of real-world security meshes. We found that the majority of implementations use simple construction -approaches and coarse structure sizes, which results in limited security when only monitoring macroscopic parameters of -the mesh such as electrical continuity or resistance. The coarse monitoring approaches based on trace continuity that -are used in many commercial designs are incapable of detecting attacks that manipulate small parts of the mesh. The most +particular security mesh implementation and its implementation cost. Commercial designs often only coarsely monitor the +conductivity of the mesh traces and are incapable of detecting attacks that manipulate small parts of the mesh. The most secure meshes are made in custom manufacturing processes. Materials such as polymer substrates are specifically chosen such that the mesh is difficult to manipulate without breaking it. A drawback of this approach is that the specialized -manufacturing processes are difficult to replicate and that the resulting cost of the mesh is high~\cite{isaacs2013}. In -some lower-security applications such as card payment terminals, simpler approaches are still commonly used for their -ease of implementation. Often, standard copper/polyimide Flexible Printed Circuits (FPCs) or even standard Printed -Circuit Boards (PCBs) are used because of the wide availability of -manufacturing services. +manufacturing processes are difficult to replicate and that the resulting cost of the mesh is high. In some +lower-security applications such as card payment terminals, simpler approaches are still commonly used for their ease of +implementation. Often, standard copper/polyimide Flexible Printed Circuits (FPCs) or even standard Printed Circuit +Boards (PCBs) are used because of the wide availability of manufacturing services. +\todo{Integrate new scope plots!} Inertial HSMs are one approach that enables the use of less expensive, commodity materials in high-security applications. Several other academic approaches exist that target low-cost~\cite{ @@ -48,7 +45,7 @@ applications. Several other academic approaches exist that target low-cost~\cite High-performance mesh monitoring approaches try to characterize the mesh's physical properties with high accuracy, but often come at the cost of specialized, expensive circuitry. Low-cost approaches utilize advanced analog techniques in their circuitry to extract precise measurements using few components. They trade off measurement precision for lower -component cost. Besides simple monitoring, detecting tamper attempts by replacing the mesh with a macro-scale Physical +component cost. Besides simple monitoring, detecting tamper attempts by replacing the mesh with a macro-scale Physically Unclonable Function (PUF) has also been researched~\cite{ immlerBTREPIDBatterylessTamperresistant2018, staatAntiTamperRadioSystemLevel2022, @@ -151,8 +148,8 @@ blind spots. obermaierMeasurementSystemCapacitive2018, garbTamperSensitiveDesignPUFBased} propose one of the most advanced security mesh designs in the current academic state of the art. They use a specialized -security mesh as a Physical Unclonable Function (PUF), combining tamper sensing with cryptographic key storage. In their -design, the mesh consists of a cross-hatch pattern made from several dozen individually addressable capacitive +security mesh as a Physically Unclonable Function (PUF), combining tamper sensing with cryptographic key storage. In +their design, the mesh consists of a cross-hatch pattern made from several dozen individually addressable capacitive electrodes. They manufacture their meshes in a specialized process that results in unpredictable, random variations in capacitance between electrodes. They propose an analog frontend that measures the precise mutual capacitance of each pair of electrodes~\cite{obermaierMeasurementSystemCapacitive2018} using an approach similar to @@ -756,47 +753,7 @@ its switching happens in the short period between its input differential voltage combined forward voltage of the Schottky diodes. Thus, while the \partno{74LVC} might produce slow edges overall, its large output swing results in a high slew rate in the critical region around the zero crossing. -\begin{figure} - \begin{center} - \begin{subfigure}{0.45\textwidth} - \centering - \includegraphics[width=\textwidth]{edge_sampling_pulse_scope.pdf} - \vspace*{-5mm} - \caption{Sampling pulse} - \label{fig_osc_risetime_samp} - \end{subfigure} - \unskip\begin{subfigure}{0.45\textwidth} - \centering - \includegraphics[width=\textwidth]{edge_stimulus_pulse_scope_normalized.pdf} - \vspace*{-5mm} - \caption{Stimulus pulse} - \label{fig_osc_risetime_stim} - \end{subfigure} - \end{center} - \vspace*{-5mm} - \caption[Pulse risetime oscilloscope measurements]{Oscilloscope measurements of the sampling pulse probed - differentially (left) and of the stimulus pulse probed single-ended and normalized (right). The 74LVC pulse is - plotted on the right Y axis in the left plot due to its large amplitude. In the right plot, it is not shown - since our measurement setup did not allow for a measurement of this amplitude.} - \label{fig_osc_risetime} -\end{figure} - -Figure~\ref{fig_osc_risetime} shows the sampling and stimulus pulse edges measured using a Siglent SDS7404A -\qty{4}{\giga\hertz} oscilloscope. The stimulus pulse was directly measured single-ended, and the sampaling pulse was -measured differentially through a Siglent SAP2500D \qty{2.5}{\giga\hertz} active differential probe. These measurements -support the conclusion from Figure~\ref{fig_spec_risetime} that in raw edge risetime, \partno{MAX3748} and -\partno{TDP0604} perform fastest, with \partno{PI3HDX12211} being slightly slower. They also exhibit the large -differences in amplitude that we expect cause the differences in actual measurement performance as shwon in -Figure~\ref{fig_edge_risetime}. Note that due to the differences in measurement methodology, a direct comparison of the -rise times is not possible between these plots. The spectrum measurements do not convey amplitude information and -discard low-frequency content, but due to the very large bandwidth of the spectrum analyzer used, they will represent -the true risetime the closest. In both the self-characterization and the oscilloscope measurements, the displayed -risetime is contaminated by the measurement system. In case of the self-characterization, the stimmulus rise time is -folded into the measurement result, leading in the displayed risetime being slower by a factor of $\sqrt{2}$. Similarly, -in the oscilloscope measurements, the combined risetime of the oscilloscope frontend and active probe contaminate the -results. - -We observed the best overall performance with the \partno{PI3HDX12211} redriver, resulting in a rise time of +We observed the best result overall with the \partno{PI3HDX12211} redriver, resulting in a rise time of \qty{264}{\pico\second}. In this test specimen, we fed the pulse through the amplifier twice since we had two unused channels, and we used \qty{200}{\pico\second} clip lines on the amplifier's output for pulse shaping. We only used clip lines here and for \partno{TDP0604} since the other amplifiers' output did not contain sufficient harmonic content. @@ -848,7 +805,7 @@ lines here and for \partno{TDP0604} since the other amplifiers' output did not c \qty{2.86}{\meter}& \qty{3.86}{\meter}\\ - \textbf{Approx. Delay}& + \textbf{Approximate Delay}& \qty{7.1}{\nano\second}& \qty{13}{\nano\second}& \qty{19}{\nano\second}& @@ -862,13 +819,13 @@ lines here and for \partno{TDP0604} since the other amplifiers' output did not c \label{tab_mesh_spec} \end{table} -To measure the practical performance of our prototype, we created a set of tamper sensing mesh test specimens using the -algorithm described in Chapter~\ref{chapter-ihsm}. Each specimen contains four separate meshes with the same area. -Table~\ref{tab_mesh_spec} shows the design specifications. Each specimen contains four separate meshes on the outer -layers of a four-layer, \qty{1.0}{\milli\meter} thickness PCB, two equal-size meshes on each side. The inner layers were -used as ground. Figure\ \ref{fig_mesh_length} shows the results of a baseline measurement of each mesh using each design -variant. The step response resulting from an edge entering the mesh and its reflection arriving back at the start after -traversing the mesh back and forth is clearly visible. +To measure the practical performance of our prototype, we created a set of tamper sensing mesh test specimens. Each +specimen contains four separate meshes with the same area. Table~\ref{tab_mesh_spec} shows the design specifications. +Each specimen contains four separate meshes on the outer layers of a four-layer, \qty{1.0}{\milli\meter} thickness PCB, +two equal-size meshes on each side. The inner layers were used as ground. Figure\ \ref{fig_mesh_length} shows the +results of a baseline measurement of each mesh using each design variant. The step response resulting from an edge +entering the mesh and its reflection arriving back at the start after traversing the mesh back and forth is clearly +visible. We validated the results from Figure\ \ref{fig_mesh_length} by calculating speed of light in our mesh specimen's substrate based on them. The resulting measurements are shown in Table\ \ref{tab_speed_of_light}. All amplifier @@ -908,7 +865,7 @@ switching. 2& 3& 4& - Calculated $c$ + Calculated speed of light $c$ \\\hline \partno{PI3HDX12211}& @@ -940,8 +897,8 @@ switching. $\qty{1.59d8}{\meter\per\second}$\\ \end{tabular} \end{center} - \caption[Speed of light calculations]{Speed of light $c$ and time offset calculated from delays read from the graphs - in Figure\ \ref{fig_mesh_length}. $c$ is the speed of light determined by linear fit.} + \caption[Speed of light calculations]{Speed of light and time offset calculated from delays read from the graphs in + Figure\ \ref{fig_mesh_length}. $c$ is the speed of light determined by linear fit.} \label{tab_speed_of_light} \end{table} diff --git a/chapter-sampling-mesh-monitor/figures/edge_sampling_pulse_scope.pdf b/chapter-sampling-mesh-monitor/figures/edge_sampling_pulse_scope.pdf deleted file mode 100644 index baa45bd..0000000 Binary files a/chapter-sampling-mesh-monitor/figures/edge_sampling_pulse_scope.pdf and /dev/null differ diff --git a/chapter-sampling-mesh-monitor/figures/edge_stimulus_pulse_scope_normalized.pdf b/chapter-sampling-mesh-monitor/figures/edge_stimulus_pulse_scope_normalized.pdf deleted file mode 100644 index 8d43eec..0000000 Binary files a/chapter-sampling-mesh-monitor/figures/edge_stimulus_pulse_scope_normalized.pdf and /dev/null differ diff --git a/chapter-sampling-mesh-monitor/figures/sampling-mesh-monitor b/chapter-sampling-mesh-monitor/figures/sampling-mesh-monitor index cd33cff..b4dc582 160000 --- a/chapter-sampling-mesh-monitor/figures/sampling-mesh-monitor +++ b/chapter-sampling-mesh-monitor/figures/sampling-mesh-monitor @@ -1 +1 @@ -Subproject commit cd33cff0e8b3284f26a4b87c9c9d40ae226dceed +Subproject commit b4dc58286d039b1d0f70ea86f9e1f2cc538d8fbb diff --git a/chapter-smpc/chapter.tex b/chapter-smpc/chapter.tex index a5153be..b755acf 100644 --- a/chapter-smpc/chapter.tex +++ b/chapter-smpc/chapter.tex @@ -5,39 +5,34 @@ were a necessary precondition for the legalization of same sex marriage. This is also why those maintaining positions of power will always encourage the freedom to talk about ideas, but never to act.} \chaptertitle{Case Study: Multiparty Computation in Scalable Hardware Security Modules} -\label{chapter-smpc} Inertial Hardware Security Modules do not only support much larger payloads compared to conventional HSMs, they also -support much higher power dissipation since they allow for direct air cooling of their payload. The tamper-sensing -membrane of a conventional HSM must be continuous to provide security, so any heat dissipated by the payload must pass -through it. Since the polymers used in tamper sensing membranes are poor conductors of heat, and since security benefits -from a thicker tamper sensing assembly (cf.\ Chapter~\ref{chapter-survey}), power dissipation in conventional HSMs is -limited~\cite{ - petriePartIITechnical, - curetHardwareSecurityModule2025, - zhangTamperrespondentAssembliesPorous2023, - dragoneVentedTamperrespondentAssemblies2020}. +support much higher power dissipation since they allow for direct air cooling of their payload. Because they rotate at +high speed, IHSM meshes do not need to be contiguous to provide adequate security. While a non-contiuous rotating mesh +might theoretically allow a stationary attack tool to quickly penetrate, then retract through one of the mesh's gaps +while the mesh is rotating, the time available for such an attack would be too short for a practical attack. For a mesh +with three vertical connecting segments (cf.\ Figure~\ref{fig_proto_mesh} in Chapter~\ref{chapter-ihsm}) rotating at +\qty{1000}{\rpm}, this time would be in the order of \qty{20}{\milli\second}. Conventional HSM monitoring circuits often +require a similar amount of time to react to an attack~\cite{obermaier2018}. -Because IHSMs rotate at high speed, IHSM meshes do not need to be contiguous to provide adequate security. While a -non-contiguous rotating mesh might theoretically allow a stationary attack tool to quickly penetrate, then retract -through one of the mesh's gaps while the mesh is rotating, the time available for such an attack would be too short for -a practical attack (cf.\ Chapter~\ref{chapter-ihsm}). For a mesh with three vertical connecting segments (cf.\ -Figure~\ref{fig_proto_mesh} in Chapter~\ref{chapter-ihsm}) rotating at \qty{1000}{\rpm}, this time would be in the order -of \qty{20}{\milli\second}. Conventional HSM monitoring circuits would likely require a similar amount of time to react -to an attack~\cite{obermaier2018}. - -Similar to how the increase in payload \emph{size} of IHSMs compared to conventional HSMs unlocks new applications such -as the Quantum Key Distribution relay use case we presented in Chapter~\ref{chapter-qkd}, the increase in sustainable -power dissipation enabled by air cooling also unlocks a number of new applications. Especially applications that require -large amounts of computing power benefit from IHSM technology, as their needs fundamentally cannot be met by -conventional HSMs. +Similar to how the increase in payload \emph{size} unlocks new applications such as the Quantum Key Distribution relay +use case we presented in Chapter~\ref{chapter-qkd}, this increase in sustainable power dissipation by a factor of +several hundred also unlocks a number of new applications. Especially applications that require large amounts of +computing power benefit from IHSM technology, as their needs fundamentally cannot be met by conventional HSMs. One such application that does not translate to conventional HSMs due to its need for large amounts of computing power is Multiparty Computation (MPC). MPC is a cryptographic construct that allows several networked parties to jointly perform a computation in such a way that the inputs to the computation remain private to the parties providing them, and no single party must be trusted for the computation to produce the correct result. Conceptually, MPC is similar to a secret sharing scheme that shares not just data, but computation between untrusted parties. The computation primitive -MPC offers is a cryptographic tool for bootstrapping trust in a distributed computing system. +MPC offers is a cryptographic answer to the question of how to bootstrap trust in a computing system. +\todo{In this chapter, cite academic publications and patents on HSM cooling!} + +%The most challenging scenarios in computing arise when multiple +%parties such as manufacturers and operators, servers and clients, or sellers and buyers need to interact through +%computation. In many practical situations, it is impossible to create a single computer that can be trusted by every +%participant. MPC is a generic solution to a multitude of such scenarios reducing the problem of creating a single, +%shared computer everyone can trust simultaneously to everyone creating their own computer that they only can trust. We can deconstruct the problem of trust in computing into two largely disjunct parts: Establishing trust in a computing system during its creation is one, and maintaining this trust throughout its life is the other. For the second part of @@ -51,43 +46,41 @@ they cannot target all systems simultaneously and we give them too little time t A limitation of both approaches is that in either case, while the party creating or acquiring the system can trust it, they cannot prove its trustworthiness to other parties. MPC solves this issue by allowing every party to contribute -their own trusted system to the protocol, cryptographically bootstrapping common trust in the computation and its +their trusted system to the protocol, cryptographically bootstrapping common trust in the computation and its output\footnote{ In fact, MPC does more than just bootstrapping from each participant trusting their own system to a trusted shared computation. In an MPC protocol providing semi-honest or better security, MPC even \emph{relaxes} each party's trust - requirement from trusting their own system to trusting any $n$-of-$k$ out of all systems contributing to the + requirement from trusting their own system to trusting that any $n$-of-$k$ out of all systems contributing to the protocol. }. \section{Fast MPC and Slow HSMs} -MPC is a uniquely powerful cryptographic primitive, yet it has still not found widespread practical adoption. To a large -extent, this is because MPC is extremely resource-intensive to run. MPC protocols exist on a continuum trading off -between extreme memory and bandwidth requirements on one end and intense computational requirements on the other end. At -a first glance, MPC and Hardware Security Modules look like they would complement each other well, but HSMs cannot keep -up with the computational requirements posed by MPC. +MPC is a uniquely powerful cryptographic primitive, yet it has still not found widespread practical adoption. This is +because MPC is extremely resource-intensive to run. MPC protocols exist on a continuum trading off between extreme +memory and bandwidth requirements on one end and intense computational requirements on the other end. At a first glance, +MPC and Hardware Security Modules look like they would complement each other well, but HSMs cannot keep up with the +intense computational requirements posed by MPC. -Using P-256 curve ECC key generation as a benchmark, commercially available HSMs are quoted to perform between 3,500 and -22,000 cryptographic operations per second~\cite{ +Using P-256 curve ECC key generation as a benchmark, commercially available HSMs are quoted to perform between 3500 and +22000 cryptographic operations per second~\cite{ kumarIBMZ16Performance2025, ThalesLunaNetwork2024, Utrust_GP_HSM_Se_Series_Datasheet_ENpdf, -}. Meanwhile, an MPC protocol doing something as simple as a single AES encryption, corresponding to 7,000 logic +}. Meanwhile, an MPC protocol doing something as simple as a single AES encryption, corresponding to 7000 logic gates~\cite{wangGlobalScaleSecureMultiparty2017}, requires tens of thousands of cryptographic operations when performed in MPC. As a result, applying conventional HSMs to MPC at any practical scale is infeasible by multiple orders of -magnitude. Literature on MPC commonly uses server hardware as a platform for benchmarks, which has power dissipation and -processing speeds well beyond that of conventional HSMs. +magnitude. Literature on MPC commonly uses server hardware as a platform for benchmarks. HSMs are slow compared to contemporary computers because they are limited in their power dissipation, and power dissipation is largely proportional to processing speed. In the limited fields where HSMs have found commercial -application, this limitation was never considered important and market forces pushing towards faster HSMs appear to -remain light with the issue receiving little attention in either academic or manufacturer publications on the topic. -Fundamentally, conventional HSMs must envelope the entire payload in a tamper sensing mesh to detect drilling attacks, -but a tamper sensing mesh that is impermeable to a drill is also impermeable to air. As a result, any heat conducted -from the HSMs processor to the outside world must pass through the mesh. At the same time, the mesh cannot be thinned -either because thinning it would enable micro-drilling attacks. The result of these constraints is a high thermal -resistance between the HSM's processor and an external heat sink, which limits maximum power dissipation to a fraction -of that of modern CPUs or even GPUs. +application, this limitation was never considered important and market forces pushing towards faster HSMs remain +light\todo{Can we find a citation here?}. Fundamentally, conventional HSMs must envelope the entire payload in a tamper +sensing mesh to detect drilling attacks, but a tamper sensing mesh that is impermeable to a drill is also impermeable to +air. As a result, any heat conducted from the HSMs processor to the outside world must pass through the mesh. At the +same time, the mesh cannot be thinned either because thinning it would enable micro-drilling attacks. The result of +these constraints is a high thermal resistance between the HSM's processor and an external heat sink, which limits +maximum power dissipation to a fraction of what is achieved in modern CPUs or even GPUs. A secondary limitation of conventional HSMs is that the highly specialized tamper sensing foils used in their construction often cannot be scaled to arbitray sizes without incurring unsustainable process yields due to the @@ -99,9 +92,10 @@ components such as memory, power supplies and any internal heat spreading compon Inertial HSMs solve this issue since they allow their payload to be air cooled without compromising security, and they expand the feasible security boundary size from the several hundred milliliters offered by conventional HSMs to several liters and more, enabling the integration of standard, off-the-shelf server components such as mainboards, CPUs, CPU -coolers, and power supplies. In this chapter, we will first provide a short overview illustrating a basic MPC protocol -for context before elaborating a design of an IHSM tailored to MPC tasks. We will conclude with an outlook of -applications unlocked by our design as well as promising areas for future improvements of our design. +coolers, and power supplies. In this chapter, we will first provide a short overview of the theory of MPC before +elaborating a design of an IHSM tailored to MPC tasks including performance calculations and unique design aspects. We +will conclude with an outlook of applications unlocked by our design as well as promising areas for future improvements +of our design. \section{The Fundamentals of Multiparty Computation} @@ -128,8 +122,7 @@ real-world settings where parties do not have stable identities such as peer-to- mostly interesting as a research tool since protocols assuming a semi-honest adversary can often be upgraded to covert or malicious security at some performance tradeoff. In a practical setting, a semi-honest secure MPC protocol would not provide additional security over just having one party run the computation except in some situations where inadvertent -side-channel leakage is a concern. Using HSMs to secure protocol participants' cryptographic computations complements -both the covert and malicious security models. +side-channel leakage is a concern. \subsection{Oblivious Transfer} @@ -148,17 +141,19 @@ Transfer Extensions (OTe)\cite{ishaiExtendingObliviousTransfers2003}. Using OTe, base Oblivious Transfer instances can be extended into an arbitrarily large number of Oblivious Transfer instances using only invocations of a pseudo-random function (PRF) such as a cryptographic hash function. -\subsection{A basic MPC protocol: Boolean MPC with Yao's Garbled Circuits} - -As a basic example of the approach taken by MPC protocols, we will give a brief overview of Yao's Garbled Circuits (GC) -protocol. Yao's GC is one of the oldest Multiparty Computation protocols, dating back to the 1980ies. In Yao's GC, two -parties jointly compute a function that is represented as a circuit of binary logic gates by evaluating the circuit gate -by gate. In Yao's GC, one party, generator, creates a random \emph{garbled} representation of the circuit and sends it -to the other party, the evaluator, who computes its output. The core idea in Yao's GC is that every wire $w_i$ in the -circuit is assigned two random cryptographic secret keys $w_i^b$, called wire labels, one $w_i^0$ for the logical value -$0$ and one $w_i^1$ for the value $1$. The mapping from logic values to these keys is assigned randomly by the -generator, and unknown to the -evaluator~\cite{yaoHowGenerateExchange1986,beaverComplexitySecureProtocols1990,evansPragmaticIntroductionSecure}. +\subsection{Boolean MPC with Yao's Garbled Circuits} +% Yao's Garbled Circuits +Yao's Garbled Circuits (GC) protocol is one of the oldest Multiparty Computation protocols, dating back to the 1980ies. +In Yao's GC, two parties jointly compute a function that is represented as a circuit of binary logic gates by evaluating +the circuit gate by gate. In Yao's GC, one party, generator, creates a random \emph{garbled} representation of the +circuit and sends it to the other party, the evaluator, who computes its output. The core idea in Yao's GC is that every +wire $w_i$ in the circuit is assigned two random cryptographic secret keys $w_i^b$, called wire labels, one $w_i^0$ for +the logical value $0$ and one $w_i^1$ for the value $1$. The mapping from logic values to these keys is assigned +randomly by the generator, and unknown to the evaluator~\cite{ + yaoHowGenerateExchange1986, + beaverComplexitySecureProtocols1990, + evansPragmaticIntroductionSecure, +}. Gates are represented in Yao's GC as truth tables with one row for every combination of input wire values. Each row of these truth tables contains the output wire label (i.e. secret key) corresponding to the gate's logical output value for @@ -193,8 +188,28 @@ evaluations of a pseudorandom function such as a cryptographic hash or a cipher. Garbled Circuit is many times slower than performing it in the clear. Intuitively, each single-bit gate in the garbled circuit results in several cryptographic operations with input and output sizes of dozens or hundreds of bits. Practically useful functions such as AES encryption have circuit implementations measuring thousands or tens of -thousands of gates, meaning these costs quickly escalate for practical problem -sizes~\cite{boyarNewCombinationalLogic2010, songhoriTinyGarbleHighlyCompressed2015}. +thousands of gates, meaning these costs quickly escalate for practical problem sizes~\cite{ + boyarNewCombinationalLogic2010, + songhoriTinyGarbleHighlyCompressed2015, +}. + +% FIXME This entire connecting section + +%\subsection{Practical Application} +%\subsubsection{Preprocessing and Online Phases} +%\subsubsection{Constant-Round MPC} + +% \subsection{Performance} + +% zahurTwoHalvesMake2015,wangGlobalScaleSecureMultiparty2017,kellerMPSPDZVersatileFramework2020,dalskovFantasticFourHonestMajority + +% \subsection{Practical Deployments} + +% \subsection{Solutions} + +% \subsection{Hardware Security Applied to MPC} + +% Hardware security primitives can be applied in several roles in an MPC protocol. \section{A High-Performance IHSM for MPC Applications} @@ -204,17 +219,24 @@ implemented using CPU processing. The technology comes with an unavoidable incre each single plaintext computation or gate results in several cryptographic operations. A naive implementation might attempt to implement MPC using an HSM by simply offloading all cryptographic operations to -the HSM. In practice, this is not a workable solution due to the slow processing speed of conventional HSMs. In the near -term, absent radical developments in either MPC theory or in the speed and power efficiency of processing hardware, the -only feasible solution for HSM-protected MPC at any practical scale is to find a way to protect an entire server-class -computer. IHSMs are a natural fit for this requirement since they allow for large, air-cooled payloads. +the HSM. In practice, this is not a workable solution due to the slow processing speed of conventional HSMs. +Conventional HSMs use low-power embedded processors since their encapsulation using potting and security meshes impedes +heat transfer, limiting power dissipation. + +In the near term, absent radical developments in either MPC theory or in the speed and power efficiency of processing +hardware, the only feasible solution for HSM-protected MPC at any practical scale is to find a way to protect an entire +server-class computer. As elaborated above, IHSMs are a natural fit for this requirement since they allow for large, +air-cooled payloads. + +%\subsection{Hardware Requirements} As a baseline performance target, we consider a commodity server mainboard in CEB or ATX form factor, populated with a high-end server CPU and a large amount of RAM. As MPC systems do not usually require a great amount of storage, we can -largely ignore storage for our size and power calculations. As a result, we end up with a total maximum power -dissipation of approximately \qty{420}{\watt} as shown in Table~\ref{tab_power_budget}. Dissipating this amount of power -using air cooling is within the capabilities of commodity server cooling -components~\cite{coroamaPossibleFutureTrends2025}. +largely ignore storage for our size and power calculations.\todo{Refer to performance numbers from research above here} + +As a result, we end up with a total maximum power dissipation of approximately \qty{420}{\watt} as shown in +Table~\ref{tab_power_budget}. Dissipating this amount of power using air cooling is within the capabilities of commodity +server cooling components~\cite{coroamaPossibleFutureTrends2025}. \begin{table} \centering @@ -233,16 +255,16 @@ components~\cite{coroamaPossibleFutureTrends2025}. A common type of side-channel attack on cryptographic systems are power analysis attacks. In such attacks, the supply current of the target processing system is measured at high speed while the target is performing cryptographic computations. By aggregating the results of a large number of the resulting power traces, it is often possible to infer -the value of secret data such as cryptographic keys. To mitigate this type of attack, we propose placing the system's -power supply inside the IHSM envelope. A secondary benefit of placing the power supply inside the tamper-sensing barrier -is that it simplifies the power wiring between the outside of the IHSM cage and the payload. Supplying the -\qty{12}{\volt} power rails that commodity mainboard commonly use requires tens of Ampere. To carry such high current, -the wiring has to be sized accordingly. In an IHSM, even thick wires can easily be passed through the mesh cage, but -such wiring requires a large opening at the shaft on one end of the cage, which creates a literal security gap. Placing -the power supply inside of the cage reduces the size of the wires needed since the power supply steps down a lower -current \qty{240}{\volt} input to the system's high-current \qty{12}{\volt} rails. Using DIN VDE 0298-4\todo{Citation?} -as a reference, a pair of \qty{1.5}{\milli\meter^2} conductors is sufficient for more than \qty{3}{\kilo\watt} of load -under worst-case conditions. +the value of secret data such as cryptographic keys. To mitigate this type of attack, not only do we have to place the +CPU, mainboard, and memory inside of the HSM's tamper-sensing barrier, but also the power supply. A secondary benefit of +placing the power supply inside the tamper-sensing barrier is that it simplifies the power wiring between the outside of +the IHSM cage and the payload. Supplying the \qty{12}{\volt} power rails that commodity mainboard commonly use requires +tens of Ampere. To carrie such high current, the wiring has to be sized accordingly. In an IHSM, even thick wires can +easily be passed through the mesh cage, but such wiring requires a large opening at the shaft on one end of the cage, +which creates a literal security gap. Placing the power supply inside of the cage reduces the size of the wires needed +since the power supply steps down a lower current \qty{240}{\volt} input to the system's high-current \qty{12}{\volt} +rails. According to DIN VDE 0298-4\todo{Citation?}, a pair of \qty{1.5}{\milli\meter^2} conductors is sufficient for +more than \qty{3}{\kilo\watt} of load under worst-case conditions. \subsection{Software Considerations} @@ -264,61 +286,31 @@ software without effectively running a system emulation and incurring a massive Intel and AMD contain hardware features that provide transparent DRAM encryption. These hardware features would be necessary when securing an entire sever in an MPC setup with IHSMS technology. +% \subsection{Fast Zeroization of Non-Customizable Memories} +% Thermite experiements and paper + \subsection{A Joint Cooling and IHSM Envelope Powertrain} In this section, we will present a sketch of a design for an IHSM envelope large enough to fit a small server mainboard, and that provides air cooling to the payload. Our sketch solves the engineering issue of moving such an IHSM envelope while simultaneously providing cooling to the payload. -\begin{figure} - \centering - \begin{subfigure}{0.45\textwidth} - \centering - \includegraphics[width=\textwidth]{setup_0001.jpg} - \caption{} - \label{fig_setup_left} - \end{subfigure} - \hspace*{5mm} - \begin{subfigure}{0.45\textwidth} - \centering - \includegraphics[width=\textwidth]{setup_0002.jpg} - \caption{} - \label{fig_setup_right} - \end{subfigure} - \caption{Conceptual demonstrator of the fan-driven IHSM primary mesh approach.} - \label{fig_setup} -\end{figure} - +% FIXME picture! Our proposed design is based on the idea of using the cooling fans' airflow to power the rotation of the IHSM envelope. -Figure~\ref{fig_setup} shows a conceptual demonstration of this approach. Using a basic cylindrical design, the IHSM -envelope consists of two discs above and below the payload that are connected through vertical struts on the outside of -the payload. We propose widening these vertical connecting struts, and angling them such that the entire envelope -becomes a centrifugal impeller. By letting air flow into the envelope from the side, and back out through its top and -bottom, the envelope assumes the same configuration used in centrifugal cooling fans. Tamper sensing meshes are placed -inside the vertical struts as well as along the horizontal discs at the top and at the bottom. +Using the basic cylindrical design, the IHSM envelope consists of two discs above and below the payload that are +connected through vertical struts containing part of the tamper-sensing mesh on the outside of the payload. We propose +widening these vertical connecting struts, and angling them such that the entire envelope becomes a centrifugal +impeller. By letting air flow into the envelope from the side, and back out through its top and bottom, the envelope +assumes the same configuration used in centrifugal cooling fans. A secondary advantage of this concept is that we do not +need a motor on the envelope's shaft, saving vertical space and one difficult to source part. Furthermore, the cooling +fans can be located on the outside of the envelope in an easily accessible location, and can be set up in a redundant +way such that a failed cooling fan can be replaced while the system continues operation. The only disadvantage of this +solution over a direct motor drive is noise. To achieve the speed necessary for sufficient security at the large +envelope diameter of an MPC accelerator application, high-airflow fans must be used, which are very noisy when at full +speed. We consider this a valid tradeoff since such a system would be deployed in a datacenter where high noise levels +are acceptable. -Laying out an IHSM this way has several advantages. First, we save some vertical space by removing the motor from the -shaft of the mesh. Second, on top of driving the mesh, the airflow also serves to cool the payload. Finally, this -approach eliminates the motor driving the mesh as a single point of failure. In a basic IHSM design as we introduced it -in Chapter~\ref{chapter-ihsm}, this motor is a critical component as its failure would lead to the mesh accelerometer -triggering the deceleration tamper alarm. Using a brushless motor type the number of wear components in this motor can -be reduced to the motor's shaft bearings. A complication in the practical manufacturing of IHSMs at a small scale is -that small-scale production does not allow for a custom-made motor. Limiting the selection to off-the-shelf brushless -motors leads to an unpredictability of bearing life due to the cost of precision bearings. Complicating things, bearing -specifications are not usually included in motor datasheets. - -Compared to the market for off-the-shelf small brushless motors, cooling fans are easier to shop for. A large selection -of products with various form factors and specifications is available, and manufacturers usually give detailed -information on both performance and lifetime. Industrial and server cooling fans are commonly rated for uninterrupted -24/7 operation. The cooling fans can be located on the outside of the envelope in an easily accessible location. Like in -many servers, they can be set up in a redundant way such that a failed cooling fan can be replaced while the system -continues to operate. - -The main drawback of a fan-driven IHSM is the amount of airflow necessary. To maximize payload volume, the fan blades -must be kept as narrow as possible. Narrow fan blades work best at high air speed, but high air speed requires the fan -to have high airflow. Besides limiting fan selection and increasing power consumption, high airflow fans also are noisy. -Despite these limitations, we consider fan-driven IHSMs a valid tradeoff since such a system would most likely be -deployed in a datacenter where high noise levels are acceptable. +\todo{Finish sketch!} \section{Outlook} diff --git a/chapter-smpc/figures/setup_0001.jpg b/chapter-smpc/figures/setup_0001.jpg deleted file mode 100644 index f5c0a1a..0000000 Binary files a/chapter-smpc/figures/setup_0001.jpg and /dev/null differ diff --git a/chapter-smpc/figures/setup_0002.jpg b/chapter-smpc/figures/setup_0002.jpg deleted file mode 100644 index 8d0c91d..0000000 Binary files a/chapter-smpc/figures/setup_0002.jpg and /dev/null differ diff --git a/common-defs.tex b/common-defs.tex index 3eb2ce3..144493a 100644 --- a/common-defs.tex +++ b/common-defs.tex @@ -7,13 +7,11 @@ \usepackage[ backend=biber, style=numeric, - backref=true, natbib=true, url=false, doi=true, eprint=false, refsegment=chapter, - date=iso, ]{biblatex} \addbibresource{main.bib} \DeclareSourcemap{ @@ -54,20 +52,12 @@ \ifdefined\thesispreviewmode % (draft \texttt{\input{version.tex}\unskip}) % \fi % - \leftmark} -\fancyhead[OL]{\footnotesize% - \ifdefined\thesisoneside % - \leftmark% - \ifdefined\thesispreviewmode % - \\(draft \texttt{\input{version.tex}\unskip}) % - \fi % - \else% - \rightmark% - \fi} +\leftmark} +\fancyhead[OL]{\footnotesize\rightmark} \fancyhead[EL,OR]{\thepage} + \fancyfoot[LCR]{} -\setlength{\headheight}{13.6pt} \fancypagestyle{plain}{% \fancyhf{}% \renewcommand{\headrulewidth}{0pt}% @@ -175,45 +165,12 @@ \printbibliography[nottype={online},nottype={patent},heading=subbibliography,resetnumbers=false,segment=\therefsegment] } -% Fix for random mixed date formats, generated with claude.ai -% Redefine the date printing macro -\renewbibmacro*{date}{% - \iffieldundef{year} - {} - {\printtext{% - \thefield{year}% - \iffieldundef{month} - {} - {-\mkdatezeros{\thefield{month}}% - \iffieldundef{day} - {} - {-\mkdatezeros{\thefield{day}}}}% - }}% -} - -% Redefine urldate printing -\renewbibmacro*{urldate}{% - \iffieldundef{urlyear} - {} - {\printtext[urldate]{% - \thefield{urlyear}% - \iffieldundef{urlmonth} - {} - {-\mkdatezeros{\thefield{urlmonth}}% - \iffieldundef{urlday} - {} - {-\mkdatezeros{\thefield{urlday}}}}% - }}% -} -% end fix - \newrefcontext{defref} \hyphenation{a-me-na-ble} \hyphenation{da-ta-cen-ter} \hyphenation{Si-cher-heits-mo-du-l} \hyphenation{Si-cher-heits-mo-du-le} -\babelhyphenation[ngerman]{Si-cher-heits-mo-dul} \setstretch{1.3} diff --git a/defence/pearson-corr-1.png b/defence/pearson-corr-1.png deleted file mode 100644 index 0a15897..0000000 Binary files a/defence/pearson-corr-1.png and /dev/null differ diff --git a/defence/pearson-corr-sample-1.png b/defence/pearson-corr-sample-1.png deleted file mode 100644 index 2a6015d..0000000 Binary files a/defence/pearson-corr-sample-1.png and /dev/null differ diff --git a/defence/pearson-corr-sample.tex b/defence/pearson-corr-sample.tex deleted file mode 100644 index 34de09d..0000000 --- a/defence/pearson-corr-sample.tex +++ /dev/null @@ -1,21 +0,0 @@ -\documentclass[convert={density=500}, border=2pt, varwidth=3in]{standalone} - -\usepackage{amsmath} -\usepackage{amssymb} - -\begin{document} - -\begin{align*} -r_{X, Y} &= \frac{ -\sum_{i=1}^n(x_i - \overline{x})(y_i - \overline{y}) -}{ -\sqrt{ -\sum_{i=1}^n(x_i-\overline{x})^2 -} -\sqrt{ -\sum_{i=1}^n(y_i-\overline{y})^2 -} -} -\end{align*} - -\end{document} diff --git a/defence/pearson-corr.tex b/defence/pearson-corr.tex deleted file mode 100644 index 1ad3fc3..0000000 --- a/defence/pearson-corr.tex +++ /dev/null @@ -1,12 +0,0 @@ -\documentclass[convert={density=500}, border=2pt, varwidth=2in]{standalone} - -\usepackage{amsmath} -\usepackage{amssymb} - -\begin{document} - -\begin{align*} -\rho_{X,Y} &= \frac{\mathrm{cov}\left(X, Y\right)}{\sigma_X \sigma_Y} -\end{align*} - -\end{document} diff --git a/defence/phd defence pulse shaping.png b/defence/phd defence pulse shaping.png deleted file mode 100644 index dd7aae8..0000000 Binary files a/defence/phd defence pulse shaping.png and /dev/null differ diff --git a/defence/phd defence pulse shaping.svg b/defence/phd defence pulse shaping.svg deleted file mode 100644 index 07b6d9d..0000000 --- a/defence/phd defence pulse shaping.svg +++ /dev/null @@ -1,957 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - BAT17-04W - RF Schottky - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Pulse Amplifier - STM32G474 - - - 74LVC2G157 - PI3HDX12211 - Single-Ended -to Differential Conversion - - - Adjustable Voltage Regulator - - - - - - - - - - - - - - - - - - - - - - - - - Microcontroller - - - Input - - - - - - - - - - - - - - - - - - - - - - - - - Clip Line - - - Output - Sampling Gate - - diff --git a/defence/phd defence slide drafts.svg b/defence/phd defence slide drafts.svg deleted file mode 100644 index 1d3e2d6..0000000 --- a/defence/phd defence slide drafts.svg +++ /dev/null @@ -1,1508 +0,0 @@ - - - -Bootstrapping Physical -Security with Inertial -Hardware Security ModulesBootstrapping Physical -Security with Inertial -Hardware Security ModulesInertial Hardware -Security ModulesJan Sebastian Götteresearch@jaseg.deDarmstadt -2026-06-16Bootstrapping Physical -Security with Inertial -Hardware Security ModulesJan Sebastian Götteresearch@jaseg.deDarmstadt -2026-06-16Bootstrapping Physical -Security with Inertial -Hardware Security ModulesJan Sebastian Götteresearch@jaseg.deDarmstadt -2026-06-16Bootstrapping Physical -Security with Inertial -Hardware Security ModulesJan Sebastian Götteresearch@jaseg.deDarmstadt -2026-06-16Bootstrapping Physical -Security with Inertial -Hardware Security ModulesJan Sebastian Götteresearch@jaseg.deDarmstadt -2026-06-16Bootstrapping Physical -Security with Inertial -Hardware Security ModulesJan Sebastian Götteresearch@jaseg.deDarmstadt -2026-06-16Bootstrapping Physical -Security with Inertial -Hardware Security ModulesBootstrapping Physical -Security with Inertial -Hardware Security ModulesJan Sebastian Götteresearch@jaseg.deDarmstadt -2026-06-16Inertial Hardware -Security ModulesInertial Hardware -Security Modules diff --git a/defence/phd defence tdr principle.png b/defence/phd defence tdr principle.png deleted file mode 100644 index a0a0041..0000000 Binary files a/defence/phd defence tdr principle.png and /dev/null differ diff --git a/defence/phd defence tdr principle.svg b/defence/phd defence tdr principle.svg deleted file mode 100644 index 40f0e25..0000000 --- a/defence/phd defence tdr principle.svg +++ /dev/null @@ -1,376 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Z - term - - - - - - - - - - Mesh - - - - - - - - - - - - - - - - - - - - - - Coupler - - Pulse Generator - Sampler - - - - - - - - - - - - diff --git a/defence/slides.odp b/defence/slides.odp deleted file mode 100644 index da8f803..0000000 Binary files a/defence/slides.odp and /dev/null differ diff --git a/defence/slides.pdf b/defence/slides.pdf deleted file mode 100644 index 77a2771..0000000 Binary files a/defence/slides.pdf and /dev/null differ diff --git a/hsm-terminology-notes.tex b/hsm-terminology-notes.tex new file mode 100644 index 0000000..5bd91bb --- /dev/null +++ b/hsm-terminology-notes.tex @@ -0,0 +1,74 @@ +\chapter*{A Note on Hardware Security Module Terminology} +\adjustmtc +\addcontentsline{toc}{chapter}{A Note on Hardware Security Module Terminology} + +In this thesis, we use the term \emph{Hardware Security Module (HSM)} to refer to a security device that has the +following three properties. + +\begin{enumerate} +\item A HSM targets the prevention of any conceivable physical attack. In particular, this includes intrusion attempts + such as careful drilling or cutting into the device from any direction. +\item A HSM includes tamper sensors that when triggered result in an active tamper response, usually deleting all + cryptographic secrets and rendering the device inoperable. +\item A HSM's tamper sensing and response subsystem is continuously powered from a backup power supply, usually a + battery. Loss of power triggers the tamper response. +\end{enumerate} + +This use of the term \emph{HSM} aligns with common usage of the term both in the academic literature and in everyday +conversation. Particularly the requirement of active tamper detection and response is crucial to distinguish a HSM from +simpler devices such as TPMs, smart cards or secure enclaves in SoCs. Note that our use of the term HSM is slightly +different from its use in government standards, from its use in the PCI SSC (Payment Card Industry Security Standards +Council) standards, and from its industry use. + +In industry, the term HSM is often used for solutions that are only logically segregated and that do not include any +particular defense against hardware attacks. Our conjecture is that this is a consequence of the standardization +landscape, where for applications outside of card payment processing the US FIPS +140-22~\cite{usnationalinstituteofstandardsandtechnologySecurityRequirementsCryptographic2002} standard was central to +the industry. Despite encompassing both devices that include active tamper detection and response, FIPS 140-2 did not +draw a distinction in its terminology between the two classes. + +\section{Use in government standards} + +Under US national standard FIPS 140 in in its 2002 version +2~\cite{usnationalinstituteofstandardsandtechnologySecurityRequirementsCryptographic2002}, a HSM would be called a +\emph{Multiple-Chip Cryptographic Module} that conforms to the standard's \emph{Security Level 4}. Interesting to note +are that only security level 4 requires any active tamper detection and response, so its security levels 3 and below do +not align with our HSM definition. Futher of note is that according to the standard, a single-chip solution does not +require any tamper detection and response either to meet the standard's security level 4, which is in misalignment with +our definition. The standard's 2019 updated version FIPS +140-3~\cite{usnationalinstituteofstandardsandtechnologySecurityRequirementsCryptographic2019} defers to the +international standards ISO/IEC 19790 and 24759. + +ISO/IEC 19790~\cite{ISOIEC19790} and ISO/IEC 24759~\cite{ISOIEC24759} call what we call a HSM a \emph{Hardware +Cryptographic Module} corresponding with the standards \emph{Security Level 4}. However, these standards only require +active tamper detection and response when cryptographic secrets are transmitted in plaintext between chips. + +\section{Use in card payment processing (PCI SSC) standards} + +The Payment Card Industry Security Standards Council (PCI SSC) is an association of credit card network operators that +defines standards for all layers of card payment processing, from card payment terminals in stores to the handling of +payment data in online shop backend systems. + +PCI SSC terminology aligns with our use and with common everyday use of the term HSM. In PCI SSC terminology, a HSM is a +crytographic device that has active tamper detecion and response circuitry. However, PCI SSC terminology differs from +our use of the term HSM in one nuance: In PCI SSC terminology, a HSM is specifically a datacenter device used for +backend processing of payment data. The general class of ``hardware devices performing some security function with or +without particular physical security requirements'' that ISO/IEC 19790 and other standards call a \emph{Hardware +Cryptographic Module}, in PCI SSC terminology is termed \emph{Secure Cryptographic Device (SCD)} in more recent standard +versions, which was updated from the previous term \emph{Tamper-Resistant Security Module (TRSM)}. Other than HSMs, PCI +SSC includes smartcards and card payment terminals in this category. Card payment terminals, referred to as +\emph{Pin-Entry Device (PED)} in PCI SSC standards, have to include a surprising amount of active tamper detection and +response functionality including partial coverage of areas like they system's main cryptographic processor and smart +card reader by battery-backed tamper-sensing meshes. + +\section*{Tamper-Sensing Meshes} +\addcontentsline{toc}{subsection}{Tamper-Sensing Meshes} + +In this thesis, we use the terms \emph{Tamper-Sensing Mesh} and \emph{Security Mesh} synonymous. We use both terms to +refer to any electrical circuit whose path is laid out to cover a surface with the intent of detecting attempts at +drilling, cutting or otherwise manipulating this surface. While the term \emph{Security Mesh} is more concise, it is +less clear to people unfamiliar with the matter. It is also polysemous, and depending on context can also refer to woven +or stamped metal meshes used as fences or as screens in front of windows to prevent break-ins. As a result, it is harder +to use in online searches, and when using Large Language Models (LLMs), it frequently leads to amusing hallucinations. + + diff --git a/main.bib b/main.bib index 01dcd7c..8500fdd 100644 --- a/main.bib +++ b/main.bib @@ -36,13 +36,13 @@ issn = {1085-2301} } -@online{adc2019, +@report{adc2019, title = {Choose the Right Accelerometer for Predictive Maintenance}, author = {Campagnie, Bertrand}, date = {2019}, + institution = {Analog Devices}, url = {https://www.analog.com/media/en/technical-documentation/tech-articles/Choose-the-Right-Accelerometer-for-Predictive-Maintenance.pdf}, - urldate = {2021-04-01}, - organization = {Analog Devices} + urldate = {2021-04-01} } @online{adhikariDonLookUbiquitous2022, @@ -132,17 +132,6 @@ keywords = {sampling-mesh} } -@online{algorithmicsabotageresearchgroupTechFascism2025, - title = {Against {{Tech Fascism}}}, - author = {{Algorithmic Sabotage Research Group}}, - date = {2025-07-27T00:00:00+00:00}, - url = {https://algorithmic-sabotage.gitlab.io/asrg/against-tech-fascism/}, - urldate = {2025-12-04}, - abstract = {This draft debate piece examines technofascism and its domineering configurations of power, while advancing resistance through the proposed strategic intervention of “algorithmic sabotage”.}, - langid = {english}, - organization = {ASRG} -} - @online{alievExperimentalDemonstrationScalable2023, title = {Experimental Demonstration of Scalable Quantum Key Distribution over a Thousand Kilometers}, author = {Aliev, A. and Statiev, V. and Zarubin, I. and Kirsanov, N. and Strizhak, D. and Bezruchenko, A. and Osicheva, A. and Smirnov, A. and Yarovikov, M. and Kodukhov, A. and Pastushenko, V. and Pflitsch, M. and Vinokur, V.}, @@ -175,6 +164,7 @@ volume = {11476}, pages = {129--158}, publisher = {Springer International Publishing}, + location = {Cham}, doi = {10.1007/978-3-030-17653-2_5}, url = {https://link.springer.com/10.1007/978-3-030-17653-2_5}, urldate = {2025-11-26}, @@ -217,6 +207,7 @@ volume = {10892}, pages = {143--162}, publisher = {Springer International Publishing}, + location = {Cham}, doi = {10.1007/978-3-319-93387-0_8}, url = {https://link.springer.com/10.1007/978-3-319-93387-0_8}, urldate = {2024-06-19}, @@ -303,7 +294,7 @@ shorttitle = {Security {{Engineering}}}, author = {Anderson, Ross}, date = {2020-12-22}, - edition = {3}, + edition = {1}, publisher = {Wiley}, doi = {10.1002/9781119644682}, url = {https://onlinelibrary.wiley.com/doi/book/10.1002/9781119644682}, @@ -402,6 +393,7 @@ volume = {13269}, pages = {663--683}, publisher = {Springer International Publishing}, + location = {Cham}, doi = {10.1007/978-3-031-09234-3_33}, url = {https://link.springer.com/10.1007/978-3-031-09234-3_33}, urldate = {2024-07-25}, @@ -473,6 +465,7 @@ volume = {10322}, pages = {477--497}, publisher = {Springer International Publishing}, + location = {Cham}, doi = {10.1007/978-3-319-70972-7_27}, url = {https://link.springer.com/10.1007/978-3-319-70972-7_27}, urldate = {2025-08-13}, @@ -540,6 +533,7 @@ date = {2023}, pages = {198--227}, publisher = {Springer Nature Switzerland}, + location = {Cham}, doi = {10.1007/978-3-031-48624-1_8}, abstract = {In the framework of Impagliazzo’s five worlds, a distinction is often made between two worlds, one where public-key encryption exists (Cryptomania), and one in which only one-way functions exist (MiniCrypt). However, the boundaries between these worlds can change when quantum information is taken into account. Recent work has shown that quantum variants of oblivious transfer and multi-party computation, both primitives that are classically in Cryptomania, can be constructed from one-way functions, placing them in the realm of quantum MiniCrypt (the so-called MiniQCrypt). This naturally raises the following question: Is it possible to construct a quantum variant of public-key encryption, which is at the heart of Cryptomania, from one-way functions or potentially weaker assumptions?}, isbn = {978-3-031-48624-1}, @@ -599,6 +593,7 @@ volume = {13510}, pages = {329--358}, publisher = {Springer Nature Switzerland}, + location = {Cham}, doi = {10.1007/978-3-031-15985-5_12}, url = {https://link.springer.com/10.1007/978-3-031-15985-5_12}, urldate = {2023-02-28}, @@ -670,7 +665,7 @@ } @article{bencivenniTimeDomainReflectometer2013, - title = {A {{Time Domain Reflectometer}} with 100ps Precision Implemented in a Cost-Effective {{FPGA}} for the Test of the {{KLOE-2 Inner Tracker}} Readout Anodes}, + title = {A {{Time Domain Reflectometer}} with 100 ~ Ps Precision Implemented in a Cost-Effective {{FPGA}} for the Test of the {{KLOE-2 Inner Tracker}} Readout Anodes}, author = {Bencivenni, G. and Czerwinski, E. and De Lucia, E. and De Robertis, G. and Domenici, D. and Erriquez, O. and Fanizzi, G. and Felici, G. and Liuzzi, R. and Loddo, F. and Mongelli, M. and Morello, G. and Ranieri, A. and Valentino, V.}, date = {2013-01-11}, journaltitle = {Nuclear Instruments and Methods in Physics Research Section A: Accelerators, Spectrometers, Detectors and Associated Equipment}, @@ -825,17 +820,17 @@ isbn = {978-1-4503-5084-6} } -@incollection{blomNoGodsNo2025, +@inbook{blomNoGodsNo2025, title = {No {{Gods No Masters}}: {{Anarchist}} Mots de Mémoire from {{Titles}} to {{T-Shirts}}}, booktitle = {Memory and the {{Language}} of {{Contention}}}, author = {Blom, Tashina}, - editor = {Van Den Elzen, Sophie and Rigney, Ann}, date = {2025-03-10}, pages = {231--247}, publisher = {BRILL}, doi = {10.1163/9789004692978}, url = {https://brill.com/view/title/69864}, urldate = {2025-11-24}, + bookauthor = {Van Den Elzen, Sophie and Rigney, Ann}, isbn = {978-90-04-69297-8} } @@ -849,30 +844,6 @@ organization = {US National Security Agency (NSA)} } -@book{boakHistoryUSCommunications1973, - title = {A {{History}} of {{U}}.{{S}}. {{Communications Security}} ({{The David G}}. {{Boak Lectures}}), {{Volume I}}}, - author = {Boak, David G.}, - date = {1973}, - publisher = {(US) National Security Agency}, - url = {http://archive.org/details/history_comsec-nsa}, - urldate = {2025-02-18}, - langid = {english}, - keywords = {NSA}, - annotation = {2015 re-declassified version contains more material} -} - -@book{boakHistoryUSCommunications1981, - title = {A {{History}} of {{U}}.{{S}}. {{Communications Security}} ({{The David G}}. {{Boak Lectures}}), {{Volume II}}}, - author = {Boak, David G.}, - date = {1981}, - publisher = {(US) National Security Agency}, - url = {http://archive.org/details/history_comsec_ii-nsa}, - urldate = {2025-02-18}, - langid = {english}, - keywords = {NSA}, - annotation = {2015 re-declassified version contains more material} -} - @book{bogatinSignalPowerIntegrity2018, title = {Signal and Power Integrity, Simplified}, author = {Bogatin, Eric}, @@ -910,7 +881,8 @@ date = {2019}, volume = {11694}, pages = {489--518}, - publisher = {Springer}, + publisher = {Springer International Publishing}, + location = {Cham}, doi = {10.1007/978-3-030-26954-8_16}, url = {http://link.springer.com/10.1007/978-3-030-26954-8_16}, urldate = {2024-02-26}, @@ -945,6 +917,7 @@ date = {2023}, pages = {271--302}, publisher = {Springer Nature Switzerland}, + location = {Cham}, doi = {10.1007/978-3-031-30545-0_10}, abstract = {The computational overhead of a cryptographic task is the asymptotic ratio between the computational cost of securely realizing the task and that of realizing the task with no security at all.}, isbn = {978-3-031-30545-0}, @@ -960,6 +933,7 @@ volume = {13275}, pages = {427--457}, publisher = {Springer International Publishing}, + location = {Cham}, doi = {10.1007/978-3-031-06944-4_15}, url = {https://link.springer.com/10.1007/978-3-031-06944-4_15}, urldate = {2024-06-06}, @@ -975,7 +949,8 @@ date = {2021}, volume = {12826}, pages = {457--485}, - publisher = {Springer}, + publisher = {Springer International Publishing}, + location = {Cham}, doi = {10.1007/978-3-030-84245-1_16}, url = {https://link.springer.com/10.1007/978-3-030-84245-1_16}, urldate = {2023-02-28}, @@ -1175,6 +1150,7 @@ date = {2015}, pages = {3--16}, publisher = {Springer International Publishing}, + location = {Cham}, doi = {10.1007/978-3-319-17040-4_1}, abstract = {In this work, we study the ability for malware to leak sensitive information from an air-gapped high-security system to systems on a low-security network, using ultrasonic and audible audio covert channels in two different environments: an open-concept office and a closed-door office. Our results show that malware installed on unmodified commodity hardware can leak data from an air-gapped system using the ultrasonic frequency range from 20~kHz to 20.5~kHz at a rate of 140~bps and at a rate of 6.7~kbps using the audible spectrum from 500~Hz to 18~kHz. Additionally, we show that data can be communicated using ultrasonic communication at distances up~to 11~m with bit rates over 230~bps and a bit error rate of 2~\%. Given our results, our attacks are able to leak captured keystrokes in real-time using ultrasonic signals and, using audible signals when nobody is present in the environment - the overnight attack, both keystrokes and recorded audio.}, isbn = {978-3-319-17040-4}, @@ -1217,6 +1193,7 @@ volume = {14008}, pages = {423--447}, publisher = {Springer Nature Switzerland}, + location = {Cham}, doi = {10.1007/978-3-031-30589-4_15}, url = {https://link.springer.com/10.1007/978-3-031-30589-4_15}, urldate = {2024-06-27}, @@ -1286,6 +1263,7 @@ volume = {13555}, pages = {275--294}, publisher = {Springer Nature Switzerland}, + location = {Cham}, doi = {10.1007/978-3-031-17146-8_14}, url = {https://link.springer.com/10.1007/978-3-031-17146-8_14}, urldate = {2024-08-26}, @@ -1406,13 +1384,6 @@ @article{chorPrivateInformationRetrieval, title = {Private Information Retrieval}, author = {Chor, Benny and Goldreich, Oded and Kushilevitz, Eyal}, - date = {1998-11-01}, - journaltitle = {Journal of the ACM}, - shortjournal = {JACM}, - volume = {45}, - number = {6}, - pages = {965--981}, - doi = {10.1145/293347.293350}, abstract = {Publicly accessible databases are an indispensable resource for retrieving up-to-date information. But they also pose a significant risk to the privacy of the user, since a curious database operator can follow the user’s queries and infer what the user is after. Indeed, in cases where the users’ intentions are to be kept secret, users are often cautious about accessing the database. It can be shown that when accessing a single database, to completely guarantee the privacy of the user, the whole database should be down-loaded; namely n bits should be communicated (where n is the number of bits in the database).}, langid = {english} } @@ -1426,6 +1397,7 @@ volume = {12238}, pages = {600--620}, publisher = {Springer International Publishing}, + location = {Cham}, doi = {10.1007/978-3-030-57990-6_30}, url = {https://link.springer.com/10.1007/978-3-030-57990-6_30}, urldate = {2024-07-25}, @@ -1444,6 +1416,7 @@ volume = {12826}, pages = {94--123}, publisher = {Springer International Publishing}, + location = {Cham}, doi = {10.1007/978-3-030-84245-1_4}, url = {https://link.springer.com/10.1007/978-3-030-84245-1_4}, urldate = {2024-07-15}, @@ -1557,6 +1530,7 @@ date = {2021}, series = {{{SpringerBriefs}} in {{Criminology}}}, publisher = {Springer International Publishing}, + location = {Cham}, doi = {10.1007/978-3-030-76377-0}, url = {https://link.springer.com/10.1007/978-3-030-76377-0}, urldate = {2025-08-15}, @@ -1602,6 +1576,7 @@ volume = {12827}, pages = {502--534}, publisher = {Springer International Publishing}, + location = {Cham}, doi = {10.1007/978-3-030-84252-9_17}, url = {https://link.springer.com/10.1007/978-3-030-84252-9_17}, urldate = {2023-02-28}, @@ -1638,18 +1613,6 @@ abstract = {An experimental program aimed at defining the effects of applied stress, temperature, humidity, and buffer coating on the static fatigue behavior of optical fibers in bending configurations is in progress. Data are presented below which demonstrate that the static fatigue behavior of fiber is strongly dependent on the polymeric buffer coating. Furthermore, the effect of humidity is readily evident by the comparison of times to failure at 30\% RH and in water immersion. The ultimate objective of this research is to determine an allowable bend radius for fiber optic cable which is based on measurements of both static fatigue and strength in bending and which will assure reliable performance of the fiber over the design lifetime.} } -@patent{curetHardwareSecurityModule2025, - type = {patentus}, - title = {Hardware Security Module Adapter System, Method and Device}, - author = {Curet, Jon Cameron Grant and Wong, Daniel}, - holder = {{Marvell Asia Pte Ltd}}, - date = {2025-05-20}, - number = {12309267B1}, - url = {https://patents.google.com/patent/US12309267B1/en?q=(hardware+security+module+heatsink)&oq=hardware+security+module+heatsink}, - urldate = {2025-12-03}, - keywords = {circuit board,contact pads,encryption,mesh,printed circuit} -} - @article{curranModelingCharacterizationPCB2015, title = {Modeling and Characterization of {{PCB}} Coils for Inductive Wireless Charging}, author = {Curran, Brian and Maaß, Uwe and Fotheringham, Gerhard and Stevens, Nobby and Ndip, Ivan and Lang, Klaus-Dieter}, @@ -1847,6 +1810,7 @@ volume = {13510}, pages = {57--87}, publisher = {Springer Nature Switzerland}, + location = {Cham}, doi = {10.1007/978-3-031-15985-5_3}, url = {https://link.springer.com/10.1007/978-3-031-15985-5_3}, urldate = {2023-02-28}, @@ -1882,6 +1846,7 @@ volume = {12110}, pages = {341--373}, publisher = {Springer International Publishing}, + location = {Cham}, doi = {10.1007/978-3-030-45374-9_12}, url = {https://link.springer.com/10.1007/978-3-030-45374-9_12}, urldate = {2025-11-26}, @@ -1890,19 +1855,6 @@ langid = {english} } -@patent{dragoneVentedTamperrespondentAssemblies2020, - type = {patentus}, - title = {Vented Tamper-Respondent Assemblies}, - author = {Dragone, Silvio and Oggioni, Stefano S. and Santiago-Fernandez, William}, - holder = {{International Business Machines Corp}}, - date = {2020-05-26}, - number = {10667389B2}, - url = {https://patents.google.com/patent/US10667389B2/en?q=(hardware+security+module+heatsink)&assignee=International+Business+Machines+Corporation}, - urldate = {2025-12-03}, - langid = {english}, - keywords = {circuit board,multilayer circuit,secure volume,tamper,vent} -} - @inproceedings{drimer2008, title = {Thinking inside the Box: System-Level Failures of Tamper Proofing}, booktitle = {2008 {{IEEE}} Symposium on Security and Privacy (Sp 2008)}, @@ -1916,7 +1868,7 @@ @patent{droegeSicherheitsmodulMitEinteiliger1997, type = {patentde}, title = {Sicherheitsmodul Mit Einteiliger {{Sicherheitsfolie}}}, - author = {Droege, Hartmut and Fischer, Ludwig and Scheibel, Markus and Sonnentag, Dieter}, + author = {Droege, Hartmut Dipl Ing and Fischer, Ludwig Dipl Ing and Scheibel, Markus Dipl Ing and Sonnentag, Dieter Dipl Ing}, holder = {{International Business Machines Corp}}, date = {1997-07-17}, number = {19600769A1}, @@ -2075,20 +2027,6 @@ abstract = {Capacitive sensors can be constructed for tamper resistant enclosures to prevent unauthorized intrusions. The use printed circuit can provide serpentine geometric patterns of conductors. Any penetration of this envelope interferes with the conductive serpentine, producing a detectable warning of intrusion. Capacitive sensors discussed in this paper are suitable for implementing in the area of physical security cryptographic modules. These sensors conform to Levels 3 and 4 of the Federal Information Processing Standard (FIPS) 140-2} } -@inproceedings{erenFringeEffectCapacitiveProximity2005a, - title = {Fringe-{{Effect Capacitive Proximity Sensors}} for {{Tamper Proof Enclosures}}}, - booktitle = {2005 {{Sensors}} for {{Industry Conference}}}, - author = {Eren, Halit and Sandor, Lucas D}, - date = {2005-02}, - pages = {22--26}, - doi = {10.1109/SICON.2005.257863}, - url = {https://ieeexplore.ieee.org/abstract/document/4027448}, - urldate = {2025-12-24}, - abstract = {Capacitive sensors can be constructed for tamper resistant enclosures to prevent unauthorized intrusions. The use printed circuit can provide serpentine geometric patterns of conductors. Any penetration of this envelope interferes with the conductive serpentine, producing a detectable warning of intrusion. Capacitive sensors discussed in this paper are suitable for implementing in the area of physical security cryptographic modules. These sensors conform to Levels 3 and 4 of the Federal Information Processing Standard (FIPS) 140-2}, - eventtitle = {2005 {{Sensors}} for {{Industry Conference}}}, - keywords = {Capacitance,Capacitive sensors,Computer industry,Cryptography,Electrodes,Hardware,Information security,Magnetic sensors,Printed circuits,Protection} -} - @inproceedings{essexObliviousPrintingSecret2012, title = {Oblivious {{Printing}} of {{Secret Messages}} in a {{Multi-party Setting}}}, booktitle = {Financial {{Cryptography}} and {{Data Security}}}, @@ -2221,21 +2159,6 @@ keywords = {twisted-inductor} } -@report{fowlerInvestigationFlowProcesses1966, - title = {An Investigation of the Flow Processes in a Centrifugal Compressor Impeller}, - author = {Fowler, H. S.}, - date = {1966}, - journaltitle = {Mechanical Engineering Report (National Research Council Canada. Division of Mechanical Engineering. Engine Laboratory)}, - volume = {ME-220}, - institution = {National Research Council Canada}, - issn = {0077-555X}, - doi = {10.4224/40003753}, - url = {https://nrc-publications.canada.ca/eng/view/object/?id=fd41e817-48ff-4d37-a5af-aede36a9a9cb}, - urldate = {2025-12-02}, - abstract = {The flow in the impeller of a centrifugal flow compressor is complex, and is not yet fully understood. A theoretical model of this flow is proposed, from first principles, and an experimental method of investigating the validity of this model is described. An observer is placed in the centre of a large model of the impeller, and by rotating with it is enabled to examine the flow in the impeller passages in great detail . Experimental results obtained by this method are analysed, and some tentative conclusions on the accuracy of parts of the model are put forward.}, - langid = {english} -} - @online{fraunhofersitAbschlussberichtSicherheitsanalyseGesamtsystems2024, title = {Abschlussbericht {{Sicherheitsanalyse}} Des {{Gesamtsystems ePA}} Für Alle}, author = {{Fraunhofer SIT}}, @@ -2323,6 +2246,7 @@ @inproceedings{garbFORTRESSFORtifiedTamperResistant2021, title = {{{FORTRESS}}: {{FORtified Tamper-Resistant Envelope}} with {{Embedded Security Sensor}}}, shorttitle = {{{FORTRESS}}}, + booktitle = {2021 18th {{International Conference}} on {{Privacy}}, {{Security}} and {{Trust}} ({{PST}})}, author = {Garb, Kathrin and Obermaier, Johannes and Ferres, Elischa and Künig, Martin}, date = {2021-12}, pages = {1--12}, @@ -2330,12 +2254,11 @@ url = {https://ieeexplore.ieee.org/document/9647783/?arnumber=9647783}, urldate = {2025-04-04}, abstract = {Protecting security modules from attacks on the hardware level presents a very challenging endeavor since the attacker can manipulate the device directly through physical access. To address this issue, different physical security enclosures have been developed with the goal to cover entire hardware modules and, hence, protect them from external manipulation.Novel concepts are battery-less and based on Physical Unclonable Functions (PUFs), aiming at overcoming the most severe drawbacks of past devices; the need for active monitoring and, thus, limited battery life-time. Although some progress has already been made for certain aspects of PUF-based enclosures, the combination and integration of all required components and the creation of a corresponding architecture for Hardware Security Modules (HSMs) is still an open issue. In this paper, we present FORTRESS, a PUF-based HSM that integrates the tamper-sensitive capacitive PUF-based envelope and its embedded security sensor IC into a secure architecture. Our concept proposes a secure life cycle concept including shipment aspects, a full key generation scheme with re-enrollment capabilities, and ourthe next generation Embedded Key Management System. With FORTRESS, we take the next step towards the productive operation of PUF-based HSMs.}, - eventtitle = {18th {{International Conference}} on {{Privacy}}, {{Security}} and {{Trust}} ({{PST}})}, + eventtitle = {2021 18th {{International Conference}} on {{Privacy}}, {{Security}} and {{Trust}} ({{PST}})}, keywords = {capacitive enclosure,Hardware,hardware security module,Integrated circuits,physical unclonable function,Physical unclonable function,Privacy,secure life cycle,Security,Solids,Supply chains,tamper-sensitive} } @thesis{garbTamperSensitiveDesignPUFBased, - type = {phdthesis}, title = {Tamper-Sensitive Design of PUF-Based Security Enclosures}, author = {Garb, Kathrin A}, langid = {ngerman} @@ -2420,7 +2343,7 @@ @online{gematikWhitepaperDatenschutzUnd2025, title = {Whitepaper Datenschutz und Informationssicherheit in der Telematikinfrastruktur}, - author = {{gematik}}, + author = {{Gematik}}, date = {2025-07}, url = {https://www.gematik.de/media/gematik/Medien/Newsroom/Publikationen/Informationsmaterialien/gematik_Whitepaper_Datenschutz_web_20250707.pdf}, urldate = {2025-11-21}, @@ -2503,27 +2426,6 @@ keywords = {Audio steganalysis,Audio steganography,Human auditory system,Mel frequency cepstrum coefficients,Universal steganalysis} } -@article{gibneyCanResearchersStop2025, - title = {Can Researchers Stop {{AI}} Making up Citations?}, - author = {Gibney, Elizabeth}, - date = {2025-09-08}, - journaltitle = {Nature}, - volume = {645}, - number = {8081}, - pages = {569--570}, - publisher = {Nature Publishing Group}, - issn = {1476-4687}, - doi = {10.1038/d41586-025-02853-8}, - url = {https://www.nature.com/articles/d41586-025-02853-8}, - urldate = {2025-12-04}, - abstract = {OpenAI’s GPT-5 hallucinates less than previous models do, but cutting hallucination completely might prove impossible.}, - langid = {english}, - keywords = {Computer science}, - annotation = {Bandiera\_abtest: a\\ -Cg\_type: News\\ -Subject\_term: Computer science} -} - @incollection{giraultGeneralizedBirthdayAttack1988, title = {A {{Generalized Birthday Attack}}}, booktitle = {Advances in {{Cryptology}} — {{EUROCRYPT}} ’88}, @@ -2575,6 +2477,7 @@ Subject\_term: Computer science} url = {https://www.nytimes.com/2025/09/04/world/asia/china-hack-salt-typhoon.html}, urldate = {2025-11-26}, abstract = {Information collected during the yearslong Salt Typhoon attack could allow Beijing’s intelligence services to track targets from the United States and dozens of other countries.}, + journalsubtitle = {World}, langid = {american}, keywords = {China,Cyberattacks and Hackers,Cyberwarfare and Defense,Defense and Military Forces,Espionage and Intelligence Services,International Relations,Surveillance of Citizens by Government,United States Politics and Government} } @@ -2643,7 +2546,8 @@ Subject\_term: Computer science} date = {1999}, volume = {1666}, pages = {65--79}, - publisher = {Springer}, + publisher = {Springer Berlin Heidelberg}, + location = {Berlin, Heidelberg}, doi = {10.1007/3-540-48405-1_5}, url = {http://link.springer.com/10.1007/3-540-48405-1_5}, urldate = {2024-05-29}, @@ -2668,31 +2572,13 @@ Subject\_term: Computer science} keywords = {electronic commerce,hardware security,implementation,smart cards} } -@inproceedings{gotteGermanyRollingOut2026, - title = {Germany Is {{Rolling Out Nation-Scale Key Escrow}} and {{Nobody}} Is {{Talking About}} It}, - booktitle = {Computer {{Security}}. {{ESORICS}} 2025 {{International Workshops}}}, - author = {Götte, Jan Sebastian}, - editor = {Laborde, Romain and Garcia-Alfaro, Joaquin and Yazdinejad, Abbas and Epiphaniou, Gregory and Abie, Habtamu and Ranise, Silvio and Choraś, Michał and Woźniak, Michał and Hara, Yuko and Mühlberg, Jan Tobias and Greco, Claudia and Choo, Kim-Kwang Raymond}, - date = {2026}, - pages = {370--377}, - publisher = {Springer Nature Switzerland}, - location = {Cham}, - doi = {10.1007/978-3-032-16165-9_22}, - abstract = {Germany is currently rolling out an opt-out, nation-scale database of the medical records of the majority of~its population, with low-income people being disproportionally represented among its users. While there has~been considerable criticism of the system coming from civil society, independent academic analysis of the system by~the cryptography and information security community has been largely absent. In this paper, we aim to raise awareness~of the system’s existence and, based on the system’s public specifications, highlight several concerning cryptographic engineering decisions. Our core observations is that the system’s most sensitive long-term user keys are derived~by a rudimentary, home-grown centralized key escrow mechanism. This mechanism relies on a per-use salt and only 256~bit of entropy, shared globally across millions of users. Furthermore, the system’s specification mandates only level~3 compliance with the obsolete FIPS 140-2 security standard, which requires “hard, opaque potting”, but lacks active tamper sensing. As a result, the system remains vulnerable to attacks by nation states and other well-funded adversaries.}, - isbn = {978-3-032-16165-9}, - langid = {english}, - keywords = {Cryptography,Governance,Hardware Security Module (HSM),Healthcare,Physical Security,Tamper Resistance} -} - @inproceedings{gotteHighFidelitySecurity2026, title = {High {{Fidelity Security Mesh Monitoring}} Using {{Low-Cost}}, {{Embedded Time Domain Reflectometry}}}, booktitle = {Transactions on {{Cryptographic Hardware}} and {{Embedded Systems}}}, author = {Götte, Jan Sebastian and Scheuermann, Björn}, - date = {2026-01}, + date = {2026}, volume = {2026/1}, - pages = {533--558}, publisher = {IACR}, - doi = {10.46586/tches.v2026.i1.533-558}, url = {https://eprint.iacr.org/2025/1962}, urldate = {2025-11-04}, abstract = {Security Meshes are patterns of sensing traces covering an area that are used in Hardware Security Modules (HSMs) and other systems to detect attempts to physically intrude into the device's protective shell. State-of-the-art solutions manufacture meshes in bespoke processes from carefully chosen materials, which is expensive and makes replication challenging. Additionally, state-of-the-art monitoring circuits sacrifice either monitoring precision or cost efficiency. In this paper, we present an embeddable security mesh monitoring circuit constructed from low-cost, standard components that utilizes Time Domain Reflectometry (TDR) to create a unique fingerprint of a mesh. Our approach is both low-cost and precise, and enables the use of inexpensive standard Printed Circuit Boards (PCBs) as security mesh material. We demonstrate a working prototype of our TDR circuit costing less than 10 € in components that achieves both time resolution and rise time better than 200 ps—a 25 × improvement over previous work. We demonstrate a simple classifier that detects several types of advanced attacks such as probing using an oscilloscope probe or micro-soldering attacks with no false negatives.}, @@ -2707,6 +2593,7 @@ Subject\_term: Computer science} series = {{{EuroSec}}'17}, pages = {1--6}, publisher = {Association for Computing Machinery}, + location = {New York, NY, USA}, doi = {10.1145/3065913.3065915}, url = {https://dl.acm.org/doi/10.1145/3065913.3065915}, urldate = {2025-11-26}, @@ -2714,6 +2601,12 @@ Subject\_term: Computer science} isbn = {978-1-4503-4935-2} } +@online{Goutimacocom84813320240417, + title = {Go.Utimaco.Com/l/848133/2024-04-17/3ld3sv/848133/{{1713340754fcnmfM7d}}/u.trust\_{{GP}}\_{{HSM}}\_{{Se}}\_{{Series}}\_{{Datasheet}}\_{{EN}}.Pdf}, + url = {https://go.utimaco.com/l/848133/2024-04-17/3ld3sv/848133/1713340754fcnmfM7d/u.trust_GP_HSM_Se_Series_Datasheet_EN.pdf}, + urldate = {2025-10-27} +} + @online{greenbergSignalMoreEncrypted2024, title = {Signal {{Is More Than Encrypted Messaging}}. {{Under Meredith Whittaker}}, {{It}}’s {{Out}} to {{Prove Surveillance Capitalism Wrong}}}, author = {Greenberg, Andy}, @@ -2732,6 +2625,7 @@ Subject\_term: Computer science} date = {2021}, pages = {531--561}, publisher = {Springer International Publishing}, + location = {Cham}, doi = {10.1007/978-3-030-77886-6_18}, abstract = {MiniQCrypt is a world where quantum-secure one-way functions exist, and quantum communication is possible. We construct an oblivious transfer (OT) protocol in MiniQCrypt that achieves simulation-security in the plain model against malicious quantum polynomial-time adversaries, building on the foundational work of Crépeau and Killian (FOCS 1988) and Bennett, Brassard, Crépeau and Skubiszewska (CRYPTO 1991). Combining the OT protocol with prior works, we obtain secure two-party and multi-party computation protocols also in MiniQCrypt. This is in contrast to the classical world, where it is widely believed that one-way functions alone do not give us OT.}, isbn = {978-3-030-77886-6}, @@ -2830,6 +2724,7 @@ Subject\_term: Computer science} date = {2005}, edition = {Complete unabridged ed}, publisher = {AK Press}, + location = {Edinburgh, Scotland Oakland, CA}, abstract = {Vol.1: Max Stirner (1806-1856) -- Pierre-Joseph Proudhon (1809-1865) -- Mikhail Bakunin (1814-1876) -- Vol.2: Mikhail Bakunin (cont.) -- Direct action and libertarian construction foreshadowed -- James Guillaume (1844-1916) -- Peter Kropotkin (1842-1921) -- Vol. 3: Errico Malatesta (1853-1932) -- Émile Henry (1872-1894) -- The French anarchists in the trade unions -- Fernand Pelloutier (1867-1901) -- Émile Pouget (1860-1931) -- The Spanish collectives -- Voline (1882-1945) -- Vol.4: Nestor Makhno (1889-1935) -- Kronstadt (1921) -- Anarchists behind bars -- Anarchism in the Spanish Civil War -- Durruti (1896-1936) and libertarian warfare -- Anarcho-syndicalism in government}, isbn = {978-1-904859-25-3}, langid = {english}, @@ -2924,8 +2819,8 @@ Subject\_term: Computer science} @www{haines2006, title = {{{US}} Outfit Patents 'invisible' {{UAV}}: {{Stealth}} through Persistence of Vision}, author = {Haines, Lester}, + editor = {Register, The}, date = {2006-09-25}, - journaltitle = {The Register}, url = {https://www.theregister.com/2006/09/25/phantom_sentinel/}, urldate = {2020-09-17} } @@ -2998,19 +2893,6 @@ Subject\_term: Computer science} langid = {english} } -@inproceedings{harrisonSoKSecurityArchitects2025, - title = {{{SoK}}: {{A Security Architect}}'s {{View}} of {{Printed Circuit Board Attacks}}}, - shorttitle = {{{SoK}}}, - author = {Harrison, Jacob and Jessurun, Nathan and Tehranipoor, Mark}, - date = {2025}, - pages = {1907--1924}, - url = {https://www.usenix.org/conference/usenixsecurity25/presentation/harrison}, - urldate = {2025-11-27}, - eventtitle = {34th {{USENIX Security Symposium}} ({{USENIX Security}} 25)}, - isbn = {978-1-939133-52-6}, - langid = {english} -} - @inproceedings{hastingsSoKGeneralPurpose2019, title = {{{SoK}}: {{General Purpose Compilers}} for {{Secure Multi-Party Computation}}}, shorttitle = {{{SoK}}}, @@ -3053,7 +2935,7 @@ Subject\_term: Computer science} title = {Cloud-{{Dienstleister OVH}}: {{Feuer}} Zerstört {{Rechenzentrum}}, Ein Weiteres Beschädigt}, author = {Holland, Martin}, date = {2021-03-10}, - journaltitle = {heise online}, + publisher = {Heise Online / Heise Online}, url = {https://www.heise.de/news/OVH-Feuer-zerstoert-Rechenzentrum-in-Strassburg-ein-weiteres-beschaedigt-5076320.html} } @@ -3235,13 +3117,14 @@ Subject\_term: Computer science} @book{huangHardwareHackerAdventures2019, title = {The {{Hardware Hacker}}: {{Adventures}} in {{Making}} and {{Breaking Hardware}}}, shorttitle = {The {{Hardware Hacker}}}, - author = {Huang, Andrew ``bunnie''}, + author = {Huang, Andrew "bunnie"}, date = {2019}, publisher = {No Starch Press}, location = {San Francisco}, abstract = {Intro -- Praise for The Hardware Hacker -- Title Page -- Copyright Page -- Acknowledgments -- brief contents -- contents in detail -- preface -- part 1: adventures in manufacturing -- Chapter 1. made in china -- The Ultimate Electronic Component Flea Market -- The Next Technological Revolution -- Touring Factories with Chumby -- Scale in Shenzhen -- Feeding the Factory -- Dedication to Quality -- Building Technology Without Using It -- Skilled Workers -- The Need for Craftspeople -- Automation for Electronics Assembly -- Precision, Injection Molding, and Patience -- The Challenge of Quality -- Closing Thoughts -- Chapter 2. inside three very different factories -- Where Arduinos Are Born -- Starting with a Sheet of Copper -- Applying the PCB Pattern to the Copper -- Etching the PCBs -- Applying Soldermask and Silkscreen -- Testing and Finishing the Boards -- Where USB Memory Sticks Are Born -- The Beginning of a USB Stick -- Hand-Placing Chips on a PCB -- Bonding the Chips to the PCB -- A Close Look at the USB Stick Boards -- A Tale of Two Zippers -- A Fully Automated Process -- A Semiautomated Process -- The Irony of Scarcity and Demand -- Chapter 3. the factory floor -- How to Make a Bill of Materials -- A Simple BOM for a Bicycle Safety Light -- Approved Manufacturers -- Tolerance, Composition, and Voltage Specification -- Electronic Component Form Factor -- Extended Part Numbers -- The Bicycle Safety Light BOM Revisited -- Planning for and Coping with Change -- Process Optimization: Design for Manufacturing -- Why DFM? -- Tolerances to Consider -- Following DFM Helps Your Bottom Line -- The Product Behind Your Product -- Testing vs. Validation -- Finding Balance in Industrial Design -- The chumby One's Trim and Finish -- The Arduino Uno's Silkscreen Art -- My Design Process -- Picking (and Maintaining) a Partner}, isbn = {978-1-59327-758-1 978-1-59327-813-7}, - langid = {english} + langid = {english}, + pagetotal = {1} } @online{hughesCypherpunksManifesto, @@ -3312,12 +3195,13 @@ Subject\_term: Computer science} isbn = {978-92-0-118910-3} } -@online{iana21, +@www{iana21, title = {Root Zone {{KSK}} Operator Key Management Procedure}, author = {{Root Zone KSK Operator Policy Management Authority}}, date = {2021-09-22}, url = {https://www.iana.org/dnssec/procedures/ksk-operator/KSK_Key_Management_Procedure_v3.4.pdf}, - urldate = {2021-10-07} + urldate = {2021-10-07}, + version = {Version 3.4} } @online{ibmCloudHSM2016, @@ -3350,11 +3234,9 @@ Subject\_term: Computer science} @www{ika2002, title = {A Test Procedure for Airbags}, - author = {{International Motor Vehicle Inspection Commitee}}, date = {2002}, series = {{{CITA Research}} Study Programme on {{Electronically}} Controlled Systems on Vehicles}, - url = {https://citainsp.org/wp-content/uploads/2016/01/ECS-RSP-Study-2-TP-airbags.pdf}, - urldate = {2026-01-17} + publisher = {International Motor Vehicle Inspection Commitee / Rheinisch-Westfälischen Technischen Hochschule (RWTH) Aachen, Institut für Kraftfahrwesen Aachen (IKA)} } @article{immler2019, @@ -3373,15 +3255,15 @@ Subject\_term: Computer science} @inproceedings{immlerBTREPIDBatterylessTamperresistant2018, title = {B-{{TREPID}}: {{Batteryless}} Tamper-Resistant Envelope with a {{PUF}} and Integrity Detection}, shorttitle = {B-{{TREPID}}}, + booktitle = {2018 {{IEEE International Symposium}} on {{Hardware Oriented Security}} and {{Trust}} ({{HOST}})}, author = {Immler, Vincent and Obermaier, Johannes and König, Martin and Hiller, Matthias and Sig, Georg}, date = {2018-04}, pages = {49--56}, - publisher = {IEEE}, doi = {10.1109/HST.2018.8383890}, url = {https://ieeexplore.ieee.org/document/8383890/?arnumber=8383890}, urldate = {2025-04-04}, abstract = {Protecting embedded devices against physical attacks is a challenging task since the attacker has control of the device in a hostile environment. To address this issue, current countermeasures typically use a battery-backed tamper-respondent envelope that encloses the entire device to create a trusted compartment. However, the battery affects the system's robustness and weight, and also leads to difficulties with the security mechanism while shipping the device. In contrast, we present a batteryless tamper-resistant envelope, which contains a fine mesh of electrodes, and its complementary security concept. An evaluation unit checks the integrity of the sensor mesh by detecting short and open circuits. Additionally, it measures the capacitances of the mesh. Once its preliminary integrity is confirmed, a cryptographic key is derived from the capacitive measurements that represent a PUF, to decrypt and authenticate the firmware of the enclosed host system. We demonstrate the feasibility of our concept, provide details on the layout and electrical properties of the batteryless envelope, and explain the underlying security architecture. Practical results from a set of manufactured envelopes facilitate future research.}, - eventtitle = {International {{Symposium}} on {{Hardware Oriented Security}} and {{Trust}} ({{HOST}})}, + eventtitle = {2018 {{IEEE International Symposium}} on {{Hardware Oriented Security}} and {{Trust}} ({{HOST}})}, keywords = {Batteries,Capacitance,Capacitance measurement,Cryptography,FIPS 140-2,Higher-Order Alphabet PUF (HOA PUF),Monitoring,Physical Unclonable Function (PUF),Runtime,Secure Bootstrap,Security Standards,Tamper-resistance} } @@ -3467,14 +3349,12 @@ Subject\_term: Computer science} pages = {24--28} } -@inproceedings{isaacs2013, +@report{isaacs2013, title = {Tamper Proof, Tamper Evident Encryption Technology}, - booktitle = {Pan Pacific Microelectronics Symposium}, author = {Isaacs, Phil and Morris Jr, Thomas and Fisher, Michael J and Cuthbert, Keith}, - date = {2013-01-22}, - publisher = {Surface Mount Technology Association}, - doi = {10.37665/ppDGZDE20978}, - eventtitle = {{{SMTA Pan Pacific Symposium}}}, + date = {2013}, + journaltitle = {Pan pacific microelectronics symposium}, + institution = {Surface Mount Technology Association / Surface Mount Technology Association}, x-fetchedfrom = {Google Scholar} } @@ -3638,6 +3518,7 @@ Subject\_term: Computer science} date = {2020}, pages = {399--422}, publisher = {Springer International Publishing}, + location = {Cham}, doi = {10.1007/978-3-030-34316-3_18}, url = {http://link.springer.com/10.1007/978-3-030-34316-3_18}, urldate = {2024-06-25}, @@ -3645,17 +3526,6 @@ Subject\_term: Computer science} langid = {english} } -@online{kalaiWhyLanguageModels2025, - title = {Why Language Models Hallucinate}, - author = {Kalai, Adam and Vempala, Santosh and Nachum, Ofir and Zhang, Eddie and Robinson, David and Jain, Saachi and Mitchell, Eric and Beutel, Alex and Heidecke, Johannes}, - date = {2025-12-03}, - url = {https://openai.com/index/why-language-models-hallucinate/}, - urldate = {2025-12-04}, - abstract = {OpenAI’s new research explains why language models hallucinate. The findings show how improved evaluations can enhance AI reliability, honesty, and safety.}, - langid = {american}, - organization = {OpenAI} -} - @incollection{kamaraScalingPrivateSet2014, title = {Scaling {{Private Set Intersection}} to {{Billion-Element Sets}}}, booktitle = {Financial {{Cryptography}} and {{Data Security}}}, @@ -3701,6 +3571,7 @@ Subject\_term: Computer science} volume = {10355}, pages = {229--249}, publisher = {Springer International Publishing}, + location = {Cham}, doi = {10.1007/978-3-319-61204-1_12}, url = {https://link.springer.com/10.1007/978-3-319-61204-1_12}, urldate = {2024-02-26}, @@ -3892,18 +3763,6 @@ Subject\_term: Computer science} organization = {heise online} } -@online{kochNochVieleUnklarheiten2025, - title = {Noch viele Unklarheiten bei der elektronischen Patientenakte}, - author = {Koch, Marie-Claire}, - date = {2025-05-08}, - issn = {1037-7344}, - url = {https://www.heise.de/hintergrund/Elektronische-Patientenakte-Welche-Unklarheiten-es-noch-gibt-10377344.html}, - urldate = {2025-11-28}, - abstract = {Rund um die elektronische Patientenakte gibt es noch viele offene (Sicherheits-)Fragen. Dabei ist sie gerade erst bundesweit gestartet, zumindest theoretisch.}, - langid = {ngerman}, - organization = {heise online} -} - @inproceedings{kodwaniSecurityKeyDerivation2021, title = {On {{Security}} of {{Key Derivation Functions}} in {{Password-based Cryptography}}}, booktitle = {2021 {{IEEE International Conference}} on {{Cyber Security}} and {{Resilience}} ({{CSR}})}, @@ -4146,7 +4005,7 @@ Subject\_term: Computer science} title = {Internet of Things Based Monitoring of Large Rotor Vibration with a Microelectromechanical Systems Accelerometer}, author = {Koene, Ivar and Viitala, Raine and Kuosmanen, Petri}, date = {2019}, - journaltitle = {IEEE Access}, + journaltitle = {IEEE access : practical innovations, open solutions}, shortjournal = {IEEE Access}, doi = {10.1109/ACCESS.2019.2927793} } @@ -4265,17 +4124,18 @@ Subject\_term: Computer science} langid = {english} } -@online{ledger2019, +@inproceedings{ledger2019, title = {Everybody Be Cool, This Is a Robbery!}, + booktitle = {Symposium Sur La Sécurité Des Technologies de l'information et Des Communications 2019}, author = {Bédrune, Jean-Baptiste and Campana, Gabriel}, date = {2019}, - url = {https://www.youtube.com/watch?v=UX88bdHT54M}, - urldate = {2021-09-24}, - organization = {Black Hat USA} + url = {https://www.sstic.org/media/SSTIC2019/SSTIC-actes/hsm/SSTIC2019-Article-hsm-campana_bedrune_neNSDyL.pdf}, + urldate = {2021-09-24} } @inproceedings{lee16psresolutionRandomEquivalent2003, title = {A 16ps-Resolution {{Random Equivalent Sampling}} Circuit for {{TDR}} Utilizing a {{Vernier}} Time Delay Generation}, + booktitle = {2003 {{IEEE Nuclear Science Symposium}}. {{Conference Record}} ({{IEEE Cat}}. {{No}}.{{03CH37515}})}, author = {Lee, Donghwan and Sung, Jinho and Park, Jaehong}, date = {2003-10}, volume = {2}, @@ -4285,7 +4145,7 @@ Subject\_term: Computer science} url = {https://ieeexplore.ieee.org/document/1351912}, urldate = {2025-03-11}, abstract = {A Random Equivalent Sampling (RES) circuit that has 16ps sampling resolution has been developed for a high-resolution Time-Domain Reflectometer (TDR). The high-resolution TDR uses an expensive programmable delay chip or a complex Time-to-Digital Converter (TDC) circuit to capture the waveform with very fine time interval. The Vernier time delay generation technique using two crystal oscillators of slightly different frequency is proposed, which is simpler and more cost-effective and provides subpicosecond time resolution. One of the two clocks is used for the reference time to generate incident periodic pulses, and another clock is used for the sampling, The implemented RES circuit consists of the Vernier clock generator, the pulse generator and the control logic for pulse generation, interface and high-speed memory control. Using the ADC of relatively low sampling rate, the periodic pulse waveform is reconstructed with tens of GSPS high equivalent sampling rate by the repetitive sampling utilizing the incremental Vernier time delay. The performance of RES circuit is measured through the operation of TDR. The resolution of the RES circuit is 16.8ps equal to 59.5GSPS sampling rate, which means that the signal waveform in the 66.7\%VOP RG58C/U cable can be sampled by 1.6mm interval.}, - eventtitle = {2003 {{IEEE Nuclear Science Symposium}}}, + eventtitle = {2003 {{IEEE Nuclear Science Symposium}}. {{Conference Record}} ({{IEEE Cat}}. {{No}}.{{03CH37515}})}, keywords = {Clocks,Delay effects,Frequency,Logic circuits,Oscillators,Propagation delay,Pulse circuits,Pulse generation,Sampling methods,Time domain analysis} } @@ -4567,7 +4427,7 @@ Subject\_term: Computer science} langid = {english} } -@online{lpkflaser&electronicsagLPKFLDSLaser2014, +@misc{lpkflaser&electronicsagLPKFLDSLaser2014, title = {{{LPKF LDS}}: {{Laser Direct Structuring}} for {{3D Molded Interconnect Devices}}}, author = {{LPKF Laser \& Electronics AG}}, date = {2014}, @@ -4599,7 +4459,26 @@ Subject\_term: Computer science} date = {2021}, volume = {12973}, pages = {699--720}, - publisher = {Springer}, + publisher = {Springer International Publishing}, + location = {Cham}, + doi = {10.1007/978-3-030-88428-4_34}, + url = {https://link.springer.com/10.1007/978-3-030-88428-4_34}, + urldate = {2024-07-15}, + abstract = {With the advancement of the trusted execution environment (TEE) technologies, hardware-supported secure computing becomes increasingly popular due to its e ciency. During the protocol execution, typically, the players need to contact a third-party server for remote a estation, ensuring the validity of the involved trusted hardware component, such as Intel SGX, as well as the integrity of the computation result. When the hardware manufacturer is not fully trusted, sensitive information may be leaked to the third-party server through backdoors, steganography, and kleptography, etc. In this work, we introduce a new security notion called semi-trusted hardware model, where the adversary is allowed to passively or maliciously corrupt the hardware. erefore, she can learn the input of the hardware component and might also tamper its output. We then show how to utilize such semi-trusted hardwares for correlated randomness teleportation. When the semi-trusted hardware is instantiated by Intel SGX, to generate 10k random OT’s, our protocol is 24X and 450X faster than the EMP-IKNP-ROT in the LAN and WAN se ing, respectively. When SGX is used to teleport garbled circuits, the resulting two-party computation protocol is 5.3-5.7X and 43-47X faster than the EMP-SH2PC in the LAN and WAN se ing, respectively, for the AES-128, SHA-256, and SHA-512 evaluation. We also show how to achieve malicious security with li le overhead.}, + isbn = {978-3-030-88427-7 978-3-030-88428-4}, + langid = {english} +} + +@incollection{luCorrelatedRandomnessTeleportation2021a, + title = {Correlated {{Randomness Teleportation}} via {{Semi-trusted Hardware}}—{{Enabling Silent Multi-party Computation}}}, + booktitle = {Computer {{Security}} – {{ESORICS}} 2021}, + author = {Lu, Yibiao and Zhang, Bingsheng and Zhou, Hong-Sheng and Liu, Weiran and Zhang, Lei and Ren, Kui}, + editor = {Bertino, Elisa and Shulman, Haya and Waidner, Michael}, + date = {2021}, + volume = {12973}, + pages = {699--720}, + publisher = {Springer International Publishing}, + location = {Cham}, doi = {10.1007/978-3-030-88428-4_34}, url = {https://link.springer.com/10.1007/978-3-030-88428-4_34}, urldate = {2025-08-13}, @@ -4608,15 +4487,6 @@ Subject\_term: Computer science} langid = {english} } -@online{LunaNetworkHSM, - title = {Thales {{Luna Network HSM}} 7 {{Functionality Module Software Development Kit Guide}}}, - author = {{Thales Group}}, - date = {2025-11-26}, - url = {https://thalesdocs.com/gphsm/luna/7/docs/network/Content/PDF_Network/FM%20SDK%20Programming%20Guide.pdf}, - urldate = {2025-12-01}, - langid = {english} -} - @patent{macphersonImprovementsSecurityEnclosures1993, type = {patenteu}, title = {Improvements in Security Enclosures}, @@ -4714,11 +4584,12 @@ Subject\_term: Computer science} organization = {Make Your Electronics Tamper-Evident} } -@online{marczakGraphiteCaughtFirst2025, +@report{marczakGraphiteCaughtFirst2025, title = {Graphite {{Caught}}: {{First Forensic Confirmation}} of {{Paragon}}’s {{iOS Mercenary Spyware Finds Journalists Targeted}}}, shorttitle = {Graphite {{Caught}}}, author = {Marczak, Bill and Scott-Railton, John}, date = {2025-06-12T07:55:29-04:00}, + institution = {Citizen Lab, University of Toronto}, url = {https://citizenlab.ca/2025/06/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted/}, urldate = {2025-11-26}, abstract = {On April 29, 2025, a select group of iOS users were notified by Apple that they were targeted with advanced spyware. Among the group were two journalists who consented to the technical analysis of their cases. In this report, we discuss key findings from our forensic analyses of their devices.}, @@ -4928,16 +4799,15 @@ Subject\_term: Computer science} langid = {english} } -@article{mennChineseGovernmentHackers2024, - entrysubtype = {newspaper}, +@online{mennChineseGovernmentHackers2024, title = {Chinese Government Hackers Penetrate {{U}}.{{S}}. Internet Providers to Spy}, author = {Menn, Joseph}, date = {2024-08-27}, - journaltitle = {The Washington Post}, url = {https://www.washingtonpost.com/technology/2024/08/27/chinese-government-hackers-penetrate-us-internet-providers-spy/}, urldate = {2025-05-15}, abstract = {Beijing’s hacking effort has “dramatically stepped up from where it used to be,” says former top U.S cybersecurity official.}, - langid = {american} + langid = {american}, + organization = {The Washington Post} } @www{mgchemicals2017, @@ -5278,24 +5148,6 @@ Subject\_term: Computer science} abstract = {Project co-funded by the European Commission within the 6th Framework Programme Dissemination Level PU Public X PP Restricted to other programme participants (including the Commission services) RE Restricted to a group specified by the consortium} } -@article{naddafMajorAIConference2025, - title = {Major {{AI}} Conference Flooded with Peer Reviews Written Fully by {{AI}}}, - author = {Naddaf, Miryam}, - date = {2025-11-27}, - journaltitle = {Nature}, - publisher = {Nature Publishing Group}, - issn = {1476-4687}, - doi = {10.1038/d41586-025-03506-6}, - url = {https://www.nature.com/articles/d41586-025-03506-6}, - urldate = {2025-12-04}, - abstract = {Controversy has erupted after 21\% of manuscript reviews for an international AI conference were found to be generated by artificial intelligence.}, - langid = {english}, - keywords = {Computer science,Conferences and meetings,Peer review}, - annotation = {Bandiera\_abtest: a\\ -Cg\_type: News\\ -Subject\_term: Conferences and meetings, Computer science, Peer review} -} - @article{nassiLamphonePassiveSound, title = {Lamphone: {{Passive Sound Recovery}} from a {{Desk Lamp}}’s {{Light Bulb Vibrations}}}, author = {Nassi, Ben and Pirutin, Yaron and Swissa, Raz and Shamir, Adi and Elovici, Yuval and Zadov, Boris}, @@ -5303,46 +5155,6 @@ Subject\_term: Conferences and meetings, Computer science, Peer review} langid = {english} } -@article{natureeditorsToolsSuchChatGPT2023, - title = {Tools Such as {{ChatGPT}} Threaten Transparent Science; Here Are Our Ground Rules for Their Use}, - author = {{nature editors}}, - date = {2023-01-24}, - journaltitle = {Nature}, - volume = {613}, - number = {7945}, - pages = {612--612}, - publisher = {Nature Publishing Group}, - doi = {10.1038/d41586-023-00191-1}, - url = {https://www.nature.com/articles/d41586-023-00191-1}, - urldate = {2025-12-04}, - abstract = {As researchers dive into the brave new world of advanced AI chatbots, publishers need to acknowledge their legitimate uses and lay down clear guidelines to avoid abuse.}, - langid = {english}, - keywords = {Ethics,Machine learning,Publishing,Scientific community}, - annotation = {Bandiera\_abtest: a\\ -Cg\_type: Editorial\\ -Subject\_term: Ethics, Machine learning, Publishing, Scientific community} -} - -@article{natureeditorsWhyNatureWill2023, - title = {Why {{Nature}} Will Not Allow the Use of Generative {{AI}} in Images and Video}, - author = {{nature editors}}, - date = {2023-06-07}, - journaltitle = {Nature}, - volume = {618}, - number = {7964}, - pages = {214--214}, - publisher = {Nature Publishing Group}, - doi = {10.1038/d41586-023-01546-4}, - url = {https://www.nature.com/articles/d41586-023-01546-4}, - urldate = {2025-12-04}, - abstract = {Saying ‘no’ to this kind of visual content is a question of research integrity, consent, privacy and intellectual-property protection.}, - langid = {english}, - keywords = {Authorship,Education,Machine learning,Publishing}, - annotation = {Bandiera\_abtest: a\\ -Cg\_type: Editorial\\ -Subject\_term: Publishing, Machine learning, Authorship, Education} -} - @article{navasMTDWhereArt2021, title = {{{MTD}}, {{Where Art Thou}}? {{A Systematic Review}} of {{Moving Target Defense Techniques}} for {{IoT}}}, shorttitle = {{{MTD}}, {{Where Art Thou}}?}, @@ -5450,7 +5262,7 @@ Subject\_term: Publishing, Machine learning, Authorship, Education} title = {Apple's {{T2}} Security Chip Has an Unfixable Flaw}, author = {Newman, Lily Hay}, date = {2020-10-06}, - journaltitle = {WIRED}, + publisher = {Wired Magazine}, url = {https://www.wired.com/story/apple-t2-chip-unfixable-flaw-jailbreak-mac/} } @@ -5595,6 +5407,32 @@ Subject\_term: Publishing, Machine learning, Authorship, Education} keywords = {twisted-inductors} } +@book{nsaHistoryUSCommunications1973, + title = {A {{History}} of {{U}}.{{S}}. {{Communications Security}} ({{The David G}}. {{Boak Lectures}}), {{Volume I}}}, + author = {{NSA}}, + namea = {{Michael Best}}, + nameatype = {collaborator}, + date = {1973}, + url = {http://archive.org/details/history_comsec-nsa}, + urldate = {2025-02-18}, + langid = {english}, + keywords = {NSA}, + annotation = {2015 re-declassified version contains more material} +} + +@book{nsaHistoryUSCommunications1981, + title = {A {{History}} of {{U}}.{{S}}. {{Communications Security}} ({{The David G}}. {{Boak Lecture}}), {{Volume II}}}, + author = {{NSA}}, + namea = {{Michael Best}}, + nameatype = {collaborator}, + date = {1981}, + url = {http://archive.org/details/history_comsec_ii-nsa}, + urldate = {2025-02-18}, + langid = {english}, + keywords = {NSA}, + annotation = {2015 re-declassified version contains more material} +} + @article{obermaier2018, title = {The Past, Present, and Future of Physical Security Enclosures: {{From}} Battery-Backed Monitoring to {{PUF-based}} Inherent Security and Beyond}, author = {Obermaier, Johannes and Immler, Vincent}, @@ -5610,8 +5448,8 @@ Subject\_term: Publishing, Machine learning, Authorship, Education} title = {Physical Unclonable Functions: {{The}} Future Technology for Physical Security Enclosures?}, author = {Obermaier, Johannes}, date = {2019-08-24}, - doi = {10.5446/43265}, - url = {https://doi.org/10.5446/43265} + publisher = {Chaos Computer Club e.V.}, + doi = {10.5446/43265} } @article{obermaierBreakingRestoringEmbedded, @@ -5638,7 +5476,7 @@ Subject\_term: Publishing, Machine learning, Authorship, Education} @patent{obermaierPUFfilmMethodProducing2023, type = {patentus}, title = {{{PUF-film}} and Method for Producing the Same}, - author = {Obermaier, Johannes and Immler, Vincent and Hesselbarth, Robert}, + author = {Obermaier, Johannes and Immler, Vincent and HESSELBARTH, Robert}, holder = {{Fraunhofer Gesellschaft zur Foerderung der Angewandten Forschung eV}}, date = {2023-02-21}, number = {11586780B2}, @@ -5648,7 +5486,7 @@ Subject\_term: Publishing, Machine learning, Authorship, Education} keywords = {circuit,conductive traces,film,layer,puf} } -@online{oberthurcashprotectionIntroductionCashProtection2019, +@misc{oberthurcashprotectionIntroductionCashProtection2019, title = {Introduction to {{Cash Protection}}: {{Intelligent Banknote Neutralization Systems}}}, author = {{Oberthur Cash Protection}}, date = {2019}, @@ -5664,21 +5502,6 @@ Subject\_term: Publishing, Machine learning, Authorship, Education} langid = {english} } -@online{ogaraHardwareEnabledMechanismsVerifying2025, - title = {Hardware-{{Enabled Mechanisms}} for {{Verifying Responsible AI Development}}}, - author = {O'Gara, Aidan and Kulp, Gabriel and Hodgkins, Will and Petrie, James and Immler, Vincent and Aysu, Aydin and Basu, Kanad and Bhasin, Shivam and Picek, Stjepan and Srivastava, Ankur}, - date = {2025-04-02}, - eprint = {2505.03742}, - eprinttype = {arXiv}, - eprintclass = {cs}, - doi = {10.48550/arXiv.2505.03742}, - url = {http://arxiv.org/abs/2505.03742}, - urldate = {2025-12-24}, - abstract = {Advancements in AI capabilities, driven in large part by scaling up computing resources used for AI training, have created opportunities to address major global challenges but also pose risks of misuse. Hardware-enabled mechanisms (HEMs) can support responsible AI development by enabling verifiable reporting of key properties of AI training activities such as quantity of compute used, training cluster configuration or location, as well as policy enforcement. Such tools can promote transparency and improve security, while addressing privacy and intellectual property concerns. Based on insights from an interdisciplinary workshop, we identify open questions regarding potential implementation approaches, emphasizing the need for further research to ensure robust, scalable solutions.}, - pubstate = {prepublished}, - keywords = {Computer Science - Cryptography and Security} -} - @inproceedings{ohHeySiriAre2018, title = {Hey {{Siri}} – {{Are You There}}?: {{Jamming}} of {{Voice Commands Using}} the {{Resonance Effect}} ({{Work-in-Progress}})}, shorttitle = {Hey {{Siri}} – {{Are You There}}?}, @@ -5707,10 +5530,6 @@ Subject\_term: Publishing, Machine learning, Authorship, Education} isbn = {978-1-931971-10-2} } -@misc{OpticalBasedSmartStructures, - title = {Optical-{{Based Smart Structures}} for {{Tamper-Indicating Applications}}} -} - @article{orlandiOptimizationShieldedPCB2011, title = {Optimization of {{Shielded PCB Air-Core Toroids}} for {{High-Efficiency DC}}–{{DC Converters}}}, author = {Orlandi, Stefano and Allongue, Bruno Andre and Blanchot, Georges and Buso, Simone and Faccio, Federico and Fuentes, Cristian Alejandro and Kayal, Maher and Michelis, Stefano and Spiazzi, Giorgio}, @@ -5741,17 +5560,6 @@ Subject\_term: Publishing, Machine learning, Authorship, Education} keywords = {Computer Science - Cryptography and Security} } -@online{PakistanMassSurveillance2025, - title = {Pakistan: {{Mass}} Surveillance and Censorship Machine Is Fueled by {{Chinese}}, {{European}}, {{Emirati}} and {{North American}} Companies}, - shorttitle = {Pakistan}, - date = {2025-09-09T04:00:00+00:00}, - url = {https://securitylab.amnesty.org/latest/2025/09/pakistan-mass-surveillance-and-censorship-machine-is-fueled-by-chinese-european-emirati-and-north-american-companies/}, - urldate = {2025-11-27}, - abstract = {Amnesty International have published a new report, Shadows of Control: Censorship and mass surveillance in Pakistan.}, - langid = {american}, - organization = {Amnesty International Security Lab} -} - @inproceedings{paleyActiveProtectionPCB2016, title = {Active Protection against {{PCB}} Physical Tampering}, booktitle = {2016 17th {{International Symposium}} on {{Quality Electronic Design}} ({{ISQED}})}, @@ -5836,7 +5644,7 @@ Subject\_term: Publishing, Machine learning, Authorship, Education} version = {4.0} } -@standard{pcisecuritystandardscouncilPaymentCardIndustry2021, +@misc{pcisecuritystandardscouncilPaymentCardIndustry2021a, title = {Payment {{Card Industry PIN Transaction Security Hardware Security Module Modular Derived Test Requirements}}}, author = {{PCI Security Standards Council}}, date = {2021-12}, @@ -5906,13 +5714,6 @@ Subject\_term: Publishing, Machine learning, Authorship, Education} Website contains OCR'ed original source and a translation} } -@online{petriePartIITechnical, - title = {Flexible {{Hardware-Enabled Guarantees Part II}}: {{Technical Options}}}, - author = {Petrie, James and Aarne, Onni}, - langid = {english}, - organization = {(UK) Advanced Research and Innovation Agency} -} - @patent{phamAntitamperMesh2011, type = {patentus}, title = {Anti-Tamper Mesh}, @@ -5935,6 +5736,7 @@ Website contains OCR'ed original source and a translation} volume = {12106}, pages = {739--767}, publisher = {Springer International Publishing}, + location = {Cham}, doi = {10.1007/978-3-030-45724-2_25}, url = {https://link.springer.com/10.1007/978-3-030-45724-2_25}, urldate = {2023-01-17}, @@ -6043,17 +5845,6 @@ Website contains OCR'ed original source and a translation} langid = {english} } -@online{PredatorFilesTechnical2023, - title = {Predator {{Files}}: {{Technical}} Deep-Dive into {{Intellexa Alliance}}'s Surveillance Products}, - shorttitle = {Predator {{Files}}}, - date = {2023-10-06T06:00:52+00:00}, - url = {https://securitylab.amnesty.org/latest/2023/10/technical-deep-dive-into-intellexa-alliance-surveillance-products/}, - urldate = {2025-11-27}, - abstract = {An expose the Intellexa Alliance's surveillance capabilities including advanced spyware, mass surveillance platforms, and tactical systems for targeting and intercepting nearby devices.}, - langid = {american}, - organization = {Amnesty International Security Lab} -} - @online{ProductPageFiber, title = {Product Page: {{Fiber Pigtail LC}}/{{APC OS2 G652D-Yellow}} 2m - 1 Piece | {{Unique}} | {{O0485}}.2}, url = {https://www.efb-elektronik.de/en/fiber-pigtail-lc-apc-os2-g652d-yellow-2m-1-piece/o0485.2}, @@ -6063,19 +5854,6 @@ Website contains OCR'ed original source and a translation} organization = {EFB-Elektronik GmbH} } -@article{purserAIDestroyingUniversity2025, - entrysubtype = {magazine}, - title = {{{AI}} Is {{Destroying}} the {{University}} and {{Learning Itself}}}, - author = {Purser, Ronald}, - date = {2025-12-01}, - journaltitle = {Current Affairs}, - issn = {2471-2647}, - url = {https://www.currentaffairs.org/news/ai-is-destroying-the-university-and-learning-itself}, - urldate = {2025-12-04}, - abstract = {Students use AI to write papers, professors use AI to grade them, degrees become meaningless, and tech companies make fortunes. Welcome to the death of higher education.}, - langid = {english} -} - @inproceedings{putzAcousticIntegrityCodes2020, title = {Acoustic Integrity Codes: Secure Device Pairing Using Short-Range Acoustic Communication}, shorttitle = {Acoustic Integrity Codes}, @@ -6102,15 +5880,15 @@ Website contains OCR'ed original source and a translation} urldate = {2024-10-30} } -@online{quintinSomethingRememberUs2024, +@report{quintinSomethingRememberUs2024, title = {Something to {{Remember Us By}}: {{Device Confiscated}} by {{Russian Authorities Returned}} with {{Monokle-Type Spyware Installed}}}, shorttitle = {Something to {{Remember Us By}}}, author = {Quintin, Cooper and Brown, Rebekah and Scott-Railton, John}, date = {2024-12-05T05:57:38-05:00}, + institution = {Citizen Lab, University of Toronto}, url = {https://citizenlab.ca/2024/12/device-confiscated-by-russian-authorities-returned-with-monokle-type-spyware-installed/}, urldate = {2025-11-26}, abstract = {In a joint investigation with The First Department, The Citizen Lab uncovered spyware covertly implanted on the phone of a Russian programmer following his release from Russian custody. The Monokle-like spyware allows an operator to track the device’s location, record phone calls, keystrokes, and read messages from encrypted messaging apps.}, - organization = {Citizen Lab, University of Toronto}, keywords = {Russia,spyware} } @@ -6144,7 +5922,6 @@ Website contains OCR'ed original source and a translation} type = {patentus}, title = {Optical Fiber Cable with Tampering Detecting Means}, author = {Rahman, Mujib}, - holder = {{Pirelli Cable Corp}}, date = {1988-03-10}, number = {Patent US4859024A} } @@ -6211,10 +5988,10 @@ Website contains OCR'ed original source and a translation} url = {https://dl.acm.org/doi/10.1145/3634737.3657005}, urldate = {2025-11-26}, abstract = {Analyzing user data while protecting the privacy of individuals remains a big challenge. Trusted execution environments (TEEs) are a possible solution as they protect processes and Virtual Machines (VMs) against malicious hosts. However, TEEs can leak access patterns to code and to the data being processed. Furthermore, when data is stored in a TEE database, the data volume required to answer a query is another unwanted side channel that contains sensitive information. Both types of information leaks, access patterns and volume patterns, allow for database reconstruction attacks.In this paper, we present Menhir, an oblivious TEE database that hides access patterns with ORAM guarantees and volume patterns through differential privacy. The database allows range and point queries with SQL-like WHERE-clauses. It builds on the state-of-the-art oblivious AVL tree construction Oblix (S\&P'18), which by itself does not protect against volume leakage. We show how volume leakage can be exploited in range queries and improve the construction to mitigate this type of attack. We prove the correctness and obliviousness of Menhir. Our evaluation shows that our approach is feasible and scales well with the number of rows and columns in the database.}, - isbn = {979-8-4007-0482-6} + isbn = {9798400704826} } -@online{renesaselectronicscorporationApplicationNoteAN2242019, +@misc{renesaselectronicscorporationApplicationNoteAN2242019, title = {Application {{Note AN-224}}: {{ALVC}}/{{LVC Logic Characteristics}} and {{Applications}}}, author = {{Renesas Electronics Corporation}}, date = {2019}, @@ -6222,6 +5999,11 @@ Website contains OCR'ed original source and a translation} urldate = {2025-04-09} } +@article{RenesasRA6T1Group, + title = {Renesas {{RA6T1 Group User}}'s {{Manual}}: {{Hardware}}}, + langid = {english} +} + @article{renHybridQuantumKey2022, title = {Hybrid Quantum Key Distribution Network}, author = {Ren, Siyu and Wang, Yu and Su, Xiaolong}, @@ -6280,6 +6062,7 @@ Website contains OCR'ed original source and a translation} volume = {10625}, pages = {241--270}, publisher = {Springer International Publishing}, + location = {Cham}, doi = {10.1007/978-3-319-70697-9_9}, url = {https://link.springer.com/10.1007/978-3-319-70697-9_9}, urldate = {2024-09-02}, @@ -6381,6 +6164,7 @@ Website contains OCR'ed original source and a translation} url = {https://zenodo.org/record/7892181}, urldate = {2024-12-03}, abstract = {Elmer Release Notes for version 9.0 Previous release: {$<$}strong{$>$}8.4{$<$}/strong{$><$}br{$>$} Period covered: {$<$}strong{$>$}Dec 18 2018 - Nov 10 2020{$<$}/strong{$><$}br{$>$} Number of commits: {$<$}strong{$>$}\textasciitilde 1340{$<$}/strong{$>$} (excluding merges) These release notes provide information on the most essential changes. You can get a complete listing of commit messages, for example, with:{$<$}br{$>$} git log --since="2018-12-18" \> log.txt Apart from the core Elmer team at CSC (Juhani K., Mika M., Juha R., Peter R., Thomas Z.) git log shows contributions from Daniel B., Denis C., Eef v. D., Eelis T., Fabien G-C, Foad S. F., Fredrik R., Olivier G., Joe T., Luz P., Mondher C., Rupert G., Sami I., Sami R., Samuel C., and Saeki T. to this release. Additionally there are many ongoing developments in several branches that have not been merged to this release and are not therefore covered here. Also sometimes the code has been passed on by the original author by other means than the git, and in such cases the names may have been accidentally omitted. The contributions of all developers are gratefully acknowledged! New Solver Modules IncompressibleNSVec Incompressible Navier-Stokes solver utilizing vectorized and threaded assembly Includes built-in support for block preconditioning (Schur complement approximation included) Includes non-Newtonian material laws Intended for Elmer/Ice community but also other may find it useful. BeamSolver3D Solver for the Timoshenko equations of elastic beams embedded in 3-D space (see Elmer Models Manual for documentation) GmshReader Reads the mesh and results from simple Gmsh file format (that can be written by ElmerSolver as well) Solver includes interpolation of the fields to the current mesh May be used for hierarchical simulations where results are inherited from previous simulations ModelMixedPoisson A general-purpose mixed FEM solver for the Poisson equation (see Elmer Models Manual for documentation) Employs a div-conforming (face) finite element approximation SpringAssembly A generic utility to add node-wise springs and masses to structural models (see Elmer Models Manual for documentation) MarchingODESolver A solver that can compute ordinary differential equations on a moving mesh. It is assumed that the mesh is structured and there is a known draw speed. This makes it possible to relate timestep and mesh parameter directly with each other. Enhanced Solver Modules ElasticSolve Adding a new UMAT material model is simplified: compilation with an elmerf90 command is sufficient The state variables of UMAT material model can be written to a result file and visualized UMAT implementation updated to support axial symmetry EMWaveSolver The solver updated to support the basis functions of second order and simulation in 2D The solver is now documented in Elmer Models Manual MagnetoDynamics Fixes and generalization to the source projection (the determination of Jfix). A surface impedance condition for the time-harmonic AV model Thin region formulation for 1D wires in transient analysis Magnetic anisotropy (a complex-valued reluctivity tensor) enabled for the time-harmonic AV model MagnetoDynamics2D A velocity field can be given to add a Lorentz term to the equations Coreloss a posteriori formulas (Bertotti + extended Bertotti) MagnetoDynamicsCalcFields Enabled postprocessing in the case of a complex-valued reluctivity tensor Enabled the computation of magnetic co-energy ResultOutputSolver Vtu format: Enable saving of pieces, i.e. bodies and boundaries Improved saving of elemental, DG and IP fields Gmsh format: Improved use of masking features in output ShellSolver Eigenanalysis with the shell solver enabled Spring, resultant force and couple BCs added Combined analysis of 2-D shells and 1-D beams enabled Fully coupled analysis of 2-D shells and 3-D solids enabled (still subject to some geometric constraints on the mesh) Partial support for using an alternate formulation with drilling degrees of freedom StructuredMeshMapper Enable arbitrary number of layers, before limited to three. HeatSolver A new tentative vectorized version: HeatSolverVec Enable symmetric 3D cases for view factor computation to obtain significant timesavings Make Gebhart factors linear system symmetric, if possible "ViewFactor Symmetry" StressSolver Added a Maxwell visco-elastic model to linear elasticity solver Possible also to be run as incompressible (introducing pressure variable) Optional pre-stress advection term for layered Earth-deformation model WaveSolver The solver can be used to model harmonic and eigenmode cases as well. ParticleAdvector Allow particles to be sent from Gaussian integration points as well. This is beneficial for robustness since they are not located at surface. Local integration time based on local Courant number. ElmerSolver library functionality Treatment of block systems The block matrix approach for solving complicated problems has been enhanced. Currently the block approach can be used in several ways during some stage of the solution. Split up monolithic equations into subproblems that are easier to solve (e.g. IncompressibleNS) Combine linear multiphysical (coupled) problems into a block matrix (e.g. FSI problems) For problems belonging to class 1) we may perform recreation of a monolithic matrix. This will allow better use of standard linear algebra to utilize direct solvers, or change the system to be harmonic or eigenvalue problem. For the documentation of utilizing block-matrix construct in connection with the fully coupled simulation of multiphysical problems see the new chapter "Block-matrix construct to build tightly coupled solvers" in ElmerSolver Manual. More economical integration rules A collection of economical Gauss quadrature rules for prismatic elements are introduced to replace tensor product rules for quadrilateral p-elements when 1 \< p \<= 8. The tensor product rule with n = (p+1)**2 points is now replaced by more economical ones. Dirichlet BCs for div-conforming vector finite elements (face elements) A sif command of the form Q \{f\} j = Real ... can be used to specify vector-valued data whose normal component is then used to integrate the values of DOFs for vector-valued interpolation of the data. Here Q is an Elmer variable which is approximated with face finite elements. Conforming BCs by elimination System can identify conforming boundaries such that dofs related to nodes or edges on opposing sides may be assembled into one degree of freedom. This decreases the size of the linear system and is numerically favourable. Antiperiodicity may be included. For vector-valued problems all components must be treated alike. Conforming BCs for edge dofs may consider the direction of edge. See test cases with "Apply Conforming BCs" and "Conforming BC" defined. Improved internal partitioning with Zoltan Enable internal partitioning with Zoltan to honor connected boundaries. Enable primary solver to call other solvers For documentation see the section "Solver execution by a master solver" in ElmerSolver Manual. Enables calling before and after solving the primary problem. Also possible to call before and after each nonlinear iteration. Anderson Acceleration for nonlinear systems Implemented a version of Anderson Acceleration where previous solutions and residuals are used to accelerate the nonlinear convergence. May increase nonlinear convergence to quadratic, quadratic convergence (Newton's method) is not improved. Swapping meshes on-the-fly Implemented library functionality to swap meshes during the simulation. Currently no history data is interpolated. ListGetElemental routines More flexible routines for obtaining material parameters for the Gaussian integration points. Detects automatically what kind of fields the dependency depends on (nodal, DG, elemental, IP points) Vectorized versions to be used with vectorized finite element assembly View factors Allow computation of view factors in 3D cases with symmetry. Speed-up computation for cases where emissivity not equal to one. Enable view factors to be used in conjunction with DG (in HeatSolveVec) Run Control Enable external loop control over the simulation. May be used in optimization and parametric scanning etc. Applicable also to transient systems as the variable "time" is not used for the control level. Inline parameters Enable inline keywords -rpar and -ipar They are followed by the number of argument + values of the arguments. Generic source control We may tune a r.h.s. load vector such that the solution (or reaction force) at given node is the desired one. Mimics the old Smart Control operation of HeatSolve but on a library level. ElmerGrid Fixes for UNV, mptxt and Gmsh file format import. Tentative reader for FVCOM format Add possibility to define seed for Metis partitioning (-metisseed). Maintain entity names in extrusion ElmerGrid and its plugin under ElmerGUI were harmonized such that they use the same codebase. ElmerGUI Huge number of improvements by Saeki! Highlights include: Object browser to view the case at a glance and to easily access the most windows. Removed sif auto-generation functionality to avoid unintended overwriting of sif file. "Generate, save and run" button to quickly run the case modifed via GUI. "Save and run" button on sif window to quickly run the case modifed via sif window. Postprocessor button selectable from ElmerVTK, ElmerPost or ParaView. "New project..." menu as an alternative way to start a new project. Seperated "Save project as..." menu from "Save project" menu to save the project in a different directory. Improved and more robust project loading "Preference" menu on sif window and on solver log window for syntax highlighting and font selection. "Recent projects" in File menu for quick loading of recently used projects. Improved ElmerVTK postprocessor (reading simple .vtu file, bottom toolbar including time-step control and displace button, etc) Configuration \& Compilation New Windows installer utilizing msys2 either with or without ElmerGUI + with or without MPI installers Elmer/Ice New features in Elmer/Ice are documented in elmerfem/elmerice/ReleaseNotes/release\_elmerice\_9.0.md Other FreeCADBatchFEMTools improvements and added tests New Contributors @frroberts made their first contribution in https://github.com/ElmerCSC/elmerfem/pull/176 @mmcker made their first contribution in https://github.com/ElmerCSC/elmerfem/pull/118 @Foadsf made their first contribution in https://github.com/ElmerCSC/elmerfem/pull/207 @dremerb made their first contribution in https://github.com/ElmerCSC/elmerfem/pull/210 @Kezii made their first contribution in https://github.com/ElmerCSC/elmerfem/pull/234 @kinnala made their first contribution in https://github.com/ElmerCSC/elmerfem/pull/243 {$<$}strong{$>$}Full Changelog{$<$}/strong{$>$}: https://github.com/ElmerCSC/elmerfem/compare/release-8.4...release-9.0}, + organization = {Zenodo}, version = {release-9.0} } @@ -6669,15 +6453,15 @@ Website contains OCR'ed original source and a translation} keywords = {galvanically isolated,jitter,power,side-channel,timing} } -@online{scott-railtonWhoseAuthorityPegasus2024, +@report{scott-railtonWhoseAuthorityPegasus2024, title = {By {{Whose Authority}}? {{Pegasus}} Targeting of {{Russian}} \& {{Belarusian-speaking}} Opposition Activists and Independent Media in {{Europe}}}, shorttitle = {By {{Whose Authority}}?}, author = {Scott-Railton, John and Marczak, Bill and Razzak, Bahr Abdul and Ermoshina, Ksenia and Anstis, Siena and Deibert, Ron}, date = {2024-05-30T07:59:44-04:00}, + institution = {Citizen Lab, University of Toronto}, url = {https://citizenlab.ca/2024/05/pegasus-russian-belarusian-speaking-opposition-media-europe/}, urldate = {2025-11-26}, abstract = {In a joint investigation with Access Now, we found that seven Russian and Belarusian-speaking independent journalists and opposition activists based in Europe were targeted and/or infected with NSO Group’s Pegasus mercenary spyware.}, - organization = {Citizen Lab, University of Toronto}, keywords = {Apple,Pegasus,spyware} } @@ -6860,7 +6644,7 @@ Website contains OCR'ed original source and a translation} title = {Technology {{Preview}} for Secure Value Recovery}, author = {Lund, Joshua}, date = {2019-12-19}, - journaltitle = {Signal}, + publisher = {signal.org / signal.org}, url = {https://signal.org/blog/secure-value-recovery/}, urldate = {2021-07-12} } @@ -7081,7 +6865,7 @@ Archive 2: https://web.archive.org/web/20250510104017/https://de.linkedin.com/pu keywords = {Geometry,Needles,Robot sensing systems,Sensitivity,Servers,Wireless communication,Wireless sensor networks} } -@online{stmicroelectronicsSTM32G474xBDatasheet2021, +@misc{stmicroelectronicsSTM32G474xBDatasheet2021, title = {{{STM32G474xB}}/{{C}}/{{E Datasheet}}}, author = {{ST Microelectronics}}, date = {2021-11}, @@ -7254,6 +7038,7 @@ Archive 2: https://web.archive.org/web/20250510104017/https://de.linkedin.com/pu author = {Tehranipoor, Mark and Pundir, Nitin and Vashistha, Nidish and Farahmandi, Farimah}, date = {2023}, publisher = {Springer International Publishing}, + location = {Cham}, doi = {10.1007/978-3-031-19185-5}, url = {https://link.springer.com/10.1007/978-3-031-19185-5}, urldate = {2025-04-04}, @@ -7285,8 +7070,8 @@ Archive 2: https://web.archive.org/web/20250510104017/https://de.linkedin.com/pu @www{terdiman2013, title = {Aboard {{America}}'s {{Doomsday}} Command and Control Plane}, author = {Terdiman, Daniel}, - date = {2013-07-23}, - journaltitle = {CNET}, + year = {2013-07-23, 2013-07}, + publisher = {CNET / cnet.com}, url = {https://www.cnet.com/news/aboard-americas-doomsday-command-and-control-plane} } @@ -7383,7 +7168,6 @@ Archive 2: https://web.archive.org/web/20250510104017/https://de.linkedin.com/pu date = {2017}, pages = {3--18}, publisher = {IEEE}, - doi = {10.1109/EuroSP.2017.42}, x-fetchedfrom = {Google Scholar} } @@ -7402,22 +7186,22 @@ Archive 2: https://web.archive.org/web/20250510104017/https://de.linkedin.com/pu keywords = {Benchmark testing,Computer architecture,Computer performance,Conferences,Energy efficiency,Focusing,Hardware,High performance computing,Market research,Performance analysis,Power demand,Processor energy efficiency,Servers,Software} } -@online{tschirsichHackerHinOder2019, +@online{tschirsichHackerHinOder0100, title = {"{{Hacker}} Hin Oder Her": {{Die}} Elektronische {{Patientenakte}} Kommt!}, shorttitle = {"{{Hacker}} Hin Oder Her"}, - author = {Tschirsich, Martin and Brodowski, Dr med Christian and Zilch, Dr André}, - date = {2019-12-27}, + author = {Tschirsich, Martin and Brodowski, cbro-Dr med Christian and Zilch, Dr André}, + year = {01:00:00 +0100}, url = {https://media.ccc.de/v/36c3-10595-hacker_hin_oder_her_die_elektronische_patientenakte_kommt}, urldate = {2025-05-15}, abstract = {Herzstück der digitalen Gesundheitsversorgung für 73 Millionen Versicherte ist die hochsichere, kritische Telematik-Infrastruktur mit ber...}, langid = {english} } -@online{tschirsichKonnteBisherNoch2024, +@online{tschirsichKonnteBisherNoch0100, title = {„{{Konnte}} Bisher Noch Nie Gehackt Werden“: {{Die}} Elektronische {{Patientenakte}} Kommt - Jetzt Für Alle!}, shorttitle = {„{{Konnte}} Bisher Noch Nie Gehackt Werden“}, author = {Tschirsich, Martin and Kastl, Bianca}, - date = {2024-12-27}, + year = {00:00:00 +0100}, url = {https://media.ccc.de/v/38c3-konnte-bisher-noch-nie-gehackt-werden-die-elektronische-patientenakte-kommt-jetzt-fr-alle}, urldate = {2025-05-15}, abstract = {In wenigen Wochen werden die Gesundheitsdaten von rund 73 Millionen in Deutschland Krankenversicherten ohne deren Zutun über Praxis- und ...}, @@ -7505,7 +7289,7 @@ Archive 2: https://web.archive.org/web/20250510104017/https://de.linkedin.com/pu langid = {english} } -@online{Utrust_GP_HSM_Se_Series_Datasheet_ENpdf, +@misc{Utrust_GP_HSM_Se_Series_Datasheet_ENpdf, title = {U.Trust {{General Purpose HSM Se-Series Datasheet}}}, date = {2025-04}, url = {https://utimaco.com/resources/downloads/data-sheets/utrust-general-purpose-hsm-se-series-datasheet}, @@ -7560,6 +7344,7 @@ Archive 2: https://web.archive.org/web/20250510104017/https://de.linkedin.com/pu @inproceedings{vasileActiveTamperDetection2017, title = {Active Tamper Detection Circuit Based on the Analysis of Pulse Response in Conductive Mesh}, + booktitle = {2017 40th {{International Spring Seminar}} on {{Electronics Technology}} ({{ISSE}})}, author = {Vasile, Daniel-Ciprian and Svasta, Paul and Codreanu, Norocel and Safta, Mariana}, date = {2017-05}, pages = {1--6}, @@ -7568,7 +7353,7 @@ Archive 2: https://web.archive.org/web/20250510104017/https://de.linkedin.com/pu url = {https://ieeexplore.ieee.org/document/8000987/?arnumber=8000987}, urldate = {2024-07-25}, abstract = {Tamper detection circuits provide the first and most important defensive wall in protecting electronic modules containing security data. A widely used procedure is to cover the entire module with a foil containing fine conductive mesh, which detects intrusion attempts. Detection circuits are further classified as passive or active. Passive circuits have the advantage of low power consumption, however they are unable to detect small variations in the conductive mesh parameters. Since modern tools provide an upper leverage over the passive method, the most efficient way to protect security modules is thus to use active circuits. The active tamper detection circuits are typically probing the conductive mesh with short pulses, analyzing its response in terms of delay and shape. The method proposed in this paper generates short pulses at one end of the mesh and analyzes the response at the other end. Apart from measuring pulse delay, the analysis includes a frequency domain characterization of the system, determining whether there has been an intrusion or not, by comparing it to a reference (un-tampered with) spectrum. The novelty of this design is the combined analysis, in time and frequency domains, of the small variations in mesh characteristic parameters.}, - eventtitle = {40th {{International Spring Seminar}} on {{Electronics Technology}} ({{ISSE}})}, + eventtitle = {2017 40th {{International Spring Seminar}} on {{Electronics Technology}} ({{ISSE}})}, keywords = {Clocks,Delays,Frequency-domain analysis,Mesh networks,Microcontrollers,sampling-mesh,Security,Shape} } @@ -7592,27 +7377,26 @@ Archive 2: https://web.archive.org/web/20250510104017/https://de.linkedin.com/pu author = {Vasile, Daniel-Ciprian and Svasta, Paul}, date = {2019-10}, pages = {212--215}, - publisher = {IEEE}, issn = {2642-7036}, doi = {10.1109/SIITME47687.2019.8990877}, url = {https://ieeexplore.ieee.org/document/8990877/?arnumber=8990877}, urldate = {2024-12-13}, abstract = {Cryptographic modules and security circuits are the kernels of every piece of equipment that process security data. No matter where they are deployed, the equipment must be protected against physical attacks, as no one can access the electronic circuits that process the security data: firmware implementations, cryptographic keys and secret data. The most effective way to protect this kind of electronic circuits is to wrap them in a special conductive mesh and probe it with proper signals in order to detect intrusions. This paper provides a complete solution for intrusions detection: a system made of a special conductive mesh and an active tamper detection circuit. The conductive mesh consists of three layers that detect intrusions earlier than the effective penetration of the mesh. The active tamper detection circuit is designed to probe the mesh with signals that cannot be emulated by an adversary.}, - eventtitle = {25th {{International Symposium}} for {{Design}} and {{Technology}} in {{Electronic Packaging}} ({{SIITME}})}, + eventtitle = {2019 {{IEEE}} 25th {{International Symposium}} for {{Design}} and {{Technology}} in {{Electronic Packaging}} ({{SIITME}})}, keywords = {anti-tamper,cryptography,mesh,security} } @inproceedings{vasileTemperatureSensitiveActive2017, title = {Temperature Sensitive Active Tamper Detection Circuit}, + booktitle = {2017 {{IEEE}} 23rd {{International Symposium}} for {{Design}} and {{Technology}} in {{Electronic Packaging}} ({{SIITME}})}, author = {Vasile, D. C. and Svasta, P. M.}, date = {2017-10}, pages = {175--178}, - publisher = {IEEE}, doi = {10.1109/SIITME.2017.8259885}, url = {https://ieeexplore.ieee.org/document/8259885/?arnumber=8259885}, urldate = {2024-12-12}, abstract = {Electronic modules designed for processing sensitive data, such as cryptographic modules, firmware solutions protected by intellectual property rights and secure communication devices, use special circuits designed for protecting these solutions from unauthorized physical access. The main components of these circuits are the conductive mesh structure, which acts as a protective cover, and the active tamper detection circuit. Besides the physical attacks, there are side channel attacks, where an attacker takes advantage of the errors produced by the logic circuits functioning in extreme conditions. When logic circuits are subject of temperatures that exceed the operational limits, they may run with faults and create proper conditions for cryptographic attacks. This paper proposes an active tamper detection circuit that analyses the temperature (and its variation gradient) of the conductive mesh. This method improves and complements the protection functions of the active tamper detection circuits.}, - eventtitle = {23rd {{International Symposium}} for {{Design}} and {{Technology}} in {{Electronic Packaging}} ({{SIITME}})}, + eventtitle = {2017 {{IEEE}} 23rd {{International Symposium}} for {{Design}} and {{Technology}} in {{Electronic Packaging}} ({{SIITME}})}, keywords = {active,Cryptography,Electronic circuits,Ports (Computers),Program processors,sampling-mesh,security,tamper,temperature,Temperature distribution,Temperature measurement,Temperature sensors} } @@ -7937,7 +7721,7 @@ Archive 2: https://web.archive.org/web/20250510104017/https://de.linkedin.com/pu @patent{weidnerHardwareschutzFormHalbschalen2007, type = {patent}, - title = {Hardwareschutz in Form von zu Halbschalen tiefgezogenen Leiterplatten}, + title = {Hardwareschutz in form von zu halbschalen tiefgezogenen leiterplatten}, author = {Weidner, Karl and Wimmer, Anton}, holder = {{Siemens Aktiengesellschaft}}, date = {2007-01-11}, @@ -8008,7 +7792,6 @@ Archive 2: https://web.archive.org/web/20250510104017/https://de.linkedin.com/pu @online{WhatCloudHSM, title = {What Is a {{Cloud HSM}}?}, shorttitle = {What Is a {{Cloud HSM}}?}, - author = {{Entrust Corporation}}, url = {https://www.entrust.com/resources/learn/what-is-cloud-hsm}, urldate = {2025-11-21}, abstract = {Learn what a cloud hardware security module (HSM) is and how a cloud HSM can deliver the same cryptographic functionalities as on-premises HSMs.}, @@ -8032,17 +7815,6 @@ Archive 2: https://web.archive.org/web/20250510104017/https://de.linkedin.com/pu keywords = {Conducting materials,Conformal mapping,Dielectric constant,Dielectric materials,Filling,Shape,Sheet materials,Strips,Transmission line theory,Transmission lines} } -@online{wierdaWhenChatGPTSummarises2024, - title = {When {{ChatGPT}} Summarises, It Actually Does Nothing of the Kind.}, - author = {Wierda, Gerben}, - date = {2024-05-27T21:58:15+00:00}, - url = {https://ea.rna.nl/2024/05/27/when-chatgpt-summarises-it-actually-does-nothing-of-the-kind/}, - urldate = {2025-12-04}, - abstract = {One of the use cases I thought was reasonable to expect from ChatGPT and Friends (LLMs) was summarising. It turns out I was wrong. What ChatGPT isn’t summarising at all, it only looks like it…}, - langid = {english}, - organization = {R\&A IT Strategy \& Architecture} -} - @article{wiesmannEffectChloroquineCultured1975, title = {Effect of Chloroquine on Cultured Fibroblasts: Release of Lysosomal Hydrolases and Inhibition of Their Uptake}, shorttitle = {Effect of Chloroquine on Cultured Fibroblasts}, @@ -8505,19 +8277,6 @@ Archive 2: https://web.archive.org/web/20250510104017/https://de.linkedin.com/pu keywords = {Authentication,Copper,Counterfeiting,Electrical resistance measurement,High definition video,Impedance,Impedance measurement,Piracy,Printed Circuit Board (PCB),Probes,PUF,Trust} } -@patent{zhangTamperrespondentAssembliesPorous2023, - type = {patentus}, - title = {Tamper-Respondent Assemblies with Porous Heat Transfer Element(s)}, - author = {Zhang, Hongqing and HIGBY, Arthur J. and Lewison, David J. and REGO, Philipp K. BUCHLING and Bunt, Jay A. and Busby, James and Campbell, Levi}, - holder = {{International Business Machines Corp}}, - date = {2023-08-01}, - number = {11716808B2}, - url = {https://patents.google.com/patent/US11716808B2/en?q=(hardware+security+module+heatsink)&assignee=International+Business+Machines+Corporation}, - urldate = {2025-12-03}, - langid = {english}, - keywords = {circuit board,electronic component,enclosure,tamper,thermally conductive} -} - @article{zhangWirelessPowerTransfer2019, title = {Wireless {{Power Transfer}}—{{An Overview}}}, author = {Zhang, Zhen and Pang, Hongliang and Georgiadis, Apostolos and Cecati, Carlo}, diff --git a/thesis.tex b/thesis.tex index 0c8e866..75fbed8 100644 --- a/thesis.tex +++ b/thesis.tex @@ -1,10 +1,5 @@ -\ifdefined\thesisoneside % - \documentclass[11pt,a4paper,notitlepage,oneside]{book} - \usepackage[a4paper, top=3cm, bottom=3.5cm, inner=3.5cm, outer=5cm, marginpar=3.5cm]{geometry} -\else % - \documentclass[11pt,a4paper,notitlepage,twoside]{book} - \usepackage[a4paper, top=3cm, bottom=3.5cm, inner=3.5cm, outer=5cm, marginpar=3.5cm]{geometry} -\fi % +\documentclass[11pt,a4paper,notitlepage,twoside]{book} +\usepackage[a4paper, top=3cm, bottom=3.5cm, inner=3.5cm, outer=5cm, marginpar=3.8cm]{geometry} \input{common-packages} \input{common-defs} @@ -13,7 +8,6 @@ \newcommand{\chaptertitle}[1]{ \chapter{#1} \printchapterquote - %FIXME note leo: remove minitocs? \begin{spacing}{1.1} \minitoc \end{spacing} @@ -33,16 +27,15 @@ \input{titlepage.tex} \frontmatter -%\chapter*{Akademischer Werdegang} -%\includepdf[pages=-]{lebenslauf-en-akademischer-werdegang-diss.pdf} \input{abstract-de.tex} \input{abstract.tex} \input{ai-llm-use-disclosure.tex} +\input{hsm-terminology-notes.tex} \clearpage \tableofcontents -%\listoffigures -%\listoftables +\listoffigures +\listoftables \mainmatter \dochapter{chapter-introduction} % Status: In pretty good shape diff --git a/titlepage.tex b/titlepage.tex index 3557dae..cd868b1 100644 --- a/titlepage.tex +++ b/titlepage.tex @@ -55,16 +55,10 @@ Darmstadt, Technische Universität Darmstadt, 2025 \noindent - URN: https://nbn-resolving.de/urn:nbn:de:tuda-tuda-150469 + URN: TBD FIXME \noindent - DOI: https://doi.org/10.26083/tuda-7720 - - \noindent - Document revision: \input{version} - - \noindent - Tag der mündlichen Prüfung: TBD + Tag der mündlichen Prüfung: TBD FIXME \noindent Veröffentlicht unter CC-BY-SA 4.0 International