Towards Openness and Transparency in Cryptographic Hardware

bunnie | masto: @bunnie@treehouse.systems | bluesky: @bunnie.org

baochip | bluesky: @baochip.com

CC-BY-4.0

Welcome!

Hi! I'm bunnie. I have a company called Baochip,
and I'm going to tell you about my quest to build a secure open source hardware.

The story starts a while back with a presentation at CHES 2002...

24 Years Ago...

• "Accidentally" broke the DRM on Microsoft's Xbox: shared secret AES key extracted by bus sniffing
• Microsoft was not happy...
• Thank you to the CHES community for accepting my effort, even though I was a total outsider!
• The talk saved me a lawsuit and earned me my degree!

Grad Student v. Microsoft:
A Life Lesson

Contrast: Chip Makers

• Chip makers have a lot to lose
  • Mask cost for 22nm tape out: $1-2MM
  • + Tools, staff, IP: $10-20MM


• Chip teams are risk-averse

By Peellden - Own work, CC BY-SA 3.0, commons.wikimedia.org

Secure MCU Problem Statement:
$20MM Secure Chip versus This Guy

Exhibit A:
Andrew Zonenberg

https://ioc.exchange/@azonenberg

FIBs For Fun

https://siliconexposed.blogspot.com/2014/03/getting-my-feet-wet-with-invasive_31.html

Cut...

https://ioc.exchange/@azonenberg

...and Jumper!

https://ioc.exchange/@azonenberg

Barrier to Attack: Much Less than $20MM

https://www.ntu.edu.sg/nice/research-capabilities

(Google for "nice lab NTU")

Knowing where to FIB is the question

Why This Scares Chip Makers:
Marketing

Common criteria EAL ratings are widely used to market products

• Simple "number goes up" metric used to sell security

Review: EAL Attack Potential Scoring

Review: EAL Attack Potential Scoring

The "Cost" of Openness

Fictional Example

• Test mode back door register "accidentally" left into design
• Gated with a 256-bit fixed value
• Hidden in RTL, compiled into standard cells, obfuscated with e.g. logic lock
• But! Source code, mask set are "critical" secrets

The Boardroom Calculus

• Even though public review may eventually lead to a better product...
• ...secrecy could "save" your EAL rating


• No short-term upside to open sourcing the design


• Observation: secret targets have a decreasing perception over time, whereas open source targets may improve over time

But What of Kerckhoffs's Principle?

• "Design systems with the assumption that the enemy will immediately gain full familiarity with the design"
• ...until things get expensive: then, it's OK to pretend we can keep design secrets⁈

Three Can Keep a Secret, if Two are Dead

• Chip designs & IP "looted" in the attack
• NXP makes EAL6+ rated products - no rating adjustments after the attack (afaik)
  • Shouldn't we assume "adversaries" now have the design source?
  • Either they could just publish the design source and have no rating impact...
  • ...or is the rating process a sham?

Also: Machines Have Gotten Really Good at Reverse Engineering

• Binaries can be read almost as source code
• Automated circuit analysis is not far behind
• Previous "elapsed time" assessments may no longer be accurate

Status Quo: Worst of Both Worlds

• Customers get a black box with no way to verify it
• Adversaries might have more knowledge of attack vectors than customers
  • Disclosure of back doors can be compelled through legal processes
  • The list of adversaries should also include your own governments


• All trust stems from literally the label on the box

I Believe We Can Do Better, But How To Get There?

Recalling a Lesson Learned

Applying the Lesson

1. Don't be a "secure MCU"
2. Be a general-purpose MCU that happens to have secure MCU features
   • Transistors are cheap
   • Certification is expensive

https://www.infineon.com/assets/row/public/documents/corporate/company/fy2026-q3-web-en.pdf

Focus on Transferable, Cross-Generational
Software Improvements

• Delegate mitigations as much as possible to software
• Job #1: Improve code quality
  • Attack practitioners rarely use sidechannel attacks, because there are so many software bugs
  • With many eyeballs all bugs are shallow
  • Rapidly adopt & deploy community improvements

But Exactly How?

My Strategy:
"Hitchhike" Open Source Cores
on a Commercial Tape-Out

Review: Logic Density in Small-Node Chips

• Size of chip is set primarily by:
  • Memory
  • I/O perimeter
• Logic is like a "gas",
  it expands to fill the available space
  • At a detail level, it can be quite sparse

Review: Typical SoC Block Diagram

Can We...Just Add a RISC-V Core?

Yes We Can, and It's Free!

• <2% die area
  • 1x VexRiscv with MMU
  • 4x PicoRV
• No extra cost to tape-out
  • Logic is sparse
  • Could fit more logic!
  • No royalty

Okay, So...Hitchhiking is Theoretically Possible But...

But Who Would Give THIS Guy A Ride?

Fig 1. "Trouble"

Luckily, Crossbar was already heading that way,
and they stopped and asked me for directions...

Result: Partially-Open RTL SoC
For High Assurance Applications

• Baochip BAO1X2S4F (Baochip-1x for short)
• "Hitchhiking" on Crossbar's tape-out
  • Five open-source CPUs
    • VexRiscv RV32IMAC+MMU @ 350MHz
    • 4x PicoRV I/O Engine ("BIO") @ 700MHz
  • 4MiB on-chip ROM ("RRAM")
  • 2MiB on-chip SRAM
  • Cryptographic accelerators, TRNG, secure mesh, attack sensors
  • USB HS, camera, I2C, SPI, UART, etc.

22nm: Room for Multiple Cryptographic Implementations

• Hardware AES has only basic mitigations
  • Explicitly not targeting top-end side channel performance
  • Included mostly because "transistors are free"
• 350MHz CPU core can do soft AES
  • Algorithmic mitigations in software
  • Also, optional clock skipping feature
  • "Fast enough" in practice

Current Status of Baochip-1x

• Started a "small organization" called Baochip to manufacture and distribute the Baochip-1x
• "Dabao" evaluation board is available via CrowdSupply
• Baochip-1x was featured in Defcon 34 conference badge
• Chips should be in distribution (Digi-Key, etc.) starting next month
• Can't wait to play with it? Ping me on Discord or catch me in the hallway track!

OK, But Isn't an Open TOE
Strictly Less Safe than a Closed TOE?

• I did in fact make these statements:
  • Attacks are cheap
  • Knowing where to attack is hard

Taking Kerckhoffs's Principle to Heart:
I Assume The Red Team Always Wins

• Obfuscation is not security
  • Chips will be FIB'd
  • Boards will be tapped
  • Supply chains will be compromised

DRM Is Not a Good Fit with Open Source

• Good. I didn't like that market anyways.
• Instead: empower ownership transfer
  • Anyone can sign firmware with a "Developer key"
  • A valid developer key signature erases secret material
  • Permission-less opt-out of signed boot
  • "Collateral" keys facilitate third-party secure signing
• This makes Baochip unattractive for a range of "traditional" secure MCU applications

So, what is this chip useful for?

Everyday Objects Deserve Good Cryptography, Too

• Triangel: possibly the world's only post-quantum secured LED art
• It's open source: see https://github.com/rowr111/triangel
• Safe defaults make for better products
  • See: Let's Encrypt!
  • We can put good cryptography in everything
  • Security should be a free default, and not a paid-premium afterthought
• Besides: general-purpose MCU market is 10x size of secure MCU market
  • Could we do for IoT what Let's Encrypt did for the Web?

Supply Chains Can be Softer Targets
than Sidechannels

My Proposed Solution: IRIS (Infra-Red, in situ) Imaging

What Types of Chips?

• Short answer: the shiny ones
  • Exposed silicon back with no film or paint applied
  • Ideally polished and/or thinned
• P- (lightly) doped substrate (e.g. TSMC, not Intel)
• Does not work for chips in plastic packages
  • Manufacturer must deliberately "design for inspectability"

Review: Silicon is Transparent to Infra-Red Light

Putting it All Together: IRIS

• Inspection of chips from the back side
• After they have been assembled into a product

Prior Work

• IR backside imaging is a well-established technique
• IR laser imaging via e.g. Hamamatsu iPhemos system
• Die photography by Fritzchens Fritz

My Work

• Aimed at point-of-use inspection
  • DIY-friendly, <$300 equipment cost
• Time of check vs Time of use matters:
  • Sending a sample to a lab for inspection is like downloading a hash of a file
  • IRIS is like downloading the file then hashing the local copy

But Photons are Big (1050nm), Transistors are 22nm!

• But photons also diffract!
• IRIS images a "hologram" of sub-wavelength features
  • Rotating the light source about the imaging axis adds additional information

What IRIS Gets You at 22nm

• "Block level" confidence in a chip's construction
• Number, size, and location of RAM & ROM macros
• Eliminates the most common classes of supply chain attacks compared to uninspectable chips
  • ✅ Detects fake chips (cost of attack: <$10 - $100)
  • ✅ Detect additional chips in package (cost of attack: $100 - $100,000)
  • ❌ Does not detect minor mask tampering (cost of attack: > $100,000)
• Possible because we share reference images of the chip & RTL-level design source

Baochip Is Specifically Packaged to Facilitate this Type of Inspection

Just Because We Shared the Source Code
Doesn't Mean We Play Nice

Or, Red-Teaming the Red team:
Playing for Team Infra-Red

Example #1: Physical Readout Attacks

Fail Sec Labs (https://sec.fail)

• Data is stored in RRAM: a filament in a thin film of HfO_x/TaO_x
• Read-out is imagined to be difficult
  • Storage filament is on the order of a couple atom's width
  • Attack hypothesized as:
    1. De-layer to metal above the storage layer
    2. Read-out based on differential SEM leakage

Frustrating the Red Team

• Derive master key by hashing ~64kbits of material
  • Hashes are "cheap"
  • Storage is plentiful in 22nm
  • If imaging 256 bits costs $1,000, recovering 64 kbits costs $256,000
• Stripe key on both edges of the RRAM array
  • Requires de-layering planarity to within 5ppm accuracy
  • Requires uniform read-out accuracy >97% (ECC can correct 2 bits per 128 bits)
  • Increase the risk of total loss so that this is not an attractive strategy
• Additional 32 kbits "chaff" (XOR in random permutation then hash) to frustrate SCA

Example #2: Volatile Keys

• Side channel attacks typically require many samples
  • Sampling is considered to be a "zero cost" operation
• Use system-level tricks to increase the cost function of repeated sampling
  • Battery-backed SRAM key included as part of root key KDF
  • Key erased on reboot, time-out, or on command
  • System includes a QR-code scanner for convenient high-entropy input
  • Architectural trick that would be impossible to consider on closed-source security chip
• Side benefit: evidence is not destroyed
  • Ciphertext is still in the device and recoverable
  • Key is in your home - obtainable with a lawful warrant
  • "Warrant key"

Open TOEs Have More Degrees of Freedom

• Being open does make it easier to know where to attack...
• ...but being open gives us more degrees of freedom to respond to attacks!
  • No longer a turn-based game of defender vs attacker
  • Anticipate, learn, and respond to attackers in real time

Empowering a Community

Create Community Spaces

• Spaces like Github allow for pull requests, issues, code sharing
• Multiple repos:
  • xous-core: Bootloader, OS, applications
    https://github.com/betrusted-io/xous-core/
  • baochip-1x: IC design
    https://github.com/baochip/baochip-1x

Create Community Spaces

• Spaces like Discord allow for Q&A and live discussion
  

Create Lots of Documentation

Create Accessible Tooling

• RTL simulations run in verilator inside Podman (Docker) container
• Waveform tool runs in browser
• Minimize friction of traditional software engineer to access hardware tools

Create Accessible Tooling

No More Cycle Counting:
Simulate to Confirm Constant Time

Run Continuous Integration

• "Hardware In Loop" (HIL) CI: changes are run on actual hardware
• Include some basic "red team" tests in the bench
• Update tests as new vulnerabilities are discovered and patched
• All my frameworks are open source, talk to me if you want tips on how

WIP: Make Side Channel Research Reproducible

• "Official" side channel analysis board for Baochip
  • Chipwhisperer-compatible form factor
  • Built-in 20x 400MHz Δ-Idd amplifier
  • Glitch crowbar
  • Open source
  • Goal: orderable by anyone via JLCPCB
• Stretch goal: integrate data acquisition hardware for turn-key setup
• The dream: integrate to HIL CI bench
  • Users can submit mitigation patches and trigger SCA remotely
  • Results can be reproduced/compared across groups & labs
  • Maybe we can establish an "uncommon criteria" based on reproducible open source benchmarks?
• https://github.com/baochip/cw308t-baochip

Towards Openness and Transparency in Cryptographic Hardware