Breaking the Root of Trust: Practical Side-Channel Key Extraction from a TPM

Breaking the Root of Trust: Practical Side-Channel Key Extraction from a TPM

Speakers: Roman Korkikian (Hardware and Software Security Researcher, uSec)

Conference: Hardwear.io USA

YouTube: https://www.youtube.com/watch?v=hk-Yyuh4cM8

Overview

In this compelling talk from Hardwear.io USA, Roman Korkikian, a Hardware and Software Security Researcher and founder of uSec, presented groundbreaking research detailing two practical attacks against Trusted Platform Modules (TPMs). The presentation, titled "Breaking the Root of Trust: Practical Side-Channel Key Extraction from a TPM," unveils methods to extract sensitive cryptographic keys from TPMs, challenging the long-held belief in their invulnerability. The motivation for this research stemmed from a client's concern regarding the hardware security of thousands of edge servers deployed in potentially hostile environments globally, prompting an investigation into whether data could be extracted, servers modified, or even turned against their operators.

Korkikian's team uncovered two distinct attack vectors. The first, described as "super standard, boring," involves sniffing cleartext communication over the Serial Peripheral Interface (SPI) bus, revealing sensitive data such as vault decryption keys. The second, and far more significant, is a novel side-channel attack capable of extracting unique, elliptic curve cryptographic keys directly from within the TPM itself. This research is particularly critical because TPMs are widely considered the "root of trust" in modern computing, underpinning the security of everything from boot processes to data encryption. The findings highlight a crucial gap between stringent security certifications like FIPS and Common Criteria, and the practical realities of hardware security, demonstrating that even certified secure elements can be compromised with relatively low-cost equipment and sufficient time.

Background

▶ Watch: Introduction: Attacking TPMs on Edge Servers (0:00)

The investigation began with a practical security challenge posed by a client deploying numerous edge servers. Unlike traditional central servers housed in secure data centers with layers of physical protection and professional IT staff, edge servers are located close to data generation or consumption points, often in physically accessible and potentially hostile environments. Examples include traffic lights or client premises, where even the client themselves might be considered a potential attacker. This inherent physical accessibility makes hardware security a paramount concern.

The edge servers under examination were essentially robust, hardened computers running an open-source, Linux-based operating system called EVOS, developed by the Linux Foundation. EVOS is designed for edge-specific principles, acting as a hypervisor that runs applications in isolated containers or virtual machines. Its security model is heavily reliant on remote operation, with no local login interfaces, disabled USB ports, read-only partitions, and no local SSH access, enforcing a strict software isolation. However, a significant portion of EVOS's security architecture hinges on the Trusted Platform Module (TPM).

The TPM plays a critical role in the EVOS ecosystem:

• It is used to encrypt a sensitive partition known as the "vault," which stores application data.
• It performs measured boot, a process where the TPM records platform configuration registers (PCRs) – hashes of the UEFI configuration, hard drive states, and peripheral lists – during the initial provisioning phase. During subsequent boots, it verifies that nothing has changed.
• It stores secret keys used by the remote orchestrator for secure communication with the edge server.

The server's lifecycle involves two phases: provisioning in a secure environment where keys are generated and the system is measured, followed by delivery to the client. After delivery, local accounts are deactivated, and all communication occurs with the remote orchestrator. Any detected tampering or recovery event must be reported via the TPM's integrity checks.

The TPM market itself is a niche, highly regulated space, dominated by a few companies (Nuvoton, Infineon, Microchip, Nations, STMicroelectronics). Entry is costly due to the necessity of adhering to the Trusted Computing Group (TCG) standard and obtaining rigorous certifications like FIPS and Common Criteria, which are security evaluation certificates.

The initial discovery that sparked deeper investigation was the observation that the TPM module on one of the client's servers could be easily unscrewed and physically removed. This suggested the possibility of offline analysis, circumventing the software-based protections enforced by EVOS. The threat model assumed an attacker with physical access to an unmodified server, a budget of $2,000 for equipment, and unlimited time, focusing on extracting critical data and keys.

Key Findings

▶ Watch: TPM's central role in EOS security mechanisms (6:00)

The research uncovered two critical vulnerabilities, primarily demonstrated on a Nuvoton TPM, which significantly undermine the security assurances typically associated with these "roots of trust."

1. SPI Bus Sniffing: The team discovered that the communication between the TPM and the host system, particularly for crucial operations like the release of the vault decryption key and Platform Configuration Register (PCR) measurements, occurs in cleartext over the SPI interface. This "standard, boring" attack allows an attacker with physical access to the edge server to passively sniff the SPI bus, capturing the entire boot process's measurements (UEFI configuration, hard drive hashes, peripheral lists) and, most critically, the vault key as it is transmitted to the CPU. While not a novel attack in principle (similar vulnerabilities have targeted systems like BitLocker), its presence on a supposedly secure edge server deployment highlights a fundamental design flaw in the overall system's security architecture.

1. Practical Side-Channel Key Extraction: The more profound finding was the successful execution of side-channel attacks to extract unique elliptic curve cryptographic keys directly from within the TPM. The team targeted the TPM's internal implementation of elliptic curve cryptography (ECC), specifically the ECDSA (Elliptic Curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman) keys. These keys are fundamental to the TPM's secure operations and are designed never to leave the module.

• ECDSA Key Extraction: By observing the power consumption profiles during the scalar-to-point multiplication operation (a core ECC primitive), the researchers found that the duration of this operation was dependent on the length of the private key (specifically, the number of leading zero bits). This information, combined with known lattice-based attacks (solving the shortest vector problem), allowed them to recover two out of the three target keys from the TPM with fewer than 3,000 signatures.
• ECDH Key Extraction: For the ECDH key, which uses a constant private key and thus didn't exhibit the key-length dependency, a more advanced multiplication by zero attack (a technique from 2003) was successfully adapted and executed. This attack involved crafting specific input points to cause an internal multiplication by zero, which manifests as a distinct and observable drop in the power consumption trace, enabling bit-by-bit recovery of the private key.

These findings collectively demonstrate that despite rigorous FIPS and Common Criteria certifications, TPMs can still be vulnerable to both simple bus sniffing and sophisticated side-channel attacks. The research, performed on a Nuvoton TPM, led to the discovery of two critical vulnerabilities. Furthermore, the disclosure process revealed a significant challenge: the re-certification of fixed firmware took approximately two years, meaning that vulnerable hardware could remain in the market for extended periods even after a fix has been developed.

Technical Deep Dive

▶ Watch: Side-channel attack setup and Novaton TPM target (13:00)

The technical investigation proceeded in two main phases: the straightforward SPI bus sniffing and the complex side-channel analysis of the TPM's cryptographic operations.

SPI Bus Sniffing: Exposing Cleartext Secrets

The initial phase leveraged the physical accessibility of edge servers. Once the server cover was removed, the team gained access to the SPI interface connecting the TPM to the host CPU. By probing this interface, they were able to record all communication occurring in cleartext.

During the measured boot process, the TPM receives various inputs from the system, including:

• UEFI configuration: Settings related to the Unified Extensible Firmware Interface.
• SHA hashes of hard drives: Integrity measurements of storage devices.
• List of peripherals: Inventory of connected hardware.

This information is fed to the TPM to populate its Platform Configuration Registers (PCRs), which are then used to verify the system's integrity against a previously recorded "known good" state from the provisioning phase. If the PCRs match, the TPM releases the vault key, which is used by the CPU to decrypt a sensitive partition containing applications and data.

The critical vulnerability here is that the transmission of the vault key from the TPM to the CPU, as well as all PCR inputs and outputs, occurs unencrypted over the SPI bus. By simply connecting a logic analyzer or oscilloscope to the SPI lines, an attacker can:

1. Extract PCR inputs: Gain full knowledge of the system's measured state, allowing for potential spoofing or bypasses in future attacks.
2. Extract PCR outputs: Understand the expected integrity measurements.
3. Extract the vault key: Directly obtain the key needed to decrypt the sensitive vault partition, compromising the confidentiality of all data stored within.

This attack, while basic, is highly effective given physical access. The speaker noted that this is where he removed slides about "implants," as an attacker could theoretically insert an interposer device to record and then replay known-good SPI traffic, thus maintaining server integrity while still extracting keys. The limitation of this attack is that it only exposes data transmitted from the TPM; it does not reveal unique cryptographic keys that are designed to reside within the TPM and never leave its boundary.

Side-Channel Attack: Unveiling Internal Cryptographic Keys

To extract the truly unique keys stored inside the TPM, a more sophisticated approach was required: side-channel analysis focusing on power consumption. The target keys were three elliptic curve keys: two used for ECDSA signatures and one for ECDH key exchange.

Equipment and Setup:

The team used a relatively low-cost setup, estimated at around $2,000:

• Custom PCB (Red Board): Provided stable 3.3V power to the TPM and simultaneously measured its power consumption. This board amplified the power signal before sending it to an oscilloscope.
• Oscilloscope: An older model (20+ years old) was sufficient for capturing the power traces.
• Raspberry Pi (or USB-to-SPI adapter): Used to communicate with the TPM via the SPI interface, sending cryptographic commands and triggering measurements.
• Simple Probes: Direct connections to the TPM's power and SPI lines, with one probe used for triggering the oscilloscope at the start of a command.

Targeting Scalar-to-Point Multiplication:

Elliptic curve cryptography relies heavily on the scalar-to-point multiplication operation (k*G, where k is a scalar and G is a point on the curve). This operation is the most computationally intensive part of ECC and thus a prime target for side-channel analysis, as it consumes the most power and time.

First Side-Channel (ECDSA Keys) - Key Length Dependency:

The initial breakthrough involved observing the power traces of scalar-to-point multiplication when the private key D was varied.

• Observation: The duration of the scalar-to-point multiplication operation was found to be directly dependent on the key length, specifically the number of leading zero bits in the private key.
• Mechanism: The cryptographic algorithm implemented in the Nuvoton TPM was designed to skip leading zero bits during computation. If a key has many leading zeros, the actual number of operations performed is reduced, leading to a shorter execution time and lower power consumption. Conversely, a key with fewer leading zeros (i.e., a "longer" effective key) results in more operations and a longer duration.
• Attack: By meticulously measuring the duration of the scalar-to-point multiplication for various operations, attackers could infer the number of leading zero bits of the private key. This partial information, though seemingly small, is highly valuable.
• Leveraging Prior Work: The researchers referenced a 2020 attack that demonstrated how knowing a few bits (like leading zero bits) of an ephemeral key, combined with lattice-based cryptography techniques (specifically, solving the shortest vector problem), is sufficient to recover the full ECDSA private key. With fewer than 3,000 signatures, they were able to extract two out of the three targeted keys from the TPM using this method.

Second Side-Channel (ECDH Key) - Multiplication by Zero Attack:

The first attack didn't work for the ECDH key because it uses a constant private key, meaning its length (and thus computation duration) would not vary. A deeper side-channel was needed.

• Initial Challenge: Even with fixed private keys and input points, the power traces for scalar-to-point multiplication appeared randomized. This indicated that the internal algorithm was dynamically changing the order of operations.
• Discovery of Constant Operations: By carefully analyzing the beginning of the power traces, the team identified a constant, non-randomized operation: point doubling. This is a fundamental operation in ECC that must occur at the start of the Montgomery ladder algorithm.
• Algorithm Identification: Recognizing the ability to swap point doubling and point addition operations while maintaining correctness, the team inferred that the TPM was likely using a Montgomery ladder implementation.
• Refined Trace Analysis: By correctly identifying the start and end of loop iterations within the Montgomery ladder, they observed distinct patterns: point doubling involved 8 big number multiplications, while point addition involved 16 big number multiplications. These patterns, though subtly randomized in order, were consistently present.

• The Multiplication by Zero Attack (2003): This attack, first published in 2003, exploits the fact that multiplying by zero significantly alters the power consumption of a cryptographic operation.
• Core Idea: The probability of a random point on an elliptic curve having a zero coordinate is extremely low (e.g., 2^-256 for a 256-bit curve). However, if an attacker can force an intermediate point in the scalar multiplication to have a zero coordinate, the subsequent multiplication by zero will produce a recognizably different power trace.
• Attack Steps:

1. Find a Special Point P: The attacker first identifies a point P on the elliptic curve that has a zero coordinate (e.g., x=0, y=e, where e is a curve-specific constant).
2. Craft Special Input Points: For each pair of bits (00, 01, 10, 11), the attacker calculates an input point Q_i such that Q_i = (k_i)^-1 * P, where k_i represents the two bits of the key being targeted.
3. Feed Q_i to ECDH: The attacker provides these crafted points Q_i to the TPM's ECDH operation, which performs D * Q_i (where D is the unknown private key).
4. Observe Power Trace: After two loop iterations (processing two bits of the key), if the k_i value matches the actual two bits of the private key D, then the internal state of the algorithm will become P (which has a zero coordinate).
5. Detect Multiplication by Zero: In the subsequent round, when the algorithm attempts to multiply by this internal P (with its zero coordinate), the power consumption will drop significantly, creating a distinct signature in the power trace.

• Iterative Key Recovery: By iterating through the four crafted Q_i points and observing which one causes the "multiplication by zero" power drop, the attacker can recover two bits of the private key. This process is then repeated bit by bit until the entire ECDH key is extracted.

Vulnerability Disclosure and Remediation:

These vulnerabilities were discovered in 2023 and immediately reported to Nuvoton. The vendor addressed the issues in a new firmware version. However, the re-certification process for the updated firmware under FIPS and Common Criteria standards took approximately two years. This extended timeline meant that the vulnerable firmware remained on the market for a significant period before the fix could be widely deployed and the public advisory released.

Demo / Proof of Concept

▶ Watch: Key length dependency reveals leading zero bits (17:00)

While the talk did not feature a live, interactive demonstration, the technical deep dive thoroughly outlined the experimental setup and presented compelling evidence in the form of power consumption traces that serve as the proof of concept. The speaker detailed the specific hardware used, including the custom red measurement board, the oscilloscope, and the Raspberry Pi for SPI communication.

Crucially, the presentation included visual representations of the power traces that validated the theoretical attacks:

• Key Length Dependency: Traces were shown illustrating how increasing the effective key length (by reducing leading zeros) directly corresponded to an increase in the duration of the scalar-to-point multiplication operation. This visual correlation demonstrated the feasibility of inferring key length information.
• Multiplication by Zero: The talk provided a clear comparison between a standard multiplication operation and a "multiplication by zero" operation within the power trace. The latter exhibited a distinct and significant drop in power consumption, confirming that this event is indeed observable and exploitable.

These detailed explanations and visual data effectively served as a robust proof of concept, demonstrating that both the SPI sniffing and the sophisticated side-channel attacks were practically achievable with the described low-cost equipment. The team's ability to extract two out of three keys using the key length dependency and the final ECDH key using the multiplication by zero technique validated the practical efficacy of their research.

Defensive Implications

▶ Watch: Lessons learned: Certification, budget, and fix times (26:00)

The findings presented in this talk carry profound implications for defenders, particularly those operating in environments where physical access to hardware cannot be entirely ruled out, such as edge server deployments.

1. Assume Physical Access Means Compromise: The most fundamental takeaway is that for edge devices, physical access must be considered a critical threat vector. Relying solely on software-based security mechanisms (like disabled USB or read-only partitions) is insufficient when an attacker can directly probe hardware interfaces or remove components.
2. Encrypt All Sensitive On-Board Communication: The discovery of cleartext transmission of the vault key over the SPI bus is a critical design flaw. Designers of secure systems must ensure that all communication channels between secure elements (like TPMs) and the host CPU, especially those carrying cryptographic keys or sensitive measurements, are encrypted and authenticated.
3. Implement Constant-Time Cryptographic Operations: The success of the side-channel attacks highlights the importance of constant-time implementations for cryptographic algorithms. The observed variations in power consumption due to key length or specific internal states (like multiplication by zero) are direct results of non-constant-time operations. TPM manufacturers must adopt robust countermeasures against side-channel leakage, such as blinding, randomization, or ensuring that all operations take the same amount of time regardless of secret data. The randomization implemented by Nuvoton was insufficient to prevent the attacks.
4. Independent Security Evaluations are Crucial: The talk underscores that certifications like FIPS and Common Criteria, while important, do not guarantee immunity from all attacks. These certifications are often based on specific threat models and evaluation methodologies that may not fully encompass advanced side-channel or physical attacks. Organizations deploying critical infrastructure should invest in independent, deep-dive hardware security assessments by specialized researchers, rather than solely relying on certification labels.
5. Consider the Full Supply Chain and Lifecycle: The ability to physically remove the TPM points to broader supply chain security concerns. Hardware designs should consider tamper-detection and anti-removal mechanisms for critical components. Furthermore, the entire lifecycle of an edge device, from provisioning to deployment and potential decommissioning, must account for physical security risks.
6. Plan for Long Remediation Cycles: The two-year re-certification period for the patched TPM firmware is a stark warning. Defenders must understand that hardware vulnerabilities, especially in certified secure elements, have extremely long remediation timelines. This necessitates:

• Proactive Threat Modeling: Anticipating such vulnerabilities and designing systems with layered defenses that can mitigate risks even if a fundamental hardware component is compromised.
• Robust Software-Level Mitigations: Implementing software-level protections that can detect or limit the impact of compromised hardware, even if the underlying secure element is vulnerable. For instance, frequently re-keying or using ephemeral keys might reduce the window of opportunity for attackers.
• Vendor Communication: Maintaining open communication with hardware vendors regarding security vulnerabilities and understanding their patch and re-certification timelines.

In essence, defenders must evolve their security posture to treat hardware, especially in exposed environments, with the same level of scrutiny as software, acknowledging that the "root of trust" can indeed be broken.

Key Takeaways

• TPMs are not infallible: Despite stringent FIPS and Common Criteria certifications, Trusted Platform Modules (TPMs) can be vulnerable to practical physical and side-channel attacks, demonstrating that certification does not equate to absolute security.
• Physical access is a critical threat: For edge servers and other physically exposed devices, physical access enables both simple cleartext sniffing of sensitive data (like the vault key over SPI) and advanced side-channel attacks to extract internal cryptographic keys.
• Cleartext SPI communication is a severe vulnerability: The transmission of crucial secrets and measurements in cleartext over the Serial Peripheral Interface (SPI) bus between the TPM and host CPU is a fundamental design flaw that allows for straightforward data interception.
• Low-cost side-channel attacks are effective: Sophisticated side-channel attacks, such as those exploiting power consumption variations during elliptic curve operations (e.g., key length dependency, multiplication by zero), can successfully extract cryptographic keys from secure elements using readily available, low-budget equipment (around $2,000).
• Certification processes are slow: The re-certification process for patched firmware in secure elements can take an exceptionally long time (e.g., two years), meaning that vulnerable hardware may remain in the market for extended periods even after a fix has been developed.
• Constant-time implementations are essential: The success of these side-channel attacks highlights the critical need for TPM manufacturers to implement cryptographic algorithms in a constant-time manner to prevent leakage of secret-dependent information through power consumption or timing variations.

About the Speaker(s)

Roman Korkikian is a Hardware and Software Security Researcher and the founder of uSec, a security consultancy based in Switzerland. His expertise lies in uncovering vulnerabilities in hardware and software systems, particularly in the context of advanced security elements like TPMs. He led the research presented in this talk, focusing on the practical exploitation of trusted platform modules.

The research also involved key contributions from:

• Rob, who was responsible for a significant portion of the side-channel analysis.
• Karim, who provided assistance in the software research aspects and offered consultancy.