<story><title>Full key extraction of Nvidia TSEC</title><url>https://gist.githubusercontent.com/plutooo/733318dbb57166d203c10d12f6c24e06/raw/15c5b2612ab62998243ce5e7877496466cabb77f/tsec.txt</url></story><parent_chain><item><author>sva_</author><text>The concept of undervolting the chip, causing bitflips, to do a differential fault analysis[0] seems like a stroke of genius. I had no idea AES could be broken in such a fashion, of interfering with just the last 1-2 rounds of the cipher.&lt;p&gt;I wonder if it will be mitigated by requiring a larger minimum voltage?&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Differential_fault_analysis&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Differential_fault_analysis&lt;/a&gt;</text></item></parent_chain><comment><author>marcan_42</author><text>Environmental sensors are common in security critical hardware, but &lt;i&gt;very&lt;/i&gt; hard to get right.&lt;p&gt;The problem is that this doesn&amp;#x27;t work for high performance CPUs, so it can only really be done for things like TSEC or Apple&amp;#x27;s SEP. You need the CPU to have a large margin where it operates correctly, so the sensor doesn&amp;#x27;t have to be extremely fast and accurate (which is nigh impossible with on-chip sensors with no external reference). And even then it has to be able to detect things like microsecond-long dips in the supply voltage, or extreme temperatures, or a single clock pulse that&amp;#x27;s too short. It&amp;#x27;s really hard.&lt;p&gt;Several years ago, I got the Wii U PowerPC boot ROM keys out by doing a self contained glitching attack like this. In that case it was a reset glitch, where I pulsed the reset line for less than the required 256 clock cycles (from the ARM core which controls it). At very specific pulse widths (that varied from device to device), that got the CPU into an inconsistent execution state that eventually fell out of the Boot ROM and into code I&amp;#x27;d placed in RAM. That one could&amp;#x27;ve easily been mitigated by a reset stretcher circuit, but it&amp;#x27;s another fun example of a &amp;quot;self-glitch&amp;quot; attack with no additional hardware.</text></comment>
<story><title>Full key extraction of Nvidia TSEC</title><url>https://gist.githubusercontent.com/plutooo/733318dbb57166d203c10d12f6c24e06/raw/15c5b2612ab62998243ce5e7877496466cabb77f/tsec.txt</url></story><parent_chain><item><author>sva_</author><text>The concept of undervolting the chip, causing bitflips, to do a differential fault analysis[0] seems like a stroke of genius. I had no idea AES could be broken in such a fashion, of interfering with just the last 1-2 rounds of the cipher.&lt;p&gt;I wonder if it will be mitigated by requiring a larger minimum voltage?&lt;p&gt;[0] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Differential_fault_analysis&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;en.wikipedia.org&amp;#x2F;wiki&amp;#x2F;Differential_fault_analysis&lt;/a&gt;</text></item></parent_chain><comment><author>sdfgsdvf</author><text>Voltage glitching for secret&amp;#x2F;rom extraction has a long and storied history.&lt;p&gt;It&amp;#x27;s the basis of how DirecTV cards were compromised in the late 90s&amp;#x2F;early 00s.</text></comment>