2168
...
endmodule
The vulnerable code shows a buggy implementation of binary exponentiation where it updates the
result register (result_reg) only when the corresponding exponent bit (exponent_reg[0]) is set to
1. However, when this exponent bit is 0, the output register is not updated. It's important to note
that this implementation introduces a physical power side-channel vulnerability within the RSA
core. This vulnerability could expose the private exponent to a determined physical attacker. Such
exposure of the private exponent could lead to a complete compromise of the private key.
To address mitigation requirements, the developer can develop the module by minimizing
dependency on conditions, particularly those reliant on secret keys. In situations where branching
is unavoidable, developers can implement masking mechanisms to obfuscate the power
consumption patterns exhibited by the module (see good code example). Additionally, certain
algorithms, such as the Karatsuba algorithm, can be implemented as illustrative examples of
side-channel resistant algorithms, as they necessitate only a limited number of branch conditions
[REF-1369].
Example Language: Verilog (Good)
...
module mod_exp
...
`UPDATE: begin
if (exponent_reg != 'd0) begin
if (exponent_reg[0]) begin
result_reg <= result_next;
end else begin
mask_reg <= result_next;
end
base_reg <= base_next;
exponent_reg <= exponent_next;
state <= `UPDATE;
...
endmodule
Observed Examples
Reference Description
CVE-2022-35888 Power side-channels leak secret information from processor
https://www.cve.org/CVERecord?id=CVE-2022-35888
CVE-2021-3011 electromagnetic-wave side-channel in security-related microcontrollers allows
extraction of private key
https://www.cve.org/CVERecord?id=CVE-2021-3011
CVE-2019-14353 Crypto hardware wallet's power consumption relates to total number of
pixels illuminated, creating a side channel in the USB connection that allows
attackers to determine secrets displayed such as PIN numbers and passwords
https://www.cve.org/CVERecord?id=CVE-2019-14353
CVE-2020-27211 Chain: microcontroller system-on-chip contains uses a register value stored in
flash to set product protection state on the memory bus but does not contain
protection against fault injection (CWE-1319), which leads to an incorrect
initialization of the memory bus (CWE-1419) leading the product to be in an
unprotected state.
https://www.cve.org/CVERecord?id=CVE-2020-27211
CVE-2013-4576 message encryption software uses certain instruction sequences that
allows RSA key extraction using a chosen-ciphertext attack and acoustic
cryptanalysis
https://www.cve.org/CVERecord?id=CVE-2013-4576
CWE Version 4.14
CWE-1300: Improper Protection of Physical Side Channels
CWE-1300: Improper Protection of Physical Side Channels