Researchers from NCC Group vulnerabilities () in Qualcomm chips, allowing the determination of the contents of closed encryption keys stored in the isolated Qualcomm QSEE (Qualcomm Secure Execution Environment) enclave, based on ARM TrustZone technology. The issue manifests in the Snapdragon SoC, which is widely used in smartphones running the Android platform. Fixes addressing the problem are already included in the April Android update and in new firmware releases for Qualcomm chips. Qualcomm took over a year to prepare the fix — the initial information about the vulnerability was sent to Qualcomm on March 19, 2018.
It is worth noting that ARM TrustZone technology allows for the creation of hardware-isolated secure environments that are completely separate from the main system and are executed on a separate virtual processor using a separate specialized operating system. The primary purpose of TrustZone is to ensure the isolated execution of encryption key handlers, biometric authentication, payment data, and other confidential information. Interaction with the main OS occurs indirectly through a dispatch interface. Closed encryption keys are placed within a hardware-isolated key storage, which, when properly implemented, helps prevent their leakage in case of a compromise of the main system.
The vulnerability is associated with a flaw in the implementation of the elliptic curve processing algorithm, which led to the leakage of information about the data processing progress. Researchers developed a side-channel attack technique that allows the recovery of closed keys stored in an isolated . The leaks are determined based on the analysis of branch prediction activity and changes in data access times in memory. In an experiment, researchers successfully demonstrated the recovery of 224-bit and 256-bit ECDSA keys from the hardware-isolated key store used in the Nexus 5X smartphone. To recover the key, approximately 12,000 digital signatures were generated, taking over 14 hours. The attack utilized the toolkit .
The primary reason for the problem is the shared use of common hardware components and cache for calculations in TrustZone and the main system—isolation is implemented at the level of logical separation, but using shared computational blocks and leaving traces of computations and transition address information in the common processor cache. By using the Prime+Probe method, which is based on assessing the change in access time to cached information, it is possible to track data flows and signs of code execution related to digital signature calculations in TrustZone with fairly high accuracy by checking for specific patterns in the cache.
Most of the time spent generating a digital signature using ECDSA keys in Qualcomm chips is taken up by performing multiplication operations in a loop with a constant initialization vector for each signature (). If an attacker can recover even a few bits of information about this vector, it becomes possible to carry out an attack by sequentially recovering the entire private key.
In the case of Qualcomm, two leakage points of such information have been identified in the multiplication algorithm: during table lookup operations and in the code for conditionally extracting data based on the value of the last bit in the 'nonce' vector. Despite Qualcomm's measures in the code against information leakage through side channels, the developed attack method allows bypassing these measures and determining several bits of the 'nonce' value, which is sufficient for recovering 256-bit ECDSA keys.
Source: opennet.ru
