search

tillitis / tillitis-key1

Board designs, FPGA verilog, firmware for TKey, the flexible and open USB security key 🔑
https://www.tillitis.se
382 stars 24 forks source link

Idea: ability (but not enforced) to clear (or R/W) CDI #186

Open cobratbq opened 3 months ago

cobratbq commented 3 months ago

I'm posting this idea from software-development perspective. I may ask something that's hard to achieve or just an exceptional case.

Would it be possible to allow writing to the CDI addresses from the loaded program-binary? That would allow initialization to do the necessary processing, then afterwards clear the CDI. (An alternative would be to allow clearing the MMIO address pointers, although strictly speaking this introduces obscurity rather than security.)

The threat I'm thinking of, is when an attacker manages to manipulate a pointer address such that the CDI is addressed rather than any other arbitrary piece of memory. I can compute values on-the-fly and securely wipe them, but the CDI remains available.

I suspect one can argue for and against this idea. I suspect it depends on the way a program is developed whether this feature is useful.

dehanj commented 3 months ago

It is possible to make the CDI writable in app-mode. It is also quite easy hardware wise. What we do today is to simply check if we are in fw-mode or in app-mode. If we are in app-mode we remove the write_enable for the CDI, so it becomes read-only.

We have discussed this internally as well, to keep the CDI writable, but we have not landed in any decision. You bring up a good point, to have it writable simply for the reason of removing access to sensitive data, once the app has used it for whatever its purpose is.

cobratbq commented 3 months ago

To make explicit what has not been said: CDI is intended to be the root of any number of derived secrets. It enables programs to become deterministically unpredictable. To erase/replace CDI after deriving secrets ("branches" in this tree), we cut off the source/root. This prevents extracting the CDI and recreating the device's execution in software.

secworks commented 3 months ago

We could allow an app to mark the CDI as read, used - which would then block any further read access from app mode. We could also trigger a wipe, zeroisation too, to ensure that the CDI is not present in the FPGA at all.

secworks commented 2 months ago

Draft PR https://github.com/tillitis/tillitis-key1/pull/204 adds the ability for device apps to lock down access to the CDI. The PR adds a new API-address ADDR_CDI_DONE. When written to will enforce that any future reads to the CDI returns an all zero value. The device must be reset to enable CDI read again.