Analyzing, breaking and improving certified cryptographic hardware (TPMs and smartcards)
The cryptographic hardware like smartcards or Trusted Platform Modules (TPMs) is a crucial component of many security systems, serving as an authentication token, digital signature device, secure storage for encryption keys, or providing a platform’s root of trust. Despite the existence of extensive security certification schemes like Common Criteria or NIST FIPS140-2, the security vulnerabilities are still found in such devices, partially due to the overall closeness of the secure hardware ecosystem.
The talk will present a suite of the open tools for black-box security analysis of cryptographic hardware developed by CRoCS laboratory at Masaryk University, and vulnerabilities found like ROCA (CVE-2017-15361) or Minerva (CVE-2019-15809) which lead to large practical impact with estimated 1-2 billion devices affected worldwide. As the analysis is performed without the need for knowledge of the hardware design or firmware source code, it can be applied not only by specialized certification laboratories but also by the end-users of these devices – all with the goal of better and continuous security analysis and more transparent certification.
Speaker: Petr Švenda
Find more at the official website - https://research.redhat.com/research-...