International Association for Cryptologic Research

International Association
for Cryptologic Research

CryptoDB

Dismantling SecureMemory, CryptoMemory and CryptoRF

Authors:
Flavio D. Garcia
Peter van Rossum
Roel Verdult
Ronny Wichers Schreur
Download:
URL: http://eprint.iacr.org/2010/169
Search ePrint
Search Google
Abstract: The Atmel chip families SecureMemory, CryptoMemory, and CryptoRF use a proprietary stream cipher to guarantee authenticity, confidentiality, and integrity. This paper describes the cipher in detail and points out several weaknesses. One is the fact that the three components of the cipher operate largely independently; another is that the intermediate output generated by two of those components is strongly correlated with the generated keystream. For SecureMemory, a single eavesdropped trace is enough to recover the secret key with probability 0.57 in 2^{39} cipher ticks. This is a factor of 2^{31.5} faster than a brute force attack. On a 2 GHz laptop, this takes around 10 minutes. With more traces, the secret key can be recovered with virtual certainty without significant additional cost in time. For CryptoMemory and CryptoRF, if one has 2640 traces it is possible to recover the key in 2^{52} cipher ticks, which is 2^{19} times faster than brute force. On a 50 machine cluster of 2 GHz quad-core machines this would take less than 2 days.
BibTeX
@misc{eprint-2010-23070,
  title={Dismantling SecureMemory, CryptoMemory and CryptoRF},
  booktitle={IACR Eprint archive},
  keywords={stream ciphers, practical cryptanalysis, smartcard security, RFID},
  url={http://eprint.iacr.org/2010/169},
  note={to appear in ACM CCS 2010 flaviog@cs.ru.nl 14790 received 30 Mar 2010, last revised 30 Jun 2010},
  author={Flavio D. Garcia and Peter van Rossum and Roel Verdult and Ronny Wichers Schreur},
  year=2010
}