lukas-heilgenbrunner
6529bf97b3
All checks were successful
Build Typst document / build_typst_documents (push) Successful in 8s
75 lines
2.3 KiB
Plaintext
75 lines
2.3 KiB
Plaintext
#import "@preview/ichigo:0.1.0": config, prob
|
|
#import "@preview/algorithmic:0.1.0"
|
|
#import algorithmic: algorithm
|
|
|
|
#show: config.with(
|
|
course-name: "SMART CARDS & NFC",
|
|
serial-str: "k12104785",
|
|
author-info: [
|
|
Lukas Heiligenbrunner
|
|
],
|
|
author-names: "Lukas Heiligenbrunner",
|
|
)
|
|
|
|
#prob[
|
|
#figure(
|
|
image("Screenshot From 2024-10-21 14-07-41.png", width: 80%),
|
|
caption: [
|
|
Pin try counter.
|
|
],
|
|
)
|
|
|
|
][
|
|
- The PiN_TRY_COUNTER is prone to turn off attacks.
|
|
Each time the chip resets the ram value of the counter is cleared and one gets basically infinite retries.
|
|
|
|
Solution:
|
|
- Store counter in non-volatile memory eg. EEPROM, flash, eMMC.
|
|
- Store counter in a secure server backend.
|
|
|
|
- Depending on the implementation of the comparison operation, it might leak side-channel information.
|
|
For example, if the comparison is done byte-wise, the attacker can determine the correct byte by comparing the time it takes to compare the bytes.
|
|
|
|
Solution:
|
|
- Implement a constant time comparison operation.
|
|
]
|
|
|
|
#prob[
|
|
#figure(
|
|
image("Screenshot From 2024-10-21 14-10-15.png", width: 80%),
|
|
caption: [
|
|
Pin comparision (PIN == REF_PIN).
|
|
],
|
|
)
|
|
][
|
|
- The comparison of the entered pin and the reference pin is array entry wise.
|
|
If a entry doesn't match the comparison is short-handed and the function returns no match.
|
|
This is prone to a timing side-channel attack. If a pin digit matches the comparison takes longer than if it doesn't.
|
|
|
|
Solution:
|
|
- Implement a constant time comparison operation. (no comparison shorthand)
|
|
|
|
For example:
|
|
#algorithm({
|
|
import algorithmic: *
|
|
Function("Constant-Time-Compare", args: ("PIN", "Ref_PIN"), {
|
|
Cmt[Check if lengths are equal]
|
|
If(cond: $"length" ("PIN") != "length"("Ref_PIN")$, {
|
|
Return[false]
|
|
})
|
|
State[]
|
|
Cmt[Initialize result variable to 0]
|
|
Assign[$"result"$][$0$]
|
|
State[]
|
|
Cmt[Loop through each character in PIN and Ref_PIN]
|
|
For(cond: [$i=0$; $i < "length"("PIN") - 1$], {
|
|
Cmt[XOR corresponding characters and accumulate result]
|
|
Assign[$"result"$][$"result" or ("PIN"[i] xor "Ref_PIN"[i])$]
|
|
})
|
|
State[]
|
|
Cmt[Return true if result is 0, else false]
|
|
Return[$"result" == 0$]
|
|
})
|
|
})
|
|
]
|