CWE-310: Cryptographic Issues

The P1735 IEEE standard describes methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP. Some of these attack vectors are well-known, such as padding-oracle attacks. Others are new, and are made possible by the need to support the typical uses of the underlying IP. In particular, the need for commercial electronic design automation (EDA) tools to synthesize multiple pieces of IP into a fully specified chip design and to provide HDL syntax errors. These flaws can be exploited by leveraging the commercial EDA tool as a black-box oracle. In addition to being able to recover entire plaintext IP, one can produce standard-compliant ciphertexts of IP that have been modified to include targeted hardware Trojans.

Design of complex electronics design intellectual property (IP) involves multiple IP owners. To prevent rogue entities in the design flow from stealing their IPs, they use the P1735 IEEE standard to provide confidentiality and access control. The standard not only recommends poor cryptographic choices, it is vague/silent on security critical decisions.

The following CVE IDs were assigned to document weaknesses in the P1735 standard as described in the researcher's paper.

• CVE-2017-13091: improperly specified padding in CBC mode allows use of an EDA tool as a decryption oracle.
• CVE-2017-13092: improperly specified HDL syntax allows use of an EDA tool as a decryption oracle
• CVE-2017-13093: modification of encrypted IP cyphertext to insert hardware trojans.
• CVE-2017-13094: modification of the encryption key and insertion of hardware trojans in any IP.
• CVE-2017-13095: modification of a license-deny response to a license grant.

• CVE-2017-13096: modification of Rights Block to remove or relax access control.
• CVE-2017-13097: modification of Rights Block to remove or relax license requirement.

An adversary can recover electronic design IPs encrypted using the P1735 workflow, resulting in IP theft and/or analysis of security critical features, as well as the ability to insert hardware trojans into an encrypted IP without the knowledge of the IP owner. Impacts may include loss of profit and reputation of the IP owners as well as integrated circuits (ICs) with trojans that contain backdoors, perform poorly, or even fail completely. See the researcher's paper for full impact details.

Apply an update

Developers of EDA software can apply suggested fixes from the researcher's paper.

Users may apply a vendor update to their EDA software, as it becomes available. More vendor information is available below.