Secure JTAG Implementation Using Schnorr Protocol

The standard IEEE 1149.1 (Test Access Port and Boundary-Scan Architecture, also known as JTAG port) provides a useful interface for embedded systems development, debug, and test. In an 1149.1-compatible integrated circuit, the JTAG port allows the circuit to be easily accessed from the external world, and even to control and observe the internal scan chains of the circuit. However, the JTAG port can be also exploited by attackers to mount several cryptographic attacks. In this paper we propose a novel architecture that implements a secure JTAG interface. Our JTAG scheme allows for mutual authentication between the device and the tester. In contrast to previous work, our scheme uses provably secure asymmetric-key based authentication and verification protocols. The complete scheme is implemented in hardware and integrated with the standard JTAG interface. Detailed area and timing results are also presented.

This work was supported in part by the Research Council KU Leuven: GOA TENSE (GOA/11/007), by the Flemish iMinds projects, and by the European Commission through the ICT programme under contract ICT-2007-216676 ECRYPT II. In addition, this work is supported in part by the Flemish Government, FWO G.0550.12N, by the Hercules Foundation AKUL/11/19, and by the European Commission through the ICT programme under FP7-ICT-2011-8 HINT. Amitabh Das was initially funded by the Erasmus Mundus External Cooperation Window Lot 15 (EMECW15) when part of the work was performed. Santosh Ghosh is a beneficiary of a mobility grant from the Belgian Federal Science Policy Office co-funded by the Marie Curie Actions from the European Commission. The authors are thankful to Dr. Junfeng Fan (ESAT/COSIC, KU Leuven) for his useful comments in improving the paper.

Authors and Affiliations

1. KU Leuven and iMinds, ESAT/COSIC, Leuven, Belgium

   Amitabh Das, Santosh Ghosh, Stefaan Seys & Ingrid Verbauwhede

2. LIRMM (Université Montpellier II/CNRS UMR 5506), Montpellier, France

   Jean Da Rolt, Sophie Dupuis, Giorgio Di Natale, Marie-Lise Flottes & Bruno Rouzeyre

Corresponding author

Correspondence to Amitabh Das.

Responsible Editor : M. Tehranipoor

Appendix A

ECC-based Schnorr Protocol

In the manufacturer environment scenario, A is the prover (Secure JTAG) and B is the verifier (Test server):

P_a is the public key of A and k_a is the private key of A, which are related by:

where P is the initial point on the Elliptic curve (base point), which is public. k_a.P represents a point multiplication of scalar k_a with base-point P.

Goal: B wants to be ensured the identity of A, in other words A knows k_a.

Protocol:

1. 1)

   A generates a random number n_a and sends an intermediate value ‘T_a’ (point multiplication of n_a and P) to B;

   $$ \begin{array}{ll}\mathrm{A}\to \mathrm{B}:\hfill & {\mathrm{T}}_{\mathrm{a}}={\mathrm{n}}_{\mathrm{a}}.\mathrm{P}\hfill \end{array} $$
2. 2)

   B generates a random number n_b and sends it to A;

   $$ \begin{array}{ll}\mathrm{A}\leftarrow \mathrm{B}:\hfill & {\mathrm{n}}_{\mathrm{b}}\hfill \end{array} $$
3. 3)

   A sends ‘s’ to B;

   $$ \begin{array}{ll}\mathrm{A}\to \mathrm{B}:\hfill & \mathrm{s}={\mathrm{n}}_{\mathrm{a}}+{\mathrm{k}}_{\mathrm{a}}.{\mathrm{n}}_{\mathrm{b}}\hfill \end{array} $$

Here k_a.n_b represents an integer multiplication, while ‘+’ indicates an ordinary addition.

B can verify that A is A by calculating the point multiplication of scalar s with base-point P and cross-checking it with the modular addition of ‘T_a’ with the point multiplication of n_b and P_a:

Thus B verifies the identity of A by only knowing A’s public key P_a.

For in-the-field updates, debug and test:

A is the prover (Secure JTAG), when B is the verifier (Test server).

B is the prover (Test server), when A is the verifier (Secure JTAG).

P_a is the public key of A and k_a is the private key of A, which are related by:

P_a = k_a.P, where P is the initial point on the Elliptic curve (base point), which is public.

P_b is the public key of B and k_b is the private key of B, which are related by:

P_b = k_b.P, where P is the initial point on the Elliptic curve (base point), which is public.

Goal: B wants to be sure that A is actually A, in other words, that A knows k_a. Similarly, A wants to be sure that B is actually B, in other words, that B knows k_b.

Protocol:

1. 1)

   A generates a random number n_a, and sends it along with an intermediate value ‘T_a’ to B, which is calculated as:

   $$ \begin{array}{ll}\mathrm{A}\to \mathrm{B}:\hfill & {\mathrm{T}}_{\mathrm{a}}={\mathrm{n}}_{\mathrm{a}}.\mathrm{P}\hfill \end{array} $$
2. 2)

   B generates two random number n_b and n_b’, and sends n_b along with an intermediate value ‘T_b’ to A, which is calculated as:

   $$ \begin{array}{ll}\mathrm{A}\leftarrow \mathrm{B}:\hfill & {\mathrm{T}}_{\mathrm{b}}={\mathrm{n}}_{\mathrm{b}}'.\mathrm{P},\kern0.5em {\mathrm{n}}_{\mathrm{b}}\hfill \end{array} $$
3. 3)

   A generates another random number n_a’ and sends it along with sends ‘s’ to B, B sends ‘s₁’ to A:

   $$ \begin{array}{l}\begin{array}{ll}\mathrm{A}\to \mathrm{B}:\hfill & \mathrm{s}={\mathrm{n}}_{\mathrm{a}}+{\mathrm{k}}_{\mathrm{a}}.{\mathrm{n}}_{\mathrm{b}},\kern0.5em {\mathrm{n}}_{\mathrm{a}}'\hfill \end{array}\hfill \\ \begin{array}{ll}\mathrm{A}\leftarrow \mathrm{B}:\hfill & {\mathrm{s}}_1={\mathrm{n}}_{\mathrm{b}}'+{\mathrm{k}}_{\mathrm{b}}.{\mathrm{n}}_{\mathrm{a}}'\hfill \end{array}\hfill \end{array} $$

B can verify that A is A by calculating:

Similarly, A can verify that B is B by calculating:

Thus B verifies the identity of A by only knowing A’s public key P_a, and A verifies the identity of B by only knowing B’s public key P_b.

Moreover, n_a.n_b’.P can be used as a session key K to encrypt all future communication between the security chip and test server. The reason behind this is that A knows n_a.P and n_b’, while B knows n_a and n_b’.P from which they can construct K, but any unauthorized party cannot do so. This may be particularly useful for instance, in the case of pay-TV updates happening on the set-top box from a remote server using a network communication, where an eavesdropper can listen to the channel in between.

Appendix B

ECC based Schnorr for secure JTAG

The execution of the Schnorr protocol is now explained in some detail using the block diagram below:

1. 1)

   First, the JTAG public key Pa is calculated. For this, the ECC controller module sends the private JTAG key k_a (from on-chip storage) and the base point coordinates and other curve parameters (prime number, R*R mod n) from the non-volatile memory to the ECC point multiplier module. It then instructs the point multiplier module to start an ECC point multiplication operation.

2. 2)

   The ECC point multiplier then performs a point multiplication of the scalar k_a with the base point P and returns the result (P_a) back to the ECC controller module. This result is stored in a 192-bit temporary register inside the controller module.

3. 3)

   A 192-bit random number n_a is generated by the on-chip random-number generator and sent to the ECC controller module.

4. 4)

   The ECC controller module then sends this n_a and the base point coordinates and other curve parameters from the non-volatile memory to the ECC point multiplier module. It then instructs the point multiplier module to start an ECC point multiplication operation.

5. 5)

   The ECC point multiplier then performs a point multiplication of the scalar n_a with the base point P and returns the result (‘T_a’) back to the ECC controller module. This result is stored in another temporary register inside the controller module.

6. 6)

   The test server then generates a 192-bit random number n_b and sends this to the JTAG module bit-by-bit through the TDI input. This is then stored in the 192-bit shift (data) register of the JTAG.

7. 7)

   n_b and the private key of the JTAG (k_a) are transferred to the ECC.

8. 8)

   For the integer multiplication of k_a with n_b, the ECC controller instructs the arithmetic module inside the point multiplier module to perform a modular multiplication of k_a with n_b using the ‘order of the prime’ (fetched from the non-volatile memory storage of curve parameters) as the modulus (this is equivalent to integer multiplication of k_a with n_b). The result is stored back in a 192-bit register inside the ECC controller module.

9. 9)

   A modular addition of n_a with k_a.n_b is then performed in the arithmetic block inside the point multiplier module. For this, the appropriate control is provided from the ECC controller which also stores the result of the computation (‘s’) in the same 192-bit register.

10. 10)

    The ECC controller module then sends ‘s’ and the base point coordinates and other curve parameters from the non-volatile memory to the ECC point multiplier module. It then instructs the point multiplier module to start an ECC point multiplication operation.

11. 11)

    The ECC point multiplier then performs a point multiplication of the scalar ‘s’ with the base point P and returns the result back to the ECC controller module. This result is stored in the same register inside the controller module.

12. 12)

    Next, the ECC controller module then sends n_b and the public key of the JTAG (P_a) and other curve parameters from the non-volatile memory to the ECC point multiplier module. It then instructs the point multiplier module to start an ECC point multiplication operation.

13. 13)

    The ECC point multiplier then performs a point multiplication of the scalar n_b with P_a and returns the result back to the ECC controller module. This result is stored in another temporary register inside the controller module.

14. 14)

    A modular addition of the stored ‘T_a’ with n_b.P_a is then performed in the arithmetic block inside the point multiplier module. For this, the appropriate control is provided from the ECC controller which also stores the result of the computation in the same 192-bit register.

15. 15)

    The result of the above computation (T_a + n_b.P_a) is then compared with s.P computed and stored earlier inside the comparator module in the ECC controller module. If they match, then only the JTAG is allowed to enter the test and debug modes, otherwise it remains in the bypass mode.

Appendix C

Point Addition and Point Doubling in Affine Coordinates:

When P = (x_P,y_P) and Q = (x_Q,y_Q) are not negative of each other, then P + Q = R where

Note that s is the slope of the line through P and Q.

Similarly, When y_P is not 0, then 2P = R where

Recall that ‘a’ is one of the parameters chosen with the elliptic curve and that s is the tangent on the point P.

Formulae for ECC Point Addition and Doubling in Projective Coordinates:

Appendix D

Appendix E

Modular adder/subtractor

A “naïve” implementation of a modular addition A+B mod P is presented in Fig. 5.a; it consists in computing A+B, and then subtracting P to this result. A comparison between these two intermediate results allows choosing which one to use for the final result. However, this comparator could be avoided by observing the carry (borrow) out signal of addition (subtraction) which could be realized by a single OR gate (instead of a 192-bit comparator) such as presented in Fig. 5.b. Concerning the subtraction, the principle is the same: computing A-B and then A-B+P, and comparing these intermediate results to choose which one to use for the final result. A naïve and an optimized version of the subtraction are presented in Fig. 5.c and d.

Modular addition and subtraction implementations

Full size image

The two optimized versions (Fig. 5.b and d) have been combined to produce an optimized modular adder/subtractor block such as depicted in Fig. 5.e. In this architecture an input (op_type) is used to generate whether an addition or a subtraction (put to 1 for an addition and 0 for a subtraction). This architecture uses two adder/subtractor blocks (i.e., an addition combined with the inversion (or not) of the second operand using XOR gates and the input carry to ‘1’ (or ‘0’)) and the optimized comparison implementation depicted earlier. Concerning the architecture used for the additions/subtractions, we have used the library provided by the synthesizer which includes highly optimized RTL for arithmetic building blocks.

In the end, an efficient adder architecture combined with an optimized comparison implantation have led us optimize the area of more than 90 %, by comparison with the area obtained from a VHDL file directly generated by our Gezel implementation.

Appendix F

16-cycle JTAG TAP Controller State Diagram

TAP controller state diagram

Full size image

Reprints and permissions