eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Smart cards and cryptographic hardware devices are vulnerable to a form of attack called Differential Power Analysis. A DPA attack enables a skilled hacker to non-intrusively obtain or modify secure data on a cryptographic device such as a smart card or a cryptographic token. DPA works by monitoring the electrical signals of a device, samples the data, and extracts information such as secret keys or PINs from the device using statistical methods.
Although DPA attacks are not easily performed and require significant cryptography and electrical engineering know-how, a person who has the right skill set and some inexpensive, off-the-shelf equipment could use DPA to break into most cryptographic devices in a fairly short time.
Now Cryptography Research Inc. is ready to help enterprises stop DPA intrusions. The San Francisco-based company will be releasing a DPA workstation test tool next week that will allow companies to test how well their smart card products can stand up to power-related vulnerabilities.
CRIs DPA workstation is a comprehensive testing package that includes hardware and software, in-depth training and product support. The packages hardware is a standard PC running Windows 2000 with proprietary analysis software pre-installed. The system also has a smart card data acquisition system that includes a specialized reader with fiber optic connections to the PC and a GPIB (General Purpose Interface Bus)-connected digital oscilloscope for preliminary data viewing.
The workstation can sample power consumption data at a high sampling rate (up to 500MHz), and its high-speed analysis software can analyze large chunks of data quickly. The system also has a programmable shell that allows users to automate test scripts using macros.
The DPA workstation is a very specialized tool and doesnt come cheap, costing anywhere from $145,000 to $200,000 depending on the configuration. Although the DPA workstation can be customized to test different kinds of cryptographic devices, it can only perform DPA testing.
CRIs DPA testing tool targets not only smart card vendors, but also evaluation labs. Unfortunately, there arent many tools out there that perform vulnerability testing on smart cards, so corporations have to pay a premium for the tools. I believe the DPA workstations high cost will limit its appeal to large companies with a specialized need to perform in-house characterization of cryptographic devices.
For sites that dont want to pay the hefty price for the device to test in-house, CRI also provides testing services with its own test labs.
Technical Analyst Francis Chu can be reached at francis_chu@ziffdavis.com.