Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.arch.embedded > #25838

Re: Is protected flash secure?

Show all headers | View raw

On 2/16/2017 3:41 PM, Klaus Kragelund wrote:
> Hi
>
> So, I have been using a ST Cortex M0 STM32, NXP LPC, PIC32 and also a
> Renesas RX63. Just for fun. They look interesting as a potential candidate
>
> All processors has a bit to set it up in protected mode, so the flash with
> proprietary IP cannot be read out
>
> But, say my competitor wants to dig into my code

What resources do they have available?  How motivated are they to attempt
outright theft vs. just being a "copycat" (at some other level)?

> Is there really such a thing as a safe micro controller which memory is
> protected from Reverse Engineering conducted by a Russian or Chinese firm?
>
> Isn't it just a matter of how much you pay for an invasive attack? (I have
> read numbers from 1000 to 20.000 USD)

Exactly.  Virtually every "protection scheme" can be beat; the question is
where you draw the line between practical vs. impractical for a given attack
vector.

Is it cheaper for me to try to break your ("hardware") protection?  Bribe
one of your employees?  Reimplement your design from black-box observations
of its behavior/specifications?

[There are firms that specialize in the latter -- and I'm sure others who
resort to the other approaches!]

If you are truly interested in the types of attacks that can be mounted
on your hardware with MINIMAL access to the device's internals, there
are lots of papers on the subject.  (E.g., dynamically monitoring
power supply current to deduce the instructions that are being executed)

Back to comp.arch.embedded | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Is protected flash secure? Klaus Kragelund <klauskvik@hotmail.com> - 2017-02-16 14:41 -0800
  Re: Is protected flash secure? Johann Klammer <klammerj@NOSPAM.a1.net> - 2017-02-17 00:22 +0100
  Re: Is protected flash secure? Don Y <blockedofcourse@foo.invalid> - 2017-02-16 20:38 -0700
  Re: Is protected flash secure? Paul Rubin <no.email@nospam.invalid> - 2017-02-16 20:54 -0800
  Re: Is protected flash secure? Theo Markettos <theom+news@chiark.greenend.org.uk> - 2017-02-17 12:38 +0000

csiph-web