@inproceedings{WeissRennerMottoketal., author = {Weiss, Nils and Renner, Sebastian and Mottok, J{\"u}rgen and Matoušek, V{\´a}clav}, title = {Automated Threat Evaluation of Automotive Diagnostic Protocols}, series = {ESCAR USA, 2021, Virtual}, booktitle = {ESCAR USA, 2021, Virtual}, url = {http://nbn-resolving.de/urn:nbn:de:bvb:898-opus4-29882}, pages = {20}, abstract = {Diagnostic protocols in automotive systems can offer a huge attack surface with devastating impacts if vulnerabilities are present. This paper shows the application of active automata learning techniques for reverse engineering system state machines of automotive systems. The developed black-box testing strategy is based on diagnostic protocol communication. Through this approach, it is possible to automatically investigate a highly increased attack surface. Based on a new metric, introduced in this paper, we are able to rate the possible attack surface of an entire vehicle or a single Electronic Control Unit (ECU). A novel attack surface metric allows comparisons of different ECUs from different Original Equipment Manufacturers (OEMs), even between different diagnostic protocols. Additionally, we demonstrate the analysis capabilities of our graph-based model to evaluate an ECUs possible attack surface over a lifetime.}, language = {en} } @misc{RennerPozzobonMottok, author = {Renner, Sebastian and Pozzobon, Enrico and Mottok, J{\"u}rgen}, title = {Current and Future Efforts in Benchmarking NIST LWC Ciphers}, series = {4th Lightweight Cryptography Workshop 2020 at NIST, Gaithersburg, USA}, journal = {4th Lightweight Cryptography Workshop 2020 at NIST, Gaithersburg, USA}, language = {en} } @misc{RennerPozzobon, author = {Renner, Sebastian and Pozzobon, Enrico}, title = {SIM SIMulator}, series = {IT Security Conference Troopers19, 2019, Heidelberg, Germany}, journal = {IT Security Conference Troopers19, 2019, Heidelberg, Germany}, abstract = {Der Vortrag pr{\"a}sentierte ein Tool, das die Simulation einer SIM-Karte durch einen Standard-Mikrocontroller erm{\"o}glicht. Mit diesem T{\"a}uschungsman{\"o}ver kann die Authentifizierung des 3G-Mobilfunkstandards seitens der SIM-Karte umgangen werden. Tritt zus{\"a}tzliche Hardware hinzu, die eine 3G-Basisstation vort{\"a}uscht, l{\"a}sst sich eine Man-in-the-Middle-Attacke im 3G-Netz durchf{\"u}hren. In diesem Szenario ist es m{\"o}glich, die sensiblen Kommunikationsdaten, also den gesamten Datenverkehr beispielsweise zwischen einem Pkw und den Backend-Servern des Herstellers, auszulesen und zu untersuchen. Zudem eignet sich das Tool zum Pentesten von Modems oder SIM- beziehungsweise Smartcard-Applikationen. Der komplette Aufbau des sogenannten SIMulators ist als Open-Source-Software frei verf{\"u}gbar und auf GitHub abrufbar.}, language = {en} } @inproceedings{FrauenschlaegerRennerMottok, author = {Frauenschl{\"a}ger, Tobias and Renner, Sebastian and Mottok, J{\"u}rgen}, title = {Security Improvements by Separating the Cryptographic Protocol from the Network Stack onto a Multi-MCU Architecture}, series = {Architecture of Computing Systems - ARCS 2020: 33rd international conference, Aachen, Germany, May 25-28, 2020, proceedings}, booktitle = {Architecture of Computing Systems - ARCS 2020: 33rd international conference, Aachen, Germany, May 25-28, 2020, proceedings}, publisher = {Springer International Publishing}, doi = {10.1007/978-3-030-52794-5_14}, pages = {185 -- 199}, abstract = {The number of IoT devices in SCADA and ICS systems is rising quickly, especially in the domain of critical infrastructures. But these kinds of systems are performing mission critical tasks like controlling devices in industrial facilities or substations in the smart grid. Therefore, they are subject to a lot of regulatory standards. Yet, to provide remote access over the internet, special architectures are developed to integrate a network interface into these devices without inferring with the actual functionality. However, these architectures either lack security measures against cyber-attacks or do not offer the necessary performance for time-critical communication interfaces. To solve that, an architecture consisting of three units is introduced in this paper to provide a network interface with extensive security measures and a high performance. The main feature is the isolation of the cryptographic functionality onto an additional MCU. After proposing the basic concept, the paper presents many implementation details. Based on the current state of implementation, a concept validation of the realized architecture is described.}, language = {en} } @inproceedings{DentgenRennerMottok, author = {Dentgen, Manuel and Renner, Sebastian and Mottok, J{\"u}rgen}, title = {Equally Distributed Bus-Communication Access Rights for Inter MCU Communication Using Multimaster SPI}, series = {Architecture of Computing Systems - ARCS 2020: 33rd international conference, Aachen, Germany, May 25-28, 2020, proceedings}, booktitle = {Architecture of Computing Systems - ARCS 2020: 33rd international conference, Aachen, Germany, May 25-28, 2020, proceedings}, editor = {Brinkmann, Andr{\´e} and Karl, Wolfgang and Lankes, Stefan and Tomforde, Sven and Pionteck, Thilo and Trinitis, Carsten}, doi = {10.1007/978-3-030-52794-5_15}, pages = {200 -- 212}, abstract = {With the rising complexity and processing power of modern computer systems, the amount of MCU on a single PCB also rises. These microcontrollers often need to communicate with each other to exchange payload and control information in a bidirectional manner. Today's well-established communication protocols in MCUs either do not fit modern transmission speed requirements or do have an inappropriate master-slave attribute, which does not allow the communication partners to have equal bus access rights. Therefore, this paper introduces an extension of the Serial Peripheral Interface (SPI) to allow an equally distributed access right for the communication interface between two microcontrollers. It simultaneously does fit modern transmission speed requirements of a common network interface, so that the message transmission does not constitute a bottleneck in data processing. Besides the protocol design, we do also provide a first prototype implementation, which constitutes a proof of concept.}, language = {en} } @inproceedings{WeissRennerMottoketal., author = {Weiss, Nils and Renner, Sebastian and Mottok, J{\"u}rgen and Matoušek, V{\´a}clav}, title = {Transport Layer Scanning for Attack Surface Detection in Vehicular Networks}, series = {CSCS '20: Computer Science in Cars Symposium}, booktitle = {CSCS '20: Computer Science in Cars Symposium}, number = {7}, address = {Feldkirchen}, doi = {10.1145/3385958.3430476}, pages = {1 -- 8}, abstract = {In the beginning of every security analysis or penetration test of a system, information about the target has to be gathered. On IT-Systems a port scan is usually performed as a first step of an investigation. Since the communication protocols differ in automotive systems, generic port scanning tools can't be used for a security analysis of CANs. More complex protocols have a higher likelihood of implementation errors and bugs. On CAN networks, such payloads are transferred through International Standard Transport Protocol (ISO-TP) communication. We designed a new methodology to identify ISO-TP endpoints in automotive networks. Every of these endpoints can provide exploitable application layer protocols and therefor has to be considered during penetration testing and security analysis. We contribute a new scan approach for the automated evaluation of possible attack surfaces in automotive CAN networks which has a higher coverage and multiple advantages than state of the art approaches.}, language = {en} } @inproceedings{RennerPozzobonMottok, author = {Renner, Sebastian and Pozzobon, Enrico and Mottok, J{\"u}rgen}, title = {A Hardware in the Loop Benchmark Suite to Evaluate NIST LWC Ciphers on Microcontrollers}, series = {Information and Communications Security: 22nd International Conference, ICICS 2020, Copenhagen, Denmark, August 24-26, 2020, Proceedings}, booktitle = {Information and Communications Security: 22nd International Conference, ICICS 2020, Copenhagen, Denmark, August 24-26, 2020, Proceedings}, editor = {Meng, Weizhi}, publisher = {Springer}, address = {Cham}, doi = {10.1007/978-3-030-61078-4_28}, pages = {495 -- 509}, abstract = {The National Institute of Standards and Technology (NIST) started the standardization process for lightweight cryptography algorithms in 2018. By the end of the first round, 32 submissions have been selected as 2nd round candidates. NIST allowed designers of 2nd round submissions to provide small updates on both their specifications and implementation packages. In this work, we introduce a benchmarking framework for evaluating the performance of NIST Lightweight Cryptography (LWC) candidates on embedded platforms. We show the features and application of the framework and explain its design rationale. Moreover, we provide information on how we aim to present up-to-date performance figures throughout the NIST LWC competition. In this paper, we present an excerpt of our software benchmarking results regarding speed and memory requirements of selected ciphers. All up-to-date results, including benchmarking different test cases for multiple variants of each 2nd round algorithm on five different microcontrollers, are periodically published to a public website. While initially only the reference implementations were available, the ability of automatically testing the performance of the candidate algorithms on multiple platforms becomes especially relevant as more optimized implementations are developed. Finally, we show how the framework can be extended in different directions: support for more target platforms can be easily added, different kinds of algorithms can be tested, and other test metrics can be acquired. The focus of this paper should rather lay on the framework design and testing methodology than on the current results, especially for reference code.}, language = {en} } @inproceedings{RennerPozzobonMottoketal., author = {Renner, Sebastian and Pozzobon, Enrico and Mottok, J{\"u}rgen and Hackenberg, Rudolf}, title = {Benchmarking Software Implementations of 1st Round Candidates of the NIST LWC Project on Microcontrollers}, series = {3rd Lightweight Cryptography Workshop at NIST, Gaithersburg, USA}, booktitle = {3rd Lightweight Cryptography Workshop at NIST, Gaithersburg, USA}, abstract = {This paper introduces a custom framework for benchmarking software implementations from the National Institute of Standards and Technology (NIST) Lightweight Cryptography (LWC) project on embedded devices. We present the design and core functions of the framework and apply it to various NIST LWC authenticated encryption with associated data (AEAD) ciphers. Altogether, we evaluate the speed of 213 submitted algorithm vari-ants on four different microcontroller units (MCUs), including 32 bit ARM and 8 bit AVR architectures. To allow a more meaningful comparison, we also conduct code size tests on all four boards and RAM utilization tests on one test platform.}, language = {en} } @inproceedings{RennerMottok, author = {Renner, Sebastian and Mottok, J{\"u}rgen}, title = {Towards Key Management Challenges in the Smart Grid}, series = {ARCS Workshop 2019 - 32nd International Conference on Architecture of Computing Systems, 20-21 May 2019, Copenhagen, Denmark}, booktitle = {ARCS Workshop 2019 - 32nd International Conference on Architecture of Computing Systems, 20-21 May 2019, Copenhagen, Denmark}, editor = {Trinitis, Carsten and Pionteck, Thilo}, publisher = {VDE-Verlag}, address = {Berlin}, isbn = {978-3-8007-4957-7}, abstract = {The used technology in the power system is subject of great change. Through the use of smart devices, the systems in the power grid get interconnected between each other and remote networks. Especially the remote access to the critical smart grid environment involves new challenges in the area of security. To ensure the transmitted data and the access to the system is secured, cryptographic mechanisms have to be implemented. One critical part in this task is the management of cryptographic keys. This paper explains and defines a set of basic requirements for cryptographic key management in the smart grid. These requirements are derived from challenges present in common corporate environments. Then, basic approaches in the field of key management are stated and evaluated for the applicability in the power system. Different protocols for the implementation of key management strategies are shown and an assessment regarding their suitability for the defined requirements is conducted.}, language = {en} } @inproceedings{PozzobonWeissRenneretal., author = {Pozzobon, Enrico and Weiss, Nils and Renner, Sebastian and Hackenberg, Rudolf}, title = {A Survey on Media Access Solutions for CAN Penetration Testing}, series = {ACM Computer Science in Cars Symposium (CSCS), 2nd, 2018, Munich, Germany}, booktitle = {ACM Computer Science in Cars Symposium (CSCS), 2nd, 2018, Munich, Germany}, abstract = {Controller Area Network (CAN) is still the most used network technology in today's connected cars. Now and in the near future, penetration tests in the area of automotive security will still require tools for CAN media access. More and more open source automotive penetration tools and frameworks are presented by researchers on various conferences, all with different properties in terms of usability, features and supported use-cases. Choosing a proper tool for security investigations in automotive network poses a challenge, since lots of different solutions are available. This paper compares currently available CAN media access solutions and gives advice on competitive hard-and software tools for automotive penetration testing.}, language = {en} } @inproceedings{HackenbergWeissRenneretal., author = {Hackenberg, Rudolf and Weiss, Nils and Renner, Sebastian and Pozzobon, Enrico}, title = {Extending Vehicle Attack Surface Through Smart Devices}, series = {SECURWARE 2017 : The Eleventh International Conference on Emerging Security Information, Systems and Technologies, 11th, 2017, Rome, Italy}, booktitle = {SECURWARE 2017 : The Eleventh International Conference on Emerging Security Information, Systems and Technologies, 11th, 2017, Rome, Italy}, publisher = {IARIA}, isbn = {978-1-61208-582-1}, pages = {131 -- 135}, abstract = {Modern cars include more and more features that first emerged from the consumer electronics industry. Technologies like Bluetooth and Internet-connected services found their way into the vehicle industry. The secure implementation of these functions presents a great challenge for the manufacturers because products originating from the consumer industry can often not be easily transferred to the safety-sensitive traffic environment due to security concerns. However, common automotive interfaces like the diagnostics port are now also used to implement new services into the car. With dongles designed to read out certain vehicle data and transfer it to the Internet via the cellular network, the owner can access information about gas consumption or vehicle location through a mobile phone app, even when he is away from the car. This paper wants to emphasize new threats that appear due to the ongoing interconnection in modern cars by discussing the security of the diagnostics interface in combination with the use of an Internet-connected dongle. Potential attack vectors, as well as proof-of-concept exploits will be shown and the implications of security breaches on the safe state of the vehicle will be investigated.}, language = {en} } @inproceedings{PozzobonRennerMottoketal., author = {Pozzobon, Enrico and Renner, Sebastian and Mottok, J{\"u}rgen and Matoušek, V{\´a}clav}, title = {An optimized Bitsliced Masked Adder for ARM Thumb-2 Controllers}, series = {27th International Conference on Applied Electronics (AE): Sep 6, 2022 - Sep 7, 2022, Pilsen, Czech Republic}, booktitle = {27th International Conference on Applied Electronics (AE): Sep 6, 2022 - Sep 7, 2022, Pilsen, Czech Republic}, publisher = {IEEE}, doi = {10.1109/AE54730.2022.9919884}, pages = {4}, abstract = {The modular addition is used as a non-linear operation in ARX ciphers because it achieves the requirement of introducing non-linearity in a cryptographic primitive while only taking one clock cycle to execute on most modern architectures. This makes ARX ciphers especially fast in software implementations, but comes at the cost of making it harder to protect against side-channel information leakages using Boolean masking: the best known 2-shares masked adder for ARM Thumb micro-controllers takes 83 instructions to add two 32-bit numbers together. Our approach is to operate in bitsliced mode, performing 32 additions in parallel on a 32-bit microcontroller. We show that, even after taking into account the cost of bitslicing before and after the encryption, it is possible to achieve a higher throughput on the tested ciphers (CRAX and ChaCha20) when operating in bitsliced mode. Furthermore, we prove that no first-order information leakage is happening in either simulated power traces and power traces acquired from real hardware, after sufficient countermeasures are put into place to guard against pipeline leakages.}, language = {en} } @misc{RennerPozzobonMottok, author = {Renner, Sebastian and Pozzobon, Enrico and Mottok, J{\"u}rgen}, title = {3rd Round Ciphers Evaluation on Microcontrollers}, series = {Lightweight Cryptography Workshop (virtual): May 9-11 2022}, journal = {Lightweight Cryptography Workshop (virtual): May 9-11 2022}, publisher = {National Institute of Standards and Technology (NIST)}, address = {Gaithersburg}, language = {en} } @inproceedings{RennerPozzobonMottok, author = {Renner, Sebastian and Pozzobon, Enrico and Mottok, J{\"u}rgen}, title = {The Final Round: Benchmarking NIST LWC Ciphers on Microcontrollers}, series = {Attacks and Defenses for the Internet-of-Things, 5th International Workshop, ADIoT 2022: Copenhagen, Denmark, September 30, 2022, Revised Selected Papers}, booktitle = {Attacks and Defenses for the Internet-of-Things, 5th International Workshop, ADIoT 2022: Copenhagen, Denmark, September 30, 2022, Revised Selected Papers}, editor = {Li, Wenjuan and Furnell, Steven and Meng, Weizhi}, publisher = {Springer Nature}, address = {Cham}, isbn = {978-3-031-21311-3}, doi = {10.1007/978-3-031-21311-3_1}, pages = {1 -- 20}, abstract = {In this work, we present our benchmarking results for the ten finalist ciphers of the Lightweight Cryptography (LWC) project initiated by National Institute of Standards and Technology (NIST). We evaluate the speed and code size of various software implementations on five different platforms featuring four different architectures. Moreover, we benchmark the dynamic memory utilization of the remaining NIST LWC algorithms on one 32-bit ARM controller. We describe our test cases and methodology and provide some information regarding the design and properties of the finalists before showing and discussing our results. Altogether, we evaluated almost 300 implementations of the 3rd round candidates and pick the most appropriate and best (primary) implementation of each cipher for our comparisons. We include a variant of AES-GCM in our benchmarking in order to be able to compare the state-of-the-art to the novel LWC ciphers. Our research gives an overview over the performance of the latest software implementations of the NIST LWC finalists and shows under which circumstances which candidate is performing the best in our individual test cases. Additionally, we make all benchmarking results, the code for our test framework and every tested implementation available to the public to ensure a transparent testing process.}, language = {en} } @inproceedings{RennerPozzobonMottok, author = {Renner, Sebastian and Pozzobon, Enrico and Mottok, J{\"u}rgen}, title = {Evolving a Boolean Masked Adder Using Neuroevolution}, series = {Attacks and Defenses for the Internet-of-Things, 5th International Workshop, ADIoT 2022: Copenhagen, Denmark, September 30, 2022, Revised Selected Papers}, booktitle = {Attacks and Defenses for the Internet-of-Things, 5th International Workshop, ADIoT 2022: Copenhagen, Denmark, September 30, 2022, Revised Selected Papers}, editor = {Li, Wenjuan and Furnell, Steven and Meng, Weizhi}, publisher = {Springer Nature}, address = {Cham}, isbn = {978-3-031-21310-6}, doi = {10.1007/978-3-031-21311-3_2}, pages = {21 -- 40}, abstract = {The modular addition is a popular building block when designing lightweight ciphers. While algorithms mainly based on the addition can reach very high performance, masking their implementations results in a huge penalty. Since efficient protection against side-channel attacks is a requirement in lots of use cases, we focus on optimizing the Boolean masking of the modular addition. Contrary to recent related work, we target evolving a masked full adder instead of parts of a parallel prefix adder. We study how techniques typically found in neural network evolution and genetic algorithms can be adapted in order to help in evolving an efficiently masked adder. We customize a well-known neuroevolution algorithm, develop an optimized masked adder with our new approach and implement the ChaCha20 cipher on an ARM Cortex-M3 controller. We compare the performance of the protected neuroevolved implementation to solutions found by traditional search methods. Moreover, the leakage of our new solution is validated by a t-test conducted with a leakage simulator. We present under which circumstances our masked implementation outperforms related work and prove the feasibility of successfully using neuroevolution when searching for complex Boolean networks.}, language = {en} } @phdthesis{Renner, author = {Renner, Sebastian}, title = {Secure Lightweight Authenticated Encryption for Critical Infrastructures in the Internet of Things}, url = {http://nbn-resolving.de/urn:nbn:de:bvb:91-diss-20230922-1703211-1-0}, pages = {xix, 135}, abstract = {The cryptographic protection of transmitted data on resource-constraint IoT devices presents a difficult challenge. In this thesis, a benchmarking framework for the performance evaluation of lightweight encryption algorithms is introduced. It is analyzed, if and when novel encryption algorithms are more suitable for IoT use cases than the current standard. Besides comparing the sole performance, the cost for hardening the algorithms against side-channel analysis is discussed.}, language = {en} }