# Can a hard drive store clear text data that is physically impossible to retrieve?

I'm trying to study how HSM and TPM works when storing secret data in clear text. How can they achieve physical impossibility in retrieving secret data?

I get the point in software, if you just have input and no outputs then it should be impossible through software to retrieve something.

But, I want to know the hardware (physics) part as well. How can an IC achieve physical impossibility to retrieve data? Let's assume the data is stored in an hard drive permanently.

• I once shorted the terminals on my motherboard where the button cell battery sits and wiped my usb keyboard drivers, so I might dig into some HP white papers. Had a hardware password set too so that day was pretty much a nightmare. – Q-Club Feb 7 '18 at 2:52
• If data is physically impossible to retrieve, then it hasn't been "stored" in any meaningful sense :) – hobbs Feb 7 '18 at 8:20
• I always store my backups in /dev/null, its quite impossible to retrieve them from there. – PlasmaHH Feb 7 '18 at 9:10
• @hobbs I assume it's tongue-in-cheek, but... The implied claim is "impossible to retrieve from the outside". The chip itself can read it, use the data to perform some operation, and discard the data again without ever leaking the secret to the outside. – Luaan Feb 7 '18 at 11:42
• Use the little-known but well-documented Signetics Write-Only Memory chip. sigwom.com/?page_id=17 – Carl Witthoft Feb 8 '18 at 15:46

The normal way is to keep secret data in volatile static RAM (i.e. 6 transistors per bit, like in current CPU caches, not with capacitors like in DRAM). When the power is cut, the data is gone in a matter of microseconds. The HSM contains a small battery to keep the RAM up and running for up to a few weeks. The battery also powers an array of sensors, e.g. on temperature, light, physical integrity of the covering and so on. If anything goes amiss, the system automatically shuts down the power, and the keys are gone.

So the trick, really, is not to store the data "in an hard drive, permanently".

An amusing consequence is that if an HSM is unpowered for too much time, the keys can be lost. Pro-tip: when you ship an HSM to a factory in China, label it as "a network card". Otherwise, customs will keep it around for a month, and the keys will be lost.

The above is valid for HSM and payment terminals. Smart cards, on the other hand, employ other tricks, which are undocumented (and most of them are trade secrets).

• If anything goes amiss, the system automatically shuts down the power, and the keys are gone. — I would not say "anything" as that's too general and could potentially provide base for misinterpretation. After all, HSM misconfiguration or glitches caused by the HSM API might well produce security problems (where the HSM will not wipe its keys). Yet, maybe I'm just nit-picking here. – e-sushi Feb 7 '18 at 0:32
• Recovery of data stored over a long period in SRAM has been shown. Also your protip is not advisable. Failure to declare cryptographic equipment, especially to a place like China, can cause significant legal problems. – user71659 Feb 7 '18 at 20:56
• And what about a Cold boot attack? Even the folks over at electronics know about freezing RAM. – Pharap Feb 7 '18 at 21:44
• "undocumented (and most of them are trade secrets)" So their obscurity isn't a security decision but rather a business decision - they don't want their competition to know how they're securing their data. – corsiKa Feb 8 '18 at 16:02

It is not physically impossible to retrieve data, merely very difficult. Physical sensors such as light sensors and mesh layers on chips can be bypassed.

Christopher Tarnovsky's work using a Focused Ion Beam (FIB) electron microscope is worth a watch. IIRC the FIB he's using cost him somewhere around \$500,000 used, over 10 years ago. Renting time on one is about \$400/hour. It takes months of work to figure out how to hack a given TPM/HSM, and destroys numerous sample devices. That's ignoring the costs of the time of a skilled semiconductor engineer to conduct the attack. It's very, very difficult, but not impossible.

• For further reading (not everyone will want to rely on a single youtube video), here's one of many articles out there about prominent HSM breaches in RealLife™ that worked without using expensive things like electron microscopes — cryptosense.com/real-hsm-breaches – e-sushi Feb 7 '18 at 0:11
• Yeah, I just wanted a single counterexample since that's all that's really needed to prove the "physically impossible" statement wrong. – SAI Peregrinus Feb 7 '18 at 5:31

One way to address this question is not to ‘store’ secrets in the sense that they can be retrieved, but to create a circuit that only computes a pseudorandom function $f_k(c)$ of a challenge $c$ with a physically randomly chosen secret key $k$, embedded in a medium that breaks down under attempts to merely read the secret key. This is called a PUF, physical unclonable function.

A typical application might be wired to an AES circuit to compute $\operatorname{AES}_{f_k(c)}(m)$. Nowhere is the key $k$ or the derived AES key $f_k(c)$ stored, per se, in a way that can reliably be read.

Of course, the devil is in the details of preventing someone from monitoring the electrical signals in the IC to recover the AES key while it is in use! There is a whole literature—and, no doubt, a private array of trade secrets—on how to physically design PUFs, and physically attack the designs, etc.

• Is there an example of how to implement AES as a PUF? I thought physical unclonable functions would be more "random" than that (and thus not so easy to use for symmetric crypto). – Paŭlo Ebermann Feb 6 '18 at 22:37
• @PaŭloEbermann you don't implement AES as a PUF, you implement the key storage as a PUF. – Dmitry Grigoryev Feb 7 '18 at 12:53
• Is there any info you can refer to, that explains the break down in a read attempt of the secret key? I thought PUF was the key itself. – einstein Feb 25 '18 at 20:02
• The key $k$ is a mathematical abstraction. The only way you can interact with it physically, in the model of a PUF, is to evaluate $f_k(c)$ for some specified input $c$; there's no way to interrogate the bits of $k$ itself. – Squeamish Ossifrage Feb 25 '18 at 20:11

If an integrated circuit holding the data doesn't offer the interface to read it, the only way to get that data is a reverse engineering process known as chip decapping. Roughly speaking, one has to remove the IC case, then laser drill the area where the bits of interest are located, and read them out with probes or an electron microscope.

This process has a few problems when applied to modern chips:

• it's destructive

• it requires expensive equipment and expert knowledge

• the chances of success on an individual chip are rather low. If you have a bunch of identical chips, you can be confident you'll get the data; with a single chip containing unique data it's a wild shot.

There are various non-destructive techniques commonly known as glitching which are used to bypass simple data protection mechanisms, when the interface to read the sensitive data exists, but is locked by a "protection" bit. Needless to say, HSMs which simply don't have the interface to access sensitive data are immune to such methods by design.

• A related method to this is "power rail analysis" (known by various names), and is non destructive. Certain chip architectures are known to exhibit tiny fluctuations on the power pins that coincide with data being passed around within the chip, "crosstalk" basically. In some cases you can passively read the data off the power rails with sensitive enough filtering. Crypto hardware designers are wise to this now and are actively building devices that do not have this vulnerability. – Wossname Feb 8 '18 at 17:07

To give a more high-level answer, HSMs seem to work by just combining as many layers of physical security as possible. Nothing is impossible to retrieve; it's just way too difficult and expensive to do most of the time.

If you have sensors that account for pretty much every thinkable physical attack and almost instantly wipe all sensible data when triggered, you have a pretty secure system.