Bug 09 - AES Data Output Register Reset Bypass (Secure Wipe Defeated)

Legacy reference: Bug #16 in the working set

---

Security feature bypassed

AES output-register secure wipe on reset - the requirement that all AES state registers be zeroed when reset asserts

Attack type

Type 2 - physical attacker with fault injection capability

Finding

In aes_core.sv, the data_out_reg always_ff block implements a conditional reset that only clears the register when data_out_we is not equal to SP2V_HIGH (sparse enum 3'b011):

// aes_core.sv:872-878
always_ff @(posedge clk_i or negedge rst_ni) begin : data_out_reg
    if (!rst_ni && data_out_we != SP2V_HIGH) begin   // BUG: conditional reset
      data_out_q <= '0;
    end else if (data_out_we == SP2V_HIGH) begin
      data_out_q <= data_out_d;                        // WRITES during reset!
    end
  end

Mechanism: when reset asserts (rst_ni=0) while data_out_we == 3'b011 (the value indicating valid output data):

1. The if condition !rst_ni && data_out_we != SP2V_HIGH - 1 && 0 = 0 - reset branch skipped
2. The else if (data_out_we == SP2V_HIGH) triggers - writes data_out_d into data_out_q during reset instead of clearing it

Contrast: key_reg and IV_reg use unconditional reset (if (!rst_ni) ... <= '0; else if ...). Only data_out_reg has the gated reset.

Location or code reference

• hw/ip/aes/rtl/aes_core.sv:872-878 - conditional reset on data_out_reg (writes during reset when data_out_we == SP2V_HIGH)
• hw/ip/aes/rtl/aes_core.sv:860 - reference: unconditional reset on reg_sp_enc_err

New Tools

Yes - custom HWF-AFL pipeline. A minimal Verilator model replicated the exact data_out_reg logic (sp2v_e type, SP2V_HIGH=3'b011); AFL inputs control rst_ni, data_out_we, and 128-bit data_in. The model cycles reset-assert/write/deassert; if data_out_q is non-zero after reset deassert - abort(). Crash found within 15 s from a safe seed - AFL mutated the control byte to 0x07 (rst=0, we=3'b011), triggering write-during-reset (logs/afl-fuzzer_stats, logs/afl-crash_input.bin).

AI Tools

No.

LLM

No.

LLM Details

PLACEHOLDER - to be completed (model name/version, parameters, download link or API endpoint).

Online LLM Details

PLACEHOLDER - to be completed (input/output/total token counts, verification script).

LLM Prompts

PLACEHOLDER - to be completed (complete prompt, full model response, step-by-step explanation).

Detection method

Automated detection with the HWF-AFL pipeline (property: data_out_q must be zero after reset deassert), then confirmation on the actual OpenTitan RTL - aes_core_tb.sv instantiates the real aes_core.sv and observes write-during-reset behavior (testbench/logs/rtl-test-simulation.log).

Security impact

A physical attacker performing clock or reset fault injection times a reset glitch to coincide with data_out_we == SP2V_HIGH (output data available). The output register is not cleared - ciphertext/plaintext is written into data_out_q, survives the reset, and software reads it back after reset. Violates the output-register secure-wipe requirement; enables cross-reset-domain data exfiltration.

Adversary profile

Type 2 - physical attacker with fault injection equipment (ChipWhisperer, oscilloscope, voltage/clock glitcher). Requires precise timing knowledge of the AES operation.

Proposed mitigation

always_ff @(posedge clk_i or negedge rst_ni) begin : data_out_reg
    if (!rst_ni) begin
      data_out_q <= '0;                    // Unconditional reset
    end else if (data_out_we == SP2V_HIGH) begin
      data_out_q <= data_out_d;
    end
  end

CVSSv3.1 score and severity

7.1 - HIGH

CVSSv3.1 Details

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

• AV: Physical - fault injection equipment
• AC: High - precise timing needed to hit the WE=SP2V_HIGH window
• PR: None
• S: Changed - AES cryptographic data exposed across reset domain
• C: High - sensitive output data recoverable

Attachment links

Located in this repository (GitHub is the cloud storage for the submission):

• exploit/
• exploit/code/
• exploit/logs/
• testbench/
• testbench/code/
• testbench/logs/