Bug 13 - CSRNG CTR_DRBG State Leaked via Unmasked AES Datapath
Legacy reference: Bug #20 in the working set
Security feature bypassed
CSRNG internal state confidentiality - the first-order side-channel protection on the AES-128 CTR_DRBG datapath
Attack type
Type 2 - physical attacker with side-channel measurement equipment
Finding
The CSRNG AES cipher core is instantiated with .SecMasking(1'b0) - masking explicitly
disabled:
// csrng_block_encrypt.sv:95
aes_cipher_core #(
.AES192Enable ( 1'b0 ),
.CiphOpFwdOnly ( 1'b1 ),
.SecMasking ( 1'b0 ), // BUG: Masking explicitly disabled
.SecSBoxImpl ( SBoxImpl )
) u_aes_cipher_core (...);
The CTR_DRBG secret state (key K + V) is processed with no side-channel protection. Power/EM traces of CSRNG operations leak the AES key, which is the DRBG state, enabling recovery and prediction of all future random output.
Location or code reference
- hw/ip/csrng/rtl/csrng_block_encrypt.sv:95 -
.SecMasking(1'b0)- masking explicitly disabled
New Tools
Yes - static RTL audit (grep for SecMasking parameter at instantiation sites,
cross-referenced against the secure default 1'b1) + actual-RTL module instantiation
(Verilator 4.210): csrng_block_encrypt_tb.sv instantiates the real module with its genuine
dependency chain and confirms the unmasked instantiation (see testbench/logs/).
AI Tools
No.
LLM
No.
LLM Details
PLACEHOLDER - to be completed (model name/version, parameters, download link or API endpoint).
Online LLM Details
PLACEHOLDER - to be completed (input/output/total token counts, verification script).
LLM Prompts
PLACEHOLDER - to be completed (complete prompt, full model response, step-by-step explanation).
Detection method
Static parameter audit: grep SecMasking.*1'b0 in csrng_block_encrypt.sv (line 95
CONFIRMED unmasked), verified by compiling the actual RTL module closure under Verilator and
inspecting the instantiation parameter flow.
Security impact
Complete prediction of CSRNG output. Every key, nonce, IV, and random value derived after state recovery is known to the attacker - TLS session keys, Key Manager keys (which use CSRNG for entropy), and OTBN random numbers are all compromised.
Adversary profile
Type 2 - physical attacker with power/EM measurement equipment (oscilloscope, EM probe). Single AES-128 key recovery via CPA typically needs a few thousand traces.
Proposed mitigation
.SecMasking(1'b1) // enable DPA protection on AES
CVSSv3.1 score and severity
7.5 - HIGH
CVSSv3.1 Details
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
- AV: Physical - trace acquisition on the device
- AC: High - CPA/DPA analysis required
- PR: None
- S: Changed - crosses from CSRNG into all derived keys
- C/I: High - full DRBG state recovery and prediction
Attachment links
Located in this repository (GitHub is the cloud storage for the submission):