Bug 16 - CSRNG: AES Key and State Not Zeroized After Operation (Key Remanence)
Legacy reference: Bug #23 in the working set
Security feature bypassed
CSRNG key-material remanence protection - the post-operation zeroization of DRBG key state
Attack type
Type 2 - physical attacker with register-read capability
Finding
After a CSRNG AES-CTR_DRBG operation the AES key (the DRBG state) and intermediate data
remain in registers: key_clear_i is hardwired to 0 and key_clear_o is unconnected -
the AES cipher core’s key clearing mechanism is explicitly disabled:
// csrng_block_encrypt.sv:116-117
.key_clear_i ( 1'b0 ), // BUG: Key clearing disabled
.key_clear_o ( ), // BUG: Clear output unconnected
Location or code reference
- hw/ip/csrng/rtl/csrng_block_encrypt.sv:116-117 -
.key_clear_i(1'b0), .key_clear_o()- zeroization disabled/unconnected
New Tools
Yes - static RTL audit (grep key_clear_i.*1'b0 - CONFIRMED at lines 116-117) +
actual-RTL module instantiation (Verilator 4.210): csrng_block_encrypt_tb.sv instantiates
the real module and confirms the disabled zeroization path
(see testbench/logs/rtl-test-simulation.log).
AI Tools
No.
LLM
No.
LLM Details
PLACEHOLDER - to be completed (model name/version, parameters, download link or API endpoint).
Online LLM Details
PLACEHOLDER - to be completed (input/output/total token counts, verification script).
LLM Prompts
PLACEHOLDER - to be completed (complete prompt, full model response, step-by-step explanation).
Detection method
Static RTL audit + actual-RTL instantiation. Security property: after operation completion the AES key registers must be zeroized; the evidence shows the zeroization request is never generated.
Security impact
DRBG state (128-bit K) persists in the AES cipher core registers after CSRNG operation. Combined with a register-read capability (debug bypass, scan chain, fault-induced register dump), an attacker recovers the DRBG state and predicts all past and future CSRNG output - every key derived since the state was loaded is compromised.
Adversary profile
Type 2 - physical attacker with register-read capability (JTAG/scan-chain access or fault-induced register dump).
Proposed mitigation
.key_clear_i ( key_clear_req ), // connect to state machine
.key_clear_o ( key_clear_done ), // connect to state machine
State machine: after each CSRNG operation assert key_clear_i, wait for key_clear_o,
then idle.
CVSSv3.1 score and severity
6.8 - MEDIUM
CVSSv3.1 Details
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
- AV: Physical - register read via debug/fault
- AC: High - requires a register-read primitive
- PR: None
- S: Changed - crosses from CSRNG into all derived randomness
- C: High - full DRBG state disclosure
Attachment links
Located in this repository (GitHub is the cloud storage for the submission):