hi everybody so maybe you are not coming
for this talk so I have an explanation
for that which is right there so where I
can try to convince that this is the
talk you were coming from you are coming
from but it will probably not work so my
initial talk was rejected and I got a
notification like yesterday at midnight
that in fact it was not rejected so I
decided to recycle some slides I had for
hgx
add a bit more content and that's what
the talk will be about so if you have a
medical condition and you can't listen
to a nice Jake's talk you might leave I
won't be offended otherwise it should be
interesting so with that we are going to
talk so a little bit more about around
clave the idea is to keep talking about
what we did last year previously which
was not very successful we will discuss
why and we will discuss how we can
improve that and well if you want to
follow something for example during the
talk and read something during the talks
a thread model we have in the readme is
interesting to read and it's still up to
date even if the code is not so first
question you can ask why are we making a
month wave as a hardware wallet
manufacturer so the first thing is that
we are lecture has been developing into
civil industries and created several
business units today so we are not only
making our wallets with the SE on which
we can call our own OS we are exploring
the custodian model where we work on HSN
that are not built by us so in that case
we need to work into something that
looks a little bit like an enclave and
we want to transition from a company
manufacturing hardware devices to a
company selling operating system
licenses and for that enclaves are very
good target because he already exists
there already in the market and the main
obstacle today for people to use a
ledger is actually to buy a ledger so if
we could find a way to download a ledger
and have an interesting security on an
existing computer it would be quite
interesting for us and so that's why we
are digging into those models and we are
rating the security very thoughtfully
for that so we have a reusable operating
system code base working on
Clavin changing from a secure element to
an enclave first is quite easy so using
this way using expenses and another
important thing is that well we have a
strong expertise in hardening
cryptographic code and this is some
things that's difficult to do I mean
that some things that you don't usually
do because a lot of people using secure
elements will just reuse a vendor
cryptographic library we build them from
scratch and we use everything that we
have on the chip to make them harder so
we did a popular CTF this year
honourable device that was worn by a
company called ninja labs they like CTF
didn't describe everything yet but it is
related to side channels and to template
profiling on side channels so that's the
kind of things we want to do an edge
takes as well improve it and provide the
result you everybody so if you want to
transition from a hardware wallet to via
to a secure device so 12 Enclave you
have to consider a few things first you
want to focus on the key protection so
keyboard action is the most important
part of a hardware wallet it's going to
be very important for an enclave as well
you don't want an attacker to be able to
extract keys so here for an entree we
will focus on software threat models so
we will not consider hardware threat
models where an attacker has access to
the Enclave because that's pretty much
out of scope I mean waves are quite
complex and it's difficult to focus on
securing as a whole thing against a
physical attacker then user confirmation
is extremely important as well because
if you want crave is holding keys but
users can an attacker or malware can
sign anything it's not very secure so
you should be able to confirm what you
are doing and you should be it shouldn't
be possible to fake this confirmation if
your malware then flexibility you should
be able to do software updates on your
hard wallet Enclave anytime so even if
your computer is compromised which is
quite important and as a developer you
should be able to test new
functionalities typically for atrium if
you want clave is signing an interim
transaction it should be able to support
smart contracts and
should be able if possible to display
specific UX for specific smartphone
twice in order to provide always the
best and the clearest message to the
user to know what you are doing
finally remote at the station we should
have a way in an enclave or in like we
have in the device to verify that the
code is running and a healthy platform
and that you are running the right code
so you should be able to verify which
code you're running and we'll see that
this comes with with some difficulties
on HDX but we can help solving that as
well so today in our architecture the
way we achieved source code portability
between secure element and enclaves is
quite simple we focus on C source code
portability so we write the code once
with the same API when we work natively
on the secure element we are compiling
to arm because our secure element are
based on sicker sicker of course which
is a kind of a secure arm and when we
are working on an enclave all kind of
Enclave so it could be HDX te or NHS M
we are cross compiling to moxie which is
an open architecture which was used
usually in which was used previously or
in the Bitcoin project as an experiment
by Jeff Kazik back in the days but it's
very simple it's very easy to review
easy to secure as well so it's a good
target if you want to have a simple VM
regarding the architecture itself we
will try to reuse this model as much as
we can so we want to protect the user
secrets the user secrets will sit
between a kind of a firewall
applications will be firewall between
each other as well and when an
application wants to access some
cryptographic material it will use it
will use a service call
so service cool on arm or something else
Universal machine to access the secrets
so applications can't touch secret
unless the interpreter mode which is run
by the kernel and applications are
isolated and of course come touch a
camel so if we look at the state of our
HDX stack in 2017 we had good points and
but
so the first good point is that it works
so if you want to try it today you can
do something you can run some simple
applications you can we demonstrate it
on China at the station so you can
verify that your Enclave is legitimate
on chain after you pass internet a
station you can verify that your code is
the code that is supposed to be on chain
and we have an open source sdk even if
the code is deprecated it's still
completely usable and you can still play
with it on the bad side on the negative
side you we had no user confirmation
possible since we didn't have a display
API so you couldn't use it really as a
wallet so if all code that you wanted to
run on the Enclave had to be signed by
us so that the biggest things that deter
people from using the Enclave because at
some point if you wanted to run with in
a protected environment you had to send
us the code or we had to assign a key
which was more convenient but still a
lot of people didn't want to contact us
for that so that's why in my opinion it
wasn't very popular and of course we did
no security audit so the code is really
sent to you to be to be tried and
without any kind of guarantee so how can
we improve that of course regarding the
attestation well people have been
talking about Intel at the station a lot
so the thing is internet station today
is still very useful in my opinion
because you need to validate the
platform house from time to time for
example when there is a new security
exploit that involves updating your bios
updating the microcode of your cpu the
only way to know that is to have a
centralized API at some point so it's
still used today but you can select
different setups depending what you want
for your application when you are using
your Enclave so if you don't want to use
internet a station you can it works the
code is still secure because the code is
signed so you can verify you can rebuild
the code on your side and verify that
the crisco right but in this case you
don't get remote at the station at all
it's a choice if you want to run your
wallet on your side you can do that
maybe not the best choice but it's a
choice you can run internet sensation
once if you do that you get a week later
at the station I put week here because
it will not be up to date regarding the
health of your platform which can change
so again it's a choice but if you do
internet if you run internet sensation
from time to time then you can get a
stronger attestation and the biggest
difference here
according to compare to is at the
station today is that it's something you
can validate on chain so the good news
is that with a new in therapy I call
protected connection display we can
solve two problems so we can solve the
confirmation if you and we can solve the
fact that you couldn't run on any moose
code so far so now you won't have to
contact us to run your code on the
Enclave once this is released so if we
want to summarize very quickly get an
overview of protected transaction
display it will be a way to create a
secure display to display something
securely so on your own device that will
be prepared by the Enclave so the way
this works is that PTD will allow you to
create confidential output on display so
the display here is a mixed display in
this window you have a mixed display so
some is done by PTD so can't be spied on
by the host so PIN pad here is done by
PTD this line is displayed by PT d and
this line is displayed by PT D as well
the buttons are not and this label and
string are not so the input the output
is confidential because the host cannot
read anything and with the fact that you
can display a pin code that is randomly
swap by PT D you can achieve
confidential input as well because if
for example here you type your PIN code
so host has asked no way to know that
you typed one two three four if you kick
that I mean the host will just see that
you clicked some
turns on your screen but this way you
can manage to have some securing put
even if it's not very convenient and
here we have a way to display some
additional data on PTD so you see an
amount which is an amount of 0.096
errors so here you see the number of
decimal below which is again not the
best UI but well I'm that's what you can
do today and part of a native remedy
right so after you do that after you
enter your PIN wallet codes and hand it
around addiction limitations we have
repeatedly today they eat the output is
confidential so the output cannot be
spied on but it cannot be trusted
because you can still display something
on top of the output so in this case
that's why we are do that's why we are
you have to do this user confirmation
twice so it's not the best you expose
evil but I would say it works with what
is available there so the IO primitives
are very limited today that's probably
something that can change but you don't
have the flexibility of global platform
te twisted UI if you want so one thing
that's popular in with the CPI is to
basically register an image on the
server and then this play this image so
you can be sure that nobody can
intercept the image and a malware on the
host could not replace it was the UI but
you can't in that case so that's why you
have to add the user type again and
confirm twice which is not the most
convenient thing but it works so the
alternative options you can think of or
at least I can think of hours and
typically if I want a user to if I want
to use it to verify that was the UI is
genuine you would have to train your
users to try to take screenshots for
example and see that the contact
screenshots so that's not something is
really realistic I mean geeks can
probably do that but that's a regular
user and so five windows only so if you
want to run those tests you can't want
them online X that will probably change
over time as well
we are still to one part we are still
missing compared to 2017 is a security
audit and that's what we will be
focusing on right now and that's the
reason why I didn't update the code
because we didn't run our security audit
yet so on the first part of the security
audit you want to run that like a
standard security audit so you want to
verify that your own clave is not
vulnerable to typical bugs
buffer overflows and so on so that's
very very normal then you want to verify
something more you want to see if your
key can withstand server side channel
attacks because side channel attacks got
very popular during last year so more
and more people I've been able to have
been demonstrating ways to extract keys
from enclaves either by attacking the
Enclave from another one of whom the
host and today that was still a state of
the art to be written to know if keys
are correctly protected in an enclave
and we aren't we are very interested to
answer this question we're very
interested to publish result and we want
to advance the state of the art of
protecting key and Enclave so good news
is that we are I think good at it at
least we already did it on hardware so
we should be able to do it and bigger
hollow as well and I just run them at
the adjustment which is not very related
to side channel on a cache but it's a
general Zhai channel api that we
published a few days ago that will let
you test on state of the art state
channel on completing so how can we how
will we proceed with this audit
so first we'll focus on a single curve
will focus on SEC P 256 K 1 which is a
curved used by a lot of kryptos today so
at least Bitcoin and aetherium so for
the time being that the curve we are the
most interested in we will review the
state-of-the-art library used to dye
power by multiple project coming from
Bitcoin core so ellipsoid P 256 K 1 and
we will test it against state-of-the-art
side channel attacks that we have on hgx
we will publish a review on that
detailed report if there are patches to
be written we will do that as well if we
have some well parts to rewrite we will
also do that and in the end we want to
know if and when how long we can store
keys on HDX and I think that using this
research we will be able to finally have
a workable and workable hardware wallet
on an enclave and with strong guarantees
that the keys are going to be available
and that the keys are not going to be
stolen for a given amount of time so for
this we chose not to use the Intel
proprietary the graphic library because
we figure that working on an open source
code and providing some providing some
review of that will benefit more to the
community by knowing how we can how we
can work and design new side-channel
protection attacks which could later be
applied to other curves so to finish
summary of what is coming next in 2019
for Enclave first we want to start with
the CTF so after with you we will test
so we will publish what we did with our
hardened API and well standard CTF so if
you win you get better because well
we'll put some ads in our Enclave so we
will usually increase the amount and
we'll see if people are interested in if
people manage to extract something as I
talked for cryptographic API on our
Hardware wallet so that works on well -
bitcoins I think on one Bitcoin nobody
steal it
nobody stole it on to bitcoins we found
some motivated parties so maybe we will
see the same here after we do that and
we're convinced that our security is
fine then we can we will be able to
release the wallet so we will really the
simple wallet that will work first for
Bitcoin in atrium and then we can move
forward and release an SDK that will let
people write their own application
and use PTD to secure their own
applications so that's it and we still
have some minutes for questions if you
want
you