K82F LTC AES masking

[NewDwarf]

Hello.

Is K82F's DPA countermeasure active just after Power-On Reset? 

In other words, does DPA countermeasure work without explicit calling of LTC_SetDpaMaskSeed(LTC0, maskSeed)? 

I am talking in context of LTC AES-128 encryption.

[NewDwarf]

@Celeste_Liu Thanks. If I say I am able to recover the AES keys from the LTC engine, is it known fact or is it something unknown to NXP?

[Celeste_Liu]

Hello @NewDwarf ,

The K82F LTC engine does not provide a non‑transparent mode. AES masking is intended to mitigate information leakage during algorithm execution involving cryptographic keys, thereby defending against non‑invasive DPA attacks targeting key recovery.
However, protection against key recovery typically requires more comprehensive system‑level security design considerations. The LTC AES masking technique operates only at the algorithmic level and does not fully address all use cases, especially as attack methodologies continue to evolve. Moreover, it cannot replace security mechanisms implemented at the overall system design level.

BR

Celeste

[NewDwarf]

@Celeste_Liu Hello

The interesting thing I was able to recover AES keys by using the first-order attack. Two different leakage models gave me correctly recovered AES key on the LTC engine.

Usually, if masking countermeasure is applied, the first-order attack won't work and an attack should be the second and higher order.

[Celeste_Liu]

Hello @NewDwarf ,

I need to check with the internal team for your question. Could you please provide the following information per our policy: company name, end application, and annual volume?

As this issue involves security, could you also help confirm whether an NDA has already been signed? And we recommend creating a private ticket to contact us for further support.

Case Creation Wizard 

BR

Celeste

[NewDwarf]

@Celeste_Liu 

...and I cannot use the Case Creation Wizard as it doesn't allow private email to submit the findings.

[Celeste_Liu]

Hello @NewDwarf ,

Sorry, this was my oversight. Cases cannot be submitted using a personal email address. You can continue to share your findings in the Community.

[NewDwarf]

Hello @Celeste_Liu 

I am just an independent user/researcher for this specific topic.

[Celeste_Liu · Accepted solution]

Hello @NewDwarf ,

Thanks for your post. Yes, the LTC DPA countermeasure of the K82F is active immediately after power-on reset. For LTC DPA Mask Seed (LTC0_DPAMS) register, it's an entropy. Even if application didn't initialize, the hardware countermeasure can generate random number for using by itself.

Hope it helps.

BR

Celeste

------------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the "ACCEPT AS SOLUTION" button. Thank you!
------------------------------------------------------------------------------------------------------------------------