Pierluigi Paganini November 05, 2017

Experts discovered flaws in IEEE P1735 electronics standard, which describes methods for encrypting electronic-design intellectual property (IP).

Crypto flaws in the IEEE P1735 electronics standard expose highly-valuable intellectual property in plaintext.

The IEEE P1735 electronics standard provides recommendations on methods and techniques for encrypting electronic-design intellectual property about the hardware and software in electronic equipment.

The standard describes how to protect intellectual property (IP) for commercial electronic design, as well as the management of access rights for such IP. It defines interoperability models to allow hardware and software from different to interact and at the same time protecting them from reverse-engineering and IP theft.

“This standard specifies embeddable and encapsulating markup syntaxes for design intellectual property encryption and rights management, together with recommendations for integration with design specification formats described in other standards.” states IEEE.

“It also recommends use models for interoperable tool and hardware flows, which will include selecting encryption and encoding algorithms and encryption key management.”

According to the IEEE P1735 electronics standard allow code from different manufacturers to run in hardware components and interact securely, this means that it is not possible to decrypt them.

The IEEE P1735 is implemented by almost all vendors to protect their intellectual property.

Now a group of researchers from the University of Florida has recently reviewed the IEEE P1735 electronics standard and discovered that some vulnerabilities expose it to cyber attacks.

The team composed of five experts published a paper titled “Standardizing Bad Cryptographic Practice,” at the end of September.

“The P1735 IEEE standard describes methods for encrypting electronic-design intellectual property (IP), as well as the management of access rights for such IP. The methods are flawed and, in the most egregious cases, enable attack vectors that allow recovery of the entire underlying plaintext IP.” reported the US-CERT.

“Some of these attack vectors are well-known, such as padding-oracle attacks. Others are new, and are made possible by the need to support the typical uses of the underlying IP.”

The experts discovered several crypto weaknesses, one of them could be exploited by an attacker to bypass encryption safety guards and access intellectual property in cleartext.

The access to such information represents a serious problem for hardware and software vendors, they can suffer intellectual property theft and they can potentially go out of business.

Another vulnerability discovered by the researchers could be exploited by hackers to hide hardware malware inside products. The exploitation of the flaw could allow a competitor to sabotage a vendor.

Below the list of CVE IDs assigned to the major vulnerabilities discovered by the experts: