Home page logo

bugtraq logo Bugtraq mailing list archives

Atmel "secure" crypto co-processor series microprocessors (AT91SAM7XC) leaking keys, plus bonus DESFire hack
From: Adam Laurie <adam () algroup co uk>
Date: Mon, 11 Feb 2013 09:11:59 +0000

The Atmel AT91SAM7XC series of microprocessors contain a crypto co-processor which is DES and AES capable. They include a write-only memory for key storage and multiple physical security measures to prevent decapping etc.

However, due to poor memory management, in certain circumstances it is possible to recover the crypto keys from a live system via the standard JTAG programming interface. These circumstances are made more likely to exist in the wild by the fact that the example software provided by Atmel is itself vulnerable.

Full story here:


The potential for this to be an issue has been raised within the Atmel support community several times over the years, dating back to at least 2006. I personally raised it with them in 2011.

However, I am not aware of any clarification being issued by Atmel, nor of any definitive proof one way or the other being made public until now.

The NXP DESFire 'hack' is purely a result of the weakness in the AT91SAM7XC, and nothing to do with DESFire itself, but demonstrates why this is a real problem. I'm sorry they got in the firing line, but they were just in the wrong place at the wrong time... (cyber)war is heck!

Adam Laurie                         Tel: +44 (0) 20 7993 2690
Suite 117                           Fax: +44 (0) 20 7691 7776
61 Victoria Road
Surrey                              mailto:adam () algroup co uk
KT6 4JX                             http://rfidiot.org

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]