Researchers from the University of Florida Herbert Wertheim College of Engineering presented a paper at the 2017 ACM CSS conference detailing security flaws of the IEEE P1735 electronics standard, which describes methods for encrypting electronic-design intellectual property and what those vulnerabilities represent for the industry. As a result of that paper reporting seven vulnerabilities, the Department of Homeland Security’s US-CERT issued an alert that warned of the flaws in the P1735 standard. Vendors using the IEEE P1735 scheme in an insecure manner have already been alerted by US-CERT. The vendors contacted by the US-CERT include AMD, Intel, Qualcomm, Cisco, IBM, Samsung, Synopsys, Mentor Graphics, Marvell, NXP, Cadence Design Systems, Xilinx and Zuken.

The standard was originally developed to provide guidance on the protection of electronic-design intellectual property (IP). It also provides recommended practices for using encryption in order to ensure the confidentiality of the IP. The paper, entitled “Standardizing Bad Cryptographic Practice: A Teardown of the IEEE Standard for Protecting Electronic-design Intellectual Property,” was a collaboration by researchers from the Florida Institute for Cybersecurity Research (FICS Research).

Yet, major vulnerabilities described by researchers of the paper includes potential exploitation by hackers to hide hardware malware inside products which can potentially allow competitors to sabotage a vendor.  Some additional vulnerabilities discovered include modification of encrypted IP Ciphertext to insert Hardware Trojans, improperly specified padding in CBC mode allowing the use of an EDA tool as a decryption oracle and modification of Rights Block to get rid of relax access control or relax license requirement.

Tom Shrimpton, Ph.D., an associate professor from the Department of Computer & Information Science & Engineering (CISE) explains it this way, “As a consumer, you would be affected, but you would have no way of knowing. This paper shows that not only is there no protection, but there is a straightforward way for a malicious modification to be introduced into this protected IP. A lot of money is put into R&D, and the industry is relying on the trustworthiness of IEEE standards to protect their property. It can have a huge negative impact, ranging from access to property theft.”

The paper was a collaboration by researchers from the Florida Institute for Cybersecurity Research (FICS Research), including associate professor Thomas Shrimpton; and Domenic Forte, Ph.D., an associate professor from the Department of Electrical and Computer Engineering; and FICS Research Co-Director Mark Tehranipoor, Ph.D., as well as Ph.D. students, Animesh Chhotaray and Adib Nahiyan.