Sylvain Bellemare - Here Come the Pufpunks with their Black Hole Cypher

Hello. Uh, thanks for being here. Thank you for the organizers. Thank you to Fabitio. I don't Oh, yeah.

So I saw Fabitio in ECC Khan what two weeks ago or so or and he asked me if I could give a talk. I was a bit hesitant and then I decided to say yes about puffs. Uh I was very enthusiastic about it for a couple of days. I even told him hey can I do even longer in 20 minutes? And then he told me a few days ago yeah I got you a 40 minute slot.

And by then though I was like not so enthusiastic. I was like oh my what did I do? Why why did I accept that? you know. Um, anyways, I'm going to talk about a topic that I'm not a super expert in, but I I do feel that our industry, the uh, well, when I say industry, like I come from the angle of blockchain and cryptocurrencies, uh, there's a bit of a very low interest or very little awareness about it.

And I think it's a very cool hardware primitive that is actually crucially important. And also you could say that from the point of because this is a quantum track. It's a bit in a way at the edge of classical computing and quantum computing. So you should take this presentation more as a sort of gentle introduction from someone who's not a super expert. So I think in what I'm going to present maybe there's going to be pointers for you if somehow you're interested.

The slides are online. uh they're I just put them up this week, so it's like, you know, I'm probably gonna try to improve them. But anyhow, so I hope you enjoyed this talk and if you have any questions at some point, if you think you're totally lost, I'm okay to take questions during the talk, but uh yeah, I I'll start and we see. Um so yeah, it's an invitation to think deeply about secure hardware and how to hide secrets. uh by I I'll talk more about it like um oh so another question you could think about is is it possible to have secure hardware without physical oneway function you don't have to answer now I think it's a pretty deep question um I'll skip this one uh because okay the outline so I'll go through the motivation background context um then present puffs or physically uncloable functions.

And then this proof of puff challenge it's related to the problem of remote attestation and for quantum cryptographers that's device independent cryptography like when you have certified source of randomness and all this but in the classical computing it's not as worked it's not developed the idea is not as thoroughly developed I think as in quantum cryptography. Uh okay so a bit of context yeah the context here I come from the angle of trusted execution environment like TE's so there's this like since we're in Napoli yeah a castle they say is a very old example of a tea right why because you have like security guards and within the castle whatever happened can be conserved as trusted and maybe people let's say write a letter in the castle and they seal it with some special seal and then it goes out the castle And then that envelope is kind of trusted. So I'll talk more about TE's if somehow. So when I say we talk about TE's, there are like three types and in the blockchain industry most people are more familiar with the Intel SGX, TDX, AM, AMD, SCV. Um, but your mobile device has also a trusted execution environment.

Apple is a secret enclave with Android's a strong box. And if you use a credit card or if you have a hardware wallet, there's a there's also a form of TNT. So basically, they're unavoidable. They're all over the plan the place whether you're in crypto or not, these these TE's or just all over on the planet. Um so what's the problem?

At least from the point of view of blockchains, what the problem they try to solve is this problem of secure a remote computation. So basically, you want to outsource a computation to a server that you don't trust, a service you don't trust, and you want to guarantee that they computed your u you know that they run the software that you expect on some hardware that you expect. And so the TE's is a way to try to solve this problem with hardware. If you combine ZK, zero knowledge proofs and FHE, you could say maybe you can try to solve the same problem, but there's like huge trade-offs, especially in terms of performance. So because of performance reasons I think mostly people have looked into TE's in the blockchain space.

Um so yeah like I just said that they try to solve the remote computation. So security versus compute. So there's an interesting is very simple but it's not hard to understand but as you the more compute you want to do the le the more security you have to give away. basically you have to sacrifice security at the expense of uh compute. So this little simple graph what it shows that if you're a secure elements will be much more secure but you'll have very low compute power.

So people are then willing to do compromises and that especially in the web 3 blockchain space they use things like Intel SGX and and TDX AMD but if you talk to hardware researchers they kind of scratch their head because this thing is just totally not secure from a hardware perspective. Whereas if you use a secret element on the other end of the spectrum now you're they'll be like ah okay yeah this is hard to attack. Okay. But for IntelljX and the likes, I want to emphasize that because it's like I think it's really not well understood in the blockchain web3 world because it's mostly people who do software and computer science. But again, from I'm not a hardware researcher, but from talking with hardware researchers, they're very clear on that.

They don't even want to spend time trying to attack Intel SGX because they don't see a good uh they don't see it worthwhile to get a paper out of it basically because it's just well known in by hardware researchers that these systems are not secure. Uh mobile devices are kind of in in the middle. They're actually more secure. So basically the the the moral of the story here is that if you're trying to do something, you should really think hard about do you really need something like Intelligj X or TDX? Because if you can uh you don't need to compute that much.

You can use much more secure hardware. Oh, it's not precise. I just like uh Yeah. Yeah. Yeah.

It's just to show that the the concept. Yeah. Yeah. Uh I'll skip this because I have many slides but um yeah I will skip this one. So just briefly the physical attacker models.

So with servers they kind of assume it obvious with maybe a bit of skills with mobile devices they assume obvious but maybe with some kind of bit uh like slightly expert knowledge who could maybe manage to try to hack their phone but they won't have any specialized equipment. Whereas with the secure elements and smart cards, they assume that the attacker would have access to a lab and all kinds of sophisticated equipment. Um and also mobile devices and smart card they they they are required to use some kind of certification uh an evaluation. It's a the the standard for this is called common criteria. It's not so important but the point is that these goes through uh ver verification steps by a lab who will look at the security of the system.

It doesn't mean it's perfect but you still have this in place. Whereas with uh the T's that are used in the blockchain space like by most projects like intellig and so on there's no such thing. It's just the the chip maker themselves they they try to make it secure but there's no subsequent verification by an external party. By the way, this all context, right? So, okay, the challenges of TE's, right?

It's you have secure key generation and storage and uh verifiable manufacturing and and remote attestation. The test station is linked to manufacturing in some way. But the main point is that all these systems how they work, how they get their security is because there's a a a hardware a key in the hardware that is embedded from which all the security is built. So it means if an attacker can get their hand on the key, the security of the system is totally compromised. The other problem is you have the same thing I think with quantum systems.

If you have a photon source, how do you know that it's a legit photon source, right? How do you know that you're really talking to a quantum computer? Was it manufactured properly? Were there mistakes in the manufacturing process and so on? Um so one could say that the currencies at least that people use are really secure in a way because of economical reasons.

So for instance in blockchain space what people do they say okay we'll run it behind the cloud and they assume that the cloud provider will not try to hack the the hardware. So basically the the data centers are like a castle with security guards and they just protect what's inside right. So basically we need a bal I think there's no way out of this I don't with quantum systems I'm not so sure but the at least with classical system you need a balance with with cryptography physics and economics right uh this is looks very complicated uh this is was just to show that how for instance hgx this root of trust is is um is derived okay Uh I don't know if I want to spend too much time on this but what you should get out of this slide is that at the top there's these CPU infuses and these are injected at manufacturing time by the chip maker and from this all the cryptography is derived. So if someone can get their hands on that again they can what they can do they can forge a test station uh below there's a place where there's a a quoting enclave where there's an attestation key. So that attestation key you sign a report saying hey this is the hardware I'm running this is the software I'm running trust me and this is sign and the attestation key is trusted because it's signed by intel so it means there's this chain of trust so it means if someone can get their hands on the attestation key they can forge a test station report and say hey this is what I'm running trust me but actually they're running totally something different if you know Mission Impossible the movie this is literally the same as these masks that they wear right and I will remove the mask and I'm totally someone else.

So that's like an impersonation attack. So this is the crux of all all this presentation I'm going to try to present now and why puffs are important and relevant to this context is that if we don't secure these keys, someone can just extract them and then impersonate hardware and software. So yeah, the SG extract model assumes that uh actually by the way that's what I was trying to say earlier. They don't assume that uh that it can protect against physical attacks or site channel attacks and so on. But yet people say basically you cannot touch it, right?

If you can access the hardware, it's like you have to assume that it can be broken or attacked by an attacker. So why is this? Okay, so now we're getting to the kind of maybe quantum related parts because you could say that atoms and bits are you cannot separate. Information has to live somewhere. It's not just like you know and uh so there's this uh quote here from Ralph Landau that right the that uh again information that the bits have to be encoded in matter and atoms and the spin of a photon and something so you cannot avoid that so that means that if you have a hardware key to protect from which all the security of the system will be built and that it's in the hand of an attacker.

So that means that the the key is somewhere in the hardware. It lives somewhere. It's in it's it has to be encoded. It's it's So that means that we have this challenge now how to build hardware in such a way that even though the the the hardware is in the hand of an enemy if you want or someone you don't trust and the bits the atoms are there somewhere representing the private key and it must not be accessible. Right?

So you could ask a question. Okay, then how do you hide the the bits and atoms? So, oh, so that's what I came up with actually you put them in a black hole. I think actually it's a good point. Okay, because from the point of view of the problem of hiding a secret key such that it's not available to anyone at least and by the way there's people working on this idea in the sense at the interical physics and computer science.

So it it may sounds a bit like uh just like a wild idea but it is not that crazy in a way because a black hole you can see it as a one-way function. Of course it's not practical. But we cannot have that. But the point is just to illustrate the the magnitude of the challenge basically right we have hardware on this planet that a lot of it the security depends on a hardware key that is embedded in the hardware yet depending on the means of the attacker they may be able to access this key and break compromise the security of the system. And here what I'm trying to say here is that that may not be the only way, but just to give an idea of how challenging this is.

Yeah, if you could put the key in a black hole, then maybe you could say, "Okay, yeah, that that's secure, right?" But then you cannot use it. So it's another problem. By the way, there's a paper called black hole radiation decoding is quantum cryptography. I think it's very inspiring and interesting and I encourage people to look at it.

So okay let's say you say okay but I don't want to deal with quantum systems right now I don't like shinger's cat or something right so okay so we can look at puffs puffs are in the classical context they're not in the quantum context so puffs arguably come from this work from 2001 was a PhD thesis by an MIT uh student uh called physical oneway function it's extremely interesting interesting work. Uh so I'll just now dive into this. I'll say what was the motivation, the inspiration and the concept of physical oneway functions and a bit a brief note about the implementation. So their motivation, the motivation of the author, one of the key questions they had is that how do you um um when you represent you money something that has value that has value in bits? How do you make sure how do you make sure that you that you um can make sure that these make sure these bits are authentic authentic basically that's the doubles in 200 was in 2001.

So that's the double stand for so you don't change on double spend. So he approach approach some of his word the motivation or my question was this question uh uh oh sorry another motivation was to have a fingerprint for physical objects. So basically you would want to make sure that you have some object and it's really what it should be like you know you can have a serial number but someone could try maybe to fake that serial number or to have a a copy of it clone it. Uh so that was another motivation. How can you uniquely identify an object in such a way that it cannot be uh faked?

Another motivation was the to have a better understanding between a connection of physics and cryptography. Okay. So his inspiration, key inspiration was quantum money. So this work physical oneway function that led to puffs in a classical setting were actually inspired by quantum money which I think is very very interesting. Uh and the PhD thesis mentions these two works contra coding by visner and quantum cryptography or unforgeable subway tokens by Bennett and and others.

Um so okay so what's the key concept of this physical oneway function is basically you have a physical interaction between a physical object and a probe. So if you're probing a system and that interaction would lead to some kind of like um it would mimic the like a one-way function. I'll explain more a bit in a little and and this has to be based on on on hard problems basically that you cannot easily clone the physical objects and that you cannot uh what is this? Yeah, you cannot simulate the interaction between the probing and the object. Uh and just like a hash functions, right?

It has to be easy to to make but difficult to clone. And the attach interaction between the probe um Yeah, it should be difficult to simulate basically. So, let me go to the graph here. So, okay. So, in that that work what they did they they think of it like let's say you have a kind of credit card like little to talk object and you send a laser beam but you decide on an angle.

So the angle you choose is part of the just picking a an an input to a hash function. You could think of it like that. And then the light goes through this and is will be deflected because the the the object right the token has some little irregularities and depending on the angle the light will come out at a different angle and they they put a a plate to receive the light and it will create a spot. Right? So in the middle like this 2D speckle.

So depending basically on the angle that you shoot the laser at depending on the the token itself the 3D token you'll get that the the 2D speckle will be different and then they transform this to a hash using some mathematics and that kind of mimics like a physical oneway hash function. Okay, that's that's the key work of this physical oneway function uh function PG thesis. So this then work led to puffs. Um so there was this early work called silicon physical random functions in which they they call it they changed it was called physical random function but because of uh not to avoid confusion with the PRF pseudo random functions they named it puff for physically uncclonable functions and now the idea was to implement this because the the the the work I showed before was optical right so they wanted to implement this in silicon and and integrated circuits and it's very interesting here because they mentioned that they want to uh yeah make sure that a given integrated circuit a given chip right is is is unique and you can identify it like a fingerprint but also they say it's a manufacturer resistant that that the manufacturer wouldn't be able to somehow mess with this process this was around uh 2002 right so which is interesting um so to give an concrete example of an implementation of a puff You have two wires here and you think it just like it's like a racetrack, right? But with two tracks, two wires and let's say you you an electron goes into each wire.

Just imagine it like that. And it's a race. Which one will arrive first? Even though they start at exact same time, but because the wires are not exactly the same, they have irregularities that cannot be controlled in a manufacturing process. So basically the logic is the same but the physical implementation is slightly different like if you think of atom by atom.

So one will arrive before the other and this cannot be predicted. No one can know because it's too small to control. So the first one that let's say if it's a left wire or right wire you will set a bit to zero one and vice versa. So then you can construct an array of bits this way and then you can have a key out of that and then if you give inputs to that you can then have different outputs. I don't know how I am with the time but um so going further into this world of of of puffs are there questions right now or no?

All right. So, there's two types of puffs that mainly are discussed in the literature. Strong versus weak. And the strong have been shown, well, I'll talk about this a bit later, but they have been shown to be vulnerable to machine learning attacks. And because of that, puffs kind of got a very bad reputation.

But there's another type of puffs they call the weak or puffs that are just used to generate keys. Um, and if I go back to this right in the challenge part where you have this 0 1 0 and 0 one1 this little green boxes that's the challenge uh and for for this for each different challenge you will get a different response. That's for the strong puff case. For the weak puff case, you would just basically remove this or you would just use a very few challenges or you would just use just one challenge that you kind of hardcode. And because there's when you don't have this large set of challenges, you cannot train a machine uh learning model to try to guess then what the response would be.

Uh yeah, like I said, they're theoretically promising, but they've been subject to all kinds of machine learning attacks. Uh and the generation the key generation puffs, yeah, they can be used to generate public key pairs for instance, and they're used a lot like especially in IoT devices. In IoT devices, there may be like 600 million devices deployed that that use them. Um so okay so what are some key properties of that you want to get out of a puff? Uh the main thing it should be unique right the main the way the way to think about this is like a fingerprint right you have a fingerprint for a chip or an object but here we're talking about chips so basically when a chip is made you have this kind of unique fingerprint which is just like a think of it a serial number and that that you shouldn't be able if you if you make two chips identical in terms of logic their fingerprint should should differ right so that's a key thing um and You should be able each time you query the chip because the way this work okay this puff is like a circuit block and the key basically appears when the the current flows in the chip.

So when the when there's no current in the chip there's no key. So you cannot just extract the key there's no key. So it has to be turned on and when it's turned on uh you should get the same key each time. So that's what this stability is about. Uh now if you try to probe the chip okay you could okay use a microscope or something well a microscope is a physical interaction with the chip and that very physical interaction in quantum I think you know physics you would say it's an observation but that observation you do it with an instrument which is a physical instrument so it will disturb the chip enough such that the response will diff will be different so basically the output of the puff will be different whether it's observed or not.

So if you're observing the puff, right, with some physical instrumentation, it will output something different than when it's not being observed, right? Does that make sense? Um because the entropy will be changed. So basically the the the instrumentation will introduce noise in the in the chip circuitry and environment which will will change its uh output. Uh and the other property very important it's called unclonable so it shouldn't be able to clone it.

By the way here there's this uh little uh quote at the bottom that says that the yeah the harness of cloning is uh is empirical right. So if you wanted a theoretical harness you have to go to quantum physics. So in a way there's good and bad chaos for a puff. Okay. So there's this uh process manufacturing variations which is good and then these environmental and uh variations and aging are problematic.

Um so this puff thing right when a chip is made again because they're not putting the chip atom by atom. So each chip will differ from one from the other. So these process variations are what allows uh people to design these puffs. Um now when a chip is operating there's maybe heat and other kind of physical uh phenomena happening and this kind of introduces noise. So that means that it can kind of like change the output of the puff.

So um one example is the vibration of electrons. Um so that means that the response will be slightly different from one you know each time you query the the chip for its puff response and then the a this aging as the material of the chip kind of like wears out a bit that the puff response will change too. So this leads to this thing that is called stabilization. Basically, you want a deterministic output that each time you query a chip, right, its fingerprint should five minutes. All right?

Should always be the same. Um, so the most widely used scheme that I know that I'm aware of for the stabilization is error correction schemes. So that's a bit problematic because it introduces this step where they need to store some kind of metadata in nonvolatile memory to be able to do this error correcting codes apply the error correcting codes to the puff response right so when you turn the chip on it will produce this let's say bit string but from each time you you you do it will be slightly different and they have this error correction mechanism to make the response deterministic but in order to do that they have what they call helper data that is stored in nonvolatile memory and this is an attack vector to attack the puff and there's other ways and a very interesting one is metal oxide breakdown puff but then later on the same authors attacked it anyways this is an area of research and uh I don't have much time now unfortunately to yeah I talk about this metal side breakdown puff which I think is very interesting um I I'll say briefly because I think it's So you take two transistors, you apply voltage to them like you stress them intentionally and it will cause the metal oxide to kind of break down and then they can detect that and then the first one to break down will be set to a one say and the other a zero and then you construct an array and this will be permanent. It's just like at setup time if you want the first time this happens and they managed to to attack it. The same author, the same lab that came up with this puff, they realized using an electron microscope, they could see the little spots on the chip like uh like you think of a tattoo, right?

So they could see that and then they could restore the key. Okay. So I think I will end here then. So now there's a Okay. Let's say you I don't know if I've convinced you that puffs are interesting, but let's say okay, you still have this problem that yeah, the puff is hardware.

How do you know that it's a real puff or how do you know that it's a it was manufactured properly and all that? So, I think it's an open question in in quantum cryptography. That's what I mentioned earlier. There's this concept of device independent cryptography. So, basically, how do you know you're talking to a quantum computer that is remote?

We have the same problem here. Um there's interesting work that looked at that in the past where you know if you assume a malicious puff what can you do still uh this is just a note if you want to explore these questions and beyond there's some interesting work that is from this uh friend of mine Alex and others at Arya which is UK research fund and they're looking at puffs and other things uh from point of view of research. So this is a an interesting I think picture that you see here physical and global functions but in it's a much bigger context. At the top left you have secret hardware temperproof sensors you know you have quantum money on the right hand side uh temperroof materials verifiable reaction. So the point is that these puffs, okay, if they're engineered properly, despite the challenges like I just mentioned, could play a key role in many of the infrastructure we have right on the planet.

Um, I think that's uh Yeah, that's