Michael Weiner

Breaking through fixed PUF block limitations with differential sequence coding and convolutional codes

Secret key generation with Physical Unclonable Functions (PUFs) is an alternative to conventional secure key storage with non-volatile memory. In a PUF, secret bits are generated by evaluating the internal state of a physical source. Typically, error correction is applied in two stages to remove the instability in the measurement that is caused by environmental influences. We present a new syndrome coding scheme, called Differential Sequence Coding (DSC), for the first error correction stage. DSC applies a fixed reliability criterion and searches the PUF output sequence sequentially until a number of suitable PUF outputs is found. This permits to guarantee the reliability of the indexed PUF outputs. Our analysis demonstrates that DSC is information theoretically secure and highly efficient. To the best of our knowledge, we are the first to propose a convolutional code with Viterbi decoder as second stage error correction for PUFs. We adapt an existing bounding technique for the output bit error probability to our scenario to make reliability statements without the need of laborious simulations. Aiming for a low implementation overhead in hardware, a serialized low complexity FPGA implementation of DSC and the Viterbi decoder is used in this work. For a reference SRAM PUF scenario, PUF size is reduced by 20% and the helper data size decreases by over 40% compared to the best referenced FPGA implementations in each class with a minor increase in the number of slices.

Improvement of constraint-based flux estimation during L-phenylalanine production with Escherichia coli using targeted knock-out mutants.

Fed‐batch production of the aromatic amino acid L‐phenylalanine was studied with recombinant Escherichia coli strains on a 15 L‐scale using glycerol as carbon source. Flux Variability Analysis (FVA) was applied for intracellular flux estimation to obtain an insight into intracellular flux distribution during L‐phenylalanine production. Variability analysis revealed great flux uncertainties in the central carbon metabolism, especially concerning malate consumption. Due to these results two recombinant strains were genetically engineered differing in the ability of malate degradation and anaplerotic reactions (E. coli FUS4.11 ΔmaeA pF81kan and E. coli FUS4.11 ΔmaeA ΔmaeB pF81kan). Applying these malic enzyme knock‐out mutants in the standardized L‐phenylalanine production process resulted in almost identical process performances (e.g., L‐phenylalanine concentration, production rate and byproduct formation). This clearly highlighted great redundancies in central metabolism in E. coli. Uncertainties of intracellular flux estimations by constraint‐based analyses during fed‐batch production of L‐phenylalanine were drastically reduced by application of the malic enzyme knock‐out mutants. Biotechnol. Bioeng. 2014;111: 1406–1416.

Breaking DVB-CSA

Digital Video Broadcasting (DVB) is a set of standards for digital television. DVB supports the encryption of a transmission using the Common Scrambling Algorithm (DVB-CSA). This is commonly used for PayTV or for other conditional access scenarios. While DVB-CSA support 64 bit keys, many stations use only 48 bits of entropy for the key and 16 bits are used as a checksum. In this paper, we outline a time-memory-tradeoff attack against DVB-CSA, using 48 bit keys. The attack can be used to decrypt major parts a DVB-CSA encrypted transmission online with a few seconds delay at very moderate costs. We first propose a method to identify plaintexts in an encrypted transmission and then use a precomputed rainbow table to recover the corresponding keys. The attack can be executed on a standard PC, and the precomputations can be accelerated using GPUs. We also propose countermeasures that prevent the attack and can be deployed without having to alter the receiver hardware.

Carbon storage in recombinant Escherichia coli during growth on glycerol and lactic acid

A fed‐batch process was studied with lactate and glycerol supply in the growth phase and glycerol supply during L‐phenylalanine production with recombinant E. coli K‐12. Lactic acid feeding was necessary for growth because the genes encoding the PEP‐consuming pyruvate kinase isoenzymes (pykA, pykF) have been deleted. An unexpected glucose efflux (67.6 ± 2.3 mgGlucose gCDW−1) was measured after the cells were harvested and resuspended in a mineral medium for metabolic perturbation experiments. As the efflux prohibited the application of these experiments, characterization of intracellular carbon storage was necessary. Therefore, two genetically engineered strains (one lacking glycogen metabolism and another additionally lacking trehalose synthesis) were applied in the fed‐batch process. Trehalose synthesis and accumulation from lactate was clearly identified as the source for glucose efflux after cell harvest and resuspension. Cultivations of strains with active pyruvate kinase successfully identified lactate as the carbon source causing intracellular trehalose storage. The usage of glycerol as sole carbon source during the whole process enabled an improved process performance and inhibited trehalose accumulation. Overall, this setup allows the application of perturbation experiments. Biotechnol. Bioeng. 2014;111: 2508–2519.

FPGA implementation of an improved attack against the DECT standard cipher

The DECT Standard Cipher (DSC) is a proprietary stream cipher used for enciphering payload of DECT transmissions such as cordless telephone calls. The algorithm was kept secret, but a team of cryptologists reverse-engineered it and published a way to reduce the key space when enough known keystreams are available [4]. The attack consists of two phases: At first, the keystreams are analyzed to build up an underdetermined linear equation system. In the second phase, a bruteforce attack is performed where the equation system limits the number of potentially valid keys. In this paper, we present an improved variant of the first phase of the attack as well as an optimized FPGA implementation of the second phase, which can be used with our improved variant or with the original attack. Our improvement to the first phase of the attack is able to more than double the success probability of the attack, depending of the number of available keystreams. Our FPGA implementation of the second phase of the attack is currently the most cost-efficient way to execute the second phase of the attack.

Security analysis of a widely deployed locking system

Electronic locking systems are rather new products in the physical access control market. In contrast to mechanical locking systems, they provide several convenient features such as more flexible access rights management, the possibility to revoke physical keys and the claim that electronic keys cannot be cloned as easily as their mechanical counterparts. While for some electronic locks, mechanical flaws have been found, only a few publications analyzed the cryptographic security of electronic locking systems. In this paper, we analyzed the electronic security of an electronic locking system which is still widely deployed in the field. We reverse-engineered the radio protocol and cryptographic primitives used in the system. While we consider the system concepts to be well-designed, we discovered some implementation flaws that allow the extraction of a system-wide master secret with a brute force attack or by performing a Differential Power Analysis attack to any electronic key. In addition, we discovered a weakness in the Random Number Generator that allows opening a door without breaking cryptography under certain circumstances. We suggest administrative and technical countermeasures against all proposed attacks. Finally, we give an examination of electronic lock security standards and recommend changes to one widely used standard that can help to improve the security of newly developed products.

Parallelized small-scale production of uniformly 13C-labeled cell extract for quantitative metabolome analysis

The need for quantitative intracellular metabolome information is central to modern applied biotechnology and systems biology. In most cases, sample preparation and metabolite analysis result in degradation of metabolites and signal suppression due to metabolite instability and matrix effects during LC-MS analysis. Therefore the application of uniformly (U) (13)C-labeled cell extract as an internal standard has gained interest in recent years. In this study a multiple-step protocol has been developed for efficient preparation of U-(13)C-labeled Escherichia coli cell extracts in stirred-tank bioreactors on a milliliter scale with a minimal supply of costly (13)C-labeled substrate. Significant reduction of fermentation medium salt concentration in the U-(13)C-labeled cell extract was achieved to reduce ion-suppression effects during mass-spectrometric analysis. Additionally, variation of reaction conditions in parallel-operated stirred-tank bioreactors on a milliliter scale enables the simultaneous preparation of U-(13)C-labeled cell extracts with varying metabolite concentrations, which is shown by an example of the labeled phosphoenolpyruvate level in E. coli.

Utilization of organophosphate:phosphate antiporter for isotope‐labeling experiments in E. coli

The transport of organophosphates across the cytoplasma membrane is mediated by organophosphate:phosphate antiporter proteins. In this work, we present the application of a recombinant phosphoenolpyruvate:phosphate antiporter for isotopic labeling experiments in E. coli strains. The antiporters UhpT, UhpT-D388C, and PgtP were investigated regarding transport activity and growth on phosphoenolpyruvate as sole carbon source. The expression of the protein variant UhpT-D388C in a shikimic acid producing E. coli strain was used to show the successful isotopic labeling of shikimic acid from extracellular phosphoenolpyruvate. The results demonstrate the possibility of a direct incorporation of exogenously applicated glycolysis intermediates into E. coli cells for 13C-labeling experiments.

Phosphoenolpyruvate Transporter Enables Targeted Perturbation During Metabolic Analysis of L-Phenylalanine Production With Escherichia coli

Usually perturbation of the metabolism of cells by addition of substrates is applied for metabolic analysis of production organisms, but perturbation studies are restricted to the endogenous substrates of the cells under study. The goal of this study is to overcome this limitation by making phosphoenolpyruvate (PEP) available for perturbation studies with Escherichia coli producing L-phenylalanine. A production strain overexpressing a PEP-transporter variant (UhpT-D388C) is applied in a standardized fed-batch production-process on a 42 L-scale. Four parallel short-term perturbation experiments of 20 min are performed with glucose and glycerol as fed-batch carbon sources after rapid media transition of cells from the production-process. PEP is added after 9 min and is immediately consumed by the cells with up to 1.5 mmol gCDW-1  h-1 . L-phenylalanine production rates increased by up to 200% after addition of PEP. This clearly indicates an intracellular PEP-limitation in the L-phenylalanine production strain under study. Thus, it is shown that overexpressing specific transporters for analytical reasons makes exogenous substrates available as perturbation substrates for metabolic analyses of cells sampled from production-processes and thereby allows a very targeted perturbation of whole-cell metabolism.

The low area probing detector as a countermeasure against invasive attacks

Microprobing allows intercepting data from on-chip wires as well as injecting faults into data or control lines. This makes it a commonly used attack technique against security-related semiconductors, such as smart card controllers. We present the low area probing detector (LAPD) as an efficient approach to detect microprobing. It compares delay differences between symmetric lines such as bus lines to detect timing asymmetries introduced by the capacitive load of a probe. Compared with state-of-the-art microprobing countermeasures from industry, such as shields or bus encryption, the area overhead is minimal and no delays are introduced; in contrast to probing detection schemes from academia, such as the probe attempt detector, no analog circuitry is needed. We show the Monte Carlo simulation results of mismatch variations as well as process, voltage, and temperature corners on a 65-nm technology and present a simple reliability optimization. Eventually, we show that the detection of state-of-the-art commercial microprobes is possible even under extreme conditions and the margin with respect to false positives is sufficient.