CVE-2021-3011: Ftsafe K13 Information Disclosure Flaw

CVE-2021-3011 Overview

An electromagnetic-wave side-channel vulnerability has been discovered affecting NXP SmartMX / P5x security microcontrollers and A7x secure authentication microcontrollers running CryptoLib through version 2.9. This hardware-level vulnerability allows attackers with extended physical access to extract ECDSA private keys through electromagnetic emanation analysis, ultimately enabling the creation of cloned security devices.

Critical Impact

Attackers with physical access can extract cryptographic private keys from affected hardware security devices, enabling device cloning and authentication bypass for FIDO U2F two-factor authentication tokens.

Affected Products

• Google Titan Security Key (NXP A7005a chip)
• Yubico YubiKey Neo
• Feitian FIDO U2F Security Keys (K9, K13, K21, K40)
• NXP SmartMX P5x Series (P5010, P5020, P5021, P5040)
• NXP A7x Secure Authentication Microcontrollers (A7005a)
• NXP JavaCard Smartcards (J3A081, J2A081, J3A041, and numerous J3D/J2D/J3E/J2E series variants)

Discovery Timeline

• 2021-01-07 - CVE-2021-3011 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-3011

Vulnerability Analysis

This vulnerability represents a sophisticated electromagnetic side-channel attack targeting the cryptographic operations within NXP security microcontrollers. During ECDSA signature generation, the microcontroller emits electromagnetic radiation patterns that correlate with the internal computational operations being performed. By capturing and analyzing these electromagnetic emanations during multiple signature operations, an attacker can statistically recover the private key material used in the signing process.

The attack was demonstrated successfully against the Google Titan Security Key, which utilizes the NXP A7005a secure authentication chip. The researchers showed that with extensive physical access to the device and specialized electromagnetic measurement equipment, the ECDSA private key could be fully recovered, allowing for the creation of a functionally identical clone of the security key.

Root Cause

The underlying issue stems from insufficient electromagnetic shielding and countermeasures within the NXP CryptoLib implementation (versions through 2.9) running on affected microcontrollers. The ECDSA scalar multiplication operation exhibits data-dependent power consumption and electromagnetic emission patterns that leak information about the secret scalar (private key) being used. This represents a classic side-channel vulnerability where physical characteristics of the computation reveal cryptographic secrets that should remain protected.

Attack Vector

The attack requires extended physical access to the target security device. An attacker must position an electromagnetic probe in close proximity to the security chip while it performs cryptographic operations. The attack process involves:

1. Physical acquisition - The attacker obtains temporary physical possession of the target security key
2. Electromagnetic measurement setup - Specialized equipment captures EM emanations during ECDSA operations
3. Signature collection - Multiple signature operations are triggered to gather sufficient electromagnetic traces
4. Statistical analysis - Collected traces are analyzed to correlate EM patterns with scalar multiplication operations
5. Key recovery - The ECDSA private key is mathematically reconstructed from the leaked information
6. Device cloning - A replica security device is created with the extracted key material

The vulnerability is particularly concerning because the attack leaves no detectable trace on the original device, and the cloned device can be used to bypass two-factor authentication protections. Technical details of the attack methodology are documented in the NinjaLab research publication.

Detection Methods for CVE-2021-3011

Indicators of Compromise

• Unexplained physical access events to security keys or smartcards
• Authentication events from security keys that users don't recognize
• Multiple simultaneous authentication sessions using the same hardware token
• Unusual patterns in two-factor authentication logs suggesting cloned credentials

Detection Strategies

• Monitor authentication systems for concurrent sessions using the same hardware security key from different geographic locations
• Implement anomaly detection for authentication patterns that deviate from established user baselines
• Review physical access logs and surveillance records for unauthorized handling of hardware security devices
• Correlate authentication events with user presence indicators (badge access, network location, etc.)

Monitoring Recommendations

• Enable comprehensive logging for all FIDO U2F authentication events including device identifiers
• Implement alerting for authentication attempts from hardware tokens during periods when users are known to be offline
• Monitor for registration of new security keys that could indicate an attacker establishing persistence with a cloned device
• Establish baseline authentication patterns for hardware token usage to detect statistical anomalies

How to Mitigate CVE-2021-3011

Immediate Actions Required

• Maintain strict physical custody of affected security keys and smartcards to prevent unauthorized access
• Consider replacing affected devices with hardware security tokens using newer, side-channel resistant implementations
• Review and audit all authentications performed by potentially compromised devices
• Implement additional authentication factors beyond hardware tokens for high-security operations

Patch Information

This vulnerability affects hardware and low-level cryptographic library implementations. NXP CryptoLib through version 2.9 is confirmed vulnerable. Organizations using affected devices should contact their hardware vendors (Google, Yubico, Feitian, NXP) for guidance on device replacement or firmware updates where available. Since this is a hardware-level vulnerability, software patches alone may not fully remediate the issue, and device replacement may be necessary for environments requiring strong cryptographic assurances.

Workarounds

• Implement tamper-evident enclosures or physical security measures for high-value security keys
• Reduce the exposure window by using security keys only when necessary and storing them securely
• Implement monitoring to detect if a cloned key is being used concurrently with the original
• Consider transitioning to security keys based on newer chip architectures with improved side-channel protections
• For high-security environments, implement defense-in-depth with multiple independent authentication factors

# Example: Monitoring FIDO U2F authentication events on Linux systems
# Review authentication logs for hardware token usage patterns
journalctl -u pam_u2f | grep -E "(authenticated|failed)" | tail -100

# Check for multiple concurrent sessions using same token
grep "U2F" /var/log/auth.log | awk '{print $1, $2, $NF}' | sort | uniq -c | sort -rn