Re: DalSemi: Add-Only Memory for Storage of Digital Cash (fwd)

Forwarded message:
From die Wed Oct 18 21:42:07 1995
Subject: Re: DalSemi: Add-Only Memory for Storage of Digital Cash
To: roy@cybrspc.mn.org
Date: Wed, 18 Oct 1995 21:42:07 -0400 (EDT)
From: "Dave Emery" <die@pig.die.com>
Reply-To: die@die.com
In-Reply-To: <951017.172824.4H9.rnr.w165w@cybrspc.mn.org> from "Roy M. Silvernail" at Oct 17, 95 05:28:24 pm
X-Mailer: ELM [version 2.4 PL24alpha3]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Content-Length: 1135      

Roy Silvernail writes:

> This comes from the fact that PROMs are typically mask-programmed at the
> fabrication stage.  EPROMS are programmed in the field.  And yes, if you
> could get the top of the chip off cleanly, you could erase and reprogram
> them.  (not likely, and hardly undetectable, but it's ever so slightly
> possible)  More often, I see these devices called OTP (for One Time
> Programmable).  In the more standard types (27C256, for example),
> they're a fraction of the cost of the erasable ones.  Ceramic cases and
> quartz windows are spendy.

	Perhaps someone with more semiconductor physics background
can correct me, but my understanding is that some kinds of nuclear
radiation can be used to erase OTP EPROMS.   I suppose this might damage
the crystal lattice badly enough to render the device useless in
some bit positions or reduce data retention time a lot, but I sure
wouldn't bet any security on devices out there not being 
arbitrarily reprogrammable (thus using bits to represent digital
coins in a wallet that get reset when they are spent is not a
good idea).

						Dave Emery
						die@die.com

>

> 	Perhaps someone with more semiconductor physics background
 > can correct me, but my understanding is that some kinds of nuclear
 > radiation can be used to erase OTP EPROMS.   I suppose this might damage
 > the crystal lattice badly enough to render the device useless in
 > some bit positions or reduce data retention time a lot, but I sure
 > wouldn't bet any security on devices out there not being 
 > arbitrarily reprogrammable (thus using bits to represent digital
 > coins in a wallet that get reset when they are spent is not a
 > good idea).

You might want to take a look at the paper I mentioned, then: I
believe that irradiation of the OTP EPROM to return all bits to "ones"
is too blunt a tool to do you any good. A virgin EPROM has a value of
zero in the suggested scheme. And, as mentioned, flipping random sets
of bits is strongly likely to get you caught.

Note also that the encoding is strongly tied to the laser-etched serial
number on the chip, so replay attacks between two different chips --
i.e. copying a fully loaded chip to a virgin chip -- won't work.

However, it does open up the scheme to replay attacks, if you can load
the chip with value, spend it, irradiate it, and then successfully
reprogram the chip with the exact same values you recorded.

Good point.

I seem to remember PROMs actually undergoing physical, rather than
electrical, state changes (that were presumably nonreversible). Am I
recalling old technology, or am I just plain mistaken?

nathan