We show how to extract sensitive cryptographic keys from a variety of commercially available tamper resistant cryptographic security tokens and smartcards, exploiting vulnerabilities in their RSA PKCS#11 based APIs. The attacks are performed by Tookan, an automated tool we have developed, which reverse-engineers the particular token in use to deduce its functionality, constructs a model of its API for a model checker, and then executes any attack trace found by the model checker directly on the token. We describe the operation of Tookan and give results of testing the tool on 18 commercially available tokens: 10 were vulnerable to attack, while the other 8 had severely restricted functionality. Response from manufacturers has varied from registering the vulnerability with MITRE and announcing a patch programme to a complete lack of response. We discuss how Tookan may be used to verify patches to insecure devices, and give a secure configuration that we have implemented in a patch to a software token simulator. This is the first such configuration to appear in the literature that does not require any new cryptographic mechanisms to be added to the standard. We comment on lessons for future key management APIs.

Joint work with Matteo Bortolozzo, Matteo Centenaro, and Riccardo Focardi.