Hardware Security

Learn hardware security with multiple-choice questions focused on principles and countermeasures: speculative-execution side channels (Spectre and Meltdown), power analysis and timing attacks, secure boot, TEEs, PUFs and hardware Trojans.

—Your accuracy
0 / 50Questions answered
Practice this topicAll questions in this topic, in random order Weak questionsRetry only the questions you last got wrong

Hardware Security: key points

Even when software is free of bugs, information can leak through properties of the hardware. Vulnerabilities known as Spectre and Meltdown exploit the fact that speculative execution and caches, which exist to improve performance, leave traces of data that should be invisible. Side-channel attacks can also infer cryptographic keys from tiny differences in power consumption or execution time.

Defensive technologies include secure boot, which starts only trusted software; trusted execution environments (TEEs), isolated even from the OS; PUFs, which use each chip's manufacturing variation like a fingerprint; and countermeasures against malicious circuits inserted during design or manufacturing (hardware Trojans). The goal is to understand principles and defenses, not attack procedures.

All Hardware Security questions (50)

  1. Which best describes the problems addressed by hardware security?
  2. Which describes a side-channel attack?
  3. Which correctly pairs the principle behind timing attacks with a typical countermeasure?
  4. What weakness lurks in the password comparison function above, and what is the fix?
  5. What is the main reason cache-based side-channel attacks work?
  6. What is the principle behind the speculative execution vulnerability known as Spectre?
  7. Why does information still leak in attacks like Spectre even though speculatively executed instructions are rolled back?
  8. What is the principle of the vulnerability called Meltdown, which affected some CPUs?
  9. What is the idea behind KPTI (kernel page-table isolation), introduced as a software countermeasure to Meltdown?
  10. Which is NOT used as a countermeasure to speculative-execution vulnerabilities such as Spectre?
  11. Which statement about countermeasures to speculative-execution vulnerabilities is generally correct?
  12. Among power analysis attacks on chips performing cryptography, what characterizes differential power analysis (DPA)?
  13. What is the idea behind masking, a countermeasure against power analysis?
  14. What characterizes electromagnetic side-channel analysis?
  15. Which describes a fault injection attack?
  16. Which is NOT a countermeasure against fault injection attacks?
  17. Which is a countermeasure against DRAM Rowhammer?
  18. Which correctly pairs why cold boot attacks work with a typical countermeasure?
  19. Which describes secure boot?
  20. What is the most suitable thing placed inside the chip as the root of trust for secure boot?
  21. What is the advantage of using public-key cryptography to verify software signatures in secure boot?
  22. In devices with secure boot, why is an anti-rollback mechanism needed?
  23. What is the main role of a TPM (Trusted Platform Module) installed in PCs and similar?
  24. What is the difference between secure boot and measured boot?
  25. Which describes remote attestation?
  26. Which describes a TEE (trusted execution environment)?
  27. What is the basic mechanism of Arm TrustZone?
  28. What characterizes enclave-style TEEs such as Intel SGX?
  29. In confidential computing on the cloud, what is the purpose of CPU features that encrypt virtual machine memory (such as AMD SEV or Intel TDX)?
  30. Which describes a PUF (physically unclonable function)?
  31. What is the advantage of using a PUF for key storage?
  32. What property does an SRAM PUF exploit?
  33. Why is error correction (such as helper data) combined with PUFs when deriving keys?
  34. Which describes a true random number generator (TRNG) built into a chip?
  35. What can happen if poor-quality, predictable random numbers are used to generate cryptographic keys?
  36. Which describes a hardware Trojan?
  37. What is the main reason hardware Trojans are hard to find with ordinary testing?
  38. Which is NOT a countermeasure against hardware Trojans?
  39. What is the danger of counterfeit chips (such as remarked parts) in the semiconductor supply chain?
  40. Why are debug ports such as JTAG disabled or placed behind authentication in shipped products?
  41. Which describes the tamper resistance required of security chips such as smart cards?
  42. Which method is commonly used to store keys written into a chip?
  43. Besides speed, what advantage comes from giving CPUs dedicated AES instructions (such as AES-NI)?
  44. What must be observed when implementing cryptographic code in constant time?
  45. What is the idea of partitioning a shared cache as a countermeasure to cache side channels?
  46. Why do some systems handling confidential work disable the CPU's simultaneous multithreading (SMT)?
  47. What countermeasure protects against external devices connected to a PC using DMA to read or write main memory without permission?
  48. What is the idea of "defense in depth," emphasized in hardware and software security?
  49. When manufacturing many devices, why give each device its own key instead of the same key in all of them?
  50. When a CPU hardware vulnerability is discovered, which is one countermeasure applied to CPUs already shipped?

Other topics in Computer systems