The Theoretical Foundation and Dynamic Verification of Signatures

Biometric authentication technologies are based on measuring and matching the unique parameters of the human body, its skills or behavioral patterns. Unlike classical security factors (passwords or physical tokens), biometrics ties a digital identity directly to a physical person.

Historical and Socio-Technical Context

The first documented application of a security protocol based on the individual characteristics of a person (speech physiology) is described in the Book of Judges (12:5–6), where the accent used when pronouncing the word "Shibboleth" served as the authenticator (members of the tribe of Ephraim could not correctly pronounce the "sh" sound and pronounced it as "Sibboleth"). The Bible also mentions less formal methods — for example, Isaac's attempt to identify Esau by his body hair, which was successfully bypassed by Jacob using disguise (an example of early biometric spoofing).
The modern classification divides biometric parameters into three main categories:

1. Anatomical / Physiological characteristics: Measurable static parameters of the geometry or structure of the body (hand geometry, fingerprint ridge patterns, the structure of the iris of the eye).
2. Behavioral characteristics / Ingrained skills: Dynamic patterns of a person's actions (handwritten signature, the tempo and style of typing on a keyboard).
3. Combined parameters: Characteristics that depend both on anatomy and on behavior (the spectral characteristics of the voice).

The market for biometric systems experienced explosive growth after the events of 11 September 2001, increasing from $50 million in 1998 to more than $1.5 billion in 2005. This was driven by the launch of large-scale government programs: the international standardization of biometric travel documents, the American entry control system US-VISIT, European Schengen visas and initiatives on the introduction of national ID cards.

The Mathematics of Biometric Recognition Errors

Any biometric system performs probabilistic matching. Unlike the cryptographic comparison of hashes, where the result is binary (matched/did not match), a biometric algorithm computes the distance of similarity (a metric) between the stored template (enrolled template) and the presented feature vector (live sample).
The decision threshold determines the balance between two fundamental types of error:

• Type 1 Errors: The false rejection of a legitimate user. In the biometric literature this is denoted as FRR (False Reject Rate). In the banking sector this parameter is critical from the point of view of user experience and is called the Insult Rate.
• Type 2 Errors: The false confirmation of the identity of an attacker. It is denoted as FAR (False Accept Rate). In banking terminology this parameter is called the Fraud Rate.

The relationship between these errors is described by the ROC (Receiver Operating Characteristic) curve, borrowed from radar theory. By changing the threshold value of the algorithm's sensitivity, the operator shifts the point on the ROC curve:

• Increasing sensitivity (strengthening security) reduces the FAR (Fraud Rate), but exponentially increases the FRR (Insult Rate).
• Lowering the threshold makes the system more "tolerant", reducing the number of false rejections (FRR), but opens up opportunities for successful compromise attacks (a rise in the FAR).

Important Metrics:

• EER (Equal Error Rate): The point on the ROC curve where FAR = FRR. It serves as a basic (but often insufficient for practice) indicator of the overall accuracy of the algorithm.
• Practical business requirements: For the deployment of systems in retail and the banking sector, the requirements are stricter than the EER point. For example, British banks set a target benchmark: Fraud Rate (FAR) ≤1% at an Insult Rate (FRR) ≤0.01%. For modern signature recognition systems and even fingerprint scanning, this threshold remains difficult to achieve in an uncontrolled environment.

Handwritten Signatures

Historical-Legal Aspects and the Distribution of Risks

In classical China, Japan and Korea, personal carved seals (facsimiles), which possessed a higher legal status, historically predominated. In Europe, after the Renaissance, the handwritten signature became the standard means of expressing consent and certifying documents.
The reliability of the signature as a biometric mechanism was historically considered weak because of the ease of its visual forgery; however, the system functioned successfully thanks to the legal context of the distribution of responsibility:

• Within the framework of English common law (UK Law), a forged signature is recognized as null and void. The risk and financial losses from accepting a forgery are borne by the party that relied on it (for example, the bank), and the rules of customer service cannot forcibly shift this risk onto the consumer.
• In the USA, the effect of the regulatory act Regulation E imposes analogous obligations on banks for failures in the electronic systems they have deployed.
• Conversely, in some jurisdictions (for example, in a number of Swiss banks) the rules may place responsibility for forged cheques on the customer himself.

Expert Document Analysis vs Random Matching

The probability of successfully detecting a forgery depends directly on the qualification of the checker. Let us give the results of a landmark experiment:

• In pairwise comparison of handwriting samples, professional expert graphologists (document examiners) made errors in 6.5% of cases. Their errors are often caused by cognitive biases, the context of the case and professional prejudices.
• The control group of untrained people demonstrated an error rate of 38.3% of cases. Introducing monetary motivation for the non-specialists did not improve this figure at all.

When matching signatures on cheques or trade vouchers in real conditions (where the check is performed superficially by cashiers), the real error level is significantly higher.

Automation: Static and Dynamic Recognition

In bank cheque processing centers, manual verification is economically justified only for transactions exceeding a certain limit (for example, from $1,000 to $10,000). To automate low-budget transactions, two classes of systems are being developed:

1. Optical (static) recognition: Analysis of the scanned image of a finished signature. This is an extremely difficult computer vision task because of the high natural variability of the signature of one and the same person at different times of day, on different paper and in different psychological states. The Equal Error Rate (EER) for optical methods amounts to several percent, which makes them unsuitable for automated decision-making.
2. Dynamic verification (Signature Tablets): The use of specialized sensor tablets. The device records not only the final geometry of the lines, but also the dynamic parameters of the biometric act during its performance:

• The vector of change of the pen movement speed (v(t)).
• Acceleration and coordinate timings.
• The moments when the pen lifts off the surface (when the line is interrupted, but the movement of the hand continues).
• In advanced models — the angle of inclination of the pen and the force of pressure on the substrate.

For dynamic tablets the EER value is in the region of 1%. Although this makes the technology inapplicable as the sole line of authorization in retail (rejecting every hundredth customer paralyzes trade), it effectively performs the role of a "filter" in decision support systems.

A Practical Case: The University of Kent Experiment

In a post office in Southampton (UK), a system of dynamic signature verification was implemented to combat fraud in the receipt of social benefits. Since an automatic refusal to a customer is unacceptable, the architects of the system tuned it to a balance at the EER point. The system did not block the issuance of funds on its own: when a deviation of the dynamic parameters from the template was recorded, the terminal issued a warning to the operator, initiating an in-depth manual check of the documents and a personal interview of the applicant by a postal employee. This approach made it possible to sharply reduce the volume of fraud through psychological deterrence and targeted control, while minimizing conflicts with honest citizens.

Face Recognition, Bertillon's Anthropometry and Forensic Criminology

The transition from behavioral biometrics to the automated analysis of anatomical facial features required a rethinking of approaches to the classification and storage of data. At the basis of modern face recognition systems lie both historical forensic practices and complex image decomposition algorithms.

The Anthropometry of Alphonse Bertillon (Bertillonage)

Before the appearance of fingerprinting, the first structured biometric system in the world was the Bertillon system (bertillonage), developed in Paris in 1879. The card index of the criminal police of that time was ineffective: criminals easily changed their names, disguised themselves and moved to other cities, which made it impossible to identify recidivists.
Bertillon applied a strictly scientific approach, based on the assumption that the bone structures of an adult (over 20 years old) remain unchanged throughout life. The system included:

1. Precise anthropometric measurements: 11 parameters were measured (height, arm span, trunk length, length and width of the head, length of the right ear, length of the left foot, length of the middle finger of the left hand, etc.) with the help of special calipers.
2. The portrait parlé (spoken portrait): A standardized textual description of anatomical features (the shape of the nose, the slope of the forehead, the color of the iris according to a strict scale).
3. Standardized photography: A frontal shot and a profile with a rigidly fixed focal length and lighting (in fact, this laid down the standard of the modern mugshot).

The Mathematics of Bertillonage and the Collapse of the System

Bertillon divided each parameter into three categories: "small", "medium" and "large". Having 11 independent measurements, the theoretical number of unique combinations amounted to 3^11 = 177,147. This made it possible to distribute the card index into isolated drawers and find a suspect's card in a few minutes instead of a many-hour sorting through thousands of photographs.
However, the system possessed critical vulnerabilities:

• Dependence on the operator: Measurements made by different policemen in different cities differed substantially because of instrument errors and the resistance of the arrested.
• Genetic correlation: The body parameters of a person are not fully independent (for example, tall height strongly correlates with the length of the foot and the fingers), which reduced the real entropy of the system.

The final collapse of bertillonage occurred in 1903 at Leavenworth prison (USA), where a prisoner named Will West was delivered. His anthropometric data practically ideally matched the card of William West, who was already serving a term there. It turned out that these were completely different people who looked like twins. The case proved the unreliability of bone measurements and accelerated the transition of the world's intelligence services to fingerprinting.

Automated Face Recognition Technologies

Modern computer face recognition systems (Automated Face Recognition — AFR) are forced to solve the problem of variability: one and the same face looks fundamentally different depending on the shooting angle (the viewpoint), lighting, facial expression (mimics) and age.

Algorithmic Approaches:

1. Principal Component Analysis (PCA) and Eigenfaces: This is historically the first successful mathematical approach. A set of training digital portraits is transformed into an orthogonal basis of features (the eigenvectors of the covariance matrix of the images). Any new face is represented as a linear combination of these "eigenfaces". Comparison reduces to computing the Euclidean distance between the weighting coefficients. The method is highly efficient in ideal conditions, but instantly loses accuracy when the lighting changes or the head turns.
2. Local Feature Analysis: The algorithm highlights the key anthropometric points (the inner and outer corners of the eyes, the tip of the nose, the edges of the lips, the boundaries of the chin). The relative distances and angles between them are measured. This approach is more resistant to facial expressions.
3. 3D face scanning: The use of infrared illumination and structured light to construct a three-dimensional mesh of the face. The method is resistant to makeup and to changes of viewpoint, but requires expensive equipment and is inapplicable for covert surveillance from standard CCTV cameras.

The Problem of Matching Against a Photo-ID ("What Goes Wrong")

The introduction of face recognition systems into national passports and visas (ICAO standards) created the illusion of high reliability. However, let us analyze in detail the vulnerabilities of these systems in real scenarios.

Experiments with Bank Cards and Photo-IDs

In the 1990s in the UK, retailers and banks conducted a large-scale study, attempting to introduce photographs of customers onto plastic cards in order to combat fraud. It was assumed that a supermarket cashier would compare the face of the buyer with the image on the card. The results turned out to be catastrophic:

• Cashiers let through up to 30-40% of cards that were definitely someone else's (a high level of FAR because of inattention and fatigue).
• At the same time they regularly blocked legitimate customers (a high FRR) whose hairstyle had changed, whose hair color had changed, or who had acquired glasses or light stubble.
  The idea of photo-IDs on cards was recognized as unviable, which pushed the industry toward the introduction of the EMV standard (Chip & PIN).

The Limitations of Automated Inspection Systems (Smart Gates)

When AFR is integrated at border control in airports, two systemic problems arise:

• False Positives: If the system is configured to search for terrorists on a "black list" (Watchlist), then because of a mathematical phenomenon (the base-rate paradox) even with an algorithm accuracy of 99.9% the overwhelming majority of hits on a many-thousand passenger flow will be false. This leads to "alarm fatigue" (alarm fatigue) among security operators.
• Attacks on Templates (Imitation): 2D recognition systems are vulnerable to the simplest spoofing with the help of high-resolution printed photographs or tablet screens. Advanced systems require a "liveness" check (liveness detection) — they ask the user to blink or turn their head, which, however, is bypassed by the use of high-quality silicone masks or deepfake technologies.

Forensic Handwriting and Signature Analysis in Court

In judicial practice, graphological expertise (forensic document examination) was for a long time considered indisputable evidence. There is a systemic crisis in this area:

• Subjectivity: Unlike DNA analysis, graphologists have no rigid statistical base. The assessment of "matching curls" or "the character of the pressure" depends largely on the intuition of the expert.
• Contextual Bias: If, together with the document samples, the expert is given the materials of the case (for example, is told that the suspect has already confessed or that his fingerprints were found at the crime scene), the accuracy of his independent analysis falls. The expert subconsciously looks for matches where there are none.

For this reason, modern standards of justice in developed countries (for example, the Daubert rules in the USA) require the minimization of the influence of the human factor and the gradual transfer of forensic handwriting assessment onto strict automated rails using statistical metrics of feature distribution.

Fingerprints and Iris Recognition

The transition to high-precision physiological biometric parameters made it possible to significantly reduce the theoretical error rates. However, the practical implementation of fingerprint and iris scanning revealed fundamental differences between the laboratory accuracy of algorithms and their resistance to real attacks and to the peculiarities of the human factor.

Fingerprinting and AFIS Systems

The idea of the uniqueness of ridge patterns was developed at the end of the 19th century by William Herschel, Francis Galton and Edward Henry. Henry's classification system divided the patterns into three main classes: arches, loops and whorls, which made it possible to index paper card files.

Recognition Algorithms: Minutiae vs Correlation

Modern automated fingerprint identification systems (AFIS — Automated Fingerprint Identification Systems) use two main mathematical approaches for matching:

1. Minutiae-based (Local feature analysis): The algorithm binarizes the fingerprint image, thins the lines down to a thickness of 1 pixel and extracts minutiae — points of anomaly of the ridge pattern. The main types of minutiae are ridge endings and bifurcations. Each minutia is described by a vector: coordinates (x, y) and the angle of the line direction θ. The comparison of two fingerprints reduces to the task of subgraph search and computing the geometric alignment of point sets. This method is resistant to small shifts and rotations of the finger on the scanner.
2. Correlation-based method: Direct pixel-by-pixel superposition and computation of the correlation coefficient between two images. The method requires ideal positioning of the finger and is extremely sensitive to pressure, skin deformation and scanner contamination, which is why it is practically not used in large-scale systems.

Judicial Errors and "Standards of Matches"

Some experts criticize the belief entrenched in society that fingerprinting is an infallible science. Historically, in the criminology of different countries there existed rigid legal standards: for a match to be recognized in court, the expert had to record a certain number of identical minutiae (for example, 16 points in the UK, 12 in France, from 8 to 12 in Germany).
However, in 2001, under pressure from the police, the standards were relaxed in favor of a "non-numeric subjective assessment by the expert" (non-numeric standard). This led to a rise in judicial errors:

• The Shirley McKie Case: A Scottish detective was accused of perjury because her fingerprint was allegedly found at a murder scene. Independent international experts later proved that the ridge pattern belonged to another person, and that the official forensic scientists had made a gross error because of cognitive bias.
• The Brandon Mayfield Case: After the terrorist attacks in Madrid in 2004, the FBI, using an AFIS system, identified the American lawyer Mayfield from a fingerprint on a bag with explosives. The match was confirmed by three top FBI experts. Several weeks later the Spanish police detained the real terrorist, whose fingerprint matched far more precisely. The error occurred because the AFIS algorithm issued, from a many-million database, a subset of visually very similar patterns, and the experts subconsciously fitted the result to the suspect.

Iris Recognition

The technology of iris recognition, developed by the mathematician John Daugman at Cambridge University, is considered the standard of accuracy in biometrics and possesses the highest theoretical entropy.

The Mathematical Basis: Daugman's Codes

The iris is formed in the process of intrauterine development in a random manner (morphogenesis) and remains unchanged. The texture of the right and left eye is absolutely unique even in identical twins.
Daugman's algorithm works as follows:

1. The system captures an image of the eye in the near-infrared range (NIR, 700–900 nm). This is necessary in order to reveal the complex texture even in dark brown eyes.
2. The boundaries of the pupil and the iris are localized with the help of integro-differential operators.
3. The extracted circular zone is transformed into polar coordinates, normalized by size (in order to compensate for the narrowing or expansion of the pupil from light).
4. The texture is filtered using two-dimensional Gabor wavelets. The phase information is extracted and quantized into a binary matrix of size 2048 bits (256 bytes) — the IrisCode. Another 2048 bits are allocated for a noise mask (excluding eyelashes, glares and eyelids).

Hamming Distance and Phenomenal Accuracy

The comparison of two iris codes is performed through the bitwise XOR operation with counting of the number of differing bits — the computation of the Hamming Distance (HD).

• If the codes belong to one and the same eye, because of scanning noise the HD amounts to about 0.05 - 0.1 (more than 90% of the bits match).
• If two different eyes are compared, the bits are distributed absolutely randomly, and the mean Hamming distance strictly obeys a binomial distribution with a peak at the point HD = 0.5.

Thanks to the high power independence of the features (about 249 degrees of freedom), the tails of the distributions do not intersect. By setting the cutoff threshold at the level HD = 0.32, the system ensures a theoretical probability of false match (FAR) at the level of 1 in 10 billion. This makes the IrisCode the only biometric applicable for "one-to-many" (1:N) search over gigantic databases without the prior entry of an ID card or PIN code.

Methods of Bypassing Scanners and Attacks on Sensors (Spoofing)

Despite the mathematical perfection of the algorithms, the physical level of biometric scanners is vulnerable to imitation (mock-up) attacks. Let us describe a number of experiments that have become classics:

Fingerprint Spoofing (Tsutomu Matsumoto's "Jelly Fingers")

In 2002, the Japanese cryptographer Tsutomu Matsumoto conducted a study that proved the vulnerability of most commercial fingerprint scanners (both optical and capacitive):

• Attack with consent: The user's finger is poured over with liquid silicone or plastic in order to create a casting mold. Ordinary edible gelatin (from which jelly bears are made) is poured into the mold. The resulting gelatin mock-up has the same moisture and conductivity as human skin. Capacitive scanners recognize it as a live finger in 80% of cases.
• Attack without consent (extraction of a trace): A residual fingerprint on glass or on a drinking glass is developed with the help of superglue (cyanoacrylate) fumes, photographed, contrasted in a graphic editor and etched onto a copper photoresist board. The resulting relief cliché is used to create the same gelatin knob. The effectiveness of the attack amounted to more than 60%.

Iris Spoofing

At the early stages of the deployment of control systems in airports (for example, in the UAE and in Frankfurt), security researchers demonstrated that Daugman's algorithm could be deceived:

• A photograph of an eye of high resolution, printed on a high-quality laser printer with a cut-out hole for the pupil (so that the system would see the live dynamics of the pupil), was successfully accepted by first-generation scanners.
• Later, attackers began to use colored contact lenses with the pattern of someone else's IrisCode applied to them.

This forced developers to introduce hardware methods of checking the "liveness" of tissue (Liveness Detection / Anti-spoofing): tracking the narrowing of the pupil during a brief flash of light, analysis of the spectral absorption of infrared radiation by living tissue, and monitoring of the natural three-dimensional trembling of the eye (microsaccades).

Voice Recognition, System Failures and Common Vulnerabilities of Biometric Systems

Voice Verification (Speaker Recognition / Voice Verification)

Recognizing a person by voice is an attractive solution for remote banking and telephone service systems (IVR), since it does not require the purchase of expensive hardware scanners and works through existing communication channels (smartphones, landline telephones). However, from a technical point of view the voice is one of the most unstable biometric parameters.

Physiology and Mathematical Methods:

The voice combines anatomical features (the size and shape of the larynx, the vocal cords, the nasopharynx) and behavioral habits (the tempo of speech, accent, modulation).
The main method of mathematical analysis of the audio signal is the extraction of Mel-Frequency Cepstral Coefficients (MFCC):

1. The speech signal is broken into short frames (of 20–30 milliseconds), within which the signal is stationary.
2. To each frame a fast Fourier transform (FFT) is applied in order to obtain the power spectrum.
3. The spectrum is passed through a grid of triangular filters distributed along the logarithmic Mel scale (imitating the perception of sounds by the human ear).
4. A discrete cosine transform (DCT) is applied to the logarithms of the obtained powers. The result is a vector of MFCC coefficients describing the envelope of the spectrum (the shape of the vocal tract).

For matching feature vectors in time, Dynamic Time Warping (DTW) algorithms or hidden Markov models (HMM) are used.

Vulnerabilities of Voice Verification:

• The acoustic channel: The systems are critically dependent on the quality of the microphone and on sound compression in telephone networks. If the user registered the reference template through a high-quality headset, but tries to authorize himself in noisy transport through the cheap microphone of a budget phone, the FRR (Insult Rate) indicator rises to unacceptable values.
• Physiological changes: A cold, laryngitis, fatigue, stress or natural aging radically change the spectral characteristics of the voice.
• Replay Attacks: It is enough for an attacker to record the victim's voice (for example, during a telephone prank or from open sources) and play back the key phrases ("Yes", "I confirm", the code word) through the loudspeaker of another device. Commercial voice verification systems for a long time could not effectively filter loudspeaker artifacts.
• Text-to-Speech Synthesis and Voice Cloning: The use of neural networks and signal processors (DSP) makes it possible to clone the key characteristics of someone else's voice on the basis of a short audio fragment, completely bypassing MFCC algorithms.

Systemic and Socio-Technical Vulnerabilities ("What Goes Wrong")

Let us emphasize: a biometric system is protected exactly as much as its weakest link is protected, and most often this link lies outside the mathematical algorithms of template comparison.

A) The Enrollment Attack

The most dangerous systemic attack. If an attacker bribes the operator or uses forged documents during the first registration in the system, he ties his own biometric data to someone else's digital identity. As a result, the system will work flawlessly from a mathematical point of view, but will authorize a criminal.

B) The Compromise of Communication Channels and Template Databases

Biometric templates (for example, an IrisCode or minutiae vectors) are stored in databases. If these databases are not cryptographically protected, or if the communication channel between the scanner and the authentication server is vulnerable to interception (a "man-in-the-middle" attack — MITM), the attacker can carry out a Template Replay attack. Instead of scanning a real finger, he sends into the network a binary code intercepted earlier.

C) The Critical Problem of Non-revocability

This is the fundamental vice of biometrics. If your password is compromised, you can change it in a minute. If a database of cryptographic keys is compromised, you can issue new ones. But if attackers have stolen the digital traces of your fingerprints or your iris, you cannot replace your fingers or your eyes. A compromised biometric factor is lost to security forever.

D) The Problem of "Function Creep"

Government databases created for one purpose (for example, the issuing of driving licenses) begin over time to be used for other purposes (covert surveillance through city cameras, commercial scoring, tracking political activity). This violates privacy and creates large-scale risks of abuse of power and of the leakage of sensitive data.

The Economics and Psychology of Biometric Systems

The introduction of biometrics is often driven not by the requirements of real security, but by considerations of corporate psychology and marketing.

• The shifting of legal responsibility: By deploying biometric terminals, banks and corporations attempt to create in court the illusion of "absolute protection". If the system has declared that a transaction was made using the customer's fingerprint, the courts subconsciously side with the bank, placing the blame on the customer ("your biometrics are unique, therefore it was you who paid"). At the same time, technical failures, the possibility of making mock-ups and insider attacks within the bank itself are ignored by the court.
• The placebo effect: The presence of scanners creates in ordinary people a false sense of security (security theater), making them weaken their vigilance in other respects (for example, using simple PIN codes for backup entry).

Summary Comparison Table of Biometric Technologies

Technology	Accuracy (Theoretical FAR)	Resistance to mock-ups / spoofing	Stability of the feature over time	Main vulnerabilities
Dynamic signature	Medium (EER≈1%)	High (difficult to repeat the dynamics of pressure)	Low (depends on stress, age)	High variability, unsuitability for 1:N systems.
Face recognition (2D)	Low/Medium	Very low	Medium (aging, plastic surgery, makeup)	Sensitivity to lighting, viewpoint. Bypass with photographs/masks.
Fingerprints	High	Low (without Liveness Detection)	High (if there are no injuries)	Gelatin mock-ups (Matsumoto), residual traces on surfaces.
Eye iris	Extreme (1 : 10^10)	High (in modern systems)	Extremely high	Lenses with a pattern, high-quality photo printing (in old scanners).
Voice	Low	Low	Low	Recording onto a voice recorder, a cold, background noise, AI cloning.

Physical Tamper Resistance and the Architecture of Highly Protected Cryptoprocessors (IBM 4758)

The transition from organizational measures and network security to the hardware level of protection is dictated by a fundamental rule: if an attacker has unlimited physical access to a device, the standard software mechanisms of access control cease to work. Now let us talk about the evolution of hardware protection systems (Tamper Resistance) — from mechanical locks and sensors to modern chips with distributed logic, capable of resisting physical hacking, laser probing and side-channel attacks.

The Philosophy and Classification of Hardware Protection

Let us divide the concepts and goals of device protection into three levels of interaction with an attacker:

• Tamper-resistant: Devices that create physical or economic barriers making the opening of the casing or the reading of signals inside the chip extremely difficult or unprofitable.
• Tamper-evident: Devices that cannot physically prevent a break-in, but leave clear traces of intrusion that can be recorded visually or by hardware (for example, special seals, brittle substrates or glue that is destroyed upon opening).
• Tamper-responding: Systems equipped with active sensors which, upon detecting an attempted intrusion, instantly destroy critical data (for example, cryptographic keys) before the attacker obtains physical access to them.

High-End Processors on the Example of the IBM 4758

IBM 4758 is an epoch-making product in the security industry, which became the first commercial coprocessor to successfully pass certification by the US government at the maximum level of protection, FIPS 140-1 Level 4. It was used in banking server farms for transaction processing, protection of master keys and verification of customer PIN codes.

The Anatomy of the IBM 4758's Protection ("A Fortress in Miniature")

The device is a board enclosed in an extremely complex multilayer protective shell:

1. Tamper-sensing mesh: All the internal electronics are wrapped in a flexible substrate onto which a dense labyrinth of ultra-thin conductors is applied (chemically reactive chemicals and carbon threads). A weak electric current is continuously passed through these lines, and a microcontroller constantly measures their resistance and capacitance. An attempt to drill the casing, cut the substrate or dissolve it with acid leads to a change in the circuit parameters.
2. Potting material: The internal volume is filled with a dense polyurethane resin with the addition of corundum chips (aluminum oxide). If an attacker tries to dissolve the compound with chemicals, the acid simultaneously destroys the conductors of the sensing mesh. An attempt to scrape off the resin mechanically leads to the destruction of the silicon crystals and of the tracks on the board.
3. Aluminium shield: A layer of aluminum prevents the leakage of data through radio emission and side channels (protection against Tempest attacks).

The Mechanism of Active Key Destruction (Zeroization)

The heart of the response scheme is the volatile static memory (SRAM), where the master keys of the device are stored. The memory is continuously powered by a built-in lithium battery. When any of the sensors is triggered (a break in a mesh line, a short circuit, a sharp change in temperature or an attempt at X-ray irradiation), the emergency reset circuit instantly shorts the SRAM power lines to ground. The keys are erased within a few nanoseconds — the "street value" of the captured equipment falls to zero.

The Evolution of Attacks and Protective Mechanisms of Microcontrollers and Smart Cards

If the IBM 4758 is an expensive server device, then smart cards (SIM cards, EMV bank chips) must possess high protection at a production cost of less than $1. In this area a large-scale technological arms race unfolded.

The Chronicle of Attacks on Smart Cards (from the practice of the Cambridge laboratory):

1. Invasive Attacks:
   * Methodology: The smart card is "opened up" with the help of fuming nitric acid, which dissolves the plastic casing and leaves the bare silicon crystal. The first generations of chips were attacked with the help of probing stations — ultra-thin tungsten needles under a microscope, which were physically connected to the internal data bus of the processor in order to intercept unencrypted traffic.
   * Evolution of protection: The introduction of a top protective passivation layer made of super-hard materials (silicon carbide, boron nitride), as well as the placement of active lines of the internal sensing mesh directly above the metal tracks of the data bus. Modern chips are manufactured using Glue Logic — hundreds of thousands of transistors and bus lines are mixed on the crystal in a random manner by automatic routers. Instead of neat blocks, the architecture looks like a "sea of chaotic gates", whose structure is impossible to understand visually.

2. Non-invasive Attacks (side-channel attacks):
   * Differential Power Analysis (DPA): In 1998 Paul Kocher proved that the execution by the processor of different instructions (and the processing of a "0" or a "1" in the RSA/AES cryptographic algorithms) consumes a different amount of energy. By including a resistor in the card's power circuit and recording the current oscillogram, one can recover the secret key bit by bit.
   * Timing Attacks: Measuring the execution time of cryptographic operations (for example, if the exponentiation algorithm skips steps at zero bits of the key) makes it possible to compute the structure of the private key.
   * Protection: The introduction of hardware noise generators into the power circuits, the execution of "dummy" instructions (dummy cycles), the use of cryptography with masking (blinding) and of dual-rail self-synchronizing logic, where energy consumption is mathematically identical regardless of the data being processed.

3. Semi-invasive / Fault Induction Attacks:
   * Optical probing: Sergey Skorobogatov and Ross Anderson demonstrated that the use of an ordinary photographic flash or a cheap laser directed at an open crystal ionizes the silicon and forces specific transistors to change their state. In this way one can "blind" the security fuse (trigger) of a microcontroller, forcing it to go into test mode and hand over the entire firmware together with the keys.
   * Glitching: A brief intentional distortion of the supply voltage or of the clock frequency (applying a high-voltage pulse for a fraction of a microsecond) at the moment when the processor checks the entered PIN code forces the JZ instruction (jump if zero) to fail, opening access even with an incorrect password.

The Evaluation Crisis and the Economic Traps of Hardware Protection

Let us criticize the concept of "Security by Obscurity" and point to the systemic problem of the hardware security market — The Lemons Market.

• The complexity of independent verification: The buyer (for example, a bank or an electronics manufacturer) cannot independently check the level of Tamper Resistance of the chips being purchased. He has to trust the evaluation certificates (such as Common Criteria or FIPS).
• The deceptiveness of certificates: Certificates often evaluate only part of the system. Cases are known where a manufacturer declared the highest security level of a card (EAL4+), but on a detailed reading of the documents it turned out that only the logic of the card's operating system had been evaluated, while the hardware crystal was vulnerable to the simplest laser fault.
• Risk Dumping (The shifting of risks): Equipment suppliers strive to shift responsibility for a break-in onto the end integrator, declaring that their chip is "theoretically unhackable", transferring the financial risks onto banks and users.

Mid-Level Security Processors, FPGAs and Hardware Attacks on Commercial Chips

Let us consider how the principles of physical tamper resistance are implemented in commercial devices of the mid-price range, analyze the protection of field-programmable gate arrays (FPGA) and study the vulnerabilities of interfaces (APIs) that make it possible to bypass hardware barriers.

The Architecture of Mid-Level Security Devices (Dallas iButton and Others)

When the cost of a device is limited to a few dollars, the creation of an active sensing mesh with battery power (as in the IBM 4758) is impossible. Developers of mid-level protection chips (such as the Dallas iButton / DS1990 series and specialized microcontrollers) rely on passive methods of memory protection and on logical barriers.

• Security Fuses technology: After the control firmware and the cryptographic keys have been written into the memory of the chip (EEPROM or Flash), an elevated voltage is applied to a special isolated transistor or link. The link is physically burned through (or the gate of the transistor is saturated with charge forever), which blocks external memory read commands (Read-Out Protection). The processor can execute the code locally, but it can no longer be extracted through the external pins (the interface pins).
• Protection against ultraviolet readout (EPROM): In old chips with memory erased by ultraviolet light, the crystal was protected against unauthorized reading by opaque metal layers (masks) laid over the memory cells, in order to prevent their visual scanning under a microscope or their spot erasure by a UV beam.

The Protection of FPGA Configuration Bits

FPGA (Field-Programmable Gate Array) are integrated circuits whose digital logic is not set at production, but is configured by the user when the device is switched on. The configuration (the firmware / bitstream) is usually stored in an external flash memory chip and is loaded into the FPGA at start-up.
Let us point out that there is a critical vulnerability of such an architecture: the attacker does not need to open the FPGA chip itself. It is enough for him to connect a logic analyzer to the tracks of the board between the external flash memory and the FPGA at the moment the device is switched on, intercept the unencrypted bitstream and completely copy the intellectual property of the developer (a cloning attack).

Methods of FPGA Protection:

1. Hardware encryption of the bitstream: Modern protected FPGAs contain a built-in hardware decryption unit (for example, AES). The secret decryption key is written into non-volatile memory inside the FPGA itself at the production stage. The external bitstream is stored in the flash memory in encrypted form. At start-up, interception of the data bus gives the attacker nothing, since the data are encrypted.
2. The problem of storing the key in the FPGA: The key in an FPGA may be stored either in permanent (once-burned) memory or in volatile SRAM. In the latter case a small battery must be connected to the board. If the battery discharges or is desoldered, the key is erased and the device loses its functionality.

An Economic Story: The Political Failure of the Clipper Chip

In the early 1990s the US government (the NSA) attempted to introduce a mid-level security cryptoprocessor called the Clipper chip into commercial digital telephony. Its goal was to provide strong encryption for civilians, but with the preservation of the possibility of wiretapping for the intelligence services through a key escrow mechanism (Key Escrow).
Each device had a unique key K_P, a copy of which was held by two trusted government bodies. At each call the Clipper chip generated a LEAF (Law Enforcement Access Field) field containing the encrypted information that the intelligence services needed in order to recover the session key.

The Technical Collapse of Clipper:

The protection of the Clipper chip was implemented at the hardware level (opening the chip and removing the LEAF function was commercially unprofitable). However, in 1994 the researcher Matt Blaze discovered a fundamental logical defect in the protocol of LEAF generation. He proved that it was possible to manipulate the checksum of the LEAF field by software means, forcing the receiving Clipper chip to establish a protected connection, but passing incorrect data for wiretapping to the intelligence services. This technical fiasco, combined with the stiff resistance of the IT industry, completely destroyed the Clipper project.

Attacks on Interfaces (Logical API Attacks)

The deepest technical conclusion regarding physically protected chips is the following: attackers rarely spend millions of dollars on lasers and ion beams if the device can be made to hand over its keys through its own application programming interface (API).
Cryptoprocessors communicate with the outside world through a limited set of commands (for example, "encrypt data", "verify a PIN code", "export a key under another key"). Attacks on APIs exploit logical errors in the implementation of these commands.

Example: The Key-Binding / Type-Confusion Attack

In banking HSMs (Hardware Security Modules), keys are separated by type:

• K_Data — a key for encrypting data (ordinary low priority).
• K_Master — a key for encrypting other keys (the highest priority).

If the API is designed incorrectly and does not check the key type tags when they are imported/exported, an attacker can perform the following sequence:

1. Send the highly protected key K_Master into a command intended for decrypting ordinary data (K_Data).
2. The hardware chip, obediently executing the logic of the command, will decrypt the master key and hand it out in plain text form directly onto the screen of the attacker's terminal.

At the same time, not a single physical tamper sensor of the chip will be triggered, since the device was used exclusively within the framework of its standard electrical specifications.

The Evolution of Smart Card Security, Pay-TV Cryptography and Memory Protection

Let us consider a historical cross-section of the development of smart cards (microcontrollers), analyze the technical confrontation in the pay-TV industry, which became the catalyst for the development of hardware hacking, and study the mechanisms of code isolation and memory protection (MMU) at the physical level of the chip.

The Historical Genesis of Smart Cards and the First Generations of Chips

The first mass microcontrollers for smart cards appeared at the end of the 1970s — beginning of the 1980s in France (the Télécarte project for payphones) and were intended to replace the vulnerable magnetic stripe cards.

The Architecture of First-Generation Cards:

• Memory Cards (Memory logic): These cards did not have a full-fledged central processor (CPU). They represented an array of EEPROM/PROM memory with a simplest hardware state machine (state machine).
• Token Counters (Unit counters): In payphone cards the balance was reduced by burning through fusible links (fuses) bit by bit. When all the available bits had "burned out", the card became invalid.

The Vulnerabilities of the First Generation:

Cards with memory logic had zero resistance to active attacks on the interface. Hackers quickly discovered that if a voltage pulse different from the standard one was applied to a certain input-output (I/O) contact at the right moment in time (for example, to simulate a reset signal or to put the card into testing mode), the hardware state machine was reset, allowing the card to be used infinitely or the balance bits to be rewritten.

The Cryptographic Wars in the Pay-TV Industry

A large-scale impetus to the development of the industry of physical hacking and the subsequent strengthening of Tamper Resistance was given by the sphere of pay satellite and cable television in the 1990s (in particular, the VideoCrypt encoding systems of Sky TV and the solutions of the companies Canal+ and DirecTV). Broadcasters used smart cards to decrypt the television signal on the subscriber's side.

The Anatomy of Attacks on the Smart Cards of Satellite Receivers:

Since the commercial value of hacking was enormous (free access to premium channels for hundreds of thousands of users), a highly profitable shadow market formed around the reverse engineering of smart cards. The attacks evolved through the following stages:

1. "Man-in-the-Middle" Attacks (Emulation / Cloning):
   Instead of opening the chip itself, researchers intercepted the traffic between the receiver and the card. Every few seconds the receiver sent an encrypted word (a cryptogram) to the card, and the card returned the operating key for decrypting the video signal (the Control Word). Hackers created emulators based on standard PIC microcontrollers (for example, the PIC16C84), which intercepted these keys or reproduced the mathematics of the algorithm.
2. The Power Glitching Attack:
   In order to extract the master keys from legitimate cards, hackers used controlled sags of the supply voltage (glitches) at the moment when the card's processor was performing an authentication check or computing a cryptographic function. This forced the card to hand over the secret keys through the serial interface.
3. Chemical Opening and Optical Reading:
   When the manufacturers protected the interfaces, hackers began to dissolve the plastic casings of the cards in fuming nitric acid. The cleaned silicon crystal was placed under an optical microscope. In early chips the ROM was topologically transparent: the bits "0" and "1" physically differed by the presence or absence of metallized links, and the entire firmware of the card could literally be "read from a photograph".

Memory Management Units (MMU) and Code Isolation on the Chip

In response to the successes of hackers, smart card manufacturers moved to the architecture of full-fledged protected microcomputers, introducing hardware MMU (Memory Management Unit) blocks and rigid isolation of software environments.

The Implementation of Hardware Isolation:

• Multi-application OSes (Smart Card Operating Systems): A modern smart card (for example, based on Java Card) simultaneously contains the code of the operating system, cryptographic libraries and several independent applications (applets) — for example, an EMV banking application, a transport ticket and an access identifier.
• Security Domains (Hardware security domains): The MMU on the chip physically delimits the memory space (RAM, ROM, EEPROM/Flash) between applets. Code executing within the framework of the transport applet physically has no access to the memory addresses where the keys of the banking applet lie. Any attempt to go beyond one's own address space is instantly blocked by the hardware logic of the processor core, causing an irreversible reset (hardware reset) or the transfer of the chip into a mode of permanent lockout (mute).
• Encryption of the Address Space and of Data: In order to prevent the reading of information with the help of microprobes (even if the hacker has connected to the bus), modern chips use hardware encryption of the data bus and of the address bus (Bus Encryption). The data are decrypted directly inside the CPU at the moment of execution, and in the memory cells themselves and on the internal tracks of the crystal they are stored in the form of pseudo-random noise.

The Current State of the Smart Card Industry (State of the Art) and Advanced Hardware Protection Mechanisms

Modern smart cards used in banking transactions (EMV), electronic passports and next-generation SIM cards no longer rely on passive isolation. They represent dynamic systems in a state of "constant combat readiness" against invasive, semi-invasive and side-channel attacks.

Active Shields

In earlier generations of chips the protective silicon layer was passive: it simply covered the underlying transistors from physical access. Hackers bypassed this protection with the help of precision chemical etching or local polishing.
In modern protected processors the Active Shields technology is applied:

• The very top metal layer of the crystal is turned into a dense, continuous web of hundreds of interwoven microscopic conductors.
• During the operation of the chip, pseudo-random high-frequency digital signals generated by an internal cryptographic unit are continuously transmitted along these tracks.
• Special monitoring circuits constantly check the integrity of the signals, the phase shift, the resistance and the capacitance of the lines.
• If an attacker tries to carefully cut away part of this layer, short-circuit the tracks or drill a micro-hole with a diameter of even a few hundred nanometers in order to bring up a microprobe, the integrity of the signature is violated. The chip instantly detects the intrusion and activates the data destruction protocol (Zeroization), forever turning the device into a "brick".

Randomization of Command Execution and Protection Against Side-Channel Attacks

Simple interception of energy consumption (DPA) or of electromagnetic radiation (SEMA) has become ineffective thanks to the introduction of total algorithmic and hardware randomization at the level of the processor core.

• The introduction of dummy cycles (Dummy Cycles / Clock Jitter): The hardware clock frequency generator of modern smart cards works unstably by design. It constantly makes microscopic random phase shifts and delays (jitter). In addition, the processor randomly inserts into the command execution pipeline "empty" instructions (NOP or dummy mathematical operations), which do not affect the result but completely blur the oscillogram of energy consumption over time. An attempt to superimpose thousands of graphs on each other for a statistical DPA analysis fails, since the key cryptographic operations take place at different moments of time each time.
• Data masking (Blinding / Masking): Before the execution of a cryptographic operation (for example, before the operation of modular exponentiation in RSA or of point multiplication on an elliptic curve in ECC), the secret key is mathematically "mixed" with a random number (a mask) generated by a hardware true random number generator (TRNG). All the intermediate computations the processor performs on the masked data. At the very end of the operation the mask is mathematically removed. As a result, the side electromagnetic and energy emissions of the chip correlate not with the secret key, but with absolutely random noise.

Bus Encryption and the Destruction of the Cell Structure

In modern chips the topology of the elements on the silicon no longer corresponds to the logical scheme of the processor.

• Hardware encryption of the data and address buses: The data bus (Data Bus) connecting the processor with the memory is constantly encrypted on the fly. The bus encryption key is generated anew at each switching-on of the device. Even if an attacker manages to bypass the active mesh and connect a focused ion beam (FIB) to the bus tracks, he will see only a continuous stream of encrypted noise.
• Dynamic memory re-encoding (Address Scrambling): The address space of RAM and Flash memory is constantly shuffled by a hardware controller. The logical address 0x0001 may physically be located in completely different parts of the silicon crystal at each new write cycle.
• Transistor Camouflaging: To combat visual reverse engineering with the help of electron microscopes, manufacturers create transistors that look absolutely identical (the same shape of the diffusion and metallization layers), but have a different type of conductivity (p-type or n-type) through hidden deep ion doping. A hacker reconstructing the circuit from layer-by-layer photographs of the crystal will assemble an incorrect logical model that has nothing in common with the real operation of the chip.

A Comprehensive Failure Response System (Environmental Sensors)

A modern smart card literally "senses" its environment. On the crystal there is placed a complex of passive and active sensors continuously assessing the physical parameters:

• Voltage sensors (Voltage Gladiators): They register the slightest attempts at glitching (intentional sags or spikes of the supply).
• Frequency sensors: They block operation if the external clock frequency falls below a critical level (which is often used by hackers to slow down the processor and take data step by step).
• Temperature sensors: They prevent memory freezing attacks (when the chip is cooled with liquid nitrogen in order to increase the time of charge retention in the SRAM cells after the power is switched off).
• Optical sensors (Light Detectors): Microscopic photodiodes on the crystal. If a hacker opens the casing and light falls on the silicon (or a laser beam during an attempted optical fault), the sensor instantly gives the command to lock the core.

Advanced-Level Physical, Invasive and Semi-Invasive Attacks

Let us consider the toolkit and methodology of advanced physical hacking of protected chips. When logical barriers, bus encryption and passive isolation mechanisms do not allow information to be extracted, attackers move on to the physical modification of the silicon crystal and to direct manipulation of its internal structure.

Invasive Attacks: Focused Ion Beams (FIB)

FIB (focused ion beam) installations were originally created for the semiconductor industry for the purpose of defectoscopy and of correcting errors in the topology of integrated circuits before launch into mass production. However, in the hands of highly qualified hackers (or the laboratories of intelligence services) the FIB turned into the most powerful tool for bypassing Tamper Resistance systems.

The Physics and Capabilities of FIB Apparatus:

A FIB uses a beam of ions (usually liquid gallium) focused into a spot with a diameter of down to several nanometers. This tool works in three modes:

1. Precision milling (Ion etching): The ion beam literally knocks out atoms of silicon, oxides or metals, making it possible to create deep wells in the crystal. This is used for the local destruction of active protective meshes (Active Shields).
2. Local deposition of materials (Ion sputtering): If a special gas is fed into the chamber (for example, a platinum-containing organometallic complex), the ion beam splits it, depositing an ultra-thin track of conductive metal (platinum). In this way new electrical connections can be created right inside the substrate.
3. Insulating deposition: The deposition of dielectrics (silicon oxide) for the insulation of tracks.

The Methodology of an Attack on a Protected Data Bus:

If the data bus is hidden under an active protective mesh, the attacker, with the help of a FIB, performs the following operations:

• Cuts a well through the protective silicon layer, bypassing the power lines of the mesh.
• Fills the walls of the well with an insulator so as not to short-circuit adjacent circuits.
• Pierces the insulator at the bottom of the well, reaching the unencrypted (or encrypted but needed) track of the data bus.
• Sputters a platinum conductor from the bus track to the surface of the crystal, creating a convenient "contact pad" (probing pad) to which an ordinary microprobe needle can easily be connected and the signals recorded with a logic analyzer.

Semi-Invasive Attacks: Laser Probing and Induced Faults

Semi-invasive attacks, studied in detail at Cambridge University by Sergey Skorobogatov and Ross Anderson, occupy an intermediate position. They require the removal of the plastic casing of the chip (opening of the crystal), but do not require physical contact with the internal tracks or the violation of the structure of the passivation layers. This makes them significantly cheaper than invasive FIB attacks.

A) Optical Fault Induction Attacks:

Every transistor on a silicon crystal is sensitive to light. If a quantum of light with energy exceeding the width of the forbidden zone of silicon is directed at a p-n junction, electron-hole pairs are generated in the semiconductor. This causes a brief induced photocurrent.

• Technique of execution: The crystal is placed on a stage under an infrared or ultraviolet microscope connected to a pulsed laser. The laser is positioned on a specific transistor (for example, a cell of the protection register or an SRAM line).
• Result: A short laser flash lasting a few nanoseconds forcibly switches the state of the transistor (from "1" to "0" or vice versa). In this way researchers bypassed the cycles of cryptographic signature verification, forcing the processor to accept an incorrect key as valid.

B) Local Laser Heating (LIVA / TIVA):

The use of continuous-wave lasers for the local heating of certain areas of the crystal. A change in temperature changes the resistance of semiconductor elements and logic gates. Monitoring the energy consumption of the chip at this moment makes it possible, without contact, to determine in which logical state (open or closed) a specific memory transistor is, which allows secret keys to be read directly from the processor registers during their processing.

Protection Against High-Tech Physical Attacks

To counter FIB systems and laser probing, the manufacturers of modern top-tier protection chips implement a complex of measures:

• Backside polishing and backside attacks: Since the front side of the chip is closed by metal layers and an active mesh, hackers began to approach the transistors from the back side of the crystal (through the silicon substrate), thinning it with the help of chemical-mechanical polishing to a thickness of several micrometers. In response, manufacturers began to introduce capacitance sensors and optical sensors on the reverse side of the crystal as well, and also to use Silicon-on-Insulator (SOI) technology, which complicates backside access.
• Light-absorbing compounds: Coating the crystal with special opaque polymers that penetrate deeply into the structure of the layers and cannot be removed without the complete chemical destruction of the transistors themselves.
• Dynamic checking of code execution paths (Control Flow Integrity): The hardware units of the processor continuously compute cryptographic checksums of the addresses of the instructions being executed. If a laser pulse or a glitch forces the processor to jump over a security check instruction, the mismatch of the CFI controller's checksum leads to immediate hardware lockout.

System Errors, Design Compromises and the Economics of the "Lemons Market" in the Security Industry

Let us move from the description of specific physical attacks to the macroeconomic and methodological factors that predetermine the vulnerability of protected hardware systems. The overwhelming majority of failures in the real world occur not because of the technological superiority of the attackers, but because of fundamental vices in the processes of certification, design and the distribution of economic risks.

The Crisis of Certification Methodologies (FIPS 140 and Common Criteria)

To assess the level of protection of commercial hardware modules (HSMs, smart cards, cryptoprocessors), the industry relies on formal security evaluation standards. The most authoritative are the American federal standard FIPS 140 (levels 1 to 4) and the international standard Common Criteria (assurance levels EAL from 1 to 7).
Let us subject these standards to harsh critical deconstruction, pointing out their conceptual flaws:

• "Patchwork" Evaluation (Scoping Illusion): When certifying a device according to the Common Criteria standards, the manufacturer has the right to independently define the so-called Target of Evaluation (TOE). This leads to situations where a smart card receives the highest security certificate (for example, EAL4+ or EAL5), but on a detailed analysis of the documentation it turns out that only the logical structure of its operating system (for example, the Java Card OS) was subjected to evaluation, while the physical silicon crystal remained vulnerable to the simplest laser fault or to a power consumption attack (DPA).
• Static evaluation against the dynamics of attacks: The process of state certification of complex equipment takes from many months to several years and costs hundreds of thousands of dollars. By the moment when a protected processor officially receives a certificate of the highest security level (for example, FIPS 140-2 Level 4), the academic community and hackers have already managed to invent fundamentally new methods of non-invasive or semi-invasive attacks, against which the architecture of the certified device turns out to be powerless.

George Akerlof's Concept and the "Lemons Market" in IT Security

To explain the reasons why the market is flooded with vulnerable hardware solutions, let us adapt George Akerlof's famous economic model — "The Market for Lemons" — which describes markets with information asymmetry.

The Mechanism of Degradation of the Hardware Security Market:

1. Information asymmetry: The buyer (for example, a commercial bank or a car manufacturer) does not possess the deep competences, the equipment (FIB, laser microscopes) and the time to independently verify the real tamper resistance of the chip (Tamper Resistance). He is forced to rely on the seller's claims and marketing brochures.
2. Price equalization: Since the buyer cannot distinguish a genuinely reliable device, expensive to develop (a high-quality "peach"), from a vulnerable but cheap analogue (a defective "lemon"), he is willing to pay for security only a certain average, compromise price.
3. The displacement of the quality product: Manufacturers of highly protected systems, who invest millions in active meshes, logic randomization and transistor camouflaging, cannot compete on price with unscrupulous suppliers who economize on the physical level of protection. As a result, quality protected processors are washed out of the market, and the overall security standards of the industry steadily fall.

The Risk Dumping Phenomenon

The second fundamental economic vulnerability lies in the distribution of legal and financial responsibility for a break-in.

• The position of the vendors: Hardware developers strive to draw up license agreements and contracts in such a way as to completely remove from themselves responsibility for any potential vulnerabilities. They declare that their product "complies with the standards", transferring the risks to the end system integrator.
• The position of banks and system operators: By deploying biometric terminals or smart cards, large financial institutions often pursue the goal not of maximizing physical security, but of creating in court the illusion of absolute protection. If hackers find a way to clone chips unnoticed (as happened in pay-TV systems or in early bank cards), banks tend to shift the financial losses onto end users or small retailers, declaring: "Our system is certified by the government, therefore hacking is impossible, and the transaction was made because of your personal negligence".

Biometric Modalities and Large-Scale Government Failures

Hand Geometry and Vein Pattern Scanning

While fingerprints and the iris of the eye captured the market of mass identification, in industrial and corporate access control systems (ACS) hand geometry dominated for a long time:

• Methodology: The user places his palm on a special platform with pins for positioning the fingers. A camera illuminates the hand and takes two orthogonal shots (from above and from the side) using a system of mirrors. The algorithm measures the three-dimensional silhouette of the hand: the length and width of the fingers, the thickness of the palm, the angles between the joints — about 90 parameters in all.
• Mathematical peculiarities: The advantage of hand geometry is that the size of the template is extremely small (only 9 bytes). This made it possible to implement the technology back in the 1980–1990s, when the computing power and memory of servers were severely limited. The EER (Equal Error Rate) value here is relatively high (about 1-2%), but for "one-to-one" verification (1:1 together with a PIN code) in the conditions of factories, nuclear facilities or airports (for example, the INSPASS system in the USA) it turned out to be ideal, since it is not affected by dirt on the skin.

Vein pattern scanning (of the finger or of the palm): A more modern alternative. It uses near-infrared light (NIR). Deoxygenated hemoglobin in the blood absorbs IR rays, thanks to which a unique hidden pattern of vessels appears on the image. This technology has built-in protection against spoofing, since it requires the presence of an active blood flow (living tissue), and it cannot be copied with the help of a photograph or a gelatin mock-up.

DNA Profiling in Criminology

Let us separately analyze DNA as an "absolute" biometric identifier, dispelling the myths about its infallibility in the judicial system.

• The technical essence of STR analysis: Modern criminology examines not the whole genome, but Short Tandem Repeats (STR) in the non-coding regions of DNA. Standard databases (for example, CODIS in the USA or NDNAD in the UK) compare profiles by 10–13 specific loci (sections of chromosomes).
• The problem of false matches in databases (The Birthday Paradox): If the probability of a random match of two profiles by 10 loci is 1 in a billion, this does not mean that when searching a database of 10 million people the probability of an error is negligible. Because of the combinatorial explosion (the birthday paradox effect), inside a many-million database there will inevitably be found random people with a high degree of match of STR profiles, which leads to false accusations.
• Contamination of samples: DNA analysis is incredibly sensitive. Particles of the expert's skin, secondary transfer (you shook hands with a person, and he touched a pistol) regularly lead to the DNA of completely innocent people being "found" at a crime scene.

Large-Scale Government Collapses and "Function Creep"

Let us analyze the geopolitical and systemic risks of biometrics on the example of large-scale national programs (such as the Indian Aadhaar system and the introduction of biometric passports).

• The Exclusion Crisis: When Aadhaar was deployed (the collection of fingerprints and irises for 1.3 billion citizens for the sake of issuing social benefits), it turned out that hundreds of millions of people physically cannot pass registration or verification. In elderly people and in manual laborers the ridge patterns are worn away by physical labor, and in people with cataracts or trachoma it is impossible to scan the iris. Biometric failures led to the most vulnerable strata of the population being deprived of food and subsidies.
• ICAO standards and passports: The introduction of contactless RFID chips into foreign passports with biometric templates created a hidden security threat. At the early stages the data from the chip were read remotely without proper cryptographic authorization (a skimming attack). An attacker with a powerful antenna in a crowd could remotely determine the citizenship of passengers (for example, single out US citizens) by intercepting the unique identifiers of the chips.

Additional Mechanisms of Physical Protection, ATM Security and Extreme Methods of Hardware Hacking

The Physical Protection of ATMs and Safe Systems

While microelectronics struggles with nanosecond glitches, the engineers of heavy protective systems face crude physical impact: explosives, hydraulic cutters, disk saws and thermal lances. An ATM is an ideal example of a distributed system where the hardware safe must protect millions of units of currency in conditions of a complete absence of constant physical supervision.

Attack Mechanisms and Engineering Methods of Counteraction:

• Protection against gas and solid explosives: Hackers and robbers often pump a combustible gas (propane-butane, acetylene) into the safe compartment of an ATM through the note-dispensing slot, after which they detonate it remotely. To protect against this, engineers apply gas dampers (explosion-suppressing valves), which passively ventilate the internal volume, as well as electronic sensors of gas concentration which, upon registering an anomaly, automatically fill the safe with an inhibiting chemical composition (halon or carbon dioxide), making an explosion impossible.
• Intelligent Banknote Neutralisation Systems (IBNS): If the safe of an ATM nevertheless undergoes critical destruction or unauthorized movement (the theft of the whole ATM with the help of construction equipment), active sensors of pressure, acceleration or casing rupture are triggered. They activate pyrotechnic cartridges which instantly flood the money cassettes with indelible, persistent inks (indigo, purple dyes or special isotopic markers). The stained notes lose their commercial value, which completely deprives the attackers of economic motivation.
• The evolution of safe locks: Modern mechanical and electromechanical locks are protected against the drilling of code disks by means of plates of high-hardness manganese steel and glass relockers. Inside the lock a brittle glass plate is placed, against which emergency bolts are spring-loaded. If a burglar tries to drill the lock, the drill inevitably shatters the glass, which leads to the instantaneous dropping of the bolts into blind grooves. After this the lock is blocked dead, and it is impossible to open it even with the native key.

Physical Skimming and Attacks on Input-Output Interfaces

Let us analyze the problem of the vulnerability of the interfaces of user interaction with the ATM, which for a long time undermined the security of bank cards.

• The anatomy of skimming: Since the data on the magnetic stripe of old cards are not encrypted, attackers installed a miniature overlay with a reading magnetic head and flash memory on top of the ATM's standard card reader. To intercept the PIN code, either clip-on micro video cameras were used, or fake keypads (PIN-pad overlays) laid over the original ones.
• Methods of engineering counteraction:
  -- Jitter card readers (Jitter Insertion): The mechanism that pulls the card inside the ATM works not smoothly, but in jerks (with sharp changes of speed). The legitimate internal reader knows the algorithm of these jerks and compensates for them in software when reading the data. An overlay skimmer, which fixes the card at the entrance, because of the uneven movement reads a distorted pitch of the magnetic domains, which makes the copied dump unsuitable for creating a duplicate.
  -- Active electromagnetic suppression (Anti-skimming): Emitters built in around the card acceptance slot generate a powerful alternating magnetic field (noise) at the moment the card is inserted. The internal reader is shielded from this noise, while the head of the external skimmer is completely blinded, recording only a pseudo-random signal.

Extreme Invasive Attacks: Radiation Irradiation and Memory Burn-Out

Let us describe the methods devoted to state espionage and to military standards of chip protection — the destructive impact on silicon with the help of ionizing radiation.

• Radiation memory dumping (X-Ray / Gamma-Ray Attacks): Non-volatile memory of the EEPROM and Flash type stores bits of information in the form of isolated electric charges on the floating gates of transistors. High-tech laboratories can subject a chip to controlled irradiation with a narrowly directed beam of X-rays or gamma rays. Ionization leads to the dielectric layer of silicon oxide insulating the gate beginning to conduct current. The charges "drain away", which makes it possible to forcibly rewrite or completely zero out the memory cells containing the protective configuration fuses (security fuses), returning a locked chip to the initial state of open factory testing.
• Military-level protection (Radiation Hardening): Components of space and military purpose, as well as top-secrecy HSMs, are designed using alternative semiconductor technologies. Instead of classical silicon, "silicon on insulator" (SOI — Silicon on Insulator) technology or semiconductors based on gallium arsenide (GaAs) is applied. In such chips the transistors are physically isolated from each other by a layer of silicon dioxide or sapphire, which minimizes parasitic currents during irradiation and prevents radiation glitching and unauthorized reading of memory states.

Comprehensive Architectural Conclusions

Combining the lessons of the whole article, let us formulate the key rules for designing reliable distributed systems:

1. Never rely on a single line of defense: Any hardware protection (be it the iris of the eye or a cryptoprocessor with an active mesh) can be compromised either by physical spoofing or through logical errors of interfaces (API attacks). Security must be built on the principles of layered defense (Defense in Depth).
2. The hardware token is only part of the protocol: The device (a smart card, an HSM) works as part of a network protocol. If the cryptographic protocol itself is designed with errors (for example, allows the replay of transactions or is vulnerable to "man-in-the-middle" attacks), the physical monolithic nature and unhackability of the chip lose all meaning.
3. Design the system on the assumption that a break-in is inevitable: The security architecture of large scale must include mechanisms for the rapid revocation of compromised keys, for the detection of anomalous activity at the level of servers, and for the flexible changing of encryption algorithms without the need for the physical replacement of millions of deployed client devices.
4. Do not confuse mathematical reliability with the resilience of a real system: Even if an algorithm demonstrates an exceptionally low probability of error (for example, the IrisCode with a probability of false match of the order of 1 in 10 billion), the security of the whole system is determined not only by the mathematical model, but also by the reliability of the physical components. The absence of "liveness" checking mechanisms (Liveness Detection) allows the protection to be bypassed with the help of photographs, video recordings or special contact lenses.
5. Assess security not only at the level of hardware, but also at the level of interfaces: The high resistance of a cryptoprocessor to physical opening does not guarantee the protection of secrets. Errors in software interfaces, in key management mechanisms or in the API logic are capable of nullifying the advantages of the most protected hardware platform and of leading to the compromise of critically important data.
6. Take economic and organizational factors into account as part of the threat model: The practical protection of information systems is determined not only by cryptographic algorithms and technical solutions. The asymmetry of information between market participants, the desire of suppliers to minimize their own costs, and the transfer of risks onto users often have a greater influence on the final level of security than the theoretical strength of the protection mechanisms used.