Chaos Communication Chemistry: DNA security systems based on molecular randomness

Chaos Communication Chemistry: DNA security systems based on molecular randomness

Speakers: Anne Lüscher

Conference: 39C3

YouTube: https://www.youtube.com/watch?v=l714lD5ezNo

Overview

In this captivating talk, Anne Lüscher, a Postdoc at the Institute for Chemical and Bioengineering at ETH Zurich, introduces the audience to the burgeoning field of DNA information technology, arguing that chemistry, particularly at the molecular level, has always been an information science. The presentation moves beyond the biological context of DNA, focusing instead on its potential as an artificial material for data storage, computation, and, critically, security applications. Lüscher aims to inspire a new perspective on biomolecules, highlighting their unique properties that could revolutionize how we approach digital information and cybersecurity.

The talk provides a comprehensive overview, starting with a crash course in DNA basics and the history of DNA information technology, before delving into the cutting-edge security-related applications. A central theme is the development of Chemical Unclonable Functions (CUFs), a novel security primitive inspired by traditional physical unclonable functions but leveraging the inherent randomness and chemical properties of synthetic DNA. This approach offers unprecedented opportunities for decentralized authentication, anti-counterfeiting, and object-bound metadata, positioning DNA as a powerful tool in the future of secure information systems.

This work matters because it explores solutions to escalating data storage and security challenges using a medium that boasts unparalleled durability, information density, and parallelism. As digital information proliferates, the need for robust, long-term, and novel security mechanisms becomes paramount. DNA information technology, as presented by Lüscher, offers a compelling vision for addressing these needs, leveraging nature's most efficient information carrier to create resilient and innovative security systems that are difficult, if not impossible, to replicate or compromise through conventional means.

Background

▶ Watch: Introduction to DNA information technology and talk goals (0:00)

The journey into DNA information technology begins with understanding DNA not merely as the blueprint of life, but as a form of source code. This perspective acknowledges that DNA doesn't just store protein building plans in a sequence of four nucleobases (A, C, T, G), but also contains regulatory elements that act as instructions, guiding complex biological processes. The fundamental principle of Watson-Crick base pairing (A with T, C with G) forms the basis of how two complementary strands form the iconic double helix, a concept crucial to all DNA manipulation.

The idea of using DNA for artificial information processing is not new; physicist Richard Feynman pondered this possibility in the 1950s. However, significant technological leaps were required to move from theory to practical application. Unlike genomic or biologically sourced DNA, this field focuses on synthesizing artificial DNA in a lab, treating it as a material for information processing, akin to how silicon is used for traditional computing.

DNA offers several unique advantages over conventional information technologies. Firstly, its durability is extraordinary. Scientists have been able to retrieve and read out horse genomes from bones dating back 700,000 years, demonstrating DNA's ability to withstand geological ages under proper conditions. In the lab, chemists can replicate these conditions, for instance, by encapsulating DNA in nanometer-scale glass beads, preserving it for potentially billions of years. Secondly, DNA stores data in a sequence, much like digital information, simplifying translation between base-2 (binary) and base-4 (DNA bases), where each base can encode two bits. Thirdly, DNA offers immense parallelism. Even a tiny drop of water contains countless DNA molecules, each capable of acting as an independent processor, performing calculations simultaneously—a feat unachievable with traditional computing architectures. This parallelism directly contributes to DNA's staggering information density. A single human body, despite most of its mass not being DNA, contains approximately 60 zetabytes of information in its DNA – roughly the amount of digital data created globally in 2020. This could theoretically fit into the volume of a single bar of chocolate.

Processing this information relies on functions "kindly developed by nature" and adapted with laboratory tools. Key operations include synthesis (writing/copying DNA), sequencing (reading DNA), deletion, and editing. A crucial enzymatic reaction is the Polymerase Chain Reaction (PCR), familiar to many from COVID testing. PCR is abstracted as a function with three instructions: splitting DNA into single strands, adding primers (short DNA segments that find complementary matches via Watson-Crick pairing), and then recruiting polymerase to copy the DNA section between the primer binding regions. This is an exponential process, effectively a "chemical for loop," doubling the amount of DNA in each cycle, enabling targeted amplification of specific sequences.

Key Findings

▶ Watch: Explaining DNA's structure and 'source code' analogy (2:00)

The core contribution of this research lies in demonstrating that DNA can serve as a robust, high-density, and durable medium not just for data storage, but for advanced security applications. Lüscher's work, building on prior efforts in DNA computing and cryptography, introduces the concept of Chemical Unclonable Functions (CUFs). These CUFs leverage the vast, inherent randomness generated during DNA synthesis to create unique, physically bound cryptographic primitives that are virtually impossible to predict or invert.

A key finding is the significant asymmetry in cost and effort between generating random DNA sequences and synthesizing specific, predetermined sequences. Lüscher highlights that hundreds of petabytes of randomness can be generated for below 100 euros in a single DNA synthesis reaction. This abundance of cheap, high-entropy randomness forms the bedrock of CUFs.

Furthermore, the research demonstrates that these molecular pools, when subjected to specific PCR primer sequences (acting as "challenges"), yield unique and reproducible "responses" in the form of amplified DNA patterns. Unlike traditional Physical Unclonable Functions (PUFs), molecular pools are dynamic; chemical reactions alter their composition. To overcome this, Lüscher's team developed a "copy and lock" mechanism, allowing the creation of multiple identical random pools that can be distributed, with each operation consuming a part of the pool. This unique property enables decentralized applications and object-bound metadata for authentication and anti-counterfeiting, where the security primitive is physically integrated into the material itself. The proof-of-concept for anti-counterfeiting in pharmaceuticals and artwork authentication showcases the practical viability and immense potential of this approach.

Technical Deep Dive

▶ Watch: Unique advantages of DNA: durability, density, parallelism (4:10)

The technical foundation of DNA security systems rests on the ability to precisely manipulate DNA sequences. The process for storing data in DNA involves several steps: encoding binary data into a base-4 DNA sequence, synthesizing this DNA in the lab, optionally amplifying (copying) it using PCR for distribution, storing it, and then sequencing (reading) it back before decoding it to binary. While seemingly straightforward, this process has historically been tedious and expensive. However, significant progress has been made, with major players like Microsoft and Seagate investing in research to enable random access, error correction, and optimized encoding schemes. Examples of early applications include an artist encoding a mansion image and Massive Attack storing music in DNA mixed into spray paint for an album cover. A notable scientific application involved embedding an STL print file into DNA within 3D printing filament, allowing a bunny to be printed, its DNA extracted, and more bunnies printed from that DNA – a meta-comment on DNA's capabilities and a practical solution for object-bound metadata in long-lifetime objects like buildings.

Beyond storage, DNA computing explores using DNA for computational tasks. Leonard Adelman famously solved the Hamiltonian path problem in non-exponential time using DNA. Later, the first logic gates were implemented in DNA. A significant proof-of-concept in the 1990s demonstrated the potential to break the 56-bit key of the Data Encryption Standard (DES) using a DNA algorithm in a fraction of the time a conventional computer would take. These early computational successes laid the groundwork for security applications.

DNA cryptography and steganography further extend these capabilities. Inspired by a Star Trek: The Next Generation episode where an ancient species hid a DNA-encoded program across the galaxy, researchers demonstrated hiding information in DNA. A team stored a "Second World War message" in DNA, embedding it within a vast background of random "dummy DNA." Retrieval required knowing the specific PCR primer sequences, effectively making the primers the key to decrypting the hidden message. This marked the starting point for DNA cryptography.

Another interesting project combined biometric data with synthetic DNA for encryption. A person's STR profile (a highly variable genomic region) was read to extract 80 bits of entropy, which generated an encryption key. This key was then used to encode a cipher text stored in synthetic DNA. To retrieve the clear text, the biometric data and synthetic DNA were sequenced again. Lüscher notes a weakness here: 80 bits of entropy is relatively low, especially considering the cost of reading large amounts of DNA.

This leads to a crucial insight: DNA synthesis itself can act as a highly efficient random generator. In a single reaction, by combining the four bases, vast amounts of randomness can be generated – hundreds of petabytes for less than 100 euros. This presents a massive asymmetry in cost: generating random DNA is cheap, while synthesizing specific, long, sequence-defined DNA strands is extremely expensive. This asymmetry is central to the security of CUFs.

Demo / Proof of Concept

▶ Watch: Illustrating DNA's incredible information density with chocolate bar (8:40)

The concept of Chemical Unclonable Functions (CUFs) draws inspiration from physical unclonable functions (PUFs). PUFs aim to implement a cryptographic hash function in a physical system rather than a mathematical algorithm. Early PUFs used a random token, such as hardened epoxy with randomly embedded glass spheres. When a laser was shone onto this token, it generated a unique diffraction pattern or 2D speckle, from which a digital key could be extracted. This key was specific to the token and the incident angle of the laser, creating an input-output relationship that was hard to predict and impossible to invert.

Lüscher's team adapted this idea to a chemical function using random DNA pools. The core idea is to manufacture vast random pools of DNA sequences. The randomness is so immense that the exact composition of all sequences cannot be known at a reasonable cost. However, these pools can still be queried. The "operation of the function" is performed using PCR. An input, a specific PCR primer pair, acts as the "challenge." Even within the vast random background, this primer pair will find its perfect complementary "puzzle piece" sequences and exponentially amplify them. The resulting amplified DNA constitutes the "response" from which a digital key can be extracted. This allows querying a system of unknown composition (the random pool) with a specific task (finding strings starting with ABC and ending with XYZ) and getting a reproducible response. Lüscher showed data illustrating how specific patterns emerge in the sequenced DNA after a challenge, differing between challenges but remaining reproducible across different runs, albeit with some noise.

A critical distinction between CUFs and traditional PUFs is that a pool of molecules behaves differently than a microscopic object. Chemical reactions inherently alter or "expire" the pool. To make CUFs repeatedly usable and distributable, Lüscher's team devised a "copy and lock mechanism." During the manufacturing stage, multiple copies of the same random pool are created. Crucially, another chemical step then "locks" these pools, preventing them from being copied again using the same mechanism. This allows the same random pool to be distributed to multiple users, with each operation consuming a defined part of the pool. This unique feature opens doors for decentralized applications where multiple users can share a common, verifiable random source for mutual authentication or shared key generation.

The talk presented two concrete proof-of-concept applications:

1. Artwork Authentication: A CUF could be integrated into a pigment, which is then used to paint an artwork. To authenticate, a tiny sample of the paint is taken, the challenge-response pair is measured, and the response is compared to a reference. This provides an undeniable method to verify the artwork's authenticity and its association with a specific artist.
2. Anti-Counterfeiting for Pharmaceuticals: The team successfully demonstrated mixing CUFs with an oral pharmaceutical. This provides a robust measure against counterfeits, where the presence and correct response of the CUF would verify the legitimacy of the drug.

Defensive Implications

▶ Watch: Overview of DNA writing, reading, and processing functions (9:59)

The advent of DNA security systems, particularly Chemical Unclonable Functions (CUFs), presents a paradigm shift for defensive strategies, yet it also introduces new challenges that require careful consideration. For defenders, understanding these molecular information technologies is paramount. The current state of the field necessitates further research to fully characterize the security properties of CUFs, including their robustness, uniqueness, and resistance to various attack vectors (e.g., side-channel analysis, reverse engineering of the chemical process).

The development of standardized frameworks and standards for DNA-based security primitives is crucial to ensure interoperability, reliability, and widespread adoption. This includes establishing best practices for DNA synthesis, storage, and sequencing in a security context. Rigorous testing against known cryptographic attacks and the development of new attack models tailored to molecular systems will be essential for continuous improvement. Lüscher emphasizes that this field is inherently interdisciplinary, requiring collaboration between "hands-on lab scientists" and individuals with a "hacker's mindset" to identify vulnerabilities and innovate defensive countermeasures.

From a practical standpoint, the error correction mechanisms that are already vital for DNA data storage will also be critical for CUFs. While CUF responses are reproducible, they are subject to "some noise" from chemical reactions; robust error correction will be needed to reliably extract cryptographic keys. The "copy and lock" mechanism offers a defensive advantage by limiting the number of operations a distributed CUF can perform, thus mitigating risks associated with repeated querying.

The applications in anti-counterfeiting for pharmaceuticals and artwork authentication highlight immediate defensive benefits. By embedding CUFs directly into materials, physical objects gain an intrinsic, unclonable digital identity. This makes it significantly harder for attackers to produce convincing fakes, as replicating the specific random DNA pool and its chemical "lock" is practically impossible due to the immense combinatorial space and high synthesis costs. Lüscher explained that an attacker attempting to reverse-engineer and re-synthesize a CUF would face billions of dollars in costs, due to the massive asymmetry between generating random DNA and synthesizing specific sequences. The chemical modification preventing adapter ligation also acts as a strong defensive measure against direct sequencing and cloning of the CUF.

Finally, the ethical considerations surrounding DNA technology, even synthetic DNA, require ongoing discussion. While Lüscher draws a clear line between artificial material use and biological DNA manipulation, defenders must remain vigilant about the potential misuse of any powerful technology and advocate for ethical guidelines as the field progresses.

Key Takeaways

• DNA as a Transformative Information Medium: DNA offers unparalleled durability, information density (60 zetabytes in a human body, fitting in a chocolate bar's volume), and potential for massive parallelism, making it a compelling alternative to traditional digital storage and processing.
• Chemical Unclonable Functions (CUFs): Inspired by physical unclonable functions, CUFs leverage molecular randomness in synthetic DNA pools to create unique, physically bound cryptographic primitives. These generate reproducible challenge-response pairs via PCR, which are difficult to predict or invert.
• Leveraging Molecular Randomness for Security: DNA synthesis can generate hundreds of petabytes of randomness for less than 100 euros, creating a significant cost asymmetry that makes CUFs practically unclonable and highly secure against reverse-engineering.
• Decentralized and Object-Bound Security: The "copy and lock" mechanism allows for the distribution of identical CUF pools, enabling decentralized multi-user authentication and the embedding of secure, unclonable metadata directly into physical materials like pigments or pharmaceuticals for anti-counterfeiting.
• Interdisciplinary Challenges and Opportunities: Advancing DNA security systems requires a concerted effort from diverse fields, combining chemical engineering and molecular biology expertise with a cybersecurity "hacker's mindset" to develop robust frameworks, standards, and defensive strategies.

About the Speaker(s)

Anne Lüscher is a Postdoc at the Institute for Chemical and Bioengineering at ETH Zurich. Her research focuses on the intersection of chemistry and information technology, specifically exploring the digital perspective of biomolecules like DNA. Lüscher is passionate about introducing audiences to the world of DNA information technology and its potential applications in data storage, computation, and particularly, security systems. Her work centers on leveraging molecular randomness and chemical processes to create novel cryptographic primitives and anti-counterfeiting measures. She advocates for an interdisciplinary approach to tackling the challenges and opportunities in this emerging field.