A Comprehensive Study of Deep Learning for Side-Channel Analysis c - PowerPoint PPT Presentation

A Comprehensive Study of Deep Learning for Side-Channel Analysis A Comprehensive Study of Deep Learning for Side-Channel Analysis ıc Masure 1,3 ecile Dumas 1 Emmanuel Prouff 2, 3 Lo¨ C´ 1 Univ. Grenoble Alpes, CEA, LETI, DSYS, CESTI, F-38000 Grenoble loic.masure@cea.fr 2 ANSSI, France 3 Sorbonne Universit´ e, UPMC Univ Paris 06, POLSYS, UMR 7606, LIP6, F-75005, Paris, France 17 / 09 / 2020, Ches 17 / 09 / 2020, Ches | Lo¨ ıc Masure, C´ ecile Dumas, Emmanuel Prouff | 1/18

Outline 1. Context 2. SCA Optimization Problem versus Deep Learning Based SCA 3. NLL Minimization is PI Maximization 4. Simulation results 5. Experimental results

A Comprehensive Study of Deep Learning for Side-Channel Analysis Who am I ◮ PhD student, studying Deep Learning (DL) for Side-Channel Analysis (SCA) Conceives a Evaluates Delivers a Security Commercialises the component Security Claims Certjfjcatjon certjfjed product Developer ITSEF ANSSI Developer French Certjfjcatjon Scheme Loïc Emmanuel Cécile 17 / 09 / 2020, Ches | Lo¨ ıc Masure, C´ ecile Dumas, Emmanuel Prouff | 3/18

A Comprehensive Study of Deep Learning for Side-Channel Analysis What is SCA? 17 / 09 / 2020, Ches | Lo¨ ıc Masure, C´ ecile Dumas, Emmanuel Prouff | 4/18

A Comprehensive Study of Deep Learning for Side-Channel Analysis What is SCA? Measure trace X Plaintext P Secret K Encryption Sensitive operation LOAD X ; LOAD B ; MV B ; … Z = C (P, K) 17 / 09 / 2020, Ches | Lo¨ ıc Masure, C´ ecile Dumas, Emmanuel Prouff | 4/18

A Comprehensive Study of Deep Learning for Side-Channel Analysis What is SCA? Measure trace X Plaintext P Secret K Encryption Sensitive operation LOAD X ; LOAD B ; MV B ; … Z = C (P, K) Profiling Attack Attack using open samples similar to the target device – same code, same chip, etc . – with full knowledge of the secret key Two steps: ◮ Profiling phase: P , K known = ⇒ Z known, X acquired on an open sample ◮ Attack phase: P known, X acquired on the target device, K guessed 17 / 09 / 2020, Ches | Lo¨ ıc Masure, C´ ecile Dumas, Emmanuel Prouff | 4/18

Outline 1. Context 2. SCA Optimization Problem versus Deep Learning Based SCA 3. NLL Minimization is PI Maximization 4. Simulation results 5. Experimental results

A Comprehensive Study of Deep Learning for Side-Channel Analysis Profiling Attacks Key Recovery ( i.e. attack step) Given N a attack traces x i with plaintext p i , calculate scores y i = F ( x i ) y 0 . . . Z i = C ( p i , k ⋆ ) . . . 0 1 0 1 K 17 / 09 / 2020, Ches | Lo¨ ıc Masure, C´ ecile Dumas, Emmanuel Prouff | 6/18

A Comprehensive Study of Deep Learning for Side-Channel Analysis Profiling Attacks Key Recovery ( i.e. attack step) Given N a attack traces x i with plaintext p i , calculate scores y i = F ( x i ) y 1 y 0 . . . Z i = C ( p i , k ⋆ ) . . . 0 1 0 1 K 17 / 09 / 2020, Ches | Lo¨ ıc Masure, C´ ecile Dumas, Emmanuel Prouff | 6/18

A Comprehensive Study of Deep Learning for Side-Channel Analysis Profiling Attacks Key Recovery ( i.e. attack step) Given N a attack traces x i with plaintext p i , calculate scores y i = F ( x i ) y 2 y 1 y 0 . . . Z i = C ( p i , k ⋆ ) . . . 0 1 0 1 K 17 / 09 / 2020, Ches | Lo¨ ıc Masure, C´ ecile Dumas, Emmanuel Prouff | 6/18

A Comprehensive Study of Deep Learning for Side-Channel Analysis Profiling Attacks Key Recovery ( i.e. attack step) Given N a attack traces x i with plaintext p i , calculate scores y i = F ( x i ) y 2 y 1 y 0 . . . Z i = C ( p i , k ⋆ ) . . . ˆ 0 1 0 1 K k 17 / 09 / 2020, Ches | Lo¨ ıc Masure, C´ ecile Dumas, Emmanuel Prouff | 6/18

A Comprehensive Study of Deep Learning for Side-Channel Analysis Profiling Attacks Key Recovery ( i.e. attack step) Given N a attack traces x i with plaintext p i , calculate scores y i = F ( x i ) y 2 y 1 y 0 . . . Z i = C ( p i , k ⋆ ) . . . ˆ 0 1 0 1 K k k = k ⋆ with probability ≥ β ( e.g. 0 . 9) Goal: find F that minimizes N a s.t. ˆ 17 / 09 / 2020, Ches | Lo¨ ıc Masure, C´ ecile Dumas, Emmanuel Prouff | 6/18

A Comprehensive Study of Deep Learning for Side-Channel Analysis Profiling Attacks Key Recovery ( i.e. attack step) Given N a attack traces x i with plaintext p i , calculate scores y i = F ( x i ) y 2 y 1 y 0 . . . Z i = C ( p i , k ⋆ ) . . . ˆ 0 1 0 1 K k k = k ⋆ with probability ≥ β ( e.g. 0 . 9) Goal: find F that minimizes N a s.t. ˆ Optimal model: F ⋆ , with N ⋆ a traces 17 / 09 / 2020, Ches | Lo¨ ıc Masure, C´ ecile Dumas, Emmanuel Prouff | 6/18

A Comprehensive Study of Deep Learning for Side-Channel Analysis Profiling Attacks Key Recovery ( i.e. attack step) Given N a attack traces x i with plaintext p i , calculate scores y i = F ( x i ) y 2 y 1 y 0 . . . Z i = C ( p i , k ⋆ ) . . . ˆ 0 1 0 1 K k k = k ⋆ with probability ≥ β ( e.g. 0 . 9) Goal: find F that minimizes N a s.t. ˆ Optimal model: F ⋆ , with N ⋆ a traces How to find F ⋆ = ⇒ profiling step Requires to know the probability distribution F ⋆ = Pr [ Z | X ] 17 / 09 / 2020, Ches | Lo¨ ıc Masure, C´ ecile Dumas, Emmanuel Prouff | 6/18

A Comprehensive Study of Deep Learning for Side-Channel Analysis Profiling Attacks Key Recovery ( i.e. attack step) Given N a attack traces x i with plaintext p i , calculate scores y i = F ( x i ) y 2 y 1 y 0 . . . Z i = C ( p i , k ⋆ ) . . . ˆ 0 1 0 1 K k k = k ⋆ with probability ≥ β ( e.g. 0 . 9) Goal: find F that minimizes N a s.t. ˆ Optimal model: F ⋆ , with N ⋆ a traces How to find F ⋆ = ⇒ profiling step Requires to know the probability distribution F ⋆ = Pr [ Z | X ] Reality: unknown for the evaluator/attacker. Estimation with parametric models F ( ., θ ): P(Z|X=x) Estjmator F( . ; θ) 0% 20% 40% 60% 80% 100% x Z=0 Z=1 17 / 09 / 2020, Ches | Lo¨ ıc Masure, C´ ecile Dumas, Emmanuel Prouff | 6/18

A Comprehensive Study of Deep Learning for Side-Channel Analysis Deep Learning (DL) based SCA is a hot topic currently Recent milestones about its effectiveness: more robust against counter-measures like masking [MPP16], jitter (misalignment) [CDP17], whether on software or FPGA [Kim+19] 17 / 09 / 2020, Ches | Lo¨ ıc Masure, C´ ecile Dumas, Emmanuel Prouff | 7/18

A Comprehensive Study of Deep Learning for Side-Channel Analysis Deep Learning (DL) based SCA is a hot topic currently Recent milestones about its effectiveness: more robust against counter-measures like masking [MPP16], jitter (misalignment) [CDP17], whether on software or FPGA [Kim+19] Training a Neural Network z = C ( p , k ⋆ ) F ( x , θ ) L ( y , z ) Parameters θ 17 / 09 / 2020, Ches | Lo¨ ıc Masure, C´ ecile Dumas, Emmanuel Prouff | 7/18

A Comprehensive Study of Deep Learning for Side-Channel Analysis Deep Learning (DL) based SCA is a hot topic currently Recent milestones about its effectiveness: more robust against counter-measures like masking [MPP16], jitter (misalignment) [CDP17], whether on software or FPGA [Kim+19] Training a Neural Network z = C ( p , k ⋆ ) F ( x , θ ) L ( y , z ) Parameters θ L : performance metric (accuracy, recall, ...) or loss function (Mean Square Error, NLL, ...) 17 / 09 / 2020, Ches | Lo¨ ıc Masure, C´ ecile Dumas, Emmanuel Prouff | 7/18

A Comprehensive Study of Deep Learning for Side-Channel Analysis Open issue with Machine Learning based SCA 1 “How to evaluate the quality of a model during training?” 1 Picek et al. , Ches 2019 [Pic+18] 17 / 09 / 2020, Ches | Lo¨ ıc Masure, C´ ecile Dumas, Emmanuel Prouff | 8/18

A Comprehensive Study of Deep Learning for Side-Channel Analysis Open issue with Machine Learning based SCA 1 “How to evaluate the quality of a model during training?” ◮ Accuracy: probability to recover the secret key with one trace 1 Picek et al. , Ches 2019 [Pic+18] 17 / 09 / 2020, Ches | Lo¨ ıc Masure, C´ ecile Dumas, Emmanuel Prouff | 8/18

A Comprehensive Study of Deep Learning for Side-Channel Analysis Open issue with Machine Learning based SCA 1 “How to evaluate the quality of a model during training?” ◮ Accuracy: probability to recover the secret key with one trace Their observations ”Accuracy does not seem to be the right performance metric in SCA” 1 Picek et al. , Ches 2019 [Pic+18] 17 / 09 / 2020, Ches | Lo¨ ıc Masure, C´ ecile Dumas, Emmanuel Prouff | 8/18

A Comprehensive Study of Deep Learning for Side-Channel Analysis Open issue with Machine Learning based SCA 1 “How to evaluate the quality of a model during training?” ◮ Accuracy: probability to recover the secret key with one trace Their observations ”Accuracy does not seem to be the right performance metric in SCA” ◮ High accuracy = ⇒ successful key recovery 1 Picek et al. , Ches 2019 [Pic+18] 17 / 09 / 2020, Ches | Lo¨ ıc Masure, C´ ecile Dumas, Emmanuel Prouff | 8/18

A Comprehensive Study of Deep Learning for Side-Channel Analysis Open issue with Machine Learning based SCA 1 “How to evaluate the quality of a model during training?” ◮ Accuracy: probability to recover the secret key with one trace Their observations ”Accuracy does not seem to be the right performance metric in SCA” ◮ High accuracy = ⇒ successful key recovery ◮ Low accuracy = ⇒ nothing 1 Picek et al. , Ches 2019 [Pic+18] 17 / 09 / 2020, Ches | Lo¨ ıc Masure, C´ ecile Dumas, Emmanuel Prouff | 8/18