A Hackers guide to reducing side-channel atuack surgaces using - PowerPoint PPT Presentation

A Hacker’s guide to reducing side-channel atuack surgaces using deep-learning Google, @jmichel_p Google, @elie with the help of many Googlers and external collaborators Security and Privacy Group

Talk is based on some of the results of a joint research project with many collaborators on hardening hardware cryptography Security and Privacy Group

Work in progress Experimental results and code ahead Security and Privacy Group

Side channel atuacks are one of the most effjcient ways to atuack secure hardware Security and Privacy Group

A side-channel atuack was used to recover the Trezor bitcoin wallet private key htups://jochen-hoenicke.de/crypto/trezor-power-analysis/ Security and Privacy Group

Side-channels atuacks are notoriously hard to debug and fjx Security and Privacy Group

Can we create a debugger ? that accurately pinpoints the code vulnerable to side-channel atuacks? Security and Privacy Group

Combine deep-learning and dynamic analysis to pinpoint origin of leakage Security and Privacy Group

AI? Really? Security and Privacy Group

Side Channel Atuacks Leak Detector Security and Privacy Group

Today’s goal : use SCALD to debug tinyAES running on STM32F4 Security and Privacy Group

Agenda What are side channels? AI based side-channel atuacks AI explainability Finding implementation leakage origin with SCALD Security and Privacy Group

Code and slides htups://elie.net/scald Security and Privacy Group

Disclaimer This talk purposely focuses on showcasing a high level overview of how to debug a cryptographic implementation end-to-end using SCALD. For technical details, see the paper Security and Privacy Group

Paru 1 What are side-channel atuacks? Security and Privacy Group

A side-channel atuack is an indirect measurement of a computation result via an auxiliary mechanism Security and Privacy Group

Real-world side-channel applications Extract crypto Recover Pergorm blind Steal passwords wallets encryption keys SQL injections and pins Security and Privacy Group

Plaintext Timing Current Heat Secret Key Electromagnetic emission Security and Privacy Group

1 2 3 4 5 6 7 8 9 10 AES round are visible in lightly protected AES implementation power traces Security and Privacy Group

SCA in a nutshell Encryption Signal acquisition Template atuack AES key! Security and Privacy Group

NewAE Chipwhisperer Pro + Picoscope 6000 for fast sampling rate is what we use for our research This is not an ad :) it is a recommendation based on what we use Security and Privacy Group

Section 2 AI based side-channel atuacks Security and Privacy Group

Side Channel Atuacks Automated with Machine Learning Security and Privacy Group

How do SCAAML atuacks work in practice? Security and Privacy Group

Check out last year talk for in-depth explanation htups://elie.net/scaaml Security and Privacy Group

Threat model whitebox atuack Contrary to our previous work that focused on black box atuacks, the traces used in this talk are truncated and collected synchronously to improve debugging quality. This is consistent with the white-box atuack model used during chip development. Additionally, the model architecture is also optimized for debugging, not pure pergormance. Security and Privacy Group

SCAAML process overview Encryption Signal acquisition Predictions Combine DNN AES key! (ChipWhisperer) using DNN predictions Security and Privacy Group

key key PT TinyAES has multiples atuack points that can be sub_bytes_in targeted by SCAAML. Today we focus on SBOX sub_bytes_in sub_bytes_out Security and Privacy Group

Probabilistic atuack: ... ... Security and Privacy Group

Probabilistic atuack: Val 0: 0.10 Val 0: 0.08 Val 0: 4.4 Val 1: 0.02 Val 1: 0.04 Val 1: 5.3 Val 2: 0.01 Val 2: 0.05 Val 2: 3.2 + … + ... ... ... Val 42: 0.3 Val 42: 0.12 Val 42: 21.4 ... ... ... Val 254: 0.02 Val 254: 0.03 Val 254: 2.9 Val 255: 0.05 Val 255: 0.10 Val 255: 4.2 *sum uses log10 + ε Security and Privacy Group

Model architecture Hyperuuned residual separated 1D convolution network Custom residual block used Security and Privacy Group

Tensorboards - 1 model per byte Security and Privacy Group

Our side-channel optimized model architecture yield 16 high accuracy model in 5 epoch as expect on this easy use-case Security and Privacy Group

How to fjnd where ? TinyAES is leaking using our model? Security and Privacy Group

Section 3 Deep-learning explainability Security and Privacy Group

A classic vision model prediction Boxer ... Tiger cat Security and Privacy Group

Why did the model ? predict a tiger cat and a boxer? Security and Privacy Group

Explainability to the rescue: Why did the model ? Boxer predict a tiger cat and dog? Explainer Security and Privacy Group

Explainability to the rescue: Why did the model ? Tiger cat predict a tiger cat and dog? Security and Privacy Group

Identifying errors and biases Unmasking Clever Hans Predictors and Assessing What Machines Really Learn Security and Privacy Group

How do I use explainability and ? combine it with dynamic analysis to debug leakages? Security and Privacy Group

Section 4 Finding leakage origin with SCALD Security and Privacy Group

Annotated code SCALD: Game plan SCALD: Game plan Target emulator Model (cpu + fjrmware) Annotated code Explainer Target emulator Traces + predictions Leakage map Security and Privacy Group

Many explainability techniques exists Sanity Checks for Saliency Maps - Adebayo et al. Security and Privacy Group

Which explainability ? techniques work best? Security and Privacy Group

Leak maps Aggregate, fjlter, and normalize Reduce to key spikes Security and Privacy Group

Byte 0 leak map SNR visualization for various techniques Grad Cam++ Activations maps Security and Privacy Group

Benchmarking key explainability techniques mask top n points Accuracy decrease Test traces model Leak map Security and Privacy Group

Benchmark results: lower is betuer 100% 95% 95% 57% 58% 58% 44% Byte 0 Byte 7 Byte 7 Byte 7 Byte 0 Byte 0 Baseline SNR Activation Grad Cam++ maps Security and Privacy Group Preliminary results - 4 points masked

Explainability techniques don’t work betuer than SNR and have very noisy leak maps Security and Privacy Group

Develop a technique tailored to leakage explanation Security and Privacy Group

Custom code? Really? Security and Privacy Group

SCALD leakage map SCALD explainer combines paruitioned Byte 0 and convolutive occlusion for speed and precise leakage Byte 7 pinpointing Security and Privacy Group

Benchmark results: lower is betuer 100% 95% 95% 57% 58% 58% 44% 42% 17% Byte 0 Byte 7 Byte 7 Byte 7 Byte 0 Byte 0 Baseline SNR Activation Grad Cam++ SCALD maps Security and Privacy Group Preliminary results - 4 points masked

SNR byte 0 leak maps comparaison: the Gradcam SCALD map is visibly cleaner SCALD Security and Privacy Group

SCALD custom explainability technique decreases accuracy the most and generate low noise leak map Security and Privacy Group

How do you go from the ? leakage map to code? Security and Privacy Group

From traces to CPU instructions state automaton FW CPU Leakage map Mapped ASM Security and Privacy Group

From CPU instructions to code Firmware Debug symbol Mapped ASM Code mapper Code leakage mapping Security and Privacy Group

Theory looks great but ? how hard is it in practice? Security and Privacy Group

Requirements An explanation technique that have single point precision We need to isolate the exact few points of the traces that cause most of the leakage as some instruction only take one cycle or two (4 or 8 traces points) An emulator that have single cycle precision We need to map each instruction to its exact cycle to be able to map them to the trace. A single error and the entire analysis is wrong as all instruction will be shifued. A bit of computation You need a 1M data point dataset, 16 models, 16 explanations, 1 full target execution and 1 mapping. With all our optimization this is requires a few days of computation that are parallelizable. Security and Privacy Group

This level of explainability and emulation precision seems out-of reach Security and Privacy Group

Model targeting sub_bytes_in are expected to mostly exploit leakage in the AddRoundKey() function STM32F4 - TinyAES Security and Privacy Group

TinyAES aes.c line 213 is exactly the sub_byte_in operation! SCALD perfectly identify the main source of leakage. Scald analysis result output Security and Privacy Group

SCALD is able to automatically isolate the exact code vulnerable to a given SCAAML side-channel atuack Security and Privacy Group