Analysis of ECC Implementations with Worst-Case Horizontal Attacks - PowerPoint PPT Presentation

A Systematic Approach to the Side-Channel Analysis of ECC Implementations with Worst-Case Horizontal Attacks Romain Poussier, François-Xavier Standaert: Université catholique de Louvain Yuanyuan Zhou: Université catholique de Louvain & Brightsight BV CHES 2017 1 28/09/2017

Outline – Context and motivation – Horizontal differential power attack: systematic framework – Practical experiments • Setup • Points of interest • Result on Cortex-M4 • Result on Cortex-A8 – Conclusion and future works CHES 2017 2 28/09/2017

SCA on ECC: many options Elliptic curve cryptography (ECC) Side-channel attacks (SCA) Scalar multiplication 𝑙 𝑄 Many attack classes Different tools • DPA • Difference of mean • Horizontal DPA • Correlation • Template • Likelihood • Bit manipulation • Machine learning • Horizontal Collision • … • … CHES 2017 3 28/09/2017

Which attack to use for evaluation Many attack classes Different tools • DPA • Difference of mean • Horizontal DPA • Correlation Which attack to use for a fixed • Template • Likelihood time security evaluation? • Bit manipulation • Machine learning • Horizontal Collision • … • … CHES 2017 4 28/09/2017

Which attack to use for evaluation Many attack classes Different tools • DPA • Difference of mean • Horizontal DPA • Correlation Which attack to use for a fixed • Template • Likelihood time security evaluation? • Bit manipulation • Machine learning • Horizontal Collision • … • … Our general goal: approaching worst-case security How: use most of the available side-channel information CHES 2017 5 28/09/2017

State of the art Attacker’s # needed # Information Input point traces assumptions used A posteriori DPA N Strong Small known Customizable Template 1 A priori known Strong (first bits only) Online 1 A priori known Very strong Customizable template A posteriori H-DPA 1 Strong Customizable known H-Collision 1 Not needed Weak Small Bit 1 Not needed Weak Small manipulation CHES 2017 6 28/09/2017

This study: contribution on H-DPA Few practical Complex experiments for H- framework DPA • Systematic • A to Z application approach • Cortex-M4 (easy) • Close to worst-case • Cortex-A8 (more with leakage challenging) characterization Teaser: promising future work shown at the end of the talk! CHES 2017 7 28/09/2017

Outline – Context and motivations – Horizontal differential power attack: systematic framework – Practical experiments • Setup • Points of interest • Result on Cortex-M4 • Result on Cortex-A8 – Conclusion and future works CHES 2017 8 28/09/2017

Elliptic curve scalar multiplication (ECSM) Note: only collision attack against this ECSM: Hanley et al. (CTRSA 2015) CHES 2017 9 28/09/2017

Identify the information: abstract view of regular ECSM Fixed and predictable sequence of register operations: N registers per scalar bit CHES 2017 10 28/09/2017

Horizontal DPA: modus operandi HDPA attack on 𝑙 0 : 1. Select several internal registers operations 𝑆𝑡 that depends on 𝑄 and 𝑙 0 CHES 2017 11 28/09/2017

Horizontal DPA: modus operandi HDPA attack on 𝑙 0 : 1. Select several internal registers operations 𝑆𝑡 that depends on 𝑄 and 𝑙 0 2. Modelize the function 𝑴 that characterizes how 𝑆𝑡 leak: information extraction CHES 2017 12 28/09/2017

Horizontal DPA: modus operandi HDPA attack on 𝑙 0 : 1. Select several internal registers operations 𝑆𝑡 that depends on 𝑄 and 𝑙 0 2. Modelize the function 𝑴 that characterizes how 𝑆𝑡 leak: information extraction 3. Acquire 1 attack measurement CHES 2017 13 28/09/2017

Horizontal DPA: modus operandi HDPA attack on 𝑙 0 : 1. Select several internal registers operations 𝑆𝑡 that depends on 𝑄 and 𝑙 0 2. Modelize the function 𝑴 that characterizes how 𝑆𝑡 leak: information extraction 3. Acquire 1 attack measurement 4. Prepare two sets 𝑇 0 (resp. 𝑇 1 ) that contain the guesses for the values 𝑆𝑡 0 (resp. 𝑆𝑡 1 ) in function of 𝑄 and 𝑙 0 = 0 (resp. 𝑙 0 = 1 ) CHES 2017 14 28/09/2017

Horizontal DPA: modus operandi HDPA attack on 𝑙 0 : 1. Select several internal registers operations 𝑆𝑡 that depends on 𝑄 and 𝑙 0 2. Modelize the function 𝑴 that characterizes how 𝑆𝑡 leak: information extraction 3. Acquire 1 attack measurement 4. Prepare two sets 𝑇 0 (resp. 𝑇 1 ) that contain the guesses for the values 𝑆𝑡 0 (resp. 𝑆𝑡 1 ) in function of 𝑄 and 𝑙 0 = 0 (resp. 𝑙 0 = 1 ) 5. Compare 𝑴(𝑆𝑡 𝑗 ) with the actual SCA leakages using a distinguisher 𝐸 : information combination CHES 2017 15 28/09/2017

Horizontal DPA: modus operandi HDPA attack on 𝑙 0 : 1. Select several internal registers operations 𝑆𝑡 that depends on 𝑄 and 𝑙 0 2. Modelize the function 𝑴 that characterizes how 𝑆𝑡 leak: information extraction 3. Acquire 1 attack measurement 4. Prepare two sets 𝑇 0 (resp. 𝑇 1 ) that contain the guesses for the values 𝑆𝑡 0 (resp. 𝑆𝑡 1 ) in function of 𝑄 and 𝑙 0 = 0 (resp. 𝑙 0 = 1 ) 5. Compare 𝑴(𝑆𝑡 𝑗 ) with the actual SCA leakages using a distinguisher 𝐸 : information combination 6. Select 𝑙 0 = 𝑗 such that 𝐸(𝑇 𝑗 , 𝑴(𝑆𝑡 𝑗 )) is maximised. CHES 2017 16 28/09/2017

Extracting the information: linear regression Classical templates: 𝑃(2 𝑡 ) Registers of size 𝑡 bits: Linear regression: 𝑃(𝑡) (or more: tradeoff) CHES 2017 17 28/09/2017

Linear regression: deterministic part Acquire 𝑜 traces with random known 𝑄 and 𝑙 . 𝒎 𝒔 𝒔(1) 𝒎(1) 𝒎(2) 𝒔(2) 𝑡 ⋅ 𝑦 𝑗 𝑀(𝑦) = 𝛽 + 𝛽 𝑗 … 𝑗=1 𝑦 𝑗 : 𝑗 -th bit of 𝑦 𝒎(𝑜) 𝒔(𝑜) Function 𝑀: (𝛽, 𝛽 1 , … , 𝛽 𝑡 ) Leakages Processed value CHES 2017 18 28/09/2017

Linear regression: noise Acquire 𝑛 traces with random known 𝑄 and 𝑙 𝒎 𝒔 𝒔(1) 𝒎(1) 𝒎(2) 𝒔(2) 𝑛 σ 2 = 1 2 𝑛 𝒎(𝑗) − 𝑀 𝒔(𝑗) 𝑗=1 … 𝒎(𝑛) 𝒔(𝑛) Noise approximation Leakages Processed value CHES 2017 19 28/09/2017

Combining the information (attack) Parameter: 𝑒 scalar bits attacked per iteration Target Simulator 𝑙 = 101 𝑒 = 3 CHES 2017 20 28/09/2017

Outline – Context and motivations – Horizontal differential power attack: systematic framework – Practical experiments • Setup • Points of interest • Result on Cortex-M4 • Result on Cortex-A8 – Conclusion and future works CHES 2017 21 28/09/2017

Setup: target implementation/devices Cortex-M4 Cortex-A8 • • 100 MHz 1 GHz • • Constant time instructions (mostly) Constant time instructions (mostly) • • 32-bit registers 32-bit registers • Ubuntu running in background Custom constant time assembly implementation of NIST p256 256x256-bit multiplication achieved through 64 32x32-bit register multiplications (framework independent of the curve/implementation) N=1600 target registers per scalar bit (only) CHES 2017 22 28/09/2017

Setup: trace acquisition & scenario Cortex-M4 Cortex-A8 • • Power measurement EM measurement • • Lecroy WaveRunner HRO 66 Lecroy WaveRunner 620Zi • • 200 Ms/sec 10 GS/s • • 123 scalar bits 4 scalar bits • • 40,000,000 samples per trace 2,000,000 samples per trace • Trace alignment Scenario: 1st order success rate Scenario: Lattice attack (ECDSA) on 123 bits with several partial nonces CHES 2017 23 28/09/2017

Outline – Context and motivations – Horizontal differential power attack: systematic framework – Practical experiments • Setup • Points of interest • Result on Cortex-M4 • Result on Cortex-A8 – Conclusion and future works CHES 2017 24 28/09/2017

Points of interest: CPA and partial SNR Acquire 𝑜 traces with random known 𝑄 and 𝑙 𝒎 𝑗 𝒎 𝑘 𝒔 𝒔(1) 𝑢 = 𝑏𝑠𝑕𝑛𝑏𝑦 𝑗 (⍴(𝐼𝑋 𝒔 , 𝒎 𝑗 )) 𝒔(2) … (𝑢𝑠𝑣𝑜𝑑 𝑐 (𝒔), 𝒎 𝑗 )) 𝑢 = 𝑏𝑠𝑕𝑛𝑏𝑦 𝑗 (𝑇𝑂𝑆 𝒔(𝑜) Leakages Processed value Time sample CHES 2017 25 28/09/2017

Points of interest: windowed mode Cortex-M4: 1600 ⋅ 123 POIs ; 40,000,000 samples CHES 2017 26 28/09/2017

Points of interest: windowed mode CHES 2017 27 28/09/2017

Points of interest: windowed mode CPA: p-value partial SNR: heuristic threshold CHES 2017 28 28/09/2017

Points of interest: windowed mode CPA: p-value partial SNR: heuristic threshold CHES 2017 29 28/09/2017

Points of interest: windowed mode CPA: p-value partial SNR: heuristic threshold CHES 2017 30 28/09/2017

Outline – Context and motivations – Horizontal differential power attack: systematic framework – Practical experiments • Setup • Points of interest • Result on Cortex-M4: first order success rate on 123 scalar bits • Result on Cortex-A8 – Conclusion and future works CHES 2017 31 28/09/2017

Cortex-M4 results: 1-O SR on 123 bits Reminder on the parameters: 1-O SR • d: number of scalar bit targeted at the same time • N: number of target register per scalar bit Number N of POI per bit CHES 2017 32 28/09/2017