and an Application to Masking in Hardware Gatan Cassiers, - PowerPoint PPT Presentation

From Trivial Composition to Full Verification and an Application to Masking in Hardware Gaëtan Cassiers, François-Xavier Standaert UCLouvain (Belgium) VeriSiCC Seminar, Paris, France, September 2019

Side-Channel Analysis

Side-Channel Analysis

Side-Channel Analysis

Side-Channel Analysis

Side-Channel Analysis

Side-Channel Analysis

Masking (e.g., Boolean 𝑦 = 𝑦 0 + 𝑦 1 + ⋯ + 𝑦 𝑒 ) 𝑑 Noisy leakages security: 𝑂 ∝ MI (𝑌;𝑴) MI 𝑌; 𝑴 < MI 𝑌 𝑗 ; 𝑀 𝑗 𝑒 Goal (ideally):

Masking (e.g., Boolean 𝑦 = 𝑦 0 + 𝑦 1 + ⋯ + 𝑦 𝑒 ) Bounded moment security: ෑ 𝑀 𝑗 𝑌 𝑗 1 ,𝑗 2 ,…,𝑗 𝑒−1 ( 𝑒 -1)th order statistical moment (ideally) 𝑑 Noisy leakages security: 𝑂 ∝ MI (𝑌;𝑴) MI 𝑌; 𝑴 < MI 𝑌 𝑗 ; 𝑀 𝑗 𝑒 Goal (ideally):

Masking (e.g., Boolean 𝑦 = 𝑦 0 + 𝑦 1 + ⋯ + 𝑦 𝑒 ) 𝑦 = 𝑦 0 + 𝑦 1 + ⋯ + 𝑦 𝑒 Probing security: Sets of ( 𝑒 -1) probes are of 𝑌 (ideally) Bounded moment security: ෑ 𝑀 𝑗 𝑌 𝑗 1 ,𝑗 2 ,…,𝑗 𝑒−1 ( 𝑒 -1)th order statistical moment (ideally) 𝑑 Noisy leakages security: 𝑂 ∝ MI (𝑌;𝑴) MI 𝑌; 𝑴 < MI 𝑌 𝑗 ; 𝑀 𝑗 𝑒 Goal (ideally):

Security reductions abstract-qualitative 𝑦 = 𝑦 0 + 𝑦 1 + ⋯ + 𝑦 𝑒 probing [Barthe et al., Eurocrypt 2017] bounded moment physical-qualitative [Duc et al., Eurocrypt 2014] physical-quantitative noisy leakages

What can go wrong? (e.g., when computing 𝑏. 𝑐 ) Issue #1. Lack of randomness (can break the independence assumption) 𝑑 1 𝑏 1 𝑐 1 𝑏 1 𝑐 2 𝑏 1 𝑐 3 Example: probing 𝑑 1 = 𝑏 1 . 𝑐 1 + 𝑐 2 + 𝑐 3 𝑑 2 𝑏 2 𝑐 1 𝑏 2 𝑐 2 𝑏 2 𝑐 3 ⇒ reveals information on 𝑐 (when 𝑑 1 = 1) 𝑑 3 𝑏 3 𝑐 1 𝑏 3 𝑐 2 𝑏 3 𝑐 3

What can go wrong? (e.g., when computing 𝑏. 𝑐 ) Issue #1. Lack of randomness (can break the independence assumption) • mitigated by adding 𝑑 1 𝑏 1 𝑐 1 𝑏 1 𝑐 2 𝑏 1 𝑐 3 0 𝑠 𝑠 1 2 «refreshing gadgets » 𝑑 2 𝑏 2 𝑐 1 𝑏 2 𝑐 2 𝑏 2 𝑐 3 𝑠 0 𝑠 + ⇒ 2 3 • can be analyzed in 𝑑 3 𝑠 𝑠 0 𝑏 3 𝑐 1 𝑏 3 𝑐 2 𝑏 3 𝑐 3 2 3 the probing model

What can go wrong? (e.g., when computing 𝑏. 𝑐 ) Issue #1. Lack of randomness (can break the independence assumption) • mitigated by adding 𝑑 1 𝑏 1 𝑐 1 𝑏 1 𝑐 2 𝑏 1 𝑐 3 0 𝑠 𝑠 1 2 «refreshing gadgets » 𝑑 2 𝑏 2 𝑐 1 𝑏 2 𝑐 2 𝑏 2 𝑐 3 𝑠 0 𝑠 + ⇒ 2 3 • can be analyzed in 𝑑 3 𝑠 𝑠 0 𝑏 3 𝑐 1 𝑏 3 𝑐 2 𝑏 3 𝑐 3 2 3 the probing model Issue #2. Physical defaults (can break the independence assumption) Example: glitches (transcient values) « re-combine » the shares such that: 𝑀 𝑗 = 𝜀(𝑦 1 ∙ 𝑦 2 ∙ 𝑦 3 ) (detected in the bounded moment model)

What can go wrong? (e.g., when computing 𝑏. 𝑐 ) Issue #1. Lack of randomness (can break the independence assumption) • mitigated by adding 𝑑 1 𝑏 1 𝑐 1 𝑏 1 𝑐 2 𝑏 1 𝑐 3 0 𝑠 𝑠 1 2 «refreshing gadgets » 𝑑 2 𝑏 2 𝑐 1 𝑏 2 𝑐 2 𝑏 2 𝑐 3 𝑠 0 𝑠 + ⇒ 2 3 • can be analyzed in 𝑑 3 𝑠 𝑠 0 𝑏 3 𝑐 1 𝑏 3 𝑐 2 𝑏 3 𝑐 3 2 3 the probing model Issue #2. Physical defaults (can break the independence assumption) • mitigated by adding a « non- completeness » property [ ≈ Theshold Implementations] • abstract property: can be analyzed in the probing model!

Technical challenge: scalability 𝒓 -probing security [ISW, 2004] : any 𝑟 -tuple of shares in the protected circuit is independent of any sensitive variable

Technical challenge: scalability 𝒓 -probing security [ISW, 2004] : any 𝑟 -tuple of shares in the protected circuit is independent of any sensitive variable Problem: the cost of testing probing security increases (very) fast with circuit size and the # of shares (since ∃ many tuples)

Technical challenge: scalability 𝒓 -probing security [ISW, 2004] : any 𝑟 -tuple of shares in the protected circuit is independent of any sensitive variable Problem: the cost of testing probing security increases (very) fast with circuit size and the # of shares (since ∃ many tuples) • Solution #1: direct verification of (weaker) circuit properties • [Barthe et al., 2015/2019], [Bloem et al., 2018] • Solution #2: composable verification with (stronger) properties • [Barthe et al., 2016] – but limited to “abstract” circuits • Solution #3: test more specific properties [Arribas et al., 2018]

Technical challenge: scalability 𝒓 -probing security [ISW, 2004] : any 𝑟 -tuple of shares in the protected circuit is independent of any sensitive variable Problem: the cost of testing probing security increases (very) fast with circuit size and the # of shares (since ∃ many tuples) • Solution #1: direct verification of (weaker) circuit properties • [Barthe et al., 2015/2019], [Bloem et al., 2018] • Solution #2: composable verification with (stronger) properties • [Barthe et al., 2016] – but limited to “abstract” circuits • Can be complementary: use #1 for gadgets, #2 for circuits

Does it go wrong (for hardware masking) ? • State-of-the-art hardware-oriented masking schemes • Consolidating Masking Scheme (CMS, 2015) • Domain-Oriented Masking (DOM, 2016) • Unified Masking Approach (UMA, 2017) • Generic Low-Latency Masking (GLM, 2018)

Does it go wrong (for hardware masking) ? • State-of-the-art hardware-oriented masking schemes • Consolidating Masking Scheme (CMS, 2015) • Domain-Oriented Masking (DOM, 2016) • Unified Masking Approach (UMA, 2017) • Generic Low-Latency Masking (GLM, 2018) • Intuitively appealing constructions • But no probing security proof at high orders • Theoretical concern or practical risk?

Does it go wrong (for hardware masking) ? • State-of-the-art hardware-oriented masking schemes • Consolidating Masking Scheme (CMS, 2015) • Domain-Oriented Masking (DOM, 2016) • Unified Masking Approach (UMA, 2017) • Generic Low-Latency Masking (GLM, 2018) • Intuitively appealing constructions • But no probing security proof at high orders • Theoretical concern or practical risk? • [Moos et al., 2019]: all the higher-order extensions of these schemes are affected by concrete flaws • Next: CMS (local) and DOM (composability) examples…

Consolidating Masking Scheme • Local flaw in the “ring refreshing” algorithm • Attack with 3 probes for any d >3 shares Problem: most of the randomness cancels out…

Consolidating Masking Scheme • Local flaw in the “ring refreshing” algorithm • Attack with 3 probes for any d >3 shares Problem: most of the randomness cancels out… Fix proposed by De Cnudde ( ⇒ CMS more similar to DOM) Composability remains unclear

Composability requirements (example) 𝑟 1 + 𝑟 2 ≤ 𝑟 𝑟 1 internal probes 𝑟 2 output probes 𝒓 -(Strong) Non Interference [Barthe et al., CCS 2016] : a circuit gadget (e.g., f 1 ) is NI (SNI) any set of 𝑟 1 + 𝑟 2 probes can be simulated with at most 𝑟 1 + 𝑟 2 (only 𝑟 1 ) shares of each input D(input shares||probes) ≈ D(input shares||simulation)

Composability requirements (example) 𝑟 1 + 𝑟 2 ≤ 𝑟 𝑟 1 internal probes 𝑟 2 output probes Theorem [trivial composition] ≈ any composition of q -SNI gadget is q -SNI 𝒓 -(Strong) Non Interference [Barthe et al., CCS 2016] : a circuit gadget (e.g., f 1 ) is NI (SNI) any set of 𝑟 1 + 𝑟 2 probes can be simulated with at most 𝑟 1 + 𝑟 2 (only 𝑟 1 ) shares of each input D(input shares||probes) ≈ D(input shares||simulation)

Domain Oriented Masking • Two algorithms: DOM-indep and DOM-dep • DOM-indep not sufficient to compose, e.g., z=x ⊗ x

Domain Oriented Masking • Two algorithms: DOM-indep and DOM-dep • DOM-indep not sufficient to compose, e.g., z=x ⊗ x ⇒ DOM-dep critical to compose but broken (& no fix)

Domain Oriented Masking • Two algorithms: DOM-indep and DOM-dep • DOM-indep not sufficient to compose, e.g., z=x ⊗ x ⇒ DOM-dep critical to compose but broken (& no fix) • SOTA (2018): ∃ composable masking schemes that ignore physical defaults such as glitches & hardware- oriented masking schemes that mitigate glitches but are at best probing secure ( so not provably composable )

(Refined) model and security definition 𝑞 1 Glitch-extended probes: probing any output of a combinatorial circuit allows the adversary to observe all the circuit inputs Example: 𝑞 1 gives 𝑏, 𝑐 and 𝑑

(Refined) model and security definition 𝑞 1 Glitch-extended probes: probing any output of a combinatorial circuit allows the adversary to observe all the circuit inputs Example: 𝑞 1 gives 𝑏, 𝑐 and 𝑑 𝑞 2 (SNI-related) clarification : the adversary can also probe the stable register output 𝑒 so both 𝑞 1 and 𝑞 2 appear in proofs