Fault Sensitivity Analysis Yang Li, Kazuo Sakiyama, Shigeto Gomisawa, Kazuo Ohta The University of Electro-Communications liyang@ice.uec.ac.jp Toshinori Fukunaga, Junko Takahashi NTT Information Sharing Platform Laboratories 19 Aug 2010 CHES 2010 @ Santa Barbara 1
Outline Differential Fault Analysis and its countermeasure Power-based Side-Channel Attacks DPA, CPA A New Fault-based Attack Fault Sensitivity Analysis (FSA) Some Case Studies on SASEBO-R FSA attack on PPRM1-AES FSA attack on WDDL-AES FSA attack on Satoh’s AES (recent result) Conclusion 19 Aug 2010 CHES 2010 @ Santa Barbara 2
Differential Fault Analysis (DFA) Basic idea Make a differential path by fault injection Get correct outputs and faulty outputs Verify the differential path for each key candidate General DFA attack requirements Specific transient fault Pairs of correct output and faulty output for the same input General DFA countermeasures Inherent resistance, prevent specific transient fault e.g. WDDL [1] Redundant calculation for error detection e.g. Satoh’s AES [2] 19 Aug 2010 CHES 2010 @ Santa Barbara 3
Outline Differential Fault Analysis and its countermeasure Power-based Side-Channel Attacks DPA, CPA A New Fault-based Attack Fault Sensitivity Analysis (FSA) Some Case Studies on SASEBO-R FSA attack on PPRM1-AES FSA attack on WDDL-AES FSA attack on Satoh’s AES (recent result) Conclusion 19 Aug 2010 CHES 2010 @ Santa Barbara 4
Power-based Side-Channel Attacks Basic idea Power consumption depends on sensitive-data that is calculable with public variables and key guess General attack procedures Have a key guess Calculate sensitive-data Check the calculated data with recorded power consumption Correct key guess matches the power consumption best! Well-kown attacks Correlation Power Analysis (CPA) Differential Power Analysis (DPA) 19 Aug 2010 CHES 2010 @ Santa Barbara 5
Outline Differential Fault Analysis and its countermeasure Power-based Side-Channel Attacks DPA, CPA A New Fault-based Attack Fault Sensitivity Analysis (FSA) Some Case Studies on SASEBO-R FSA attack on PPRM1-AES FSA attack on WDDL-AES FSA attack on Satoh’s AES (recent result) Conclusion 19 Aug 2010 CHES 2010 @ Santa Barbara 6
General Introduction to FSA Fault Sensitivity Analysis (FSA) Fault-based A new side channel leakage Sensitive-data dependency for fault sensitivity Similar Attack procedures to power-based attacks Bypass some DFA countermeasures What is Fault Sensitivity? Sensitivity to the fault injection E.g. Minimal clock frequency with correct output Has data dependency Can be used for key retrieval 19 Aug 2010 CHES 2010 @ Santa Barbara 7
Review Fault Injection (The idea of FSA) Good Environment Input Output C Device (Key) C Threshold Change ( Side-channel Leakage) Fault Intensity Fault C’ Bad Environment Input Faulty Output C’ Device (Key) Works for different types of fault injection: overclock, low-power, laser 19 Aug 2010 CHES 2010 @ Santa Barbara 8
Fault Sensitivity under an over-clock n n D in D out F/F Logic CLK Sensitive Data clk D in Critical Delay Timing illegal_clk1 illegal_clk2 Threshold as Fault Sensitivity 19 Aug 2010 CHES 2010 @ Santa Barbara 9
Signal delays for AND gate AND Gate (T X : delay time for signal X) Assume T A < T B When signal A=0, T C = T A + T AND (small) When signal A=1, T C = T B + T AND (large) T AND : Delay timing of AND gate B T A T B A Data Dependency !! T AND 0 input, small delay. C = A • B 19 Aug 2010 CHES 2010 @ Santa Barbara 10
Signal delays for XOR gate XOR Gate (T X : delay time for signal X) Assume T A < T B When signal A=0, T C = T B + T XOR When signal A=1, T C = T B + T XOR T XOR : Delay timing of XOR gate B T A T B A T XOR No Data Dependency !! C = A B 19 Aug 2010 CHES 2010 @ Santa Barbara 11
How about an FSA Attack? FSA For Power-based attacks: Sensitive Data Attackers Key Fault Power Consumption Sensitivity 19 Aug 2010 CHES 2010 @ Santa Barbara 12
FSA Attack Procedures Collect pairs of public variables and fault sensitivity Retrieval the key by the data analysis Have a key guess Calculate sensitive-data Check the calculated data with recorded fault sensitivity Directly apply the techniques in power analysis 19 Aug 2010 CHES 2010 @ Santa Barbara 13
Case studies of FSA attacks FSA attack against PPRM1-AES FSA attack against WDDL-AES FSA attack against Satoh’s AES (recent work) 19 Aug 2010 CHES 2010 @ Santa Barbara 14
CASE 1: FSA attacks against PPRM1-AES PPRM1-AES: a low power AES implementation with “PPRM1 - Sbox” [4] PPRM1 S-box PPRM1 S-box AND gate: 0 input, small delay. AND array … … AND array: XOR array More 0 inputs, smaller delay! 19 Aug 2010 CHES 2010 @ Santa Barbara 15
As a result, for PPRM1 S-box More 0 inputs , Smaller delay!! Smaller hamming weight Less sensitive to overclock Fault sensitivity Typical Side Channel Leakage Exploitable by CPA-like analysis Input hamming weight 19 Aug 2010 CHES 2010 @ Santa Barbara 16
Attack results against last round of PPRM1-AES Correlation Key guess All of the 16 key bytes can be identified clearly. 19 Aug 2010 CHES 2010 @ Santa Barbara 17
How much fault sensitivity data is needed? Less than 50 plaintexts (FS data) to obtain a 128-bit key. 19 Aug 2010 CHES 2010 @ Santa Barbara 18
How many times of fault injection? Which point is the fault sensitivity? Success rate of fault injection 1 0 Fre. of Clock In our experiment C’ C Fre. of Clock Worst case: 120 times 19 Aug 2010 CHES 2010 @ Santa Barbara 19
CASE 2: FSA attacks against WDDL-AES Naturally immune to DFA attacks based on the setup-time violation. [2] Dual-Rail Precharge Logic Complementary wires: (ture,false) “transient” fault will erase the secret information at the output. WDDL is not perfectly immune to FSA attacks based on setup-time violation. 19 Aug 2010 CHES 2010 @ Santa Barbara 20
WDDL’s Vulnerability against FSA (1/2) First of all, no clear correlation between input data and fault sensitivity. All types of gates are mixed up However, we observed a data dependence at the output. Imbalance of complementary wires leads to imbalance of critical path delays. 19 Aug 2010 CHES 2010 @ Santa Barbara 21
WDDL’s Vulnerability against FSA (2/2) Assume Precharge value = 0 Delay_ture > Delay_false then (1,0) (0,0) happens easier than (0,1) (0,0). 1 is more sensitive than 0 true false Vulnerability! WDDL Logic Exploitable by DPA-like analysis Difficult to make perfect matching wires. 19 Aug 2010 CHES 2010 @ Santa Barbara 22
Attack result against WDDL-AES with 1200 plaintexts Correlation 3 of 16 key bytes can be identified. Key guess 19 Aug 2010 CHES 2010 @ Santa Barbara 23
CASE 3: FSA attacks against Satoh’s AES Satoh’s AES (CHES2008) High performance AES with Error-detection Scheme Successful FSA attack Self-Template FSA To be continued in the rump section. 19 Aug 2010 CHES 2010 @ Santa Barbara 24
Outline Differential Fault Analysis and its countermeasure Power-based Side-Channel Attacks DPA, CPA A New Fault-based Attack Fault Sensitivity Analysis (FSA) Some Case Studies on SASEBO-R FSA attack on PPRM1-AES FSA attack on WDDL-AES FSA attack on Satoh’s AES (recent result) Conclusion 19 Aug 2010 CHES 2010 @ Santa Barbara 25
Conclusion A new side channel leakage: fault sensitivity FSA has a potential to bypass some fault attack countermeasures. Future work: FSA countermeasures (mask technique?) Stronger FSA attacks Try other types of FSA under other fault injection methods 19 Aug 2010 CHES 2010 @ Santa Barbara 26
References [1]G. Piret and J.-J. Quisquater. A Differential Fault Attack Technique against SPN Structures, with Application to the AES and KHAZAD. CHES 2003 [2] S. Guilley T. Graba N. Selmane, S. Bhasin and J.-L. Danger. WDDL is Protected Against Setup Time Violation Attacks. FDTC 2009 [3] Akashi Satoh, Takeshi Sugawara, Naofumi Homma, Takafumi Aoki: High-Performance Concurrent Error Detection Scheme for AES Hardware. CHES 2008 [4] S. Morioka and A. Satoh. An Optimized S-Box Circuit Architecture for Low Power AES Design. CHES2002 19 Aug 2010 CHES 2010 @ Santa Barbara 27
Thank you for your attentions! Questions? 19 Aug 2010 CHES 2010 @ Santa Barbara 28
Recommend
More recommend
