FIDES: Lightweight Authentication Cipher with Side-Channel - PowerPoint PPT Presentation

FIDES: Lightweight Authentication Cipher with Side-Channel Resistance for Constrained Hardware Begül Bilgin, Andrey Bogdanov, Miroslav Kne ž evi ć , Florian Mendel, and Qingju Wang 1 DIAC 2013, Chicago

Side Channel Resistance 2

Side Channel Resistance The Game... 2

Side Channel Resistance The Game... ‣ Mathematically secure crypto algorithms 2

Side Channel Resistance The Game... ‣ Mathematically secure crypto algorithms ✓ AES, RSA, Keccak, OCB, … 2

Side Channel Resistance The Game... ‣ Mathematically secure crypto algorithms ✓ AES, RSA, Keccak, OCB, … ‣ Weak implementation 2

Side Channel Resistance The Game... ‣ Mathematically secure crypto algorithms ✓ AES, RSA, Keccak, OCB, … ‣ Weak implementation 2

Side Channel Resistance The Game... ‣ Mathematically secure crypto algorithms ✓ AES, RSA, Keccak, OCB, … ‣ Weak implementation Dependency between power consumption and intermediate value (depends on the key) 2

Side Channel Resistance 3

Side Channel Resistance x Change the key frequently 3

Side Channel Resistance x Change the key frequently x Equalize power consumption 3

Side Channel Resistance x Change the key frequently x Equalize power consumption ✓ Randomize power consumption 3

Side Channel Resistance x Change the key frequently x Equalize power consumption ✓ Randomize power consumption - Boolean masking 3

Side Channel Resistance inp^m 0 out^m 1 x Change the key frequently L x Equalize power consumption m 0 m 1 L ✓ Randomize power consumption - Boolean masking 3

Side Channel Resistance x Change the key frequently x Equalize power consumption ✓ Randomize power consumption - Boolean masking 3

Side Channel Resistance inp^m 0 out^m 1 x Change the key frequently S x Equalize power consumption m 0 m 1 S ✓ Randomize power consumption - Boolean masking 3

Side Channel Resistance inp^m 0 out^m 1 x Change the key frequently S x Equalize power consumption m 0 m 1 S ✓ Randomize power consumption - Boolean masking - Multiplicative masking 3

Side Channel Resistance x Change the key frequently x Equalize power consumption ✓ Randomize power consumption - Boolean masking - Multiplicative masking 3

Side Channel Resistance x Change the key frequently x Equalize power consumption ✓ Randomize power consumption - Boolean masking - Multiplicative masking Secret sharing e.g. Threshold Implementations [Nikova’11] - 3

Side Channel Resistance inp^m 0 ^m 1 out^m 2 ^m 3 x Change the key frequently S x Equalize power consumption m 0 m 2 S ✓ Randomize power consumption m 1 S m 3 - Boolean masking - Multiplicative masking Secret sharing e.g. Threshold Implementations [Nikova’11] - 3

Side Channel Resistance 4

Side Channel Resistance Have the design 4

Side Channel Resistance Need efficient impl. Have the design 4

Side Channel Resistance Need efficient impl. Need Have the secure impl. design 4

Side Channel Resistance Need efficient impl. Need Have the secure impl. design 1 st Order Multipl. Mask Boolean Mask TI 2 nd Order SW HW ?? Still efficient ?? 4

Side Channel Resistance Need efficient impl. Need Have the secure impl. design 1 st Order Multipl. Mask Boolean Mask TI 2 nd Order SW HW Still efficient 5

Design - Structure a A 1 A 2 A v C 1 C u M u M 1 16R 16R 1R 1R 1R 1R 1R 1R K || N T . . . . . . K || 0 6

Design - Structure a A 1 A 2 A v C 1 C u M u M 1 16R 16R 1R 1R 1R 1R 1R 1R K || N T . . . . . . K || 0 Similar to duplex sponge - 6

Design - Structure a A 1 A 2 A v C 1 C u M u M 1 16R 16R 1R 1R 1R 1R 1R 1R K || N T . . . . . . K || 0 Similar to duplex sponge - Rounds are not keyed - 6

Design - Structure a A 1 A 2 A v C 1 C u M u M 1 16R 16R 1R 1R 1R 1R 1R 1R K || N T . . . . . . K || 0 Similar to duplex sponge - Rounds are not keyed - Online ✓ 6

Design - Structure a A 1 A 2 A v C 1 C u M u M 1 16R 16R 1R 1R 1R 1R 1R 1R K || N T . . . . . . K || 0 Similar to duplex sponge - Rounds are not keyed - Online ✓ Single pass ✓ 6

Design - Structure a A 1 A 2 A v C 1 C u M u M 1 16R 16R 1R 1R 1R 1R 1R 1R K || N T . . . . . . K || 0 Similar to duplex sponge - b k/n/t r Rounds are not keyed - FIDES-80 160 80 10 Online ✓ FIDES-96 192 96 12 Single pass ✓ 6

Design - Structure a A 1 A 2 A v C 1 C u M u M 1 16R 16R 1R 1R 1R 1R 1R 1R K || N T . . . . . . K || 0 Similar to duplex sponge - b k/n/t r Rounds are not keyed - FIDES-80 160 80 10 Online ✓ FIDES-96 192 96 12 Single pass ✓ 7

Design - Structure a A 1 A 2 A v C 1 C u M u M 1 16R 16R 1R 1R 1R 1R 1R 1R K || N T . . . . . . K || 0 Similar to duplex sponge - b k/n/t r Rounds are not keyed - FIDES-80 160 80 10 Online ✓ FIDES-96 192 96 12 Single pass ✓ 8

Design - Structure a A 1 A 2 A v C 1 C u M u M 1 16R 16R 1R 1R 1R 1R 1R 1R K || N T . . . . . . K || 0 Similar to duplex sponge - b k/n/t r Rounds are not keyed - FIDES-80 160 80 10 Online ✓ FIDES-96 192 96 12 Single pass ✓ 9

Design - Structure 1R State SubBytes ShiftRows MixColumns ConstantAddition 10

Design - Structure 1R State SubBytes ShiftRows MixColumns ConstantAddition 11

Design - Structure 1R State 0 SubBytes 1 2 ShiftRows 7 MixColumns ConstantAddition 12

Design - Structure 1R State SubBytes ShiftRows MixColumns ConstantAddition Almost MDS branch number is 4 13

Design - Structure 1R State SubBytes ShiftRows MixColumns ConstantAddition 14

Design - S-boxes • FIDES-80: 5-bit Almost Bent (AB) - optimal resistance against differential & linear cryptanalysis - degree 2 (two), 3(one), 4(one) • FIDES-96: 6-bit Almost Perfect Nonlinear (APN) - optimal resistance against differential cryptanalysis - degree 4 15

Design - S-boxes • FIDES-80: 5-bit Almost Bent (AB) - optimal resistance against differential & linear cryptanalysis - degree 2 (two), 3(one), 4(one) • FIDES-96: 6-bit Almost Perfect Nonlinear (APN) - optimal resistance against differential cryptanalysis - degree 4 ++Low latency++ 15

Design - S-boxes • FIDES-80: 5-bit Almost Bent (AB) - optimal resistance against differential & linear cryptanalysis - degree 2 (two), 3(one), 4(one) • FIDES-96: 6-bit Almost Perfect Nonlinear (APN) - optimal resistance against differential cryptanalysis - degree 4 ++Low latency++ 15

Design - S-boxes • FIDES-80: 5-bit Almost Bent (AB) - optimal resistance against differential & linear cryptanalysis - degree 2 (two), 3(one), 4(one) • FIDES-96: 6-bit Almost Perfect Nonlinear (APN) - optimal resistance against differential cryptanalysis - degree 4 ++Low latency++ 16

Design - S-boxes 17

Design - S-boxes Affine Equivalent to AB permutation with degree 2 17

Design - S-boxes Affine Equivalent to AB permutation with degree 2 Shared S-box Unshared S-box 25000 25000 20000 20000 # of S-boxes 15000 15000 10000 10000 5000 5000 0 0 45 50 55 60 65 70 75 80 85 90 95 100 105 245 255 135 145 155 165 175 185 195 205 215 225 235 # of GE (UMC 180nm) 17

Design - S-boxes Affine Equivalent to AB permutation with degree 2 Shared S-box Unshared S-box 25000 25000 20000 20000 # of S-boxes 15000 15000 10000 10000 5000 5000 0 0 45 50 55 60 65 70 75 80 85 90 95 100 105 245 255 135 145 155 165 175 185 195 205 215 225 235 # of GE (UMC 180nm) 18

Design - S-boxes Affine Equivalent to AB permutation with degree 2 Shared S-box Unshared S-box 25000 25000 20000 20000 # of S-boxes 15000 15000 10000 10000 5000 5000 0 0 45 50 55 60 65 70 75 80 85 90 95 100 105 245 255 135 145 155 165 175 185 195 205 215 225 235 # of GE (UMC 180nm) Similar for APN 18

Security Analysis # Active Active S-box # # rnd. any diff. zero diff. 1 0 - 2 4 - 3 7 - 4 16 - 5 22 - 6 32 52 7 42 49 8 48 48 19

Security Analysis # Active Active S-box # # rnd. any diff. zero diff. • Differential & Linear Cryptanalysis 1 0 - 2 4 - 3 7 - 4 16 - 5 22 - 6 32 52 7 42 49 8 48 48 19

Security Analysis # Active Active S-box # # rnd. any diff. zero diff. • Differential & Linear Cryptanalysis 1 0 - 16 rounds: 2 -4x48x2 = 2 -384 2 4 - 3 7 - 4 16 - 5 22 - 6 32 52 7 42 49 8 48 48 19

Security Analysis # Active Active S-box # # rnd. any diff. zero diff. • Differential & Linear Cryptanalysis 1 0 - 16 rounds: 2 -4x48x2 = 2 -384 2 4 - • Collision Trails 3 7 - 4 16 - 5 22 - 6 32 52 7 42 49 8 48 48 19

Security Analysis # Active Active S-box # # rnd. any diff. zero diff. • Differential & Linear Cryptanalysis 1 0 - 16 rounds: 2 -4x48x2 = 2 -384 2 4 - • Collision Trails 3 7 - 16 rounds: 2 -4x(48+48) = 2 -384 4 16 - 5 22 - 6 32 52 7 42 49 8 48 48 19