Flip a bit, grab a key: Symbolic execution edition Jasper van - PowerPoint PPT Presentation

Flip a bit, grab a key: Symbolic execution edition Jasper van Woudenberg @jzvw CTO Riscure North America public

Concrete execution r1 = 0xBE; r2 = 0x08 mov r1,r2 add r1,0x10 r1 = 0x18; r2 = 0x08 public 2

Symbolic execution r1 = 0xBE; r2 = 0x?? mov r1,r2 add r1,0x10 r1 = r2 + 0x10; r2 = 0x?? Program Equations public 3

Symbolic execution r1 = 0xBE; r2 = 0x?? mov r1,r2 add r1,0x10 beq r1,0x20,A: mov r3,0x00 b B: A: mov r3,0x01 B: r2==0x10: r1 = r2 + 0x10; r2 = 0x??; r3=0x00 r2!=0x10: r1 = r2 + 0x10; r2 = 0x??; r3=0x01 public Program Equations Solver 4

Fault injection r1 = 0xBE; r2 = 0x08 mov r1,r2 add r1,0x10 r1 = 0xCE; r2 = 0x08 Cause a(n exploitable) corruption on a device public 5

Fault injection (hardwear) Cause a(n exploitable) corruption on a device public 6

Fault injection (softwear) public 7

Differential Fault Analysis (DES) When R15 faulted, only a few K16 will match both outputs public 8

Inside F function… Track fault to sbox; calculate faulted sbox ⊕ normal sbox public 9

Fault match K 0 1 2 3 4 5 6 7 8 9 A B C D E F S B 7 E 0 1 4 7 A 6 1 0 D 8 B D 6 S’ 6 1 0 D 8 B D 6 B 7 E 0 1 4 7 A  D 6 E D 9 F A C D 6 E D 9 F A C K 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F S 4 9 3 E 2 F C 5 9 2 5 8 F C A 3 S’ 9 2 5 8 F C A 3 4 9 3 E 2 F C 5  D B 6 6 D 3 6 6 D B 6 6 D 3 6 6 K 20 21 22 23 24 25 26 27 28 29 2A 2B 2C 2D 2E 2F S 6 0 1 D D 3 E 4 0 E B 7 3 5 8 B S’ 0 E B 7 3 5 8 B 6 0 1 D D 3 E 4  6 E A A E 6 6 F 6 E A A E 6 6 F K 30 31 32 33 34 35 36 37 38 39 3A 3B 3C 3D 3E 3F S A C F 1 4 A 2 F 7 9 C 2 9 6 5 8 S’ 7 9 C 2 9 6 5 8 A C F 1 4 A 2 F  D 5 3 3 D C 7 7 D 5 3 3 D C 7 7

DFA on AES math (1) • Fault is injected in A E I M Substitute penultimate round B F J N • State before is: Fault C G K O ShiftRow D H L P • Hit byte ‘A’ X E I M MixColumn 9 th round B F J N • State becomes: C G K O 10 th round AddKey D H L P • Apply MixColumn, and get Substitute 2X  3B  C  D 2E  3F  G  H 2I  3J  K  L 2M  3N  O  P 2B  3C  D  X 2F  3G  H  E 2J  3K  L  I 2N  3O  P  M ShiftRow 2C  3D  X  B 2G  3H  E  F 2K  3L  I  J 2O  3P  M  N 2D  3X  B  C 2H  3E  F  G 2L  3I  J  K 2P  3M  N  O AddKey Output

DFA on AES math (2) • Apply AddKey, get for 1 st column Substitute 2X  3B  C  D  K 10,0 2B  3C  D  X  K 10,1 Fault ShiftRow 2C  3D  X  B  K 10,2 2D  3X  B  C  K 10,3 • Apply Substitute and get MixColumn 9 th round S(2X  3B  C  D  K 10,0 ) 10 th round S(2B  3C  D  X  K 10,1 ) AddKey S(2C  3D  X  B  K 10,2 ) S(2D  3X  B  C  K 10,3 ) Substitute • ShiftRow only moves cell position • Apply final AddKey, and get ShiftRow S(2X  3B  C  D  K 10,0 )  K 11,0 AddKey S(2B  3C  D  X  K 10,1 )  K 11,13 S(2C  3D  X  B  K 10,2 )  K 11,10 S(2D  3X  B  C  K 10,3 )  K 11,7 Output

DFA on AES math (3) S(2A ⊕ 3B ⊕ C ⊕ D ⊕ K 10,0 ) ⊕ K 11,0 = O 0 Normal AES S(2X ⊕ 3B ⊕ C ⊕ D ⊕ K 10,0 ) ⊕ K 11,0 = O’ 0 Faulted AES S(Y 0 ) ⊕ S(2Z ⊕ Y 0 ) = O 0 ⊕ O’ 0 Solve for Z, K Manual Rewrite to solve Faulted cipher equations for key

The insight Symbolic execution Program Equations Solver Differential fault analysis Manual Rewrite to solve Faulted cipher equations for key

The insight Use SE for DFA Faulted cipher Equations Solver

First experiments Symbolic state, fault, key ShiftRow Equations: MixColumn • pAES(state,key)=output_0 9 th round … 10 th round AddKey • pAES(state ⊕ fault_n,key)=output_n Substitute Solve for key! ShiftRow AddKey Output

FAIL… out=Sbox[in] If in==0 then 0x63, else if … else if in==0xff then 0x16

Non-bitsliced crypto 1 0 1 0 ⊕ 0 1 0 0 = X

Bitsliced crypto (slow) 1 ⊕ 0 = X0 0 ⊕ 1 = X1 1 ⊕ 0 = X2 0 ⊕ 0 = X3

Bitsliced crypto (parallel) 1 0 1 0 0 1 0 1 ⊕ 0 1 1 0 1 0 0 1 = X0 0 1 0 0 1 1 0 0 ⊕ 1 1 0 0 1 1 0 1 = X1 1 1 1 1 0 1 1 0 ⊕ 0 1 1 0 0 1 1 0 = X2 0 1 1 0 1 0 1 0 ⊕ 0 1 0 0 0 1 1 1 = X3

LUT based AES Sbox out=Sbox[in]

Bitsliced AES Sbox T1 = U[7] ^ U[4]; T2 = U[7] ^ U[2]; T3 = U[7] ^ U[1]; T4 = U[4] ^ U[2]; T5 = U[3] ^ U[1]; T6 = T1 ^ T5; T7 = U[6] ^ U[5]; T8 = U[0] ^ T6; T9 = U[0] ^ T7; T10 = T6 ^ T7; T11 = U[6] ^ U[2]; T12 = U[5] ^ U[2]; T13 = T3 ^ T4; T14 = T6 ^ T11; T15 = T5 ^ T11; T16 = T5 ^ T12; T17 = T9 ^ T16; T18 = U[4] ^ U[0]; T19 = T7 ^ T18; T20 = T1 ^ T19; T21 = U[1] ^ U[0]; T22 = T7 ^ T21; T23 = T2 ^ T22; T24 = T2 ^ T10; T25 = T20 ^ T17; T26 = T3 ^ T16; T27 = T1 ^ T12; M1 = T13 & T6; M2 = T23 & T8; M3 = T14 ^ M1; M4 = T19 & U[0]; M5 = M4 ^ M1; M6 = T3 & T16; M7 = T22 & T9; M8 = T26 ^ M6; M9 = T20 & T17; M10 = M9 ^ M6; M11 = T1 & T15; M12 = T4 & T27; M13 = M12 ^ M11; M14 = T2 & T10; M15 = M14 ^ M11; M16 = M3 ^ M2; M17 = M5 ^ T24; M18 = M8 ^ M7; M19 = M10 ^ M15; M20 = M16 ^ M13; M21 = M17 ^ M15; M22 = M18 ^ M13; M23 = M19 ^ T25; M24 = M22 ^ M23; M25 = M22 & M20; M26 = M21 ^ M25; M27 = M20 ^ M21; M28 = M23 ^ M25; M29 = M28 & M27; M30 = M26 & M24; M31 = M20 & M23; M32 = M27 & M31; M33 = M27 ^ M25; M34 = M21 & M22; M35 = M24 & M34; M36 = M24 ^ M25; M37 = M21 ^ M29; M38 = M32 ^ M33; M39 = M23 ^ M30; M40 = M35 ^ M36; M41 = M38 ^ M40; M42 = M37 ^ M39; M43 = M37 ^ M38; M44 = M39 ^ M40; M45 = M42 ^ M41; M46 = M44 & T6; M47 = M40 & T8; M48 = M39 & U[0]; M49 = M43 & T16; M50 = M38 & T9; M51 = M37 & T17; M52 = M42 & T15; M53 = M45 & T27; M54 = M41 & T10; M55 = M44 & T13; M56 = M40 & T23; M57 = M39 & T19; M58 = M43 & T3; M59 = M38 & T22; M60 = M37 & T20; M61 = M42 & T1; M62 = M45 & T4; M63 = M41 & T2; L0 = M61 ^ M62; L1 = M50 ^ M56; L2 = M46 ^ M48; L3 = M47 ^ M55; L4 = M54 ^ M58; L5 = M49 ^ M61; L6 = M62 ^ L5; L7 = M46 ^ L3; L8 = M51 ^ M59; L9 = M52 ^ M53; L10 = M53 ^ L4; L11 = M60 ^ L2; L12 = M48 ^ M51; L13 = M50 ^ L0; L14 = M52 ^ M61; L15 = M55 ^ L1; L16 = M56 ^ L0; L17 = M57 ^ L1; L18 = M58 ^ L8; L19 = M63 ^ L4; L20 = L0 ^ L1; L21 = L1 ^ L7; L22 = L3 ^ L12; L23 = L18 ^ L2; L24 = L15 ^ L9; L25 = L6 ^ L10; L26 = L7 ^ L9; L27 = L8 ^ L10; L28 = L11 ^ L14; L29 = L11 ^ L17; S[7] = L6 ^ L24; S[6] = ~(L16 ^ L26); S[5] = ~(L19 ^ L28); S[4] = L6 ^ L21; S[3] = L20 ^ L22; S[2] = L25 ^ L29; S[1] = ~(L13 ^ L27); S[0] = ~(L6 ^ L23);