Introduction to Power Analysis Benedikt Gierlichs Katholieke - PDF document

Introduction to Power Analysis Benedikt Gierlichs Katholieke Universiteit Leuven – COSIC benedikt.gierlichs@esat.kuleuven.be ECRYPT II Summer School Design and Security of Cryptographic Algorithms and Devices Albena, Bulgaria, 31 May 2011 Agenda • Measuring power consumption • Power analysis (exploration of power traces) • Power analysis attacks (revealing secrets) • Differential power analysis attacks: overview • Practical problems • Summary Albena, 31.05.2011 ECRYPT II Summer School - Benedikt Gierlichs 2 Benedikt Gierlichs, K.U.Leuven - COSIC

Measuring power consumption • Not average power over time, not peak power • Instantaneous power over time – Trace or curve, many samples Time • Typical setup: – Target device – Clock and power supply Crypto – Measurement circuit – Digital oscilloscope – PC to control it all and to store the curves Albena, 31.05.2011 ECRYPT II Summer School - Benedikt Gierlichs 3 Measuring power consumption (2) • Logic: constant supply voltage, supply current varies • Predominant technology: CMOS – Low static power consumption – Relatively high dynamic power consumption – Power consumption depends on input • CMOS inverter: Input Output Current 0-1 0 � 0 1 � 1 Low transition 0 � 1 1 � 0 Discharge 1 � 0 0 � 1 Charge 1 � 1 0 � 0 Low Albena, 31.05.2011 ECRYPT II Summer School - Benedikt Gierlichs 4 Benedikt Gierlichs, K.U.Leuven - COSIC

Measuring power consumption (3) • Oscilloscope can only measure voltage i – Generate voltage signal, proportional to current U R • Measure in VDD or GND line – Resistor (Ohm's law: U = R x i), measure U over resistor – Current probe: current � field � voltage – Dedicated measurement circuits [Tektronix] • Measure 'global' E or H field of the device – Field intensity proportional to power consumption – Field orientation depends on current direction [Rohde&Schwarz] Albena, 31.05.2011 ECRYPT II Summer School - Benedikt Gierlichs 5 Power analysis • What can we see looking at a curve? • Information in: – Repetitive patterns: typically coarse, structure of algorithm and implementation (e.g. loops) – Time: what happens when, program flow – Amplitude: what happens at a given moment in time, data flow • the same operation, executed with different operand values, consumes more or less power • Examples: trace inspection Albena, 31.05.2011 ECRYPT II Summer School - Benedikt Gierlichs 6 Benedikt Gierlichs, K.U.Leuven - COSIC

Power analysis (2) Quantized voltage Time • Unprotected software implementation of AES-128 on 8-bit µC – Ten rounds, last round shorter, without MixColumns Albena, 31.05.2011 ECRYPT II Summer School - Benedikt Gierlichs 7 Power analysis (3) Quantized voltage Time • Unprotected software implementation of AES-128 on 8-bit µC – Two rounds, four AES building blocks look different Albena, 31.05.2011 ECRYPT II Summer School - Benedikt Gierlichs 8 Benedikt Gierlichs, K.U.Leuven - COSIC

Power analysis (4) Quantized voltage Time • Few clock cycles on 8-bit µC – Capacitive charge and discharge effect visible in every clock cycle – Loading and unloading capacitors in the circuit • wires, input/output capacitances, parasitic capacitances, etc. – Amplitude depends on operation and operand value(s) Albena, 31.05.2011 ECRYPT II Summer School - Benedikt Gierlichs 9 Power analysis (5) • RSA signature generation with CRT Quantized voltage Time Albena, 31.05.2011 ECRYPT II Summer School - Benedikt Gierlichs 10 Benedikt Gierlichs, K.U.Leuven - COSIC

From power analysis to power analysis attacks • If sequence of patterns, timing or amplitude depends on secret values, power analysis attacks can possibly reveal the secrets [JO05] • Taxonomy: attacks categorized according to approach, requirements, adversarial power, etc. • Categories and criteria not 100% clear, definitions vary, transitions are smooth Albena, 31.05.2011 ECRYPT II Summer School - Benedikt Gierlichs 11 Power analysis attacks [KJJ99] • Simple power analysis (SPA) attacks • Internal collision attacks • Differential power analysis (DPA) attacks • Orthogonal: ad-hoc (non-profiled) versus profiled – Non-profiled: little prior knowledge about how the device leaks, relies on assumptions – Profiled: more or less precise profiling of the leakage behaviour, typically training of a classifier (curve � key(-related information)) Albena, 31.05.2011 ECRYPT II Summer School - Benedikt Gierlichs 12 Benedikt Gierlichs, K.U.Leuven - COSIC

Simple power analysis attacks • Anything but simple (except in examples ☺ ) • Visual inspection of few traces, worst/best case: single shot • Often exploitation of direct key dependencies, input and output data need not be known (but they are useful for verification) • Require: expertise, experience, detailed knowledge about target device and implementation • Examples: patterns, amplitude, timing Albena, 31.05.2011 ECRYPT II Summer School - Benedikt Gierlichs 13 Simple power analysis attacks (2) • Patterns (many-cycle sequences) show, e.g.: – Symmetric crypto algorithms: • Number of rounds (resp. key length), loops • Memory accesses (sometimes higher power consumption) RSA decryption, M = C d mod N – Asymmetric crypto algorithms: with d =d n-1 d n-2 ...d 0 • Key (if badly implemented, e.g. RSA / ECC) • Key length x = C for j = n-2 to 0 • Implementation details (e.g. RSA with CRT) x = x² mod N conditional if d j == 1 then operation x = xC mod N • Search for repetitive patterns end if end for return M = x Albena, 31.05.2011 ECRYPT II Summer School - Benedikt Gierlichs 14 Benedikt Gierlichs, K.U.Leuven - COSIC

Simple power analysis attacks (3) • Example: RSA exponentiation M = C d mod N • Crypto coprocessor optimized for squaring [courtesy: C. Clavier] Albena, 31.05.2011 ECRYPT II Summer School - Benedikt Gierlichs 15 Simple power analysis attacks (4) • Amplitude in a cycle can show: – Exact operand values (extreme case) – Often: Hamming weight or Hamming distance of operand(s) • Can greatly reduce key space – Operation being executed (software, microcontroller) • Reverse engineering of implementation details • Reverse engineering of e.g. proprietary algorithms (SCARE attacks) • Typically requires a classifier, device profiling Albena, 31.05.2011 ECRYPT II Summer School - Benedikt Gierlichs 16 Benedikt Gierlichs, K.U.Leuven - COSIC

Simple power analysis attacks (5) • Example: a MOV instruction with different operand values • Power consumption varies with Hamming weight of operand Quantized voltage • Suppose we have a 'dictionary' that translates power Time consumption values into Hamming weights • Example: SPA attack on the AES key schedule [M02] – Extract HWs of round keys, generate list of suitable round keys – Requires 1 plaintext/ciphertext pair to check remaining candidate keys Albena, 31.05.2011 ECRYPT II Summer School - Benedikt Gierlichs 17 Simple power analysis attacks (6) • Timing, e.g. when an operation is executed, can show: – Data-dependent branches in software implementations – If branch condition does not only depend on key but on intermediate result, one also needs to know input (output) • Example: a bad implementation of AES MixColumns Albena, 31.05.2011 ECRYPT II Summer School - Benedikt Gierlichs 18 Benedikt Gierlichs, K.U.Leuven - COSIC

SPA on a bad implementation of AES MixColumns • Per output byte a couple of XORs and multiplication by 2 [DR98] – Multiplication is in Rijndael's Galois field – Modular reduction necessary • A naive implementation on 8-bit processor: compute {02}a: – Multiply by 2 (e.g. left shift) – Conditionally (e.g. is carry set?) perform the reduction (XOR {1B}) • Execution time depends on MSB of a Albena, 31.05.2011 ECRYPT II Summer School - Benedikt Gierlichs 19 SPA on a bad implementation of AES MixColumns (2) • a = SubBytes() of XOR of some plaintext byte i and key byte j • Compute 256x256 table T – T[i][j] = 1 if MSB of SubBytes(i XOR j) equals 1, else T[i][j] = 0 • Encrypt a few random plaintexts and determine for each of them if {02}a takes more (1) or less (0) time • Compare values with table T to identify column j and thus j • Repeat for b, c and d, then target next MixColumns() – Attack has to be performed in the correct 'temporal' order' to take previously introduced delays into account – Alternative: chosen plaintexts with all but one byte fixed compare: [KQ99] Albena, 31.05.2011 ECRYPT II Summer School - Benedikt Gierlichs 20 Benedikt Gierlichs, K.U.Leuven - COSIC