Low Randomness Masking and Shulfifgn: An Evaluation Using Mutual Information Kostas Papagiannopoulos kostaspap88@gmail.com kpcrypto.net Radboud University Nijmegen Digital Security Department The Netherlands 1
Overview • Masking, shuffling and the cost of RNG • New countermeasure variants that recycle randomness • Pitfalls in formal security and noise amplification 2
Introduction Masking and Shuffling Schemes Against Side-Channel Analysis 3
Introduction: Masking Schemes • One of the most popular S0 countermeasures against SCA S7 S1 • Forces the adversary to recombine shares • Performs noise amplification [1] Secret S2 S6 S S5 S3 S4 [1] Suresh Chari, Charanjit S. Jutla, Josyula R. Rao, and Pankaj Rohatgi. Towards sound approaches to counteract power-analysis attacks. 3 [2] Yuval Ishai, Amit Sahai, and David Wagner. Private circuits: Securing hardware against probing attacks
Introduction: Masking Schemes • One of the most popular S0 countermeasures against SCA S7 S1 • Forces the adversary to recombine shares • Performs noise amplification [1] Secret S2 S6 S • Computationally demanding in operations and RNG, S5 S3 𝑃(𝑜 2 ) random elements for ISW S4 multiplication with 𝑜 shares [2] [1] Suresh Chari, Charanjit S. Jutla, Josyula R. Rao, and Pankaj Rohatgi. Towards sound approaches to counteract power-analysis attacks. 3 [2] Yuval Ishai, Amit Sahai, and David Wagner. Private circuits: Securing hardware against probing attacks
Introduction: Shuffling Schemes • Widely deployed countermeasure Sbox1 Sbox2 Sbox3 Sbox4 • Permutes blocks • Performs noise amplification [3] Sbox3 Sbox1 Sbox4 Sbox2 [3] Nicolas Veyrat-Charvillon, Marcel Medwed, Stéphanie Kerckhof, and François-Xavier Standaert. Shuffling against side-channel attacks: A comprehensive study with cautionary note 6 [4] Donald E. Knuth. The Art of Computer Programming, Volume 2 (3rd Ed.): Seminumerical Algorithms
Introduction: Shuffling Schemes • Widely deployed countermeasure • Permutes blocks Sbox1 Sbox2 Sbox3 Sbox4 • Performs noise amplification [3] • Computationally demanding in RNG, approx. k ∗ ceil 𝑚𝑝 2 k random bits, for 𝑙 operations shuffled [4] Sbox3 Sbox1 Sbox4 Sbox2 [3] Nicolas Veyrat-Charvillon, Marcel Medwed, Stéphanie Kerckhof, and François-Xavier Standaert. Shuffling against side-channel attacks: A comprehensive study with cautionary note 6 [4] Donald E. Knuth. The Art of Computer Programming, Volume 2 (3rd Ed.): Seminumerical Algorithms
Introduction: RNG Overhead • The RNG constitutes a considerable performance overhead [5] Josep Balasch, Sebastian Faust, Benedikt Gierlichs, Clara Paglialonga, and François-Xavier Standaert. Consolidating inner product masking [6] Wouter de Groot, Kostas Papagiannopoulos, Antonio de La Piedra, Erik Schneider and Lejla Batina. Bitsliced masking and arm: Friends or foes? 10 [7] Benjamin Gregoire and Kostas Papagiannopoulos and Peter Schwabe and Ko Stoffelen . Vectorizing Higher-Order Masking
Introduction: RNG Overhead • The RNG constitutes a considerable performance overhead • 2 nd -order AES on AVR pseudoRNG [5] [5] Josep Balasch, Sebastian Faust, Benedikt Gierlichs, Clara Paglialonga, and François-Xavier Standaert. Consolidating inner product masking [6] Wouter de Groot, Kostas Papagiannopoulos, Antonio de La Piedra, Erik Schneider and Lejla Batina. Bitsliced masking and arm: Friends or foes? 10 [7] Benjamin Gregoire and Kostas Papagiannopoulos and Peter Schwabe and Ko Stoffelen . Vectorizing Higher-Order Masking
Introduction: RNG Overhead • The RNG constitutes a considerable performance overhead RNG • 2 nd -order AES on AVR 38% Cipher pseudoRNG [5] 62% [5] Josep Balasch, Sebastian Faust, Benedikt Gierlichs, Clara Paglialonga, and François-Xavier Standaert. Consolidating inner product masking [6] Wouter de Groot, Kostas Papagiannopoulos, Antonio de La Piedra, Erik Schneider and Lejla Batina. Bitsliced masking and arm: Friends or foes? 10 [7] Benjamin Gregoire and Kostas Papagiannopoulos and Peter Schwabe and Ko Stoffelen . Vectorizing Higher-Order Masking
Introduction: RNG Overhead • The RNG constitutes a considerable performance overhead RNG • 2 nd -order AES on AVR 38% Cipher pseudoRNG [5] 62% • 2 nd -order PRESENT on ARM Cortex-M4 trueRNG [6] [5] Josep Balasch, Sebastian Faust, Benedikt Gierlichs, Clara Paglialonga, and François-Xavier Standaert. Consolidating inner product masking [6] Wouter de Groot, Kostas Papagiannopoulos, Antonio de La Piedra, Erik Schneider and Lejla Batina. Bitsliced masking and arm: Friends or foes? 10 [7] Benjamin Gregoire and Kostas Papagiannopoulos and Peter Schwabe and Ko Stoffelen . Vectorizing Higher-Order Masking
Introduction: RNG Overhead • The RNG constitutes a considerable performance overhead RNG • 2 nd -order AES on AVR 38% Cipher pseudoRNG [5] 62% RNG 25% • 2 nd -order PRESENT on ARM Cortex-M4 Cipher 75% trueRNG [6] [5] Josep Balasch, Sebastian Faust, Benedikt Gierlichs, Clara Paglialonga, and François-Xavier Standaert. Consolidating inner product masking [6] Wouter de Groot, Kostas Papagiannopoulos, Antonio de La Piedra, Erik Schneider and Lejla Batina. Bitsliced masking and arm: Friends or foes? 10 [7] Benjamin Gregoire and Kostas Papagiannopoulos and Peter Schwabe and Ko Stoffelen . Vectorizing Higher-Order Masking
Introduction: RNG Overhead • The RNG constitutes a considerable performance overhead RNG • 2 nd -order AES on AVR 38% Cipher pseudoRNG [5] 62% RNG 25% • 2 nd -order PRESENT on ARM Cortex-M4 Cipher 75% trueRNG [6] • 4 th -order AES on ARM Cortex-A with NEON assembly /dev/urandom [7] [5] Josep Balasch, Sebastian Faust, Benedikt Gierlichs, Clara Paglialonga, and François-Xavier Standaert. Consolidating inner product masking [6] Wouter de Groot, Kostas Papagiannopoulos, Antonio de La Piedra, Erik Schneider and Lejla Batina. Bitsliced masking and arm: Friends or foes? 10 [7] Benjamin Gregoire and Kostas Papagiannopoulos and Peter Schwabe and Ko Stoffelen . Vectorizing Higher-Order Masking
Introduction: RNG Overhead • The RNG constitutes a considerable performance overhead RNG • 2 nd -order AES on AVR 38% Cipher pseudoRNG [5] 62% RNG 25% • 2 nd -order PRESENT on ARM Cortex-M4 Cipher 75% trueRNG [6] Cipher 1% • 4 th -order AES on ARM Cortex-A with NEON assembly /dev/urandom [7] RNG 99% [5] Josep Balasch, Sebastian Faust, Benedikt Gierlichs, Clara Paglialonga, and François-Xavier Standaert. Consolidating inner product masking [6] Wouter de Groot, Kostas Papagiannopoulos, Antonio de La Piedra, Erik Schneider and Lejla Batina. Bitsliced masking and arm: Friends or foes? 10 [7] Benjamin Gregoire and Kostas Papagiannopoulos and Peter Schwabe and Ko Stoffelen . Vectorizing Higher-Order Masking
Recycled Randomness Masking Reducing the RNG overhead in masking with RRM 15
RRM: Example • Assume two 2 nd -order secure, independent ISW mult. gadgets 𝑨 = 𝑦𝑧 , 𝑑 = 𝑏𝑐 𝑨 0 = 𝑦 0 𝑧 0 ⊕ 𝑥 0 ⊕ 𝑥 1 𝑨 1 = 𝑦 1 𝑧 1 ⊕ ((𝑥 0 ⊕ 𝑦 0 𝑧 1 ) ⊕ 𝑦 1 𝑧 0 ) ⊕ 𝑥 2 𝑨 2 = 𝑦 2 𝑧 2 ⊕ ((𝑥 1 ⊕ 𝑦 0 𝑧 2 ) ⊕ 𝑦 2 𝑧 0 ) ⊕ ((𝑥 2 ⊕ 𝑦 1 𝑧 2 ) ⊕ 𝑦 2 𝑧 1 ) 𝑑 0 = 𝑏 0 𝑐 0 ⊕ 𝑢 0 ⊕ 𝑢 1 𝑑 1 = 𝑏 1 𝑐 1 ⊕ ((𝑢 0 ⊕ 𝑏 0 𝑐 1 ) ⊕ 𝑏 1 𝑐 0 ) ⊕ 𝑢 2 𝑑 2 = 𝑏 2 𝑐 2 ⊕ ((𝑢 1 ⊕ 𝑏 0 𝑐 2 ) ⊕ 𝑏 2 𝑐 0 ) ⊕ ((𝑢 2 ⊕ 𝑏 1 𝑐 2 ) ⊕ 𝑏 2 𝑐 1 ) 16
RRM: Example • Recycle some random numbers from the first to the second gadget 𝑨 0 = 𝑦 0 𝑧 0 ⊕ 𝑥 0 ⊕ 𝑥 1 𝑨 1 = 𝑦 1 𝑧 1 ⊕ ((𝑥 0 ⊕ 𝑦 0 𝑧 1 ) ⊕ 𝑦 1 𝑧 0 ) ⊕ 𝑥 2 𝑨 2 = 𝑦 2 𝑧 2 ⊕ ((𝑥 1 ⊕ 𝑦 0 𝑧 2 ) ⊕ 𝑦 2 𝑧 0 ) ⊕ ((𝑥 2 ⊕ 𝑦 1 𝑧 2 ) ⊕ 𝑦 2 𝑧 1 ) 𝑑 0 = 𝑏 0 𝑐 0 ⊕ 𝑥 0 ⊕ 𝑥 1 𝑑 1 = 𝑏 1 𝑐 1 ⊕ ((𝑥 0 ⊕ 𝑏 0 𝑐 1 ) ⊕ 𝑏 1 𝑐 0 ) ⊕ 𝑢 2 𝑑 2 = 𝑏 2 𝑐 2 ⊕ ((𝑥 1 ⊕ 𝑏 0 𝑐 2 ) ⊕ 𝑏 2 𝑐 0 ) ⊕ ((𝑢 2 ⊕ 𝑏 1 𝑐 2 ) ⊕ 𝑏 2 𝑐 1 ) Reduced Randomness cost by 2 random numbers 17
RRM: Example • Formal security verification [8] : the 2-multiplication gadget is 2-NI 𝑨 0 = 𝑦 0 𝑧 0 ⊕ 𝑥 0 ⊕ 𝑥 1 𝑨 1 = 𝑦 1 𝑧 1 ⊕ ((𝑥 0 ⊕ 𝑦 0 𝑧 1 ) ⊕ 𝑦 1 𝑧 0 ) ⊕ 𝑥 2 𝑨 2 = 𝑦 2 𝑧 2 ⊕ ((𝑥 1 ⊕ 𝑦 0 𝑧 2 ) ⊕ 𝑦 2 𝑧 0 ) ⊕ ((𝑥 2 ⊕ 𝑦 1 𝑧 2 ) ⊕ 𝑦 2 𝑧 1 ) 𝑑 0 = 𝑏 0 𝑐 0 ⊕ 𝑥 0 ⊕ 𝑥 1 𝑑 1 = 𝑏 1 𝑐 1 ⊕ ((𝑥 0 ⊕ 𝑏 0 𝑐 1 ) ⊕ 𝑏 1 𝑐 0 ) ⊕ 𝑢 2 𝑑 2 = 𝑏 2 𝑐 2 ⊕ ((𝑥 1 ⊕ 𝑏 0 𝑐 2 ) ⊕ 𝑏 2 𝑐 0 ) ⊕ ((𝑢 2 ⊕ 𝑏 1 𝑐 2 ) ⊕ 𝑏 2 𝑐 1 ) [8] Jean-Sebastien Coron. Formal Verification of Side-channel Countermeasures via Elementary Circuit Transformations. 18
RRM: Example • Recycle more! 𝑨 0 = 𝑦 0 𝑧 0 ⊕ 𝑥 0 ⊕ 𝑥 1 𝑨 1 = 𝑦 1 𝑧 1 ⊕ ((𝑥 0 ⊕ 𝑦 0 𝑧 1 ) ⊕ 𝑦 1 𝑧 0 ) ⊕ 𝑥 2 𝑨 2 = 𝑦 2 𝑧 2 ⊕ ((𝑥 1 ⊕ 𝑦 0 𝑧 2 ) ⊕ 𝑦 2 𝑧 0 ) ⊕ ((𝑥 2 ⊕ 𝑦 1 𝑧 2 ) ⊕ 𝑦 2 𝑧 1 ) 𝑑 0 = 𝑏 0 𝑐 0 ⊕ 𝑥 0 ⊕ 𝑥 1 𝑑 1 = 𝑏 1 𝑐 1 ⊕ ((𝑥 0 ⊕ 𝑏 0 𝑐 1 ) ⊕ 𝑏 1 𝑐 0 ) ⊕ 𝑥 2 𝑑 2 = 𝑏 2 𝑐 2 ⊕ ((𝑥 1 ⊕ 𝑏 0 𝑐 2 ) ⊕ 𝑏 2 𝑐 0 ) ⊕ ((𝑥 2 ⊕ 𝑏 1 𝑐 2 ) ⊕ 𝑏 2 𝑐 1 ) Reduced Randomness cost by 3 random numbers 19
Recommend
More recommend
