Introduction Attacks Counter-Measures New Applications of DPA Conclusions & Perspectives On the Power of Power Analyses Sylvain GUILLEY, Laurent SAUVAGE, Florent FLAMENT, Maxime NASSAR, Nidhal SELMANE, Jean-Luc DANGER, Philippe HOOGVORST, Tarik GRABA, Yves MATHIEU & Renaud PACALET < sylvain.guilley@TELECOM-ParisTech.fr > Institut TELECOM / TELECOM-ParisTech CNRS – LTCI (UMR 5141) SECURE ALI (ENSTA) and SALSA (LIP6/INRIA) seminar Friday March 6th, 2009, 11:00–12:00, LIP6, room 847. Sylvain GUILLEY < sylvain.guilley@TELECOM-ParisTech.fr > On the Power of Power Analyses SECURE 1
Introduction Attacks Counter-Measures New Applications of DPA Conclusions & Perspectives Presentation Outline 1 Introduction 2 Attacks DPA Oracles Study of the Power Leakage on ASICs & FPGAs 3 Counter-Measures Information Hidding Information Masking Encrypted Leakage 4 New Applications of DPA On-line Test of PCB or ASICs SCA for Reverse-Engineering: SCARE 5 Conclusions & Perspectives The DPA Contest EveSoC: an eavesdropping SoC Sylvain GUILLEY < sylvain.guilley@TELECOM-ParisTech.fr > On the Power of Power Analyses SECURE 2
Introduction Attacks Counter-Measures New Applications of DPA Conclusions & Perspectives Trusted Objects Security Market Segmentation Large markets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . lo-end devices RFID tags, smart dust SIM, Pay-TV, Bank (EMV), national-ID, E-Passport, healthcare, public transportation TPM, DRM and other ad hoc digital media usage limitation techniques Access control, login, biometry Small markets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . hi-end devices VPN, encrypting USB dongles, secured PCs Government and military PDA, firewalls, IDS State cryptography for embassies and warfare commandment Sylvain GUILLEY < sylvain.guilley@TELECOM-ParisTech.fr > On the Power of Power Analyses SECURE 3
Introduction Attacks Counter-Measures New Applications of DPA Conclusions & Perspectives Market Demand Available Products versus Large markets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . lo-end devices Application Specific Integrated Circuits = ASIC s. Small markets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . hi-end devices Field Programmable Gates Array = FPGA s. Current trend for more FPGA s Low-power models. e.g. ACTEL Igloo Computing-intensive models. e.g. ATMEL AT40K Embedded FPGAs are also an envisionned products addressing the “performance” versus “flexibility” trade-off. Sylvain GUILLEY < sylvain.guilley@TELECOM-ParisTech.fr > On the Power of Power Analyses SECURE 4
Introduction Attacks Counter-Measures New Applications of DPA Conclusions & Perspectives “Trusted Computing” Context: Side-Channel Attacks The Problematic Cryptographic algorithms have traditionally been studied to withstand theoretical attacks; However, when these algorithms are implemented on embedded devices such as smartcards, many other specific attacks become possible (like SCA = Side-Channel Attacks ). EMA SPA, DPA, CPA, templates . . . TA Attacked circuit time Sylvain GUILLEY < sylvain.guilley@TELECOM-ParisTech.fr > On the Power of Power Analyses SECURE 5
Introduction Attacks Counter-Measures New Applications of DPA Conclusions & Perspectives “Trusted Computing” Context: Fault Attacks The Problematic Faulty results allow an attacker to gain information about the secrets; The rationale is that the knowledge of both c = AES( k , m ) and c * = AES * ( k , m ) makes it possible to discard some values of k when the error (identified by “ * ”) occurs preferencially in one of the latest rounds. Typology of fault errors Non-invasive : power or clock perburbation [10,6] Semi-invasive : depackaging required ⇒ laser attacks possible Invasive : complete reverse-engineering possible Sylvain GUILLEY < sylvain.guilley@TELECOM-ParisTech.fr > On the Power of Power Analyses SECURE 6
Introduction Attacks DPA Oracles Counter-Measures Study of the Power Leakage on ASICs & FPGAs New Applications of DPA Conclusions & Perspectives Presentation Outline 1 Introduction 2 Attacks DPA Oracles Study of the Power Leakage on ASICs & FPGAs 3 Counter-Measures Information Hidding Information Masking Encrypted Leakage 4 New Applications of DPA On-line Test of PCB or ASICs SCA for Reverse-Engineering: SCARE 5 Conclusions & Perspectives The DPA Contest EveSoC: an eavesdropping SoC Sylvain GUILLEY < sylvain.guilley@TELECOM-ParisTech.fr > On the Power of Power Analyses SECURE 7
Introduction Attacks DPA Oracles Counter-Measures Study of the Power Leakage on ASICs & FPGAs New Applications of DPA Conclusions & Perspectives Power & Electro-Magnetic Traces Analysis CMOS gate dissipation model conducted dissipation ⇒ power side-channel radiated dissipation ⇒ electro-magnetic side-channel no change ⇒ no dissipation change ⇒ dissipation Hence the law: dissipation = f (activity). CMOS circuits dissipation model ξ ↑ i i ( t − 1) · i ( t ) + ξ ↓ Power = Σ i ∈ nets i i ( t − 1) · i ( t ) Referred to as the Hamming Distance model, since ξ ↑ i ≈ ξ ↓ i . Sylvain GUILLEY < sylvain.guilley@TELECOM-ParisTech.fr > On the Power of Power Analyses SECURE 8
Sample Encryptions With Hamming Distance Classes [1/3] 100 Hamming distance 24 Hamming distance 28 Hamming distance 32 80 Hamming distance 36 Hamming distance 40 60 Average trace [mV] 40 20 0 -20 -40 0 5000 10000 15000 20000 Time
Sample Encryptions With Hamming Distance Classes [2/3] 8 Hamming distance 24 Hamming distance 28 6 Hamming distance 32 Hamming distance 36 Hamming distance 40 4 Average trace [mV] 2 0 -2 -4 -6 -8 0 5000 10000 15000 20000 Time
Sample Encryptions With Hamming Distance Classes [3/3] 8 Hamming distance 24 Hamming distance 28 6 Hamming distance 32 Hamming distance 36 Hamming distance 40 4 Average trace [mV] 2 0 -2 -4 -6 -8 14000 14500 15000 15500 16000 16500 Time
DPA diff , DPA cov and CPA Oracles Amongst the many oracles that have been proposed, we focus on three of them, noted: 1 DPA diff : Differential Power Analysis (difference of means), 2 DPA cov : Differential Power Analysis (covariance) and 3 CPA: Correlation Power Analysis, defined in equations (1), (2) and (3).
DPA diff The idea behind the DPA diff is to exhibit an asymptotic difference between the behaviors. The “difference of means” criterion introduced by Paul Kocher is: = 1 T i − 1 DPA diff . � � T i , (1) m 0 m 1 i / D i =0 i / D i =1 where m 0 and m 1 denote the number of traces for each decision. More specifically, m 0 . = # { i ∈ [0 , m [ / D i = 0 } and, symmetrically, m 1 . = � m − 1 i =0 D i , with the following complementation property m 0 + m 1 = m .
DPA cov A seemingly different approach consists in computing a covariance between the m traces and their associated decision functions. The DPA covariance estimator is: = 1 T i × D i − 1 T i × 1 DPA cov . � � � D i . (2) m m m i i i It extracts the contribution of D i : only the net i is selected out of the whole netlist j [5].
DPA diff versus DPA cov The two definitions of the DPA actually coincide, as far as the decision function is balanced: Proof. Assuming that m 0 = m 1 = m / 2, � � 1 D i − 1 � DPA cov = T i × m 2 i Covariance with 1 � T i × ( − 1) D i the character = 2 m function of D . i 1 = 4 DPA diff .
Mono-bit versus Multi-bit DPA Vectorial Decision Function D D ∈ { 0 , 1 } n Mono-bit: (-1, +1) 4 bits: (-2, -1, 0, +1, +2) Dominant practice: assume 2500 # traces to break the partial key bits are indiscernible Hence partition traces 2000 according to | D | ∈ [0 , n ] 1500 Several philosophies: Thomas S. 1 1000 MESSERGES [9]: prune all but | D | = 0 or n , and 500 continue ` a la mono-bit ´ Eric BRIER [2]: weight 2 the partitions with | D | 0 1 2 3 4 5 6 7 8 Thanh-Ha LE [8,7]: 3 DES S-Box weight the partitions with ( − 1 , − 2 , 0 , +2 , +1)
CPA By definition [2], CPA is a normalization of the DPA. It is defined as a correlation coefficient, estimated by: = DPA cov CPA . ∈ [ − 1 , +1] , (3) σ T · σ D where σ X is the standard deviation of the random variable X , for which an unbiased empirical estimator is � � 2 � � m − 1 � m − 1 1 X i − 1 j =0 X j . m − 1 i =0 m
DPA cov versus CPA (1/2) DPA cov after 1k traces CPA after 1k traces 1.2 DPA differential trace CPA differential trace Averaging over 1k traces Estimation over 1k traces 30 1 Correlation factor [-100%:+100%] Correct Difference of potential [mV] peaks 0.8 20 0.6 Correct Noisy peak 10 peaks (@ clock 38) 0.4 0 0.2 -10 0 -0.2 -20 -0.4 -30 8 16 24 32 8 16 24 32 Time [clock cycles] Time [clock cycles]
DPA cov versus CPA (2/2) DPA cov after 10k traces CPA after 10k traces 1.2 DPA differential trace CPA differential trace Averaging over 10k traces Estimation over 10k traces 30 1 Correlation factor [-100%:+100%] Correct Difference of potential [mV] peaks 0.8 20 0.6 Correct Noisy peak 10 peaks (@ clock 38) has vanished 0.4 0 0.2 -10 0 -0.2 -20 -0.4 -30 8 16 24 32 8 16 24 32 Time [clock cycles] Time [clock cycles]
Recommend
More recommend
