Overview of Countermeasures against Implementation Attacks Marcel - PowerPoint PPT Presentation

Overview of Countermeasures against Implementation Attacks Marcel Medwed marcel.medwed@nxp.com

Outline Motivation & general mechanisms Side-channel countermeasures Fault countermeasures Conclusions 2 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Motivation Sensitive applications require certification – Pay TV, Banking,... – e.g. CC EAL5+ – Semi-formal evidence for security – Standard portfolio of attacks • SCA • Fault analysis, probing • … Cost security tradeoff 3 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

General Mechanisms Constant Detection Instantaneous Timing Leakage Limit measurements m 1 Faults m 2 c = E k (m) ... Probing ... m n Low SNR Independence Shielding Dependence 4 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Side-Channel Countermeasures Data independent timing Hiding Masking Regular key updates Dependent leakage 5 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Data Independent Timing Data dependent branches – Reduction, Compiler • Use regular algorithms • Use assembly code Architectural features – e.g. ARM7 multiplier • time(0xFFFF*Op2) > time(0xFF*Op2) – Cache [ [ – Code alignment • Prefetch / Branch 6 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Instantaneous Leakage - Preliminaries Leakage trace – Vector of t leakage samples Sensitive variable v – Depends on key and input  Observe noisy function of v – For some i, – E.g. L = Hamming weight – Normal distributed noise Univariate, First-order, Hamming weight – Templates and Correlation are asymptotically equivalent 7 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Hiding in General In each clock cycle, consume either – (close to) random power  increase n – (close to) constant power  L(v) ~ const. Hiding only decreases the SNR Hiding dimensions – Time – Amplitude 8 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Hiding in Time with Shuffling (1) Time – Insertion of dummy operations – Shuffling time S 1 S 3 S 3 D S 2 S 3 S 4 S 4 S 1 D S 2 S 4 S 1 D D S 2 observations S 1 S 3 D S 2 S 3 S 4 D D S 2 S 4 S 4 D S 3 D S 1 D D S 2 D S 4 S 1 S 2 S 3 S 4 S 3 D S 4 S 1 D D S 2 D S 1 S 2 S 3 S 4 9 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Hiding in Time with Shuffling (2) Effect of time randomization with k positions – Sample from with probability 1/k Plain attack – Correlation ~ k – k 2 traces Integration over all k positions – Noise increases linearly – Correlation ~ k -1/2 10 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Hiding in Amplitude Peripheral activity – ADCs – Co-processors Memory addresses – of dummy registers – of key dependent registers Random precharge of bus – Pure HD leakage? 11 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Hiding in Hardware Time – Dummy instructions – Shuffling – Random jitters Amplitude – Filters • Switching capacitors • Constant drain circuits – Noise generation engines – Parallelization – Pipelining / Unrolling – Dynamic reconfiguration (FPGAs) 12 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Hiding at Cell Level Dual-rail precharge logic styles Trans. l 0  0 0 a Single 0  1 1 q Rail b 1  0 1 1  1 0  Talk by Ingrid Verbauwhede Trans. l 10  00 1 a Dual ¬a q 01  00 1 b Rail ¬q 00  10 ¬b 1 00  01 1 13 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Conclusions for Hiding Decrease the SNR – Increase noise – Decrease signal Only minor changes to the algorithms Noise is essential for masking! EM measurements can overcome many hiding countermeasures – Shuffling / dummy operations are strong but – Which resources are used? – Exact same behavior of circuit? 14 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Masking Randomized redundant representation – nth-order masking – All n-1 intermediate variables are independent of v – Adversary needs to • identify n leakage samples • and combine their information Challenge – Usually achieving is not straightforward 15 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Masking Few Bits (1) Assume little structure (e.g. block cipher) – Boolean masking • Alternatively – Multiplicative masking (zero-value problem) • – Affine Masking • 16 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Masking Few Bits (2) Marginal PDFs are independent  joint PDF WH(v)=0 WH(v) = 4 W H (v 2 ) W H (v 2 ) W H (v 1 ) W H (v 1 ) Effect – k shares, sufficient noise – Number of traces relates to – Combination results in additional loss 17 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Masking Few Bits (3) Combined Only masking Only shuffling 18 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Masking in Software (1) First-order masking  Lookup tables Higher order masking – Secure table computation for 2nd order masking – Test all subsets! Check Hamming distance – Buses, registers,... 19 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Masking in Software (2) Rivain and Prouff – CHES10 – Provable secure masking for AES with arbitrary order – Based on Private Circuits Genelle, Prouff, and M. Quisquarter – CHES11 – Combination of additive and multiplicative masking Cycle counts for a masked AES Masking order AES cycles – Pay for security directly w/o masking 2 000 in execution time 1 25 000 2 69 000 3 180 000 20 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Masking in Hardware (1) v m S(v) m„ Masked S-box m„ m Unclear what synthesizer does – Unintentional unmasking – Unintentional combination function Data dependent phenomena – Glitches – Early propagation – Cross-talk 21 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Masking in Hardware (2) Nikova et al. – Threshold implementation – Independent processing of subset of shares z 1 f 1 f 4 v 1 y 1 f 2 f 5 z 2 v 2 y 2 f 3 f 6 z 3 v 3 y 3 If shares processed in parallel – Univariate leakage – But still higher order attack  Talk by Svetla Nikova 22 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Flawed Masking Can only provide a constant factor Do you measure right or left of the line, how bad is your flaw? Taken from http://perso.uclouvain.be/fstandae/PUBLIS/107_slides.pdf Test: Does your second-order attack work better than your first-order one? 23 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Masked Logic Styles Remove requirement for balanced routing – Average power consumption is constant (in theory) – E.g. MDPL NAND gate a m b m m ¬a m ¬b m ¬m q ¬q a m 0 0 0 1 1 1 1 0 SR b m q MAJ 0 1 0 1 0 1 1 0 m 1 0 0 0 1 1 1 0 1 1 0 0 0 1 0 1 ¬a m SR 0 0 1 1 1 0 1 0 ¬b m ¬q MAJ 0 1 1 1 0 0 0 1 ¬m 1 0 1 0 1 0 0 1 1 1 1 0 0 0 0 1 24 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Exploiting Algebraic Structures Scalar blinding Message blinding Embeddings 25 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Using Inherent Redundancy ECC point projection – Originally to avoid inversions – Free randomization 26 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013

Conclusions for Masking Take care of – Unintentional unmasking – Glitches – Lower order leakages For small mask widths – PDFs can be estimated – But exponential increase in data complexity For large mask widths (PKC) – Inexpensive and very effective – But complex operations  Additive masking of multiplicative masking,… 27 Design and Security of Cryptographic Functions, Algorithms and Devices Marcel Medwed, Albena, May 2013