Reasoning about Aggregation of Information in Timing Attacks Boris - PowerPoint PPT Presentation

Reasoning about Aggregation of Information in Timing Attacks Boris Köpf Itsaka Rakotonirina Microsoft Research INRIA Nancy Grand-Est

Choose a letter: A or B.

Choose a letter: A or B. Does it occur more than 10 times in TARATATATARATATATA ?

Choose a letter: A or B. Does it occur more than 10 times in TARATATATARATATATA ? 🤕

Choose a letter: A or B. Does it occur more than 10 times in TARATATATARATATATA ? 🤕 No.

Choose a letter: A or B. Does it occur more than 10 times in TARATATATARATATATA ? 🤕 No. Q : Which letter was chosen?

Timing attacks 1996 on RSA (Kocher) 1998 on RSA (Dhem et al. ) 2005 on AES (Bernstein) 2007 on AES (Acıiçmez et al. ) 2013 Lucky Thirteen (AlFardan, Paterson) 2014 Flush+Reload (Yarom, Falkner) 2016 on ECDH (Kaufmann et al. ) 2018 Spectre (Kocher et al. ) 2018 Meltdown (Lipp et al. ) 2019 RIDL (van Schaik et al. ) 2019 ZombieLoad (Schwarz et al. ) � 3 24 …

Timing attacks 1996 on RSA (Kocher) 1998 on RSA (Dhem et al. ) A long-term secret, and queries to an oracle 2005 on AES (Bernstein) O : public input ↦ execution time of a program Remote measurements 2007 on AES (Acıiçmez et al. ) 2013 Lucky Thirteen (AlFardan, Paterson) 2014 Flush+Reload (Yarom, Falkner) 2016 on ECDH (Kaufmann et al. ) 2018 Spectre (Kocher et al. ) 2018 Meltdown (Lipp et al. ) 2019 RIDL (van Schaik et al. ) 2019 ZombieLoad (Schwarz et al. ) � 3 24 …

Timing attacks 1996 on RSA (Kocher) 1998 on RSA (Dhem et al. ) A long-term secret, and queries to an oracle 2005 on AES (Bernstein) O : public input ↦ execution time of a program Remote measurements 2007 on AES (Acıiçmez et al. ) 2013 Lucky Thirteen (AlFardan, Paterson) 2014 Flush+Reload (Yarom, Falkner) Exploit timing variations, and not the absolute execution time 2016 on ECDH (Kaufmann et al. ) Differential measurements 2018 Spectre (Kocher et al. ) 2018 Meltdown (Lipp et al. ) 2019 RIDL (van Schaik et al. ) 2019 ZombieLoad (Schwarz et al. ) � 3 24 …

Timing attacks 1996 on RSA (Kocher) 1998 on RSA (Dhem et al. ) A long-term secret, and queries to an oracle 2005 on AES (Bernstein) O : public input ↦ execution time of a program Remote measurements 2007 on AES (Acıiçmez et al. ) 2013 Lucky Thirteen (AlFardan, Paterson) 2014 Flush+Reload (Yarom, Falkner) Exploit timing variations, and not the absolute execution time 2016 on ECDH (Kaufmann et al. ) Differential measurements 2018 Spectre (Kocher et al. ) 2018 Meltdown (Lipp et al. ) 2019 RIDL (van Schaik et al. ) The secret is recovered chunk by chunk Compositionality 2019 ZombieLoad (Schwarz et al. ) � 3 24 …

Timing attacks A long-term secret, and queries to an oracle O : public input ↦ execution time of a program Remote measurements Attacker model Exploit timing variations, and not the absolute execution time Differential measurements Under what hypotheses? The secret is recovered chunk by chunk Compositionality � 4 24

Contributions A model of timing attacks capturing the essence of compositional attacks Core hypotheses giving rise to efficient attacks under the form of independence properties Generic attack descriptions + cost analyses � 5 24

A model for timing leakage

k o Program Long-term secret Observation constant across all invocations e.g. timing as a real number of the program m Public input chosen by the attacker � 7 24

A simple example for i = 0 to n — 1 do 1 if k[i] ≠ m[i] then g() 2 done 3 � 8 24

A simple example for i = 0 to n — 1 do 1 if k[i] ≠ m[i] then g() 2 done 3 execution time proportional to: n t(k,m) = Σ i=1 k[i] ⊕ m[i] = nb of bits where k and m differ Hamming distance � 8 24

Aggregation of information 3 t(k,m) = Σ i=1 k[i] ⊕ m[i] Hamming distance k potential values of the long-term secret � 9 24

Aggregation of information 3 t(k,m) = Σ i=1 k[i] ⊕ m[i] Hamming distance k 000 o = t(k,000) ∈ {0,1,2,3} ⟼ potential values of the long-term secret � 9 24

Aggregation of information 3 t(k,m) = Σ i=1 k[i] ⊕ m[i] Hamming distance k 000 o = t(k,000) ∈ {0,1,2,3} ⟼ ⇒ k ∈ { k’ | t(k’,000) = o } potential values of the long-term secret � 9 24

Aggregation of information 3 t(k,m) = Σ i=1 k[i] ⊕ m[i] Hamming distance k 000 o = t(k,000) ∈ {0,1,2,3} ⟼ ⇒ k ∈ { k’ | t(k’,000) = o } potential values of the long-term secret � 9 24

Aggregation of information 3 t(k,m) = Σ i=1 k[i] ⊕ m[i] Hamming distance k 000 o = t(k,000) ∈ {0,1,2,3} ⟼ ⇒ k ∈ { k’ | t(k’,000) = o } 001 o’ = t(k,001) ⟼ potential values of the long-term secret � 9 24

Aggregation of information 3 t(k,m) = Σ i=1 k[i] ⊕ m[i] k Hamming distance 000 o = t(k,000) ∈ {0,1,2,3} ⟼ ⇒ k ∈ { k’ | t(k’,000) = o } 001 o’ = t(k,001) ⟼ potential values of the long-term secret � 9 24

Aggregation of information 3 t(k,m) = Σ i=1 k[i] ⊕ m[i] k Hamming distance 000 o = t(k,000) ∈ {0,1,2,3} ⟼ ⇒ k ∈ { k’ | t(k’,000) = o } 001 o’ = t(k,001) ⟼ potential values of 010 o’’ = t(k,010) the long-term secret ⟼ � 9 24

Aggregation of information 3 t(k,m) = Σ i=1 k[i] ⊕ m[i] Hamming distance k 000 o = t(k,000) ∈ {0,1,2,3} ⟼ ⇒ k ∈ { k’ | t(k’,000) = o } 001 o’ = t(k,001) ⟼ potential values of 010 o’’ = t(k,010) the long-term secret ⟼ � 9 24

Aggregation of information potential values of the long-term secret k � 10 24

Aggregation of information potential values of the long-term secret k Compute this equivalence relation over the set of secrets static approach (security bounds) � 10 24

Aggregation of information potential values of the long-term secret k Compute this equivalence relation Given an oracle to t(k, . ) , over the set of secrets retrieve the class enclosing k static approach dynamic approach (security bounds) (attacks) � 10 24

A more practical model for timing leakage

o 1 -o 2 k Program Difference of timings Long-term secret m 1 ,m 2 Two public inputs � 12 24

Differential measurements Less powerful attacker, but… o 1 -o 2 k Program Closer to the models used in actual attack research m 1 ,m 2 Compositionality � 13 24

Compositionality for differential measurements

Compositional attacks for i = 0 to n — 1 do 1 if k[i] ≠ m[i] then g() 2 done 3 recovering k? with oracle to execution time m ↦ t(k,m) � 15 24

Compositional attacks for i = 0 to n — 1 do 1 if k[i] ≠ m[i] then g() 2 done 3 recovering k? with oracle to execution time m ↦ t(k,m) if t(k,0) < t(k,2 i ) - � 15 24

Compositional attacks for i = 0 to n — 1 do 1 if k[i] ≠ m[i] then g() 2 done 3 recovering k? with oracle to execution time m ↦ t(k,m) if t(k,0) < t(k,2 i ) then K := K ∩ { k | k[i] = 1 } else K := K ∩ { k | k[i] = 0 } � 15 24 Exploiting the i th iteration

Sequential composition x = m 1 for i = 0 to n — 1 do 2 x = f i (k,x) 3 if Test i (k,x) = 1 then g() 4 done 5 � 16 24

Sequential composition x = m 1 for i = 0 to n — 1 do 2 x = f i (k,x) 3 if Test i (k,x) = 1 then g() 4 done 5 Goal : writing this code under the form p = p 0 ; p 2 ; … ; p n-1 � 16 24

Sequential composition x = m 1 for i = 0 to n — 1 do 2 x = f i (k,x) 3 if Test i (k,x) = 1 then g() 4 done 5 Goal : writing this code under the form p = p 0 ; p 2 ; … ; p n-1 p i computes f i : K x M → M with execution time Test i : K x M → {0,1} � 16 24

Sequential composition p comp = p 1 ; p 2 � 17 24

Sequential composition p comp = p 1 ; p 2 p ℓ computes f ℓ : K x M → M with execution time t ℓ : K x M → O � 17 24

Sequential composition p comp = p 1 ; p 2 p ℓ computes f ℓ : K x M → M with execution time t ℓ : K x M → O f comp = f 2 ◦ f 1 States are composed � 17 24

Sequential composition p comp = p 1 ; p 2 composition of public values, p ℓ computes f ℓ : K x M → M with i.e. (f ◦ g)(k,m) = f(k, g(k,m)) execution time t ℓ : K x M → O f comp = f 2 ◦ f 1 States are composed � 17 24

Sequential composition p comp = p 1 ; p 2 composition of public values, p ℓ computes f ℓ : K x M → M with i.e. (f ◦ g)(k,m) = f(k, g(k,m)) execution time t ℓ : K x M → O f comp = f 2 ◦ f 1 t comp = t 1 + (t 2 ◦ f 1 ) States are composed Timings are summed � 17 24

Key hypothesis: independence � 18 24

Key hypothesis: independence Hypotheses t,t’ timing functions • Theorem Leak(t+t’) = Leak(t) ⋂ Leak(t’) � 18 24

Key hypothesis: independence Hypotheses t,t’ timing functions • Theorem Leak(t+t’) = Leak(t) ⋂ Leak(t’) Leak(t) = the equivalence relation on secrets characterising timing leakage � 18 24

Key hypothesis: independence Hypotheses t,t’ timing functions for all secrets k,k’, the distributions • • X distribution of public inputs t(k, X) and t’(k’, X) are independent • Theorem Leak(t+t’) = Leak(t) ⋂ Leak(t’) Leak(t) = the equivalence relation on secrets characterising timing leakage � 18 24

Randomised compositional attack � 19 24