Side Channel Analysis & Countermeasures Begl Bilgin 27 Dec. - PowerPoint PPT Presentation

Differential Power Analysis key 1 =00 pt S(pt 1 ⊕ key 1 )&1 1234… 1 abcd… 0 8aef… 0 0354... 1 7791… 1 c80d… 0 7e9e... 1 11 [courtesy: B.Gierlichs]

Differential Power Analysis key 1 =00 pt S(pt 1 ⊕ key 1 )&1 1234… 1 abcd… 0 8aef… 0 0354... 1 7791… 1 c80d… 0 7e9e... 1 Take means 11 [courtesy: B.Gierlichs]

Differential Power Analysis key 1 =00 pt S(pt 1 ⊕ key 1 )&1 1234… 1 abcd… 0 8aef… 0 0354... 1 7791… 1 c80d… 0 7e9e... 1 Take means Take difference 11 [courtesy: B.Gierlichs]

Differential Power Analysis pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e... 12 [courtesy: B.Gierlichs]

Differential Power Analysis key 1 =2b pt S(pt 1 ⊕ key 1 )&1 1234… 0 abcd… 1 8aef… 0 0354... 0 7791… 0 c80d… 1 7e9e... 1 12 [courtesy: B.Gierlichs]

Differential Power Analysis key 1 =2b pt S(pt 1 ⊕ key 1 )&1 1234… 0 abcd… 1 8aef… 0 0354... 0 7791… 0 c80d… 1 7e9e... 1 Take means 12 [courtesy: B.Gierlichs]

Differential Power Analysis key 1 =2b pt S(pt 1 ⊕ key 1 )&1 1234… 0 abcd… 1 8aef… 0 0354... 0 7791… 0 c80d… 1 7e9e... 1 Take means Take difference 12 [courtesy: B.Gierlichs]

Differential Power Analysis key 1 =2b pt S(pt 1 ⊕ key 1 )&1 1234… 0 abcd… 1 s n a e M f 8aef… 0 o e c n e r e f f i 0354... 0 D 7791… 0 c80d… 1 7e9e... 1 Take means Take difference 12 [courtesy: B.Gierlichs]

Differential Power Analysis Correlation Power Analysis pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e... 13

Differential Power Analysis Correlation Power Analysis key 1 =00 pt S(pt 1 ⊕ key 1 ) 1234… 82 abcd… 62 8aef… 7e 0354... 7b 7791… f6 c80d… e8 7e9e... f3 13

Differential Power Analysis Correlation Power Analysis key 1 =00 pt S(pt 1 ⊕ key 1 ) 1234… 82 abcd… 62 8aef… 7e 0354... 7b 7791… f6 c80d… e8 7e9e... f3 Corr. 13

Differential Power Analysis Correlation Power Analysis key 1 =00 pt S(pt 1 ⊕ key 1 ) 1234… 82 abcd… 62 8aef… 7e 0354... 7b 7791… f6 c80d… e8 7e9e... f3 13

Differential Power Analysis Correlation Power Analysis key 1 =00 key 1 =2b pt S(pt 1 ⊕ key 1 ) S(pt 1 ⊕ key 1 ) 1234… 82 12 abcd… 62 cd 8aef… 7e 32 0354... 7b 34 7791… f6 4a c80d… e8 11 7e9e... f3 fc 13

Differential Power Analysis Correlation Power Analysis key 1 =00 key 1 =2b pt S(pt 1 ⊕ key 1 ) S(pt 1 ⊕ key 1 ) 1234… HW(82) HW(12) abcd… HW(62) HW(cd) 8aef… HW(7e) HW(32) 0354... HW(7b) HW(34) 7791… HW(f6) HW(4a) c80d… HW(e8) HW(11) 7e9e... HW(f3) HW(fc) 13

Differential Power Analysis Correlation Power Analysis key 1 =00 key 1 =2b pt S(pt 1 ⊕ key 1 ) S(pt 1 ⊕ key 1 ) 1234… HW(82) HW(12) abcd… HW(62) HW(cd) 8aef… HW(7e) HW(32) 0354... HW(7b) HW(34) 7791… HW(f6) HW(4a) c80d… HW(e8) HW(11) 7e9e... HW(f3) HW(fc) Better leakage model → better attack 13

Differential Power Analysis (Notes & Assumptions) 14

Differential Power Analysis (Notes & Assumptions) • Knowledge about the algorithm 14

Differential Power Analysis (Notes & Assumptions) • Knowledge about the algorithm • Timing of the intermediate value computation 14

Differential Power Analysis (Notes & Assumptions) • Knowledge about the algorithm • Timing of the intermediate value computation • Perfectly aligned traces 14

Differential Power Analysis (Notes & Assumptions) • Knowledge about the algorithm • Timing of the intermediate value computation • Perfectly aligned traces • No countermeasures 14

Differential Power Analysis (Notes & Assumptions) • Knowledge about the algorithm • Timing of the intermediate value computation • Perfectly aligned traces • No countermeasures • # of traces increase with noise 14

Countermeasures Against DPA 15

Countermeasures 16

Countermeasures • Limit number of encryptions per key 16

Countermeasures • Limit number of encryptions per key - Distribution of key is difficult 16

Countermeasures • Limit number of encryptions per key - Distribution of key is difficult - Leakage resilient algorithms 16

Countermeasures • Limit number of encryptions per key - Distribution of key is difficult - Leakage resilient algorithms - Performance drop 16

Countermeasures • Limit number of encryptions per key - Distribution of key is difficult - Leakage resilient algorithms - Performance drop • Decrease Signal-to-Noise Ratio (SNR) 16

Countermeasures • Limit number of encryptions per key - Distribution of key is difficult - Leakage resilient algorithms - Performance drop • Decrease Signal-to-Noise Ratio (SNR) - Decreasing signal (~constant power imp., special cells) 16

Countermeasures • Limit number of encryptions per key - Distribution of key is difficult - Leakage resilient algorithms - Performance drop • Decrease Signal-to-Noise Ratio (SNR) - Decreasing signal (~constant power imp., special cells) - Increasing noise (dummy operations, shuffling) 16

Countermeasures • Limit number of encryptions per key - Distribution of key is difficult - Leakage resilient algorithms - Performance drop • Decrease Signal-to-Noise Ratio (SNR) - Decreasing signal (~constant power imp., special cells) - Increasing noise (dummy operations, shuffling) • Breaking the correlation 16

Countermeasures • Limit number of encryptions per key - Distribution of key is difficult - Leakage resilient algorithms - Performance drop • Decrease Signal-to-Noise Ratio (SNR) - Decreasing signal (~constant power imp., special cells) - Increasing noise (dummy operations, shuffling) • Breaking the correlation - Masking 16

Boolean Masking S (x ,y ,z , ... ) (a ,b ,c , ... ) 17

Boolean Masking 18

Boolean Masking (x 1 ,y 1 ,z 1 , ... ) 18

Boolean Masking (x 1 ,y 1 ,z 1 , ... ) ⊕ (x 2 ,y 2 ,z 2 , ... ) = (x, y, z , ... ) 18

Boolean Masking S 1 (x 1 ,y 1 ,z 1 , ... ) (a 1 ,b 1 ,c 1 , ... ) ⊕ ⊕ S 2 (x 2 ,y 2 ,z 2 , ... ) (a 2 ,b 2 ,c 2 , ... ) = (x, y, z , ... ) 18

Boolean Masking S 1 (x 1 ,y 1 ,z 1 , ... ) (a 1 ,b 1 ,c 1 , ... ) ⊕ ⊕ S 2 (x 2 ,y 2 ,z 2 , ... ) (a 2 ,b 2 ,c 2 , ... ) = = (x, y, z , ... ) (a, b, c , ... ) 18

Boolean Masking S 1 (x 1 ,y 1 ,z 1 , ... ) (a 1 ,b 1 ,c 1 , ... ) ⊕ ⊕ S 2 (x 2 ,y 2 ,z 2 , ... ) (a 2 ,b 2 ,c 2 , ... ) = = (x, y, z , ... ) (a, b, c , ... ) Random input/output shares ➡ Random intermediate values 18

Boolean Masking S 1 (x 1 ,y 1 ,z 1 , ... ) (a 1 ,b 1 ,c 1 , ... ) ⊕ ⊕ S 2 (x 2 ,y 2 ,z 2 , ... ) (a 2 ,b 2 ,c 2 , ... ) = = (x, y, z , ... ) (a, b, c , ... ) Random input/output shares ➡ Random intermediate values unshared shares mean var 0,0=0 0 0 1,5 1,5 1,5 1,5 1,1=3 0,1=1 1 1 1,5 1,5 0.5 0.5 1,0=2 18

Side Channel Analysis & Countermeasures Begl Bilgin 27 Dec. - PowerPoint PPT Presentation

Side Channel Analysis & Countermeasures Begl Bilgin 27 Dec. 2014 - IAM Alumni Meeting Adversary Models 2 Adversary Models 2 Adversary Models Black-box Gray-box White-box 3 Adversary Models Black-box Gray-box White-box Key

HOST SCA Countermeasures I ECE 525 Side-Channel Analysis (SCA) Countermeasures Reference

Introduction Problem: side-channel attacks Countermeasures: hiding, masking, TI . . . 1 / 18

Introduction Problem: side-channel attacks Countermeasures: hiding, masking, TI . . . 1 / 21

Side Channel Analysis and Embedded Systems Impact and Countermeasures Job de Haas Black Hat DC

Enhancing the Power of Deep Learning in Side-Channel Analysis? Breaking multiple layers of

Side Channel Analysis and Embedded Systems Impact and Countermeasures Job de Haas Black Hat

Randomness as countermeasures against Side Channel Attacks Nadia El Mrabet

Side-Channel Countermeasures Dissection and the Limits of Closed Source Security Evaluations

Generalized Polynomial Decomposition for S-boxes with Application to Side-Channel Countermeasures

HOST SCA Countermeasures II ECE 525 Introduction We propose a technique called Side-channel

Towards the Automatic Applications of Side Channel Countermeasures Francesco Regazzoni Francesco

Provably secure compilation of side-channel countermeasures: the case of cryptographic

Side Channel Attacks and Countermeasures for Embedded Systems Job de Haas Black Hat USA

Overview of Countermeasures against Implementation Attacks Marcel Medwed marcel.medwed@nxp.com

Elliptic Curve Cryptography on Embedded Devices Scalar Multiplication and Side-Channel Attacks

Recent advances in side- channel analysis using machine learning techniques Annelie Heuser with

Glitching and Side-Channel Analysis for All Colin OFlynn NewAE Technology Inc. RECON 2015

A Comprehensive Study of Deep Learning for Side-Channel Analysis c Masure 1,3 ecile Dumas 1

SIDE-CHANNEL ATTACKS ON HARDWARE IMPLEMENTATIONS OF CRYPTOGRAPHIC ALGORITHMS Sddka Berna

Leakage Assessment Methodology - a clear roadmap for side-channel evaluations - Tobias Schneider

Introduction to Side-Channel Analysis Franois-Xavier Standaert UCL Crypto Group, Belgium

Introduction to (profiled) side-channel analysis Annelie Heuser In this talk back to

+ Side Channel and Covert Channel A1acks on Microkernel

A Stochastic Approach in Side-Channel Analysis in the Presence of Masking W. Schindler Bundesamt