Software Side-Channel Analysis: Attack Synthesis Lucas Bang - PowerPoint PPT Presentation

Side Channels and Searching: Entropy secret s ∈ S S p 1 p 2 i ∈ I p 3 p 4 8 - 14

Side Channels and Searching: Entropy secret s ∈ S S p 1 p 2 i ∈ I p 3 p 4 Quantify expected information gain measured in bits. 8 - 15

Side Channels and Searching: Entropy secret s ∈ S S p 1 p 2 i ∈ I p 3 p 4 Quantify expected information gain measured in bits. 1 p j 8 - 16

Side Channels and Searching: Entropy secret s ∈ S S p 1 p 2 i ∈ I p 3 p 4 Quantify expected information gain measured in bits. 1 log 2 p j 8 - 17

Side Channels and Searching: Entropy secret s ∈ S S p 1 p 2 i ∈ I p 3 p 4 Quantify expected information gain measured in bits. � n 1 log 2 p j j =1 p j 8 - 18

Side Channels and Searching: Entropy secret s ∈ S S p 1 p 2 i ∈ I p 3 p 4 Quantify expected information gain measured in bits. � n 1 H = log 2 p j j =1 p j 8 - 19

Side Channels and Searching: Entropy secret s ∈ S S i ∈ I i Quantify expected information gain measured in bits. � n 1 H ( i ) = log 2 p j j =1 p j 8 - 20

max H ( i ) ⇒ Binary Search o = 1 ⇒ s ≤ i o = 2 ⇒ s > i 9 - 1

max H ( i ) ⇒ Binary Search o = 1 ⇒ s ≤ i o = 2 ⇒ s > i 9 - 2

max H ( i ) ⇒ Binary Search o = 1 ⇒ s ≤ i o = 2 ⇒ s > i Password Checker Constraints 9 - 3

max H ( i ) ⇒ Binary Search o = 1 ⇒ s ≤ i o = 2 ⇒ s > i 9 - 4

max H ( i ) ⇒ Binary Search o = 1 ⇒ s ≤ i o = 2 ⇒ s > i max H ( i ) ⇒ Optimal Search any program constraints 9 - 5

max H ( i ) ⇒ Binary Search o = 1 ⇒ s ≤ i o = 2 ⇒ s > i max H ( i ) ⇒ Optimal Search any program constraints H ( i ) ??? 9 - 6

Symbolic Execution Execute program on symbolic rather than concrete inputs. Maintain path constraints , PCs, φ j over symbolic inputs. For branch instructions: φ c if(c) then s1; else s2; T F φ ← φ ∧ c φ ← φ ∧ ¬ c φ j ( s, i ) characterizes the relation between s , i , and o j 10 - 1

Symbolic Execution Execute program on symbolic rather than concrete inputs. Maintain path constraints , PCs, φ j over symbolic inputs. Maintain path constraints , PCs, φ j over symbolic inputs. For branch instructions: φ c if(c) then s1; else s2; T F φ ← φ ∧ c φ ← φ ∧ ¬ c φ 1 φ j ( s, i ) characterizes the φ 2 relation between s , i , and o j φ 3 φ 4 10 - 2

)= p ( s ∈ 11 - 1

= # φ ( i ) φ φ )= p ( s ∈ 11 - 2

Model { # φ j ( i ) } { φ j ( s, i ) } Counter = # φ ( i ) φ φ )= p ( s ∈ 11 - 3

Model { # φ j ( i ) } { φ j ( s, i ) } Counter = # φ ( i ) φ φ # φ ( i ) is the number of satisfying solutions (models) for φ ( s, i ) for a given i . )= p ( s ∈ 11 - 4

Model { # φ j ( i ) } { φ j ( s, i ) } Counter = # φ ( i ) φ φ # φ ( i ) is the number of satisfying solutions (models) for φ ( s, i ) for a given i . p ( i ) = # φ ( i ) )= p ( s ∈ | S | 11 - 5

Model { # φ j ( i ) } { φ j ( s, i ) } Counter = # φ ( i ) φ φ # φ ( i ) is the number of satisfying solutions (models) for φ ( s, i ) for a given i . p ( i ) = # φ ( i ) )= p ( s ∈ | S | H ( i ) = � n 1 j =1 p j ( i ) log 2 p j ( i ) 11 - 6

Symbolic Execution Model Counting H ( i ) Information Theory H ( i ) is a symbolic expression that measures the expected information an attacker gains when making input i . 12 - 1

Symbolic Execution Model Counting H ( i ) Information Theory H ( i ) is a symbolic expression that measures the expected information an attacker gains when making input i . H ( i ) Maximize i ∗ Maximizing H ( i ) gives an optimal side-channel attack. [IEEE Computer Security Foundations 2017] 12 - 2

1. Fully Static Offline Approach Assumes an ideal observation model (i.e. instruction counts). Does not account for actual runtime behavior. 13 - 1

1. Fully Static Offline Approach Assumes an ideal observation model (i.e. instruction counts). Does not account for actual runtime behavior. 2. Static / Dynamic + Offline / Online Approach Automatically, dynamically estimates runtime observations. Uses Bayesian inference and weighted model counting to account for noise. 13 - 2

Side-Channel Attack Synthesis Under Noisy Conditions [IEEE European Security & Privacy 2018] 14 - 1

1 private s = getMaxBytes(); 2 3 4 public int compare(int i){ 5 if(s <= i) 6 some computation; // 1 s 7 else 8 log.write("too many bytes");// 2s 9 return 0; 10 } 14 - 2

1 private s = getMaxBytes(); 2 3 4 public int compare(int i){ 5 if(s <= i) 6 some computation; // 1 s 7 else 8 log.write("too many bytes");// 2s 9 return 0; 10 } Hardware + OS 14 - 3

1 private s = getMaxBytes(); 2 3 4 public int compare(int i){ Network 5 if(s <= i) 6 some computation; // 1 s 7 else 8 log.write("too many bytes");// 2s 9 return 0; 10 } Hardware + OS 14 - 4

s ? 1 private s = getMaxBytes(); 2 3 4 public int compare(int i){ Network 5 if(s <= i) 6 some computation; // 1 s 7 else 8 log.write("too many bytes");// 2s 9 return 0; 10 } Hardware + OS 14 - 5

s ? 1 private s = getMaxBytes(); 2 input, i 3 4 public int compare(int i){ Network 5 if(s <= i) 6 some computation; // 1 s 7 else 8 log.write("too many bytes");// 2s 9 return 0; 10 } Hardware + OS 14 - 6

s ? 1 private s = getMaxBytes(); 2 input, i 3 4 public int compare(int i){ Network 5 if(s <= i) 6 some computation; // 1 s 7 else 8 log.write("too many bytes");// 2s 9 return 0; 10 } Hardware + OS 14 - 7

s ? 1 private s = getMaxBytes(); 2 input, i 3 4 public int compare(int i){ Network 5 if(s <= i) 6 some computation; // 1 s 7 else 8 log.write("too many bytes");// 2s 9 return 0; 10 } Hardware + OS 14 - 8

s ? 1 private s = getMaxBytes(); 2 input, i 3 4 public int compare(int i){ Network 5 if(s <= i) 6 some computation; // 1 s 7 else 8 log.write("too many bytes");// 2s 9 return 0; 10 } Hardware + OS s ≤ i ⇒ o = 1 14 - 9

s ? 1 private s = getMaxBytes(); 2 input, i 3 4 public int compare(int i){ Network 5 if(s <= i) 6 some computation; // 1 s 7 else 8 log.write("too many bytes");// 2s 9 return 0; 10 } Hardware + OS s ≤ i ⇒ o = 1 14 - 10

s ? 1 private s = getMaxBytes(); 2 input, i 3 4 public int compare(int i){ s ≤ i Network 5 if(s <= i) 6 some computation; // 1 s 7 else 8 log.write("too many bytes");// 2s 9 return 0; 10 } Hardware + OS s ≤ i ⇒ o = 1 14 - 11

s ? 1 private s = getMaxBytes(); 2 input, i 3 4 public int compare(int i){ s ≤ i s > i Network 5 if(s <= i) 6 some computation; // 1 s 7 else 8 log.write("too many bytes");// 2s 9 return 0; 10 } Hardware + OS 14 - 12

15 - 1

Attacker Belief s ? 15 - 2

Attacker Belief s ? 1 8 1 2 3 4 5 6 7 8 15 - 3

Attacker Belief Input Choice s ? i ∗ 1 8 1 2 3 4 5 6 7 8 15 - 4

Attacker Belief Input Choice Observation Noise s ? i ∗ s ≤ i s > i 1 8 1 2 3 4 5 6 7 8 15 - 5

Attacker Belief Input Choice Observation Noise s ? i ∗ = 5 s ≤ 5 s > 5 1 8 1 2 3 4 5 6 7 8 15 - 6

Attacker Belief Input Choice Observation Noise s ? i ∗ = 5 s ≤ 5 s > 5 1 8 1 2 3 4 5 6 7 8 t = 4.12 15 - 7

Attacker Belief Input Choice Observation Noise s ? i ∗ = 5 s ≤ 5 s > 5 1 3 1 8 1 2 3 4 5 6 7 8 t = 4.12 15 - 8

Attacker Belief Input Choice Observation Noise s ? i ∗ = 5 s ≤ 5 s > 5 1 8 1 2 3 4 5 6 7 8 15 - 9

Attacker Belief Input Choice Observation Noise s ? i ∗ = 5 s ≤ 5 s > 5 more likely less likely 1 8 t = 2.3 1 2 3 4 5 6 7 8 15 - 10

Attacker Belief Input Choice Observation Noise s ? i ∗ = 5 s ≤ 5 s > 5 1 8 1 2 3 4 5 6 7 8 15 - 11

Attacker Belief Input Choice Observation Noise s ? i ∗ = 5 s ≤ 5 s > 5 1 8 1 2 3 4 5 6 7 8 p ( s | o, i ∗ ) 15 - 12

Attacker Belief Input Choice Observation Noise s ? i ∗ = 5 s ≤ 5 s > 5 1 8 1 2 3 4 5 6 7 8 p ( s | o, i ∗ ) p ( o | s, i ) 15 - 13

Attacker Belief Input Choice Observation Noise s ? i ∗ = 5 s ≤ 5 s > 5 1 8 1 2 3 4 5 6 7 8 p ( o | s, i ) p ( s | o, i ∗ ) p ( o | s, i ) 15 - 14

Attacker Belief Input Choice Observation Noise s ? i ∗ = 5 s ≤ 5 s > 5 1 8 1 2 3 4 5 6 7 8 p ( o | s, i ∗ ) p ( s | o, i ∗ ) p ( o | s, i ) 15 - 15

Attacker Belief Input Choice Observation Noise s ? i ∗ = 5 s ≤ 5 s > 5 1 8 1 2 3 4 5 6 7 8 p ( o | s, i ∗ ) p ( s | o, i ∗ ) p ( o | s, i ) 15 - 16

Attacker Belief Input Choice Observation Noise s ? i ∗ = 5 s ≤ 5 s > 5 1 8 1 2 3 4 5 6 7 8 p ( s | o, i ∗ ) p ( s | o, i ∗ ) p ( o | s, i ) 15 - 17

Attacker Belief Input Choice Observation Noise s ? i ∗ = 5 s ≤ 5 s > 5 1 8 1 2 3 4 5 6 7 8 p ( s | o, i ∗ ) p ( s | o, i ∗ ) p ( o | s, i ) Bayes’ Rule 15 - 18

Attacker Belief Input Choice Observation Noise s ? i ∗ = 5 s ≤ 5 s > 5 1 8 1 2 3 4 5 6 7 8 p ( s | o, i ∗ ) p ( s | o, i ∗ ) p ( o | s, i ) Bayes’ Rule 15 - 19