A Hackers guide to reducing side-channel atuack surgaces using - - PowerPoint PPT Presentation

▶
a hacker s guide to reducing side channel atuack surgaces
SMART_READER_LITE
LIVE PREVIEW

A Hackers guide to reducing side-channel atuack surgaces using - - PowerPoint PPT Presentation

Apr 15, 2023 253 likes •938 views

A Hackers guide to reducing side-channel atuack surgaces using deep-learning Google, @jmichel_p Google, @elie with the help of many Googlers and external collaborators Security and Privacy Group Talk is based on some of the results of a

slide-1
SLIDE 1

Security and Privacy Group

Google, @elie

A Hacker’s guide to reducing side-channel atuack surgaces using deep-learning

with the help of many Googlers and external collaborators Google, @jmichel_p

slide-2
SLIDE 2

Security and Privacy Group

Talk is based on some

  • f the results of a joint

research project with many collaborators on hardening hardware cryptography

slide-3
SLIDE 3

Security and Privacy Group

Work in progress

Experimental results and code ahead

slide-4
SLIDE 4

Security and Privacy Group

Side channel atuacks are

  • ne of the most effjcient

ways to atuack secure hardware

slide-5
SLIDE 5

Security and Privacy Group

A side-channel atuack was used to recover the Trezor bitcoin wallet private key

htups://jochen-hoenicke.de/crypto/trezor-power-analysis/

slide-6
SLIDE 6

Security and Privacy Group

Side-channels atuacks are notoriously hard to debug and fjx

slide-7
SLIDE 7

Security and Privacy Group

Can we create a debugger that accurately pinpoints the code vulnerable to side-channel atuacks? ?

slide-8
SLIDE 8

Security and Privacy Group

Combine deep-learning and dynamic analysis to pinpoint origin of leakage

slide-9
SLIDE 9

Security and Privacy Group

AI? Really?

slide-10
SLIDE 10

Security and Privacy Group

Side Channel Atuacks Leak Detector

slide-11
SLIDE 11

Security and Privacy Group

Today’s goal: use SCALD to debug tinyAES running on STM32F4

slide-12
SLIDE 12

Security and Privacy Group

Agenda

What are side channels? AI based side-channel atuacks AI explainability Finding implementation leakage

  • rigin with SCALD
slide-13
SLIDE 13

Security and Privacy Group

Code and slides

htups://elie.net/scald

slide-14
SLIDE 14

Security and Privacy Group

Disclaimer

This talk purposely focuses on showcasing a high level overview of how to debug a cryptographic implementation end-to-end using SCALD. For technical details, see the paper

slide-15
SLIDE 15

Security and Privacy Group

Paru 1

What are side-channel atuacks?

slide-16
SLIDE 16

Security and Privacy Group

A side-channel atuack is an indirect measurement of a computation result via an auxiliary mechanism

slide-17
SLIDE 17

Security and Privacy Group

Real-world side-channel applications

Recover encryption keys Pergorm blind SQL injections Steal passwords and pins Extract crypto wallets

slide-18
SLIDE 18

Security and Privacy Group

Timing Electromagnetic emission Heat Current Plaintext Secret Key

slide-19
SLIDE 19

Security and Privacy Group

1 2 3 4 6 5 10 7 8 9

AES round are visible in lightly protected AES implementation power traces

slide-20
SLIDE 20

Security and Privacy Group

AES key!

SCA in a nutshell

Encryption Template atuack Signal acquisition

slide-21
SLIDE 21

Security and Privacy Group

NewAE Chipwhisperer Pro + Picoscope 6000 for fast sampling rate is what we use for our research

This is not an ad :) it is a recommendation based on what we use

slide-22
SLIDE 22

Security and Privacy Group

Section 2

AI based side-channel atuacks

slide-23
SLIDE 23

Security and Privacy Group

Side Channel Atuacks Automated with Machine Learning

slide-24
SLIDE 24

Security and Privacy Group

How do SCAAML atuacks work in practice?

slide-25
SLIDE 25

Security and Privacy Group

Check out last year talk for in-depth explanation

htups://elie.net/scaaml

slide-26
SLIDE 26

Security and Privacy Group

Threat model whitebox atuack

Contrary to our previous work that focused on black box atuacks, the traces used in this talk are truncated and collected synchronously to improve debugging quality. This is consistent with the white-box atuack model used during chip

  • development. Additionally, the model architecture is

also optimized for debugging, not pure pergormance.

slide-27
SLIDE 27

Security and Privacy Group

AES key!

SCAAML process overview

Encryption Combine DNN predictions Signal acquisition (ChipWhisperer) Predictions using DNN

slide-28
SLIDE 28

Security and Privacy Group

sub_bytes_in sub_bytes_out key SBOX

TinyAES has multiples atuack points that can be targeted by SCAAML. Today we focus on sub_bytes_in

key PT

slide-29
SLIDE 29

Security and Privacy Group

Probabilistic atuack:

... ...

slide-30
SLIDE 30

Security and Privacy Group

Probabilistic atuack:

Val 0: 0.10 Val 1: 0.02 Val 2: 0.01 Val 254: 0.02 Val 42: 0.3 Val 255: 0.05 ... ... Val 0: 0.08 Val 1: 0.04 Val 2: 0.05 Val 254: 0.03 Val 42: 0.12 Val 255: 0.10 ... ...

+ … +

*sum uses log10 + ε Val 0: 4.4 Val 1: 5.3 Val 2: 3.2 Val 254: 2.9 Val 42: 21.4 Val 255: 4.2 ... ...

slide-31
SLIDE 31

Security and Privacy Group

Model architecture Hyperuuned residual separated 1D convolution network

Custom residual block used

slide-32
SLIDE 32

Security and Privacy Group

Tensorboards - 1 model per byte

slide-33
SLIDE 33

Security and Privacy Group

Our side-channel

  • ptimized model

architecture yield 16 high accuracy model in 5 epoch as expect

  • n this easy use-case
slide-34
SLIDE 34

Security and Privacy Group

How to fjnd where TinyAES is leaking using

  • ur model?

?

slide-35
SLIDE 35

Security and Privacy Group

Section 3

Deep-learning explainability

slide-36
SLIDE 36

Security and Privacy Group

...

A classic vision model prediction

Boxer Tiger cat

slide-37
SLIDE 37

Security and Privacy Group

Why did the model predict a tiger cat and a boxer? ?

slide-38
SLIDE 38

Security and Privacy Group

Why did the model predict a tiger cat and dog? ? Explainability to the rescue:

Boxer

Explainer

slide-39
SLIDE 39

Security and Privacy Group

Why did the model predict a tiger cat and dog? ? Explainability to the rescue:

Tiger cat

slide-40
SLIDE 40

Security and Privacy Group

Identifying errors and biases

Unmasking Clever Hans Predictors and Assessing What Machines Really Learn

slide-41
SLIDE 41

Security and Privacy Group

How do I use explainability and combine it with dynamic analysis to debug leakages? ?

slide-42
SLIDE 42

Security and Privacy Group

Section 4

Finding leakage

  • rigin with SCALD
slide-43
SLIDE 43

Security and Privacy Group

Target emulator

SCALD: Game plan

Annotated code

SCALD: Game plan

Explainer Model Traces + predictions Leakage map Target emulator (cpu + fjrmware) Annotated code

slide-44
SLIDE 44

Security and Privacy Group

Many explainability techniques exists

Sanity Checks for Saliency Maps - Adebayo et al.

slide-45
SLIDE 45

Security and Privacy Group

Which explainability techniques work best? ?

slide-46
SLIDE 46

Security and Privacy Group

Aggregate, fjlter, and normalize Reduce to key spikes

Leak maps

slide-47
SLIDE 47

Security and Privacy Group

Byte 0 leak map visualization for various techniques

SNR Grad Cam++ Activations maps

slide-48
SLIDE 48

Security and Privacy Group

Benchmarking key explainability techniques

Test traces model Leak map mask top n points

Accuracy decrease

slide-49
SLIDE 49

Security and Privacy Group

Benchmark results: lower is betuer

Byte 0 SNR Byte 7

57% 44%

Byte 0 Activation maps Byte 7

58% 95%

Byte 0 Grad Cam++ Byte 7

58% 95%

Baseline

100%

Preliminary results - 4 points masked

slide-50
SLIDE 50

Security and Privacy Group

Explainability techniques don’t work betuer than SNR and have very noisy leak maps

slide-51
SLIDE 51

Security and Privacy Group

Develop a technique tailored to leakage explanation

slide-52
SLIDE 52

Security and Privacy Group

Custom code? Really?

slide-53
SLIDE 53

Security and Privacy Group

SCALD explainer combines paruitioned and convolutive

  • cclusion for speed

and precise leakage pinpointing

SCALD leakage map Byte 0 Byte 7

slide-54
SLIDE 54

Security and Privacy Group

Benchmark results: lower is betuer

Byte 0 SNR Byte 7

57% 44%

Byte 0 Activation maps Byte 7

58% 95%

Byte 0 Grad Cam++ Byte 7

58% 95%

Baseline

100%

Preliminary results - 4 points masked

SCALD

17% 42%

slide-55
SLIDE 55

Security and Privacy Group

SCALD

byte 0 leak maps comparaison: the SCALD map is visibly cleaner

SNR Gradcam

slide-56
SLIDE 56

Security and Privacy Group

SCALD custom explainability technique decreases accuracy the most and generate low noise leak map

slide-57
SLIDE 57

Security and Privacy Group

How do you go from the leakage map to code? ?

slide-58
SLIDE 58

Security and Privacy Group

state automaton FW CPU

From traces to CPU instructions

Leakage map Mapped ASM

slide-59
SLIDE 59

Security and Privacy Group

Code mapper

From CPU instructions to code

Mapped ASM Debug symbol Firmware Code leakage mapping

slide-60
SLIDE 60

Security and Privacy Group

Theory looks great but how hard is it in practice? ?

slide-61
SLIDE 61

Security and Privacy Group

Requirements

An explanation technique that have single point precision

We need to isolate the exact few points of the traces that cause most of the leakage as some instruction only take one cycle or two (4 or 8 traces points)

An emulator that have single cycle precision

We need to map each instruction to its exact cycle to be able to map them to the

  • trace. A single error and the entire analysis is wrong as all instruction will be shifued.

A bit of computation

You need a 1M data point dataset, 16 models, 16 explanations, 1 full target execution and 1 mapping. With all our optimization this is requires a few days of computation that are parallelizable.

slide-62
SLIDE 62

Security and Privacy Group

This level of explainability and emulation precision seems out-of reach

slide-63
SLIDE 63

Security and Privacy Group

Model targeting sub_bytes_in are expected to mostly exploit leakage in the AddRoundKey() function

STM32F4 - TinyAES

slide-64
SLIDE 64

Security and Privacy Group

Scald analysis result output TinyAES aes.c line 213 is exactly the sub_byte_in

  • peration! SCALD perfectly identify the main

source of leakage.

slide-65
SLIDE 65

Security and Privacy Group

SCALD is able to automatically isolate the exact code vulnerable to a given SCAAML side-channel atuack

slide-66
SLIDE 66

Security and Privacy Group

SCALD annotated code

empowers developers to quickly fjgure out what to patch and focus on developing stronger crypto

slide-67
SLIDE 67

Security and Privacy Group

SCAAML atuacks allows to pergorm SOTA SCA atuacks automatically AI for side-channel is still a nascent fjeld with a lot of exciting

  • pporuunities

SCALD use AI to fjnd automatically leakage

  • rigin - reducing

development cost

Takeaways

slide-68
SLIDE 68

Security and Privacy Group

Keep up with our research on deep-learning for side-channel atuacks: htups://elie.net/scaaml