A Multi-Round Side Channel Attack on AES using Belief Propagation - - PowerPoint PPT Presentation

▶
a multi round side channel attack on aes using belief
SMART_READER_LITE
LIVE PREVIEW

A Multi-Round Side Channel Attack on AES using Belief Propagation - - PowerPoint PPT Presentation

Apr 30, 2023 136 likes •315 views

A Multi-Round Side Channel Attack on AES using Belief Propagation Hlne Le Bouder 1 Ronan Lashermes 1 Yanis Linge 2 Gal Thomas 3 Jean Yves Zie 1 INRIA Rennes, LHS/PEC 2 STMicroelectronics 3 Orange Labs Issy Les Moulineaux October 25th, 2016

slide-1
SLIDE 1

A Multi-Round Side Channel Attack on AES using Belief Propagation

Hélène Le Bouder1 Ronan Lashermes1 Yanis Linge2 Gaël Thomas3 Jean Yves Zie

1 INRIA Rennes, LHS/PEC 2 STMicroelectronics 3 Orange Labs Issy Les Moulineaux

October 25th, 2016

A Multi-Round Side Channel Attack on AES using Belief Propagation Le Bouder et al. October 25th, 2016 1/17

slide-2
SLIDE 2

Context

Evaluate the power of Side-Channels Analyses.

A Multi-Round Side Channel Attack on AES using Belief Propagation Le Bouder et al. October 25th, 2016 2/17

slide-3
SLIDE 3

Introduction

Side Channel Attacks on block ciphers : physical values of a device leak information about intermediate state of the cipher. Typical SCA links texts and measurements. Restricted on the first or last round.

T

SB SR K0

EM

A Multi-Round Side Channel Attack on AES using Belief Propagation Le Bouder et al. October 25th, 2016 3/17

slide-4
SLIDE 4

Motivation

Case of an attacker who can just observe leakages. No access to the device input and output. No template.

A Multi-Round Side Channel Attack on AES using Belief Propagation Le Bouder et al. October 25th, 2016 4/17

slide-5
SLIDE 5

Overview of SCAs

Divide-and-Conquer (DC) methods Attack one key byte at a time E.g. DPA, CPA, MIA,. . . Enumeration to combine different key bytes Global methods Model whole algorithm and leakages Solve using SAT-solver, Gröbner bases or Belief Propagation (BP)

A Multi-Round Side Channel Attack on AES using Belief Propagation Le Bouder et al. October 25th, 2016 5/17

slide-6
SLIDE 6

Our Contribution

New side channel attack. The attacker only knows AES is running and is able to synchronize. No plain/ciphertexts, no template. No SPA on the Key Expansion, Round keys have already been precomputed. DC approach with two leakages to find a round key byte. Possible on any middle round of AES. Combine information over multiple rounds using BP .

A Multi-Round Side Channel Attack on AES using Belief Propagation Le Bouder et al. October 25th, 2016 6/17

slide-7
SLIDE 7

Target cipher: AES

128-bit block cipher with 128-bit key. SB non-linear S-box, SR and MC linear layer. 11 rounds keys Kr, r ∈ [

[0, 10] ].

K0 master key, Kr+1 derived from Kr using KeyExpansion.

  • - - - - - - - - - - - - - - - - - - - - - - - rounds 1 to 9
  • - - - - - - - - - - - - - - - - - - - - - - - round 0
  • - - - - - - - - - - - - - - - - - - - - - - - round 10

T

SB SR MC SB SR

C

K0 Kr K10 A Multi-Round Side Channel Attack on AES using Belief Propagation Le Bouder et al. October 25th, 2016 7/17

slide-8
SLIDE 8

Attack Path

Find two leakages for each round key. Chose the most leaking functions. Output of MC at round r. Output of SB at round r + 1. Use the Hamming Weight (HW) model.

MC SB SR X Y Kr EM(X) EM(Y)

A Multi-Round Side Channel Attack on AES using Belief Propagation Le Bouder et al. October 25th, 2016 8/17

slide-9
SLIDE 9

Does it works? (noise-free case)

Denote ˆ k the correct key byte. For a pair of HW (hx, hy), let K(hx,hy) be the set of possible keys for that pair. Repeat for every input value x, and build

K(ˆ

k) = 255

x=0 K(hx,hy).

The 256 sets K(ˆ k) are pair-wise different.

MC SB SR X Y Kr EM(X) EM(Y)

K(hx,hy) = {k s.t. ∃x ∈ HW −1(hx) and HW (SB (k ⊕ x)) = hy}

A Multi-Round Side Channel Attack on AES using Belief Propagation Le Bouder et al. October 25th, 2016 9/17

slide-10
SLIDE 10

Noisy Case

Leakage considered as Hamming Weight (HW) with Gaussian noise h′

z = hz + δ

with δ sampled from N

  • 0, σ2

Z

  • .

Goal: given n measurements {(h′

x, h′ y)}n,

estimate Ak = Pr

  • K = k|{(h′

x, h′ y)}n

  • .

Use Bayesian inference to derive it from Pr [(hx, hy)|K = k] and pdf of N(0, σ2

Z). X K Y HX HY H′

X

H′

Y

Ak ∝

n

  • i=1
  • (hx,hy)

FσX

  • h′

x,i − hx

  • ·FσY
  • h′

y,i − hy

  • ·Pr [(hx, hy)|K = k]

.

A Multi-Round Side Channel Attack on AES using Belief Propagation Le Bouder et al. October 25th, 2016 10/17

slide-11
SLIDE 11

Crossing information using Belief Propagation

Previous analysis can be conducted on every byte of every middle round key. Round keys linked by the relations of KeyExpansion (KE). Use BP to tie information together. Expected to work well because of KE sparse structure. Good at handling errors (inspired from coding theory).

A Multi-Round Side Channel Attack on AES using Belief Propagation Le Bouder et al. October 25th, 2016 11/17

slide-12
SLIDE 12

BP in a nutshell

BP relies on a bipartite graph: key bytes and equations of KE. To each node in the graph is associated some information. Nodes exchange information with their neighbours. Use Bayesian inference to improve their own knowledge. Iterate process to propagate information through the graph.

Eℓ+1,3

r

Eℓ,1

r−1

Eℓ,0

r

Eℓ,1

r

Eℓ,0

r+1

Eℓ,1

r+1

K ℓ,0

r

K ℓ,1

r

K ℓ,0

r+1

K ℓ+1,3

r−1

K ℓ,0

r−1

K ℓ+1,3

r

K ℓ,1

r−1

S S

A Multi-Round Side Channel Attack on AES using Belief Propagation Le Bouder et al. October 25th, 2016 12/17

slide-13
SLIDE 13

Simulation Results 1: on a single byte

Randomly generated HW pairs with Gaussian noise N(0, σ2). Different noise values σ, different numbers of traces n. Average rank of the good key byte ˆ k, for 100 simulated attacks and for each possible value of ˆ k, without BP.

n \ σ 0.1 0.2 0.3 0.5 1.0 1.5 2.0 3.0 100 1.2 1.3 2.3 14 66 96 107 119 1000 1 1 1 1 7.1 35 66 97 10000 1 1 1 1 1 2.2 12 48 100000 1 1 1 1 1 1 1.1 7.3

A Multi-Round Side Channel Attack on AES using Belief Propagation Le Bouder et al. October 25th, 2016 13/17

slide-14
SLIDE 14

Simulation Results 2: on the whole cipher using BP

Minimum (over the 9 round keys) Hamming distance between the guessed round key and the correct round key, with BP.

n \ σ 0.1 0.2 0.3 0.5 1.0 1.5 2.0 3.0 100 59 51 53 54 1000 39 46 51 10000 40 100000

Improvement due to BP

n \ σ 0.1 0.2 0.3 0.5 1.0 1.5 2.0 3.0 100

  • ×

× × × 1000

  • ×

× × 10000

  • ×

100000

  • A Multi-Round Side Channel Attack on AES using Belief Propagation

Le Bouder et al. October 25th, 2016 14/17

slide-15
SLIDE 15

Conclusion

New SCA with only leakage measurements, no text, no template. Combine the divide-and-conquer (DC) and global strategies. DC to score each round-key byte separately. Global using Belief Propagation to aggregate the knowledge

  • n the round-key bytes.

Simulation results shows the attack is effective. The hybrid approach, DC on key bytes, BP on KE, yield a good trade-off in efficiency vs computation cost. Beware of the amount of information that can be extracted from side-channels.

A Multi-Round Side Channel Attack on AES using Belief Propagation Le Bouder et al. October 25th, 2016 15/17

slide-16
SLIDE 16

Future works

The elephant in the room: is a noisy-leakage gaussian? Is it a good approximation? Requires practical experiments for confirmation. May the attack be adapted to accept other noise distribution? Future of SCA: take into account all leakages, not only one moment (the time dimension should not have a special treatment).

A Multi-Round Side Channel Attack on AES using Belief Propagation Le Bouder et al. October 25th, 2016 16/17

slide-17
SLIDE 17

Thank you!

Any questions? Our logo collection:

A Multi-Round Side Channel Attack on AES using Belief Propagation Le Bouder et al. October 25th, 2016 17/17