SLIDE 1
A Stochastic Approach in Side-Channel Analysis in the Presence of Masking
- W. Schindler
- W. Schindler
May 22, 2007 Slide 2
A Stochastic Approach in Side-Channel Analysis in the Presence of - - PowerPoint PPT Presentation
A Stochastic Approach in Side-Channel Analysis in the Presence of - - PowerPoint PPT Presentation
FIRST TALK A Stochastic Approach in Side-Channel Analysis in the Presence of Masking W. Schindler Bundesamt f r Sicherheit in der Informationstechnik (BSI), Bonn, Germany Barcelona, May 22, 2007 Power attacks on a block cipher
SLIDE 2
SLIDE 3
- W. Schindler
May 22, 2007 Slide 3
The Stochastic Approach (Example: Power attack on AES)
x ∈ {0,1}8 (known) part or the plaintext or ciphertext z ∈ {0,1}8 masking value k ∈ {0,1}8 subkey t time
deterministic part (depends on x,z,k)
= ht(x,z;k) +
quantifies the random- ness of the side-channel signal at time t Random variable (depends on x,z,k)
It(x,z;k)
Noise Random variable
Rt
E(Rt) = 0
Time t:
SLIDE 4
- W. Schindler
May 22, 2007 Slide 4
r
Naïve Approach: Estimate ht(x,z;k) = E (It(x,z;k)) independently for each triple (x,z;k) ∈ {0,1}8 × {0,1}8 × {0,1}8 for all t ∈ { t1,t2,…,tm } (relevant instants)
r
Drawback: Gigantic number of measurements 1st Profiling Step: Estimation of ht (.,.,.)
SLIDE 5
- W. Schindler
May 22, 2007 Slide 5
ht;k
Fu;t geometric visualization
r For any fixed subkey k interpret the function
ht;k(·,·): {0,1}8 × {0,1}8 → R, ht;k(·,·) = ht(·,·;k), as an element of a real vector space F.
r Approximate ht;k(·,·) by its image h*t;k under the
- rthogonal projection onto a suitably chosen low-
dimensional vector subspace Fu;t More efficient procedure ht;k
*
.
SLIDE 6
- W. Schindler
May 22, 2007 Slide 6
r (clou) The image h*t;k minimizes a functional on the
vector subspace Fu;t
r (Qualitative) conjectures on the reasons for the
leakage signal → subspace Fu;t
r Typical vector space dimensions (→ Example)
r dim(F ) = 216 r dim(Fu;t ) = 9 or 17
h*t;k can be determined without knowing h (.,.,.k)
SLIDE 7
- W. Schindler
May 22, 2007 Slide 7
Comparison with Template Attacks Non-masking case:
r introduced by Schindler, Lemke, Paar (CHES 2005) r extensive experimental studies by Gierlichs, Lemke,
Paar (CHES 2006)
r Compared to template attacks:
reduces the number of measurements in the profiling phase up to factor 50 Masking case: The advantages of the stochastic approach are even by an order of magnitude larger than in the non- masking case.
SLIDE 8
- W. Schindler
May 22, 2007 Slide 8
Summary The stochastic approach
r reduces the profiling workload by order(s) of
magnitude
r combines engineer’s insight into the reasons for the
leakage (→ suitability of the subspace Fu;t) with precise stochastic methods (→ optimal approximator in Fu;t )
r identifies and quantifies those properties that have
significant impact on the side-channel signal
r supports constructively the design of security
implementations
SLIDE 9
- W. Schindler
May 22, 2007 Slide 9
Contact
Bundesamt für Sicherheit in der Informationstechnik (BSI) Werner Schindler Godesberger Allee 185-189 53175 Bonn Tel: +49 (0)3018-9582-5652 Fax: +49 (0)3018-10-9582-5652 Werner.Schindler@bsi.bund.de www.bsi.bund.de www.bsi-fuer-buerger.de
SLIDE 10
A Stochastic Model for Particular Designs of Physical RNGs with Robust Entropy Estimators
Wolfgang Killmann 1, Werner Schindler 2
1 T-Systems GEI GmbH
Bonn, Germany
2 Bundesamt für Sicherheit in
der Informationstechnik (BSI) Bonn, Germany
Barcelona, May 22, 2007
SECOND TALK
SLIDE 11
- W. Schindler
May 22, 2007 Slide 11
Generic Design
rn+1 = rn + sw(n+1) (mod 2)
rn (random bit)
# switches in time period n+1
SLIDE 12
- W. Schindler
May 22, 2007 Slide 12
Summary
r Goal: Determine the conditional entropy
H(Rn+1 | R1, ...,Rn)
r We formulated and analysed a stochastic model of
the noise source.
r We derived robust entropy estimators, yielding
practically useful lower entropy bounds. Practical experiments: 105 random bits / sec (limitations by the USB interface) entropy / random bit > 1 - 10-5
SLIDE 13
- W. Schindler
May 22, 2007 Slide 13