Analysis and Improvement of Differential Computation Attacks against - - PowerPoint PPT Presentation

▶
analysis and improvement of differential computation
SMART_READER_LITE
LIVE PREVIEW

Analysis and Improvement of Differential Computation Attacks against - - PowerPoint PPT Presentation

Sep 06, 2023 361 likes •800 views

Analysis and Improvement of Differential Computation Attacks against Internally-Encoded White-Box Implementations Matthieu Rivain 1 Junwei Wang 1,2,3 1 CryptoExperts 2 University of Luxembourg 3 University Paris 8 CHES 2019, Atalanta White-Box

slide-1
SLIDE 1

Analysis and Improvement of Differential Computation Attacks against Internally-Encoded White-Box Implementations

Matthieu Rivain 1 Junwei Wang 1,2,3

1CryptoExperts 2University of Luxembourg 3University Paris 8

CHES 2019, Atalanta

slide-2
SLIDE 2

White-Box Threat Model

Goal: to extract a cryptographic key, · · · Where: from a software impl. of cipher Who: malwares, co-hosted applications, user

themselves, · · ·

How: (by all kinds of means)

◮ analyze the code ◮ spy on the memory ◮ interfere the execution ◮ · · · 2

slide-3
SLIDE 3

White-Box Threat Model

Goal: to extract a cryptographic key, · · · Where: from a software impl. of cipher Who: malwares, co-hosted applications, user

themselves, · · ·

How: (by all kinds of means)

◮ analyze the code ◮ spy on the memory ◮ interfere the execution ◮ · · ·

In theory: no provably secure white-box scheme for standard block ciphers.

2

slide-4
SLIDE 4

Typical Applications

Digital Content Distribution videos, music, games, e-books, · · · Host Card Emulation mobile payment without a secure element

slide-5
SLIDE 5

Typical Applications

Digital Content Distribution videos, music, games, e-books, · · · Host Card Emulation mobile payment without a secure element

In practice: heuristic solutions / security through obscurity

slide-6
SLIDE 6

Internal Encoding Countermeasure [SAC02]

X R1 R2 Rr Y

. . .

  • 1. Represent the cipher into a network of transformations

4

slide-7
SLIDE 7

Internal Encoding Countermeasure [SAC02]

X R1 ε1 R2 ε2

ε−1

1

Rr

ε−1

r−1

Y

. . .

pairwise annihilating parasitic functions (e.g. encodings)

  • 1. Represent the cipher into a network of transformations
  • 2. Obfuscate the network by encoding adjacent transformations

4

slide-8
SLIDE 8

Internal Encoding Countermeasure [SAC02]

X R1 ε1 R2 ε2

ε−1

1

Rr

ε−1

r−1

Y

. . .

pairwise annihilating parasitic functions (e.g. encodings)

look-up tables

  • 1. Represent the cipher into a network of transformations
  • 2. Obfuscate the network by encoding adjacent transformations
  • 3. Store the encoded transformations into look-up tables

4

slide-9
SLIDE 9

Attacks in This Talk

1 Differential Computation Analysis 2 Collision Attack

5

slide-10
SLIDE 10

Differential Computation Analysis [CHES16]

plaintext ciphertext

gray-box model

side-channel leakages (noisy)

e.g. power/EM/time/· · ·

plaintext ciphertext

white-box model

computational leakage (perfect)

e.g. registers/accessed memory/· · ·

6

slide-11
SLIDE 11

Differential Computation Analysis [CHES16]

Differential power analysis techniques on computational leakages

group by predictions collect traces

ϕk ( · ) = ϕk ( · ) = 1

average trace differential trace

Implying strong linear correlation between the sensitive vari- ables and the leaked samples in the computational traces.

7

slide-12
SLIDE 12

DCA Attack Limitations

  • 1. The seminal work [CHES16] lacks in-depth understanding of DCA
  • 2. The follow-up analysis [ACNS18] is

◮ partly experimental (in particular for wrong key guesses) ◮ Only known to work on nibble encodings ◮ Only known to work on the first and last rounds ◮ Success probability is unknown

  • 3. The computational traces are only sub-optimally exploited

8

slide-13
SLIDE 13

Internal Encoding Leakage

x ϕk(·) s input sensitive variable n m ε(·) v intermediate variable m m

A key-dependent (n, m) selection function ϕk in a block cipher A random selected m-bit bijection ε ε ◦ ϕk, as a result of some table look-ups, is leaked in the memory To exploit the leakage of ε ◦ ϕk, it is necessary that n > m

9

slide-14
SLIDE 14

DCA Analysis

Based on well-established theory – Boolean correlation, instead of dif- ference of means: for any key guess k ρk = Cor

  • ,
  • ϕk(·)

ε(·)

10

slide-15
SLIDE 15

DCA Analysis

Based on well-established theory – Boolean correlation, instead of dif- ference of means: for any key guess k ρk = Cor

  • ϕk(·)[i] ,
  • ϕk(·)

ε(·)

10

slide-16
SLIDE 16

DCA Analysis

Based on well-established theory – Boolean correlation, instead of dif- ference of means: for any key guess k ρk = Cor

  • ϕk(·)[i] ,

ε ◦ ϕk∗(·)[j]

  • ϕk(·)

ε(·)

10

slide-17
SLIDE 17

DCA Analysis

Based on well-established theory – Boolean correlation, instead of dif- ference of means: for any key guess k ρk = Cor

  • ϕk(·)[i] ,

ε ◦ ϕk∗(·)[j]

  • ϕk(·)

ε(·)

DCA success (roughly) requires:

  • ρk∗
  • > max

k×

  • ρk×
  • 10
slide-18
SLIDE 18

ρk∗ and ρk×: Distributions

Ideal assumption:

  • ϕk
  • k are mutually independent random (n, m) functions

11

slide-19
SLIDE 19

ρk∗ and ρk×: Distributions

Ideal assumption:

  • ϕk
  • k are mutually independent random (n, m) functions

Correct key guess k∗, ρk∗ = 22−mN∗ − 1 where N∗ ∼ HG(2m, 2m−1, 2m−1) . Only depends on m.

ϕk(·) ε(·) n m m

11

slide-20
SLIDE 20

ρk∗ and ρk×: Distributions

Ideal assumption:

  • ϕk
  • k are mutually independent random (n, m) functions

Correct key guess k∗, ρk∗ = 22−mN∗ − 1 where N∗ ∼ HG(2m, 2m−1, 2m−1) . Only depends on m. Incorrect key guess k×, ρk× = 22−nN× − 1 where N× ∼ HG(2n, 2n−1, 2n−1) . Only depends on n.

ϕk(·) ε(·) n m m

11

slide-21
SLIDE 21

Lemma

Lemma Let B(n) be the set of balanced n-bit Boolean function. If f ∈ B(n) and g

$

← − B(n) independent of f , then the balanceness of f + g is B(f + g) = 4 · N − 2n where N ∼ HG(2n, 2n−1, 2n−1) denotes the size of {x : f (x) = g(x) = 0}. With Cor(f + g) = 1 2n B(f + g) ⇒ ρk∗ = 22−mN∗ − 1 and ρk× = 22−nN× − 1 where N∗ ∼ HG(2m, 2m−1, 2m−1) and N× ∼ HG(2n, 2n−1, 2n−1) .

12

slide-22
SLIDE 22

ρk∗ and ρk×: Distributions

  • 0.75
  • 0.50
  • 0.25

0.25 0.50 0.75

0.1 0.2 0.3 0.4 n = 8, m = 4 PMF ρk∗ modeled ρk× modeled

13

slide-23
SLIDE 23

ρk∗ and ρk×: Distributions

  • 0.75
  • 0.50
  • 0.25

0.25 0.50 0.75

0.1 0.2 0.3 0.4 n = 8, m = 4 PMF ρk∗ modeled ρk× modeled 1,000 2,000 3,000 4,000 Counts ρk∗ simulated ρk× simulated

13

slide-24
SLIDE 24

DCA Success Rate: |ρk∗| > maxk× |ρk×|

4 6 8 10 12 14 16 0.25 0.5 0.75 n Pr

|ρk∗| > maxk× |ρk×|

  • m = 4

DCA success probability converges towards ≈ 1 − PrN∗ 2m−2 for n ≥ 2m + 2.

14

slide-25
SLIDE 25

DCA Success Rate: |ρk∗| > maxk× |ρk×|

4 6 8 10 12 14 16 0.25 0.5 0.75 n Pr

|ρk∗| > maxk× |ρk×|

  • m = 4

m = 5 m = 6 m = 7 m = 8 m = 9 m = 10 m = 11 m = 12

DCA success probability converges towards ≈ 1 − PrN∗ 2m−2 for n ≥ 2m + 2.

14

slide-26
SLIDE 26

Attack a NSC Variant: a White-Box AES

Byte encoding protected DCA has failed to break it before this work

15

slide-27
SLIDE 27

Attack a NSC Variant: a White-Box AES

Byte encoding protected DCA has failed to break it before this work Our approach: target a output byte of MixColumn in the first round

X1 X2

x1 x2

15

slide-28
SLIDE 28

Attack a NSC Variant: a White-Box AES

Byte encoding protected DCA has failed to break it before this work Our approach: target a output byte of MixColumn in the first round

X1 X2 ARK,SB

Sbox(x1 ⊕ k1) Sbox(x2 ⊕ k2) Sbox(k3) Sbox(k4)

15

slide-29
SLIDE 29

Attack a NSC Variant: a White-Box AES

Byte encoding protected DCA has failed to break it before this work Our approach: target a output byte of MixColumn in the first round

X1 X2 ARK,SB SR

Sbox(x1 ⊕ k1) Sbox(x2 ⊕ k2) Sbox(k3) Sbox(k4)

15

slide-30
SLIDE 30

Attack a NSC Variant: a White-Box AES

Byte encoding protected DCA has failed to break it before this work Our approach: target a output byte of MixColumn in the first round

X1 X2 ARK,SB SR MC

2 · Sbox(x1 ⊕ k1) ⊕ 3 · Sbox(x2 ⊕ k2) ⊕ Sbox(k3) ⊕ Sbox(k4)

15

slide-31
SLIDE 31

Attack a NSC Variant: a White-Box AES

Byte encoding protected DCA has failed to break it before this work Our approach: target a output byte of MixColumn in the first round

X1 X2 ARK,SB SR MC

2 · Sbox(x1 ⊕ k1) ⊕ 3 · Sbox(x2 ⊕ k2) ⊕ c

15

slide-32
SLIDE 32

Attack a NSC Variant: a White-Box AES

Byte encoding protected DCA has failed to break it before this work Our approach: target a output byte of MixColumn in the first round

X1 X2 ARK,SB SR MC

ϕk1||k2(x1||x2) = 2 · Sbox(x1 ⊕ k1) ⊕ 3 · Sbox(x2 ⊕ k2)

ε′ = ε ◦ ⊕c , n = 16, m = 8 , |K| = 216.

15

slide-33
SLIDE 33

Attack a NSC Variant: a White-Box AES

Attack results: ∼ 1800 traces Similar attack can be applied to a “masked” white-box implementation,

which intends to resist DCA.

16

slide-34
SLIDE 34

Attacks in This Talk

1 Differential Computation Analysis 2 Collision Attack

17

slide-35
SLIDE 35

Collision Attack

x1 x2 x3 x4

N inputs & raw traces

slide-36
SLIDE 36

Collision Attack

x1 x2 x3 x4

N inputs & raw traces

ψk(x1, x2) ψk(x1, x3) ψk(x1, x4) ψk(x2, x3) ψk(x2, x4) ψk(x3, x4)

N

2

  • collision predictions & traces

ψk(x1, x2) :=

  • ϕk(x1) = ϕk(x2)
slide-37
SLIDE 37

Collision Attack

x1 x2 x3 x4

N inputs & raw traces

ψk(x1, x2) ψk(x1, x3) ψk(x1, x4) ψk(x2, x3) ψk(x2, x4) ψk(x3, x4)

N

2

  • collision predictions & traces

Cor

  • ψk(·, ·) ,
  • ψk(x1, x2) :=
  • ϕk(x1) = ϕk(x2)
slide-38
SLIDE 38

Collision Attack: Explanation

Based on the principle: ϕk(x1) = ϕk(x2) ⇔ ε ◦ ϕk(x1) = ε ◦ ϕk(x2) Trace Complexity: N = O

  • 2

m 2

  • 19
slide-39
SLIDE 39

Collision Attack: Explanation

Predictions 1 2 3 4 5 6 key guesses k1 k∗ “collides”

  • ∀k×, k∗ and k× are not “isomorphic”

⇒ N = O

  • 2

m 2

  • 20
slide-40
SLIDE 40

Collision Attack: Explanation

Predictions 1 2 3 4 5 6 key guesses k1 k2 k3 k4 k∗ “collides”

  • ∀k×, k∗ and k× are not “isomorphic”

⇒ N = O

  • 2

m 2

  • 20
slide-41
SLIDE 41

Attack the NSC Variant

Same to DCA: targeting at one 1-st round MixColumn output byte Attack results: 60 traces 0.5 1 Sample Correlation

k× k∗ 21

slide-42
SLIDE 42

Conclusion

DCA against internal encodings has been analysed in depth

◮ Allows to attack wider encodings

Computation traces have been further exploited

◮ Showcase to attack variables beyond the first round of the cipher ◮ New class of collision attack with very low trace complexity

Hence, protecting AES with internal encodings in the beginning rounds is

insufficient

22

slide-43
SLIDE 43

Thank You !

ia.cr/2019/076