Attack and Improvement of a Secure S-box Calculation Based on the - PowerPoint PPT Presentation

8 + Attack and Improvement of a Secure S-box Calculation Based on the Fourier Transform ebastien Coron 1 , Christophe Giraud 2 , Emmanuel Prouff 2 , and Jean-S´ Matthieu Rivain 1 , 2 1 University of Luxembourg 2 Oberthur Technologies August 11, 2008 J.-S. Coron, C. Giraud, E. Prouff, and M. Rivain Attack and Improvement of the FT-Based S-box Calculation

Outline 8 + Preliminaries 1 S-box Masking Based on the Fourier Transform 2 Differential Power Analysis vs. Biased Masking 3 DPA against the FT-Based S-box Masking 4 Improved FT-Based S-box Masking 5 Conclusion 6 J.-S. Coron, C. Giraud, E. Prouff, and M. Rivain Attack and Improvement of the FT-Based S-box Calculation

Outline 8 + Preliminaries 1 S-box Masking Based on the Fourier Transform 2 Differential Power Analysis vs. Biased Masking 3 DPA against the FT-Based S-box Masking 4 Improved FT-Based S-box Masking 5 Conclusion 6 J.-S. Coron, C. Giraud, E. Prouff, and M. Rivain Attack and Improvement of the FT-Based S-box Calculation

Differential Power Analysis (DPA) 8 + DPA Basics Physical leakage dependent on intermediate variables Sensitive variable depends on both the input plaintext and on a guessable part of the secret key DPA exploits the physical leakage on a sensitive variable for key recovery J.-S. Coron, C. Giraud, E. Prouff, and M. Rivain Attack and Improvement of the FT-Based S-box Calculation

Differential Power Analysis (DPA) 8 + DPA Basics Physical leakage dependent on intermediate variables Sensitive variable depends on both the input plaintext and on a guessable part of the secret key DPA exploits the physical leakage on a sensitive variable for key recovery DPA Security Every intermediate variable is independent of any sensitive variable. J.-S. Coron, C. Giraud, E. Prouff, and M. Rivain Attack and Improvement of the FT-Based S-box Calculation

Masking & S-box protection issue 8 + Masking Countermeasure Every sensitive variable Z is masked with a random value R masked variable � Z = Z ⊕ R and mask R both independent of Z Masked variables and masks processed separately Completeness: Z = � Z ⊕ R J.-S. Coron, C. Giraud, E. Prouff, and M. Rivain Attack and Improvement of the FT-Based S-box Calculation

Masking & S-box protection issue 8 + Masking Countermeasure Every sensitive variable Z is masked with a random value R masked variable � Z = Z ⊕ R and mask R both independent of Z Masked variables and masks processed separately Completeness: Z = � Z ⊕ R Masking a block cipher requires the masking of: ◮ the key additions ◮ the linear transformations ◮ the substitution boxes (S-boxes) J.-S. Coron, C. Giraud, E. Prouff, and M. Rivain Attack and Improvement of the FT-Based S-box Calculation

Masking & S-box protection issue 8 + Masking Countermeasure Every sensitive variable Z is masked with a random value R masked variable � Z = Z ⊕ R and mask R both independent of Z Masked variables and masks processed separately Completeness: Z = � Z ⊕ R Masking a block cipher requires the masking of: ◮ the key additions ◮ the linear transformations ◮ the substitution boxes (S-boxes) Key addition Masked Var. Mask Z ⊕ R ⊕ R = Z J.-S. Coron, C. Giraud, E. Prouff, and M. Rivain Attack and Improvement of the FT-Based S-box Calculation

Masking & S-box protection issue 8 + Masking Countermeasure Every sensitive variable Z is masked with a random value R masked variable � Z = Z ⊕ R and mask R both independent of Z Masked variables and masks processed separately Completeness: Z = � Z ⊕ R Masking a block cipher requires the masking of: ◮ the key additions ◮ the linear transformations ◮ the substitution boxes (S-boxes) Key addition Masked Var. Mask Z ⊕ R ⊕ K ⊕ R = Z ⊕ K J.-S. Coron, C. Giraud, E. Prouff, and M. Rivain Attack and Improvement of the FT-Based S-box Calculation

Masking & S-box protection issue 8 + Masking Countermeasure Every sensitive variable Z is masked with a random value R masked variable � Z = Z ⊕ R and mask R both independent of Z Masked variables and masks processed separately Completeness: Z = � Z ⊕ R Masking a block cipher requires the masking of: ◮ the key additions ◮ the linear transformations ◮ the substitution boxes (S-boxes) Linear transformation Masked Var. Mask Z ⊕ R ⊕ R = Z J.-S. Coron, C. Giraud, E. Prouff, and M. Rivain Attack and Improvement of the FT-Based S-box Calculation

Masking & S-box protection issue 8 + Masking Countermeasure Every sensitive variable Z is masked with a random value R masked variable � Z = Z ⊕ R and mask R both independent of Z Masked variables and masks processed separately Completeness: Z = � Z ⊕ R Masking a block cipher requires the masking of: ◮ the key additions ◮ the linear transformations ◮ the substitution boxes (S-boxes) Linear transformation Masked Var. Mask L ( Z ⊕ R ) ⊕ L ( R ) = L ( Z ) J.-S. Coron, C. Giraud, E. Prouff, and M. Rivain Attack and Improvement of the FT-Based S-box Calculation

Masking & S-box protection issue 8 + Masking Countermeasure Every sensitive variable Z is masked with a random value R masked variable � Z = Z ⊕ R and mask R both independent of Z Masked variables and masks processed separately Completeness: Z = � Z ⊕ R Masking a block cipher requires the masking of: ◮ the key additions ◮ the linear transformations ◮ the substitution boxes (S-boxes) Substitution box Issue: From Z ⊕ R and R , compute F ( Z ) ⊕ R ′ . All intermediate var. must be independent of Z . J.-S. Coron, C. Giraud, E. Prouff, and M. Rivain Attack and Improvement of the FT-Based S-box Calculation

Outline 8 + Preliminaries 1 S-box Masking Based on the Fourier Transform 2 Differential Power Analysis vs. Biased Masking 3 DPA against the FT-Based S-box Masking 4 Improved FT-Based S-box Masking 5 Conclusion 6 J.-S. Coron, C. Giraud, E. Prouff, and M. Rivain Attack and Improvement of the FT-Based S-box Calculation

S-box Masking Based on the Fourier Transform 8 + Prouff, Giraud, and Aumonier in CHES 2006 : Provably Secure S-Box Implementation Based on Fourier Transform J.-S. Coron, C. Giraud, E. Prouff, and M. Rivain Attack and Improvement of the FT-Based S-box Calculation

S-box Masking Based on the Fourier Transform 8 + Prouff, Giraud, and Aumonier in CHES 2006 : Provably Secure S-Box Implementation Based on Fourier Transform The Fourier Transform of a ( n × n ) S-box F is defined by: � F ( a )( − 1) a · Z . � F ( Z ) = a ∈ F n 2 J.-S. Coron, C. Giraud, E. Prouff, and M. Rivain Attack and Improvement of the FT-Based S-box Calculation

S-box Masking Based on the Fourier Transform 8 + Prouff, Giraud, and Aumonier in CHES 2006 : Provably Secure S-Box Implementation Based on Fourier Transform The Fourier Transform of a ( n × n ) S-box F is defined by: � F ( a )( − 1) a · Z . � F ( Z ) = a ∈ F n 2 It satisfies � � F = 2 n F , that is: � F ( Z ) = 1 F ( Z ) = 1 � � F ( a )( − 1) a · Z � 2 n 2 n a ∈ F n 2 J.-S. Coron, C. Giraud, E. Prouff, and M. Rivain Attack and Improvement of the FT-Based S-box Calculation

S-box Masking Based on the Fourier Transform 8 + S-box Masking Based on the Fourier Transform Inputs: a masked var. � Z = Z ⊕ R 1 , a mask R 1 , a look-up table � F Outputs: a masked output F ( Z ) ⊕ R 3 , a mask R 3 � F ( Z ) = 1 � F ( a )( − 1) a · Z 2 n a ∈ F n 2 J.-S. Coron, C. Giraud, E. Prouff, and M. Rivain Attack and Improvement of the FT-Based S-box Calculation

S-box Masking Based on the Fourier Transform 8 + S-box Masking Based on the Fourier Transform Inputs: a masked var. � Z = Z ⊕ R 1 , a mask R 1 , a look-up table � F Outputs: a masked output F ( Z ) ⊕ R 3 , a mask R 3 � Z · R 1 F ( Z ) = 1 � F ( a )( − 1) a · � Z ⊕ R 1 · ( a ⊕ � � Z ) ( − 1) 2 n a ∈ F n 2 J.-S. Coron, C. Giraud, E. Prouff, and M. Rivain Attack and Improvement of the FT-Based S-box Calculation

S-box Masking Based on the Fourier Transform 8 + S-box Masking Based on the Fourier Transform Inputs: a masked var. � Z = Z ⊕ R 1 , a mask R 1 , a look-up table � F Outputs: a masked output F ( Z ) ⊕ R 3 , a mask R 3 � Z ⊕ R 2 ) · R 1 F ( Z ) = 1 ( − 1) ( � F ( a )( − 1) a · � Z ⊕ R 1 · ( a ⊕ � � Z ⊕ R 2 ) 2 n a ∈ F n 2 J.-S. Coron, C. Giraud, E. Prouff, and M. Rivain Attack and Improvement of the FT-Based S-box Calculation

S-box Masking Based on the Fourier Transform 8 + S-box Masking Based on the Fourier Transform Inputs: a masked var. � Z = Z ⊕ R 1 , a mask R 1 , a look-up table � F Outputs: a masked output F ( Z ) ⊕ R 3 , a mask R 3 ( − 1) ( � Z ⊕ R 2 ) · R 1 F ( Z )+ R 3 mod 2 n = � Z ⊕ R 2 ) mod2 2 n � � 1 F ( a )( − 1) a · � Z ⊕ R 1 · ( a ⊕ � � 2 n R 3 + R 4 + 2 n a ∈ F n 2 J.-S. Coron, C. Giraud, E. Prouff, and M. Rivain Attack and Improvement of the FT-Based S-box Calculation