Blind Source Separation from Single Measurements using Singular - PowerPoint PPT Presentation

Blind Source Separation from Single Measurements using Singular Spectrum Analysis CHES 2015 14.Sept.2015, Saint-Malo, France Santos Merino del Pozo and Fran¸ cois-Xavier Standaert ICTEAM/ELEN/Crypto Group Universit´ e catholique de Louvain, Belgium. UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 Microelectronics Laboratory

Because Noise Matters ◮ More noise → More side-channel measurements UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 1 Microelectronics Laboratory

Because Noise Matters ◮ More noise → More side-channel measurements ◮ attacks become more challenging ◮ critical for higher-order (HO) attacks !! UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 1 Microelectronics Laboratory

Because Noise Matters ◮ More noise → More side-channel measurements ◮ attacks become more challenging ◮ critical for higher-order (HO) attacks !! ◮ Ideally, low-noise measurements UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 1 Microelectronics Laboratory

Because Noise Matters ◮ More noise → More side-channel measurements ◮ attacks become more challenging ◮ critical for higher-order (HO) attacks !! ◮ Ideally, low-noise measurements ◮ can be difficult to achieve in practice ◮ architecture, countermeasures, measurement setup, ... UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 1 Microelectronics Laboratory

Because Noise Matters ◮ More noise → More side-channel measurements ◮ attacks become more challenging ◮ critical for higher-order (HO) attacks !! ◮ Ideally, low-noise measurements ◮ can be difficult to achieve in practice ◮ architecture, countermeasures, measurement setup, ... ◮ So, preprocessing the collected traces is always advisable UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 1 Microelectronics Laboratory

State-of-the-Art: Perks and Pitfalls ◮ Averaging ◮ Digital filtering ◮ PCA and LDA UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 2 Microelectronics Laboratory

State-of-the-Art: Perks and Pitfalls ◮ Averaging ✔ easy yet effective ✘ useless when exploiting HO leakages ◮ Digital filtering ◮ PCA and LDA UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 2 Microelectronics Laboratory

State-of-the-Art: Perks and Pitfalls ◮ Averaging ✔ easy yet effective ✘ useless when exploiting HO leakages ◮ Digital filtering ✔ relevant for HO analysis ✘ not trivial to design ◮ PCA and LDA UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 2 Microelectronics Laboratory

State-of-the-Art: Perks and Pitfalls ◮ Averaging ✔ easy yet effective ✘ useless when exploiting HO leakages ◮ Digital filtering ✔ relevant for HO analysis ✘ not trivial to design ◮ PCA and LDA ✔ intuitive and easy to implement ✘ requires profiling, extension to HO analysis? UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 2 Microelectronics Laboratory

Our Solution ◮ Blind source separation using Singular Spectrum Analysis (SSA) UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 3 Microelectronics Laboratory

Our Solution ◮ Blind source separation using Singular Spectrum Analysis (SSA) ◮ Disregarded in the context of side-channel analysis ◮ Cool features from the attackers point-of-view ◮ working in a per-trace fashion ◮ being readily applied to HO scenarios ◮ not requiring proficiency in signal processing ◮ not needing a profiling stage UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 3 Microelectronics Laboratory

Outline Singular Spectrum Analysis 101 Experimental Results Masked software Unprotected hardware Conclusions UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 4 Microelectronics Laboratory

SSA 101 - Decomposition � ℓ 1 , . . . , ℓ N � So you got a noisy leakage trace ℓ = ◮ First, take W = ⌊ log ( N ) c ⌋ with c ∈ [1 . 5 , 3], ◮ define D = N − W + 1 delayed vectors UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 5 Microelectronics Laboratory

SSA 101 - Decomposition � ℓ 1 , . . . , ℓ N � So you got a noisy leakage trace ℓ = ◮ First, take W = ⌊ log ( N ) c ⌋ with c ∈ [1 . 5 , 3], ◮ define D = N − W + 1 delayed vectors ℓ 1 ℓ 2 . . . ℓ W UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 5 Microelectronics Laboratory

SSA 101 - Decomposition � ℓ 1 , . . . , ℓ N � So you got a noisy leakage trace ℓ = ◮ First, take W = ⌊ log ( N ) c ⌋ with c ∈ [1 . 5 , 3], ◮ define D = N − W + 1 delayed vectors ℓ 1 ℓ 2 ℓ 2 ℓ 3 . . . . . . ℓ W +1 ℓ W UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 5 Microelectronics Laboratory

SSA 101 - Decomposition � ℓ 1 , . . . , ℓ N � So you got a noisy leakage trace ℓ = ◮ First, take W = ⌊ log ( N ) c ⌋ with c ∈ [1 . 5 , 3], ◮ define D = N − W + 1 delayed vectors ℓ 1 ℓ 2 ℓ D · · · ℓ 2 ℓ 3 ℓ D +1 · · · . . . ... . . . . . . ℓ W +1 ℓ W · · · ℓ N UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 5 Microelectronics Laboratory

SSA 101 - Decomposition � ℓ 1 , . . . , ℓ N � So you got a noisy leakage trace ℓ = ◮ First, take W = ⌊ log ( N ) c ⌋ with c ∈ [1 . 5 , 3], ◮ define D = N − W + 1 delayed vectors ◮ and then build the so-called trajectory matrix L   ℓ 1 ℓ 2 ℓ D · · · ℓ 2 ℓ 3 ℓ D +1 · · ·   L =  . . .  ... . . .   . . .   ℓ W ℓ W +1 ℓ N · · · UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 5 Microelectronics Laboratory

SSA 101 - Decomposition Compute the eigenvalues of LL ⊤ ◮ ( λ 1 ≥ · · · ≥ λ d ), the so-called singular spectrum ◮ d = W if none of them is zero together with the corresponding eigenvectors u 1 , u 2 , . . . , u d UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 6 Microelectronics Laboratory

SSA 101 - Decomposition Compute the eigenvalues of LL ⊤ ◮ ( λ 1 ≥ · · · ≥ λ d ), the so-called singular spectrum ◮ d = W if none of them is zero together with the corresponding eigenvectors u 1 , u 2 , . . . , u d The SVD decomposition of L is L = ˜ L 1 + · · · + ˜ L d , L i = √ λ i u i v ⊤ i and v i = L ⊤ u i such that ˜ √ λ i UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 6 Microelectronics Laboratory

SSA 101 - Reconstruction Now, we are ready to extract the underlying components of ℓ ◮ Each ˜ L i matrix is transformed into the i -th component � � ˜ ˜ i , . . . , ˜ ℓ 1 ℓ N ℓ i = i UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 7 Microelectronics Laboratory

SSA 101 - Reconstruction Now, we are ready to extract the underlying components of ℓ ◮ Each ˜ L i matrix is transformed into the i -th component � � ˜ ˜ i , . . . , ˜ ℓ 1 ℓ N ℓ i = i ◮ Trivial when ˜ L i is a Hankel matrix, i.e., ˜ ˜ ˜ ℓ 1 ℓ 2 ℓ 3  · · ·  i i i ˜ ˜ ℓ 2 ℓ 3 · · · · · ·   i i ˜ L i = .  ...  . ˜ ˜ ℓ 3 ℓ N − 1 .   i i   . . . . ˜ ˜ ℓ N − 1 ℓ N . . i i UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 7 Microelectronics Laboratory

SSA 101 - Reconstruction Now, we are ready to extract the underlying components of ℓ ◮ Each ˜ L i matrix is transformed into the i -th component � � ˜ ˜ i , . . . , ˜ ℓ 1 ℓ N ℓ i = i ◮ Trivial when ˜ L i is a Hankel matrix, i.e., ˜ ˜ ˜ ℓ 1 ℓ 2 ℓ 3  · · ·  i i i ˜ ˜ ℓ 2 ℓ 3 · · · · · ·   i i ˜ L i = .  ...  . ˜ ˜ ℓ 3 ℓ N − 1 .   i i   . . . . ˜ ˜ ℓ N − 1 ℓ N . . i i ◮ but since this is not the case, the so-called hankelization function must be applied on each ˜ L i UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 7 Microelectronics Laboratory

SSA 101 - Reconstruction Lastly, the original leakage trace ℓ can be reconstructed as ℓ = ˜ ℓ 1 + · · · + ˜ ℓ d UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 8 Microelectronics Laboratory

SSA 101 - Reconstruction Lastly, the original leakage trace ℓ can be reconstructed as ◮ but we aim at a signal vs. noise decomposition ℓ = ˜ ℓ 1 + · · · + ˜ ℓ d UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 8 Microelectronics Laboratory

SSA 101 - Reconstruction Lastly, the original leakage trace ℓ can be reconstructed as ◮ but we aim at a signal vs. noise decomposition ◮ I = { 1 , . . . , d } is partitioned into I signal and I noise , ℓ = ˜ ℓ 1 + · · · + ˜ ℓ d UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 8 Microelectronics Laboratory

SSA 101 - Reconstruction Lastly, the original leakage trace ℓ can be reconstructed as ◮ but we aim at a signal vs. noise decomposition ◮ I = { 1 , . . . , d } is partitioned into I signal and I noise , so � ˜ � ˜ ℓ = ℓ i + ℓ i i ∈I signal i ∈I noise UCL Crypto Group Santos Merino del Pozo - CHES 2015 - 14.Sept.2015 8 Microelectronics Laboratory