Eff Efficient Entr icient Entropy opy Est Estimation imation for - PowerPoint PPT Presentation

Efficient entropy estimation for MIA using B-splines Eff Efficient Entr icient Entropy opy Est Estimation imation for for Mutua Mutual l Information Information Analys Analysis is using using B-splines splines Alexandre VENELLI IML – ERISCS ATMEL Secure Microcontroller Solutions Université de la Méditerranée Rousset, FRANCE Marseille, FRANCE

Efficient entropy estimation for MIA using B-splines Outl Outline ine  Differential side-channel attacks – Power analysis  Mutual Information Analysis  Proposed B-splines estimation technique  Experimental results  Conclusion WISTP 2010 2

Efficient entropy estimation for MIA using B-splines Di Differen fferenti tial al side side-channel channel attac attack workflow workflow WISTP 2010 3

Efficient entropy estimation for MIA using B-splines Power Po wer an analysis alysis and and leak leakag age mod model el  Messerges et al. 1999 power consumption  Linear relation between power consumption and Hamming Weight of a processed data.   P ( t ) a . H ( M ) b time WISTP 2010 4

Efficient entropy estimation for MIA using B-splines Some Some statisti statistica cal tests tests use used in p in prac racti tice ce ( (1) 1)  Kocher et al. 1999  Simplified T-Test (distance of means)  Brier et al. 2004  Pearson correlation factor,  Correlation Power Analysis (CPA) WISTP 2010 5

Efficient entropy estimation for MIA using B-splines Some Some statisti statistica cal tests tests use used in p in prac racti tice ce ( (2) 2)  Gierlichs et al. 2008  Mutual Information Analysis (MIA) + histograms  Veyrat-Charvillon et al. 2009  Cramér-von Mises test (nonparametric)  This presentation  MIA + B-splines estimation (nonparametric) WISTP 2010 6

Efficient entropy estimation for MIA using B-splines Remaind Remainder er on on i info nformation rmation the theory ory  Let X be a random variable with M X possible states X i with i = {1…M X }. M  X   Entropy of X: H ( X ) p ( X ) log( p ( X )) i i  i 1  Mutual information:   I ( X ; Y ) H ( X ) H ( X Y )     I ( X ; Y ) H ( X ) H ( Y ) H ( X , Y )  WISTP 2010 7

Efficient entropy estimation for MIA using B-splines Prob Problem lem : : estimating estimating mutua mutual information information  Mutual Information:  very powerful,  yet difficult to estimate.  Using the definition of entropy, the density has to be estimated.  Goal: estimate a density given a finite number of data points drawn from that density function.  Different approaches:  histograms, kernel density estimation, … WISTP 2010 8

Efficient entropy estimation for MIA using B-splines Hi Histog stogram ram ba base sed estimation estimation - Easy to calculate and - Systematic errors due understand. to the finite size of the dataset. WISTP 2010 9

Efficient entropy estimation for MIA using B-splines MIA MIA vs vs CPA CPA  Figure taken from : Moradi A, Mousavi N, Paar C, Salmasizadeh M. A Comparative Study of Mutual Information Analysis under a Gaussian Assumption. Information Security Applications. 2009:193 – 205. WISTP 2010 10

Efficient entropy estimation for MIA using B-splines Wha What are are B B-sp spli line ne fun function ctions ? (1) ? (1) Degr Degree ee-0 0 basis basis fun functions ctions 1.5 WISTP 2010 11

Efficient entropy estimation for MIA using B-splines Wha What are are B B-sp spli line ne fun function ctions ? (2) ? (2) Degr Degree ee-1 1 basis basis fun functions ctions 1.5 WISTP 2010 12

Efficient entropy estimation for MIA using B-splines Wha What are are B B-sp spli line ne fun function ctions ? (3) ? (3) Degr Degree ee-2 2 basis basis fun functions ctions 1.5 WISTP 2010 13

Efficient entropy estimation for MIA using B-splines B-sp spli line nes for MI estimation for MI estimation  Idea proposed by Daub et al. 2004 in the context of medical studies.  Instead of using a step function with histograms, a polynomial B-spline function is used to weight a data point.  Hence, data points can be in one or several intervals. WISTP 2010 14

Efficient entropy estimation for MIA using B-splines MI MI estimation estimation i in n the the pre prese senc nce of no of noise ise His Histogr tograms ams 1.5 2.5 WISTP 2010 15

Efficient entropy estimation for MIA using B-splines MI MI estimation estimation i in n the the pre prese senc nce of no of noise ise Degr Degree ee-2 2 B-spline spline fun functions ctions 1.5 2.5 WISTP 2010 16

Efficient entropy estimation for MIA using B-splines B-sp spli line nes for MI estimation for MI estimation - Better efficiency than - Slower to compute histograms than histograms - Interesting propriety for side-channel WISTP 2010 17

Efficient entropy estimation for MIA using B-splines Cr Cramé amér-vo von Mi Mise ses s wi with th B-sp spli line nes  Cramér-von Mises test in Veyrat-Charvillon et al. 2009.  Its needs cumulative density functions.  B-splines can be used to estimate these density functions. WISTP 2010 18

Efficient entropy estimation for MIA using B-splines Exp Experimental erimental resu result lts  Metrics to measure the efficiency of side-channel attacks by Standaert et al. 2008:  first order success rate : given a number of traces, the probability that the correct hypothesis is the first best hypothesis of an attack.  guessed entropy : average position of the correct hypothesis in the sorted hypothesis vector of an attack  Attacks efficiency tested with 2 different setups:  on « DPA Contest 2008/2009 a » power curves of a DES,  on power curves acquired on a Atmel STK600 board with a ATmega2560 chip of a multiprecision multiplication. a: HTTP :// WWW . DPACONTEST . ORG WISTP 2010 19

Efficient entropy estimation for MIA using B-splines DES DES – DPA DPA Contes Contest 20 2008 08/200 /2009 First ord First order er su succ cces ess rate rate WISTP 2010 20

Efficient entropy estimation for MIA using B-splines DES DES – DPA DPA Contes Contest 20 2008 08/200 /2009 Gue Guess ssed ed En Entrop tropy WISTP 2010 21

Efficient entropy estimation for MIA using B-splines Multi Multiplication plication – ST STK600 K600 / / At Atmeg mega 2560 2560 First First ord order er su succ cces ess rate rate WISTP 2010 22

Efficient entropy estimation for MIA using B-splines Multi Multiplication plication – ST STK600 K600 / / At Atmeg mega 2560 2560 Gue Guess ssed ed en entrop tropy WISTP 2010 23

Efficient entropy estimation for MIA using B-splines Conc Conclusion lusion  B-splines offer a lot more efficiency than classical histograms for an acceptable computational overhead.  However MIA still is not as performant as CPA on most platforms.  A New Hope:  Other efficient entropy estimators,  Higher order side-channel analysis. WISTP 2010 24

Efficient entropy estimation for MIA using B-splines Ques Questi tion ons s ? WISTP 2010 25