SLIDE 1
Implementing Practical leakage-resilient symmetric cryptography - - PDF document
Implementing Practical leakage-resilient symmetric cryptography - - PDF document
Implementing Practical leakage-resilient symmetric cryptography Daniel J. Bernstein University of Illinois at Chicago, Technische Universiteit Eindhoven CHES 2012 paper Practical leakage-resilient symmetric cryptography (Faust,
SLIDE 2
SLIDE 3
CHES 2012 paper “Practical leakage-resilient symmetric cryptography” (Faust, Pietrzak, Schipper) explains how to “protect against realistic side-channel attacks.” Sounds great! But is it secure?
SLIDE 4
CHES 2012 paper “Practical leakage-resilient symmetric cryptography” (Faust, Pietrzak, Schipper) explains how to “protect against realistic side-channel attacks.” Sounds great! But is it secure? Will an implementor doing what this paper says actually end up with a side-channel-protected cipher?
SLIDE 5
The TCC view: “What do you mean? It’s provably secure! We have proofs and theorems!”
SLIDE 6
The TCC view: “What do you mean? It’s provably secure! We have proofs and theorems!” Macbeth’s view: “It is a tale told by an idiot, full of sound and fury, signifying nothing.”
SLIDE 7
The TCC view: “What do you mean? It’s provably secure! We have proofs and theorems!” Macbeth’s view: “It is a tale told by an idiot, full of sound and fury, signifying nothing.” My view: Carefully evaluating side-channel security requires an implementation. ✮ Let’s implement the cipher.
SLIDE 8
Prerequisite: “❋”, a “PRF” (or a “weak PRF”) mapping a ❦-bit key and an ❵-bit nonce to a 2❦-bit output.
SLIDE 9
Prerequisite: “❋”, a “PRF” (or a “weak PRF”) mapping a ❦-bit key and an ❵-bit nonce to a 2❦-bit output. Hmmm, this is vague. What’s ❦? ❵? ❋? Practical cryptography requires complete specification.
SLIDE 10
Prerequisite: “❋”, a “PRF” (or a “weak PRF”) mapping a ❦-bit key and an ❵-bit nonce to a 2❦-bit output. Hmmm, this is vague. What’s ❦? ❵? ❋? Practical cryptography requires complete specification. My best guesses: ❦ = 128; ❵ = 127; ❋❑(♣) = AES❑(0♣) AES❑(1♣).
SLIDE 11
First-level cipher Γ: Input: 128-bit key ❑; standard random 32639-bit string ♣ = (♣0❀ ♣1❀ ✿ ✿ ✿ ❀ ♣255❀ ♣256); 256-bit nonce ♥ = (♥0❀ ♥1❀ ✿ ✿ ✿ ❀ ♥255).
SLIDE 12
First-level cipher Γ: Input: 128-bit key ❑; standard random 32639-bit string ♣ = (♣0❀ ♣1❀ ✿ ✿ ✿ ❀ ♣255❀ ♣256); 256-bit nonce ♥ = (♥0❀ ♥1❀ ✿ ✿ ✿ ❀ ♥255). Compute ❳0 = ❑, ❳1 = AES❳0(♥0♣0), ❳2 = AES❳1(♥1♣1), ✿ ✿ ✿, ❳256 = AES❳255(♥255♣255).
SLIDE 13
First-level cipher Γ: Input: 128-bit key ❑; standard random 32639-bit string ♣ = (♣0❀ ♣1❀ ✿ ✿ ✿ ❀ ♣255❀ ♣256); 256-bit nonce ♥ = (♥0❀ ♥1❀ ✿ ✿ ✿ ❀ ♥255). Compute ❳0 = ❑, ❳1 = AES❳0(♥0♣0), ❳2 = AES❳1(♥1♣1), ✿ ✿ ✿, ❳256 = AES❳255(♥255♣255). Output: 256-bit string AES❳256(♣2560) AES❳256(♣2561).
SLIDE 14
The final cipher: Input: 384-bit key ❑0❀ ❑1❀ ❑2; 512-bit plaintext (❛0❀ ❜0).
SLIDE 15
The final cipher: Input: 384-bit key ❑0❀ ❑1❀ ❑2; 512-bit plaintext (❛0❀ ❜0). Compute (❛1❀ ❜1) = (❛0❀ ❜0 ✟ Γ❑0(❛0)); (❛2❀ ❜2) = (❛1 ✟ Γ❑1(❜1)❀ ❜1); (❛3❀ ❜3) = (❛2❀ ❜2 ✟ Γ❑2(❛2)).
SLIDE 16
The final cipher: Input: 384-bit key ❑0❀ ❑1❀ ❑2; 512-bit plaintext (❛0❀ ❜0). Compute (❛1❀ ❜1) = (❛0❀ ❜0 ✟ Γ❑0(❛0)); (❛2❀ ❜2) = (❛1 ✟ Γ❑1(❜1)❀ ❜1); (❛3❀ ❜3) = (❛2❀ ❜2 ✟ Γ❑2(❛2)). Output: 512-bit ciphertext (❛3❀ ❜3).
SLIDE 17
I implemented this cipher during a talk this morning.
SLIDE 18
I implemented this cipher during a talk this morning. “Code simplicity?”
SLIDE 19
I implemented this cipher during a talk this morning. “Code simplicity?” Not bad, assuming AES is provided. I used AES from OpenSSL.
SLIDE 20
I implemented this cipher during a talk this morning. “Code simplicity?” Not bad, assuming AES is provided. I used AES from OpenSSL. “Validation status?”
SLIDE 21
I implemented this cipher during a talk this morning. “Code simplicity?” Not bad, assuming AES is provided. I used AES from OpenSSL. “Validation status?” Bad. Surely there are bugs. Practical cryptography requires test vectors.
SLIDE 22
I implemented this cipher during a talk this morning. “Code simplicity?” Not bad, assuming AES is provided. I used AES from OpenSSL. “Validation status?” Bad. Surely there are bugs. Practical cryptography requires test vectors. “Source of random ♣?”
SLIDE 23
I implemented this cipher during a talk this morning. “Code simplicity?” Not bad, assuming AES is provided. I used AES from OpenSSL. “Validation status?” Bad. Surely there are bugs. Practical cryptography requires test vectors. “Source of random ♣?” Bad. I used C’s random().
SLIDE 24
I implemented this cipher during a talk this morning. “Code simplicity?” Not bad, assuming AES is provided. I used AES from OpenSSL. “Validation status?” Bad. Surely there are bugs. Practical cryptography requires test vectors. “Source of random ♣?” Bad. I used C’s random(). I’m going to hell.
SLIDE 25
“Code availability?”
SLIDE 26
“Code availability?” Good. cr.yp.to/aesgonewild.html
SLIDE 27
“Code availability?” Good. cr.yp.to/aesgonewild.html “Speed?”
SLIDE 28
“Code availability?” Good. cr.yp.to/aesgonewild.html “Speed?” Horrifying. Encrypting 64 bytes: close to 1 million cycles
- n one core of my laptop.
SLIDE 29
“Code availability?” Good. cr.yp.to/aesgonewild.html “Speed?” Horrifying. Encrypting 64 bytes: close to 1 million cycles
- n one core of my laptop.
But faster than FHE.
SLIDE 30
“Code availability?” Good. cr.yp.to/aesgonewild.html “Speed?” Horrifying. Encrypting 64 bytes: close to 1 million cycles
- n one core of my laptop.