Introdution to Physical Cryptanalysis ASK 2014 Victor LOMNE ANSSI - - PowerPoint PPT Presentation

▶
introdution to physical cryptanalysis
SMART_READER_LITE
LIVE PREVIEW

Introdution to Physical Cryptanalysis ASK 2014 Victor LOMNE ANSSI - - PowerPoint PPT Presentation

Sep 17, 2023 93 likes •821 views

Introdution to Physical Cryptanalysis ASK 2014 Victor LOMNE ANSSI (French Network and Information Security Agency) Saturday, December 20 th , 2014 Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections|

slide-1
SLIDE 1

Introdution to Physical Cryptanalysis

ASK 2014

Victor LOMNE

ANSSI (French Network and Information Security Agency) Saturday, December 20th, 2014

slide-2
SLIDE 2

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections|

Agenda

1

Introduction

  • a. Embedded Systems
  • b. Security Models

2

Side Channel Attacks (SCA)

  • a. Side Channels
  • b. Cryptanalysis Techniques
  • c. SCA on Commercial Products

3

Fault Attacks (FA)

  • a. Fault Injection Means
  • b. Cryptanalysis Techniques
  • c. Real World Attacks

4

Combined Attacks

  • a. Use Case
  • b. Principle

5

Protections

  • a. SCA Protections
  • b. FA Protections
  • c. Certification

1/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-3
SLIDE 3

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Embedded Systems| Security Models|

Agenda

1

Introduction

  • a. Embedded Systems
  • b. Security Models

2

Side Channel Attacks (SCA)

  • a. Side Channels
  • b. Cryptanalysis Techniques
  • c. SCA on Commercial Products

3

Fault Attacks (FA)

  • a. Fault Injection Means
  • b. Cryptanalysis Techniques
  • c. Real World Attacks

4

Combined Attacks

  • a. Use Case
  • b. Principle

5

Protections

  • a. SCA Protections
  • b. FA Protections
  • c. Certification

2/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-4
SLIDE 4

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Embedded Systems| Security Models|

Context

Since the 90’s, increasing use of secure embedded devices

◮ 8G smartcard ICs sold in 2012 (SIM cards, credit cards ✿ ✿ ✿)

Strong cryptography from a mathematical point of view used to manage sensitive data

◮ AES, RSA, ECC, SHA-3 ✿ ✿ ✿ 3/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-5
SLIDE 5

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Embedded Systems| Security Models|

Secure Embedded devices

Functionalities:

◮ secure boot ◮ secure storage & execution of code

in confidentiality & integrity

◮ secure storage of sensitive data

in confidentiality & integrity

◮ secure implementation of crypto operations

Small set of commands ✮ reduce the Attack Surface

4/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-6
SLIDE 6

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Embedded Systems| Security Models|

Examples of Secure Embedded Devices

Smartcards (credit cards, USIM, e-passports ✿ ✿ ✿) Trusted Platform Modules (TPM) Smartphone secure elements Hard disk drives with HW encryption Set-Top Boxes Hardware Security Modules (HSM) Wireless sensors network ✿ ✿ ✿

5/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-7
SLIDE 7

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Embedded Systems| Security Models|

Agenda

1

Introduction

  • a. Embedded Systems
  • b. Security Models

2

Side Channel Attacks (SCA)

  • a. Side Channels
  • b. Cryptanalysis Techniques
  • c. SCA on Commercial Products

3

Fault Attacks (FA)

  • a. Fault Injection Means
  • b. Cryptanalysis Techniques
  • c. Real World Attacks

4

Combined Attacks

  • a. Use Case
  • b. Principle

5

Protections

  • a. SCA Protections
  • b. FA Protections
  • c. Certification

6/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-8
SLIDE 8

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Embedded Systems| Security Models|

Classical Cryptography

Black-Box Model assumed in classical cryptography:

◮ key(s) stored in the device ◮ cryptographic operations computed inside the device

PLAINTEXT

blablablablablabla blibliblibliblibliblibl bloblobloblobloblo blublublublublublu blyblyblyblyblybly

CIPHERTEXT

tO^à@:/!uYe#&²é" ccGt*µ$Bg;./rSdrtg ([jKé~-|kLm%*ø$tf vB:!§eR'{qZé~rt6- phçö^$"NhR([qSrT

black-box model

The attacker has only access to pairs of plaintexts / ciphertexts.

7/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-9
SLIDE 9

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Embedded Systems| Security Models|

Secure Cipher - Unsecure Implementation (1/2)

❬Kocher❪ ✭1996✮ ✮ exploitation of physical leakages

◮ cryptosystems integrated in CMOS technology ◮ physical leakages correlated with computed data

PLAINTEXT

blablablablablabla blibliblibliblibliblibl bloblobloblobloblo blublublublublublu blyblyblyblyblybly

CIPHERTEXT

tO^à@:/!uYe#&²é" ccGt*µ$Bg;./rSdrtg ([jKé~-|kLm%*ø$tf vB:!§eR'{qZé~rt6- phçö^$"NhR([qSrT

CRYPTOSYSTEM

gray-box model (spy the computation)

time power electromagnetic radiations vibrations light ...

The attacker has also access to physical leakages New class of attacks ✮ Side-Channel Attacks (SCA)

8/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-10
SLIDE 10

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Embedded Systems| Security Models|

Secure Cipher - Unsecure Implementation (2/2)

❬Boneh et al.❪ ✭1997✮ ✮ exploitation of faulty encryptions

◮ the attacker can generate faulty encryptions

PLAINTEXT

blablablablablabla blibliblibliblibliblibl bloblobloblobloblo blublublublublublu blyblyblyblyblybly

BAD CIPHERTEXT

tO^à@:/!uYe#&²é" ccGt*µ$toto/rSdrtg ([jKé~-|kLm%*ø$tf vB:!§eR'{UZé~rt6- phç%^$"NhR([qSrT

CRYPTOSYSTEM

gray-box model (perturbate the computation)

power glitch light eletromagnetic field ...

the attacker has access to correct & faulty ciphertexts New class of attacks ✮ Fault Attacks (FA)

9/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-11
SLIDE 11

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections|

Agenda

1

Introduction

  • a. Embedded Systems
  • b. Security Models

2

Side Channel Attacks (SCA)

  • a. Side Channels
  • b. Cryptanalysis Techniques
  • c. SCA on Commercial Products

3

Fault Attacks (FA)

  • a. Fault Injection Means
  • b. Cryptanalysis Techniques
  • c. Real World Attacks

4

Combined Attacks

  • a. Use Case
  • b. Principle

5

Protections

  • a. SCA Protections
  • b. FA Protections
  • c. Certification

10/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-12
SLIDE 12

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections|

Side Channel Cryptanalysis

SCA consist in measuring a physical leakage of a device when it handles sensitive information

◮ e.g. cryptographic keys

Handled info. are correlated with the physical leakage

◮ e.g. a register leaking as the Hamming Weight of its value

The attacker can then apply statistical methods to extract the secret from the measurements

◮ Simple Side-Channel Attacks (SSCA) ◮ Differential Side-Channel Attacks (DSCA) ◮ Template Attacks (TA) ◮ Collision-based Side-Channel Attacks ◮ ✿ ✿ ✿ 11/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-13
SLIDE 13

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Agenda

1

Introduction

  • a. Embedded Systems
  • b. Security Models

2

Side Channel Attacks (SCA)

  • a. Side Channels
  • b. Cryptanalysis Techniques
  • c. SCA on Commercial Products

3

Fault Attacks (FA)

  • a. Fault Injection Means
  • b. Cryptanalysis Techniques
  • c. Real World Attacks

4

Combined Attacks

  • a. Use Case
  • b. Principle

5

Protections

  • a. SCA Protections
  • b. FA Protections
  • c. Certification

12/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-14
SLIDE 14

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Physical Leakages exploited by SCA

Timing Attacks

(CRYPTO 96) - [Kocher] exploit the computational time of cryptographic operations

Power Analysis

(CRYPTO 99) - [Kocher et al.] exploit the power consumption of the IC

ElectroMagnetic Analysis

(CHES 01) - [Gandolfi et al.] exploit the electro-magnetic radiations of the IC

Acoustic Cryptanalysis

(2004) - [Shamir] exploit the sound emitted by the IC

Light Emission Analysis

(CHES 10) - [Di Battista et al.] exploit the light emission of the IC

13/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-15
SLIDE 15

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Measuring the Power Consumption of an IC (1/2)

Different means:

◮ shunt resistor ◮ current probe ◮ differential probe

Optional: Low Noise Amplifier ✦ amplify the signal Cost: low

14/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-16
SLIDE 16

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Measuring the Power Consumption of an IC (2/2)

The IC can filter the current switching The IC can be mounted on complex boards !!!

◮ Where is the power supply pin ? ◮ There is sometimes several power supply pins ✿ ✿ ✿ 15/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-17
SLIDE 17

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Measuring the EM Radiations of an IC (1/3)

When an IC is computing, current flows through the different metal layers to supply the gates. Maxwell equations ✮ current flowing through each metal rails creates an ElectroMagnetic field

16/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-18
SLIDE 18

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Measuring the EM Radiations of an IC (2/3)

Electromagnetic sensor:

◮ made of several coils of copper ◮ diameter of coils ✦ spatial precision ◮ number of coils ✦ increase the gain

Mandatory: Low Noise Amplifier ✦ amplify the signal Cost: low / medium

17/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-19
SLIDE 19

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Measuring the EM Radiations of an IC (3/3)

Examples of hand-made / commercial EM sensors:

18/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-20
SLIDE 20

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Digitizing the Side Channel Signal

Oscilloscope:

◮ frequency bandwidth ◮ sampling rate ◮ vertical sensibility ◮ precision of digitizing ◮ number & memory of channels

Cost: medium / high

19/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-21
SLIDE 21

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Triggering the Record

Mechanism allowing to trig the record of the signal just before the beginning of the targeted operation

◮ could be based on the sending of the command ◮ could be generated by a test code running on the IC

Most oscilloscopes have triggering capabilities Custom readers / electronic boards allow to communicate with the device & provide trigger capabilities

20/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-22
SLIDE 22

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Example 1 - AES encryption on a smartcard chip

21/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-23
SLIDE 23

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Example 2 - AES encryption on a FPGA

22/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-24
SLIDE 24

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Example 3 - Internal Authenticate on a smartcard

23/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-25
SLIDE 25

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Agenda

1

Introduction

  • a. Embedded Systems
  • b. Security Models

2

Side Channel Attacks (SCA)

  • a. Side Channels
  • b. Cryptanalysis Techniques
  • c. SCA on Commercial Products

3

Fault Attacks (FA)

  • a. Fault Injection Means
  • b. Cryptanalysis Techniques
  • c. Real World Attacks

4

Combined Attacks

  • a. Use Case
  • b. Principle

5

Protections

  • a. SCA Protections
  • b. FA Protections
  • c. Certification

24/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-26
SLIDE 26

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Some Pre-Processing Techniques

Signal Processing Techniques

◮ (smart) filtering ◮ Resynchronization

Dimension Reduction Techniques (research of Points Of Interest - POI)

◮ Signal-to-Noise-Ratio (SNR) ◮ Variance ◮ Principal Component Analysis (PCA) 25/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-27
SLIDE 27

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Resynchronization - Example (1/3)

26/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-28
SLIDE 28

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Resynchronization - Example (2/3)

27/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-29
SLIDE 29

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Resynchronization - Example (3/3)

28/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-30
SLIDE 30

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Generic SCA Flow

  • 1. Collect N side channel traces w. known inputs

t1 ✦ Enc✭p1❀ k✮❀ ✿ ✿ ✿ ❀ tN ✦ Enc✭pN ❀ k✮

  • 2. Choose sensitive variable depend. on input & secret

e.g. AES Sbox output ✦ v

❫ k i ❂ S✭pi ✟ ❫

k✮

  • 3. Choose a Leakage Model

e.g. Hamming Weight (H)

  • 4. Compute predictions for each key hypothesis

❫ k ❂ 0 ✦ H✭v

❫ k❂0 1

✮❀ ✿ ✿ ✿ ❀ H✭v

❫ k❂0 N

✮ ✿ ✿ ✿ ❫ k ❂ 255 ✦ H✭v

❫ k❂255 1

✮❀ ✿ ✿ ✿ ❀ H✭v

❫ k❂255 N

✮

  • 5. Use a distinguisher to discriminate the correct key

by comparing the N traces and the predictions

29/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-31
SLIDE 31

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

SCA flow and Leakage Model: 3 cases

  • 1. Select a priori a Leakage Model

◮ Hamming Weight, Hamming Distance ◮ Used in classical SCA (DPA, CPA, MIA, ✿ ✿ ✿)

  • 2. Select a priori a space of Leakage Models

◮ Attack will guess the correct model in selected space ◮ Used in Linear Regression Attack (LRA)

  • 3. Infer a Leakage Model through profiling before attack

◮ A preliminary step is performed on an open copy of the

device to build a leakage model for each key value

◮ Used in Template Attack (TA) 30/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-32
SLIDE 32

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Some Side Channel Attack Techniques (1/2)

Simple Power Analysis (SPA)

(CRYPTO 99) - [Kocher et al.] exploit one power trace to retrieve the key

Differential Power Analysis (DPA) (CRYPTO 99) - [Kocher et al.]

exploit several power traces to retrieve the key

Big Mac Attack

(CHES 01) - [Walter] extract private key from single exponentiation trace

Template Attack (TA)

(CHES 02) - [Chari et al.] build a dictionnary for all key values and use it to guess unknown key

Collision based SCA

(FSE 03) - [Schramm et al.] exploit a collision between two leakages

31/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-33
SLIDE 33

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Some Side Channel Attack Techniques (2/2)

Correlation Power Analysis (CPA)

(CHES 04) - [Brier et al.] similar to DPA with Pearson correlation

Stochastic Attacks

(CHES 05) - [Schindler et al.] retrieve the key and the leakage model through profiling

Horizontal Correlation Analysis

(ICICS 10) - [Clavier et al.] perform CPA on a single RSA exponentiation

Collision-Correlation based SCA

(CHES 10) - [Moradi et al.] compute a correlation between collisions

Linear Regression Analysis (LRA)

(JCEN 12) - [Doget et al.] similar to stochastic attack without profiling

32/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-34
SLIDE 34

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Some Side Channel Distinguishers

Difference of Means

(CRYPTO 99) - [Kocher et al.]

Maximum Likelihood

(CHES 02) - [Chari et al.]

Pearson Correlation

(CHES 04) - [Brier et al.]

Mutual Information

(CHES 07) - [Gierlichs et al.]

Student T-Test

(ICISC 08) - [Standaert et al.]

Magnitude Squared Coherence

(ePrint 11) - [Dehbaoui et al.]

Kolmogorov-Smirnov Test

(CARDIS 11) - [Whitnall et al.]

33/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-35
SLIDE 35

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Some Post-Processing Techniques

Partial Brute-Force Attack

◮ Require one pair of plaintext/ciphertext

Key Enumeration Algorithms (KEA)

◮ Require one pair of plaintext/ciphertext ◮ SCA rank subkey values from the most likely to the less ◮ KEA enumerates keys from this information ◮ KEA ❂ smart brute-force attack 34/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-36
SLIDE 36

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Example: SPA on RSA

35/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-37
SLIDE 37

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

Agenda

1

Introduction

  • a. Embedded Systems
  • b. Security Models

2

Side Channel Attacks (SCA)

  • a. Side Channels
  • b. Cryptanalysis Techniques
  • c. SCA on Commercial Products

3

Fault Attacks (FA)

  • a. Fault Injection Means
  • b. Cryptanalysis Techniques
  • c. Real World Attacks

4

Combined Attacks

  • a. Use Case
  • b. Principle

5

Protections

  • a. SCA Protections
  • b. FA Protections
  • c. Certification

36/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-38
SLIDE 38

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

SCA on Commercial Products (1/4)

KEELOQ (MICROCHIP)

◮ On the Power of Power Analysis in the Real World: A

Complete Break of the KEELOQ Code Hopping Scheme (CRYPTO 08) [Eisenbarth et al.]

◮ Proprietary NLFSR-based block cipher implemented in

  • HCSXXX memory modules (HW implem.)
  • PIC microcontrollers (SW implem.)

◮ Used in remote keyless entry systems

(garage door openers, car anti-theft systems)

◮ Successfull CPA attack in 10 traces ◮ Extraction of the manufacturer key 37/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-39
SLIDE 39

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

SCA on Commercial Products (2/4)

MIFARE DESFire (NXP)

◮ Breaking Mifare DESFire MF3ICD40: Power Analysis and

Templates in the Real World (CHES 11) [Oswald et al.]

◮ Contactless smartcard with HW 3DES co-processor ◮ Used for access control or public transport ◮ Successfull CPA attack in 250k traces ◮ Allow to clone the card ◮ NXP has discontinuited the product 38/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-40
SLIDE 40

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

SCA on Commercial Products (3/4)

Virtex II PRO (XILINX)

◮ On the Vulnerability of FPGA Bitstream Encryption against

Power Analysis Attacks: Extracting Keys from Xilinx Virtex-II FPGAs (CCS 11) [Moradi et al.]

◮ FPGA (SRAM) with HW 3DES co-processor ◮ Used for bitstream encryption ◮ Successfull CPA attack in 25k traces ◮ Allow to clone/modify the bitstream 39/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-41
SLIDE 41

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Side Channels| Cryptanalysis Techniques| SCA on Commercial Products|

SCA on Commercial Products (4/4)

ProASIC3 (ACTEL/MICROSEMI)

◮ In the Blink of an Eye: There Goes your AES key

(ePrint 12) [Skorobogatov et al.]

◮ FPGA (FLASH) with HW AES co-processor ◮ Used for bitstream encryption ◮ Use of a custom acquisition setup ◮ Successfull Pipeline Emission Analysis (PEA) in 0✿01s ◮ Allow to clone/modify the bitstream 40/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-42
SLIDE 42

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections|

Agenda

1

Introduction

  • a. Embedded Systems
  • b. Security Models

2

Side Channel Attacks (SCA)

  • a. Side Channels
  • b. Cryptanalysis Techniques
  • c. SCA on Commercial Products

3

Fault Attacks (FA)

  • a. Fault Injection Means
  • b. Cryptanalysis Techniques
  • c. Real World Attacks

4

Combined Attacks

  • a. Use Case
  • b. Principle

5

Protections

  • a. SCA Protections
  • b. FA Protections
  • c. Certification

41/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-43
SLIDE 43

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections|

Fault based Cryptanalysis

FA consist in perturbing the execution of the cryptographic operation in order to get faulty results Hypotheses are made on:

◮ the targeted intermediate value (IV) ◮ the effect of the injection on the IV

The attacker can then apply algorithmic methods to extract the secret from the obtained results (correct and/or faulty)

42/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-44
SLIDE 44

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Fault Injection Means| Cryptanalysis Techniques| Real World Attacks|

Agenda

1

Introduction

  • a. Embedded Systems
  • b. Security Models

2

Side Channel Attacks (SCA)

  • a. Side Channels
  • b. Cryptanalysis Techniques
  • c. SCA on Commercial Products

3

Fault Attacks (FA)

  • a. Fault Injection Means
  • b. Cryptanalysis Techniques
  • c. Real World Attacks

4

Combined Attacks

  • a. Use Case
  • b. Principle

5

Protections

  • a. SCA Protections
  • b. FA Protections
  • c. Certification

43/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-45
SLIDE 45

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Fault Injection Means| Cryptanalysis Techniques| Real World Attacks|

Fault Injection Means

Different means to inject a fault inside an IC:

◮ Inject a power glitch on the VCC of the IC ◮ Tamper the clock signal of the IC ◮ Inject a light beam inside the IC ◮ Inject an EM field inside the IC 44/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-46
SLIDE 46

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Fault Injection Means| Cryptanalysis Techniques| Real World Attacks|

Fault Injection Effects

Different effects when injecting a fault inside an IC:

◮ Set/reset/flip a bit stored inside a register or a memory ◮ Modify a value transiting on a bus ◮ Modify the current executed opcode ◮ Modify a current operand 45/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-47
SLIDE 47

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Fault Injection Means| Cryptanalysis Techniques| Real World Attacks|

Power glitch

Principle: under/over supply a device during a very short time Low-cost attack Well known technique at the golden age of pay-TV smartcard hackers Modern secure devices (e.g. smartcards) are protected against this attack path power pins filter the current to prevent under/over-powering

46/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-48
SLIDE 48

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Fault Injection Means| Cryptanalysis Techniques| Real World Attacks|

Tamper the clock

Principle: reduce the clock period at the clock cycle you want to disturb the device Low-cost attack Modern secure devices (e.g. smartcards) are protected against this attack path they generate their own clock internally

47/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-49
SLIDE 49

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Fault Injection Means| Cryptanalysis Techniques| Real World Attacks|

ElectroMagnetic Injection (EMI)

Principle: inject an electromagnetic field inside the device to disturb it EMI sensor is made of several coils of wire similar to SCA EM sensors A high power pulse generator is necessary to generate the power spike injected in the sensor

48/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-50
SLIDE 50

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Fault Injection Means| Cryptanalysis Techniques| Real World Attacks|

Light Injection

Principle: inject a light beam inside the device to disturb it Modern methods are based on laser It requires to open the device remove the package of the chip Laser attacks very powerful and difficult to thwart Countermeasures: light sensors

49/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-51
SLIDE 51

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Fault Injection Means| Cryptanalysis Techniques| Real World Attacks|

Agenda

1

Introduction

  • a. Embedded Systems
  • b. Security Models

2

Side Channel Attacks (SCA)

  • a. Side Channels
  • b. Cryptanalysis Techniques
  • c. SCA on Commercial Products

3

Fault Attacks (FA)

  • a. Fault Injection Means
  • b. Cryptanalysis Techniques
  • c. Real World Attacks

4

Combined Attacks

  • a. Use Case
  • b. Principle

5

Protections

  • a. SCA Protections
  • b. FA Protections
  • c. Certification

50/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-52
SLIDE 52

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Fault Injection Means| Cryptanalysis Techniques| Real World Attacks|

Fault Attack Techniques

Differential Fault Analysis (DFA) (CRYPTO 97) - [Shamir et al.]

◮ require to encrypt/sign two times the same message ◮ require to have one or several pairs of correct/wrong

ciphertext/signature corresponding to the same message

Safe Error Attack (SEA)

◮ require to encrypt/sign two times the same message ◮ similar to Template Attacks, they require an copy of the

target device that the adversary can fully controls

Statistical Fault Attack

(FDTC 13) - [Fuhr et al.]

◮ work even with a set of faulty ciphertexts corresponding

to different unknown plaintexts

◮ require a Fixed Fault Logical Effect 51/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-53
SLIDE 53

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Fault Injection Means| Cryptanalysis Techniques| Real World Attacks|

Classification of Fault Models

One can define a Fault Model as a function f such that: f ✿ x ✦ x ❄ e (1) x target variable, e fault logical effect and ❄ a logical

  • peration

Any Fault-based Cryptanalysis requires an Invariant ✮ new classification of FA based on the Invariant:

◮ FA based on a Fixed Fault Diffusion Pattern

DFA - e.g. [Piret+ 2003], [Mukhopadhyay+ 2009] ✿ ✿ ✿

◮ FA based on a Fixed Fault Logical Effect

Safe Error Attacks, Statistical Fault Attacks

52/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-54
SLIDE 54

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Fault Injection Means| Cryptanalysis Techniques| Real World Attacks|

Example: FA on RSA CRT

Consider a RSA CRT implementation, with

◮ N

❂ p✿q the public modulous

◮ e and d the public and private exponents s.t.

e✿d ❂ 1 mod✭✣✭N✮✮

The adversary generates two RSA signatures S and ⑦ S

◮ S

❂ M d mod N, a correct signature

◮ ⑦

S ❂ M d mod N, a faulted signature

The adversary can then factorize N to get p and q with gcd✭S

  • ⑦

S❀ N✮ ❂ q

53/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-55
SLIDE 55

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Fault Injection Means| Cryptanalysis Techniques| Real World Attacks|

Agenda

1

Introduction

  • a. Embedded Systems
  • b. Security Models

2

Side Channel Attacks (SCA)

  • a. Side Channels
  • b. Cryptanalysis Techniques
  • c. SCA on Commercial Products

3

Fault Attacks (FA)

  • a. Fault Injection Means
  • b. Cryptanalysis Techniques
  • c. Real World Attacks

4

Combined Attacks

  • a. Use Case
  • b. Principle

5

Protections

  • a. SCA Protections
  • b. FA Protections
  • c. Certification

54/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-56
SLIDE 56

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Fault Injection Means| Cryptanalysis Techniques| Real World Attacks|

Bug Attack

Pentium FDIV bug was a bug in the Intel P5 Pentium floating point unit (FPU) Because of the bug, the processor would return incorrect results for many calculations Nevertheless, bug is hard to detect 1 in 9 billion floating point divides with random parameters would produce inaccurate results Shamir proposed a modified version of the Bellcore attack which exploits this bug to retrieve a RSA private key More dangerous than a classical fault attack because can be perfomed remotely

55/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-57
SLIDE 57

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Fault Injection Means| Cryptanalysis Techniques| Real World Attacks|

PS3 Hack

George Hotz (a.k.a. Geohot) published in 2009 a hack of the Sony PS3 The otherOS functionnality of the PS3 allows to boot a Linux OS A bus glitch allows him to gain control of the hypervisor ✮ ring 0 access ✮ full memory access In consequence Sony took George Hotz to court Sony and Hotz had settled the lawsuit out of court, on the condition that Hotz would never again resume any hacking work on Sony products

56/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-58
SLIDE 58

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Use Case| Principle|

Outline

1

Introduction

  • a. Embedded Systems
  • b. Security Models

2

Side Channel Attacks (SCA)

  • a. Side Channels
  • b. Cryptanalysis Techniques
  • c. SCA on Commercial Products

3

Fault Attacks (FA)

  • a. Fault Injection Means
  • b. Cryptanalysis Techniques
  • c. Real World Attacks

4

Combined Attacks

  • a. Use Case
  • b. Principle

5

Protections

  • a. SCA Protections
  • b. FA Protections
  • c. Certification

57/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-59
SLIDE 59

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Use Case| Principle|

Combined Attacks: Use Case

Consider a cryptographic implementation secured by:

◮ a masking scheme such that SCA are unpracticable ◮ a duplication countermeasure to avoid FA

Is such an implementation really secure ?

◮ If one takes each attack path alone yes ! ◮ But if one mixes both attack paths . . . 58/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-60
SLIDE 60

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Use Case| Principle|

Outline

1

Introduction

  • a. Embedded Systems
  • b. Security Models

2

Side Channel Attacks (SCA)

  • a. Side Channels
  • b. Cryptanalysis Techniques
  • c. SCA on Commercial Products

3

Fault Attacks (FA)

  • a. Fault Injection Means
  • b. Cryptanalysis Techniques
  • c. Real World Attacks

4

Combined Attacks

  • a. Use Case
  • b. Principle

5

Protections

  • a. SCA Protections
  • b. FA Protections
  • c. Certification

59/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-61
SLIDE 61

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Use Case| Principle|

Combined Attacks: Principle

Combined Attacks exploit the side-channel leakage

  • f a faulty encryption to bypass both SCA and FA CM

Examples:

◮ Combined Attack of [Clavier+ 2010]

targets 1st order masked AES implementation

◮ Combined Attack of [Roche+ 2011]

targets any masked AES implementation

◮ Combined Attack of [Giraud+ 2013]

targets a protected RSA implementation

Interestingly enough, up to now only FA based on a Fixed Fault Logical Effect have been extended to CA

60/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-62
SLIDE 62

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| Use Case| Principle|

Example: Combined Attack of [Roche+ 2011]

Encrypt N plaintexts P1 ✿ ✿ ✿ PN and keep the N ciphertexts C1 ✿ ✿ ✿ CN Encrypt the N plaintexts once again by injecting a fault during the penultimate round of the Key-Schedule and record the leakage traces ✡1 ✿ ✿ ✿ ✡N Exploit the side-channel leakage of the faulty ciphertext: k ❂ argmax✭✚✭HW ✭SB✭SB1✭C i

j ✟ ❫

k✮ ✟ ❫ e9✮ ✟ ❫ k ✟ ❫ e10✮❀ ✡i✮✮ The attack will work if the fault has the effect of a XOR with a non negligible rate

61/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-63
SLIDE 63

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| SCA Protections| FA Protections|

Outline

1

Introduction

  • a. Embedded Systems
  • b. Security Models

2

Side Channel Attacks (SCA)

  • a. Side Channels
  • b. Cryptanalysis Techniques
  • c. SCA on Commercial Products

3

Fault Attacks (FA)

  • a. Fault Injection Means
  • b. Cryptanalysis Techniques
  • c. Real World Attacks

4

Combined Attacks

  • a. Use Case
  • b. Principle

5

Protections

  • a. SCA Protections
  • b. FA Protections
  • c. Certification

62/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-64
SLIDE 64

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| SCA Protections| FA Protections|

Hardware level

Add noise

◮ jittered clock ◮ noise generator ◮ ✿ ✿ ✿

Balance/Randomize leakage

◮ Balanced Dual Rail Logic ◮ Masked/Random Dual Rail Logic ◮ Asynchronous Logic 63/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-65
SLIDE 65

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| SCA Protections| FA Protections|

Algorithmic Level

Random delay insertion Dummy instruction/operation insertion Schuffling operations Masking techniques

◮ boolean masking ◮ arithmetic masking ◮ exponent blinding ◮ ✿ ✿ ✿ 64/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-66
SLIDE 66

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| SCA Protections| FA Protections|

Outline

1

Introduction

  • a. Embedded Systems
  • b. Security Models

2

Side Channel Attacks (SCA)

  • a. Side Channels
  • b. Cryptanalysis Techniques
  • c. SCA on Commercial Products

3

Fault Attacks (FA)

  • a. Fault Injection Means
  • b. Cryptanalysis Techniques
  • c. Real World Attacks

4

Combined Attacks

  • a. Use Case
  • b. Principle

5

Protections

  • a. SCA Protections
  • b. FA Protections
  • c. Certification

65/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-67
SLIDE 67

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| SCA Protections| FA Protections|

Hardware level

Analog level

◮ jittered clock ◮ glitch detector ◮ light detector ◮ ✿ ✿ ✿

Digital level

◮ Redundant Logic ◮ Store a value and its complementary ◮ Error Detecting Codes ◮ ✿ ✿ ✿ 66/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-68
SLIDE 68

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| SCA Protections| FA Protections|

Algorithmic Level

Random delay insertion Dummy instruction/operation insertion Schuffling operations Redundancy techniques Infection techniques

67/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-69
SLIDE 69

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| SCA Protections| FA Protections|

Outline

1

Introduction

  • a. Embedded Systems
  • b. Security Models

2

Side Channel Attacks (SCA)

  • a. Side Channels
  • b. Cryptanalysis Techniques
  • c. SCA on Commercial Products

3

Fault Attacks (FA)

  • a. Fault Injection Means
  • b. Cryptanalysis Techniques
  • c. Real World Attacks

4

Combined Attacks

  • a. Use Case
  • b. Principle

5

Protections

  • a. SCA Protections
  • b. FA Protections
  • c. Certification

68/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-70
SLIDE 70

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| SCA Protections| FA Protections|

Certification Schemes

Procedure to evaluate the security level of a product Three actors: the developper / the security lab / the scheme Some certification schemes:

◮ Common Critera ◮ EMVCo ◮ CSPN ◮ ✿ ✿ ✿ 69/70 Victor LOMNE - ANSSI / Physical Cryptanalysis

slide-71
SLIDE 71

Introduction| Side Channel Attacks (SCA)| Fault Attacks (FA)| Combined Attacks| Protections| SCA Protections| FA Protections|

Questions ?

contact: victor.lomne@ssi.gouv.fr

70/70 Victor LOMNE - ANSSI / Physical Cryptanalysis