Leakage Squeezing Revisited Vincent Grosso 1 , Fran cois-Xavier - - PowerPoint PPT Presentation
Leakage Squeezing Revisited Vincent Grosso 1 , Fran cois-Xavier Standaert 1 , Emmanuel Prouff 2 . 1 ICTEAM/ELEN/Crypto Group, Universit e catholique de Louvain, Belgium. 2 ANSSI, 51 Bd de la Tour-Maubourg, 75700 Paris 07 SP, France. CARDIS
Vincent Grosso1, Fran¸ cois-Xavier Standaert1, Emmanuel Prouff2.
1 ICTEAM/ELEN/Crypto Group, Universit´
e catholique de Louvain, Belgium.
2 ANSSI, 51 Bd de la Tour-Maubourg, 75700 Paris 07 SP, France.
CARDIS 2013, Berlin.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
1 / 26
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
1 / 26
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
1 / 26
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
2 / 26
Let X be a variable and M a random value uniformly chosen among the possible values of X.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
2 / 26
Let X be a variable and M a random value uniformly chosen among the possible values of X. Then X can be shared with the vector (X ⊕ M, M).
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
2 / 26
Let X be a variable and M a random value uniformly chosen among the possible values of X. Then X can be shared with the vector (X ⊕ M, M). M is random ⇒ no information on X is available from the
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
2 / 26
Let X be a variable and M a random value uniformly chosen among the possible values of X. Then X can be shared with the vector (X ⊕ M, M). M is random ⇒ no information on X is available from the
X ⊕ M one-time-pad of X ⇒ no information on X is available from the observation of X ⊕ M.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
3 / 26
Traces contain information plus some noise.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
3 / 26
Unprotected device: unidimensional leakage is sufficient to mount an attack.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
3 / 26
Protected software device with 2 shares: ideally bi- dimensional leakages are sufficient to mount an attack.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
3 / 26
Protected software device with 3 shares: ideally tri- dimensional leakages are sufficient to mount an attack.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
3 / 26
Dimension of an attack : number of leakage points used.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
4 / 26
Let Xi be r random variables, then the central mixed moment of orders d1, . . . , dr is defined by: E((X1 − E(X1))d1 × · · · × (Xr − E(Xr))dr).
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
4 / 26
Let Xi be r random variables, then the central mixed moment of orders d1, . . . , dr is defined by: E((X1 − E(X1))d1 × · · · × (Xr − E(Xr))dr). The order of an attack is the smallest statical moment
i di) used in the attack.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
4 / 26
Let Xi be r random variables, then the central mixed moment of orders d1, . . . , dr is defined by: E((X1 − E(X1))d1 × · · · × (Xr − E(Xr))dr). The order of an attack is the smallest statical moment
i di) used in the attack.
If we have noisy random variables, the moment becomes harder to estimate as the order increases.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
5 / 26
⊲ Order
↔ data complexity.
⊲ Dimension
↔ computational complexity.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
5 / 26
⊲ Order
↔ data complexity.
⊲ Dimension
↔ computational complexity. The data complexity of a successful attack increases exponentially with the order of the attack (with noise as a basis).
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
6 / 26
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
7 / 26
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
8 / 26
⊲ Masking security holds if all masks are uniformly
distributed ⇒ strong randomness requirements in masked implementation. Leakage squeezing proposes to reduce the amount of entropy (i.e. the number of masks).
⊲ Less masks can lead to more efficient implementation ⊲ Preserved security order under two conditions:
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
9 / 26
⊲ Unidimensional leakage only 1 share, adversarial
condition:
What happen if adversary obtain leakage on both shares?
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
9 / 26
⊲ Unidimensional leakage only 1 share, adversarial
condition:
What happen if adversary obtain leakage on both shares? Similar security as uniform masking :)
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
9 / 26
⊲ Unidimensional leakage only 1 share, adversarial
condition:
What happen if adversary obtain leakage on both shares? Similar security as uniform masking :)
⊲ Linear leakage, physical condition:
adversary but not for evaluation
leakage function
What happen if the leakage function is not linear?
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
9 / 26
⊲ Unidimensional leakage only 1 share, adversarial
condition:
What happen if adversary obtain leakage on both shares? Similar security as uniform masking :)
⊲ Linear leakage, physical condition:
adversary but not for evaluation
leakage function
What happen if the leakage function is not linear? The security order decrease, depending on the degree
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
10 / 26
C12 = {0x03, 0x18, 0x3f, 0x55, 0x60, 0x6e, 0x8c, 0xa5, 0xb2, 0xcb, 0xd6, 0xf9} [NGD11]. Univariate security of
C16 = {0x10, 0x1f, 0x26, 0x29, 0x43, 0x4c, 0x75, 0x7a, 0x85, 0x8a, 0xb3, 0xbc, 0xd6, 0xd9, 0xe0, 0xef} [BCG13]. Univariate security of order 3, if linear leakage.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
11 / 26
⊲ Multivariate (higher dimension) attacks. ⇒
Adversarial condition. l1 = l(X ⊕ m) + N1,
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
11 / 26
⊲ Multivariate (higher dimension) attacks. ⇒
Adversarial condition. l1 = l(X ⊕ m) + N1, l2 = l(m) + N2
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
11 / 26
⊲ Multivariate (higher dimension) attacks. ⇒
Adversarial condition. l1 = l(X ⊕ m) + N1, l2 = l(m) + N2
⊲ Polynomial leakage. ⇒ Physical condition.
Let X be an internal value, Xi denotes the value of the ith bit of X. For a linear leakage ∃{ai}i s.t. l(X) =
i aiXi
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
11 / 26
⊲ Multivariate (higher dimension) attacks. ⇒
Adversarial condition. l1 = l(X ⊕ m) + N1, l2 = l(m) + N2
⊲ Polynomial leakage. ⇒ Physical condition.
Let X be an internal value, Xi denotes the value of the ith bit of X. For a polynomial leakage ∃{ai}i, {bi,j}i,j, . . . s.t. l(X) =
i aiXi
+
i
i
For uniform masking, polynomial leakage does not mix different shares. It has thus no incidence on security
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
12 / 26
⊲ Mutual information.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
12 / 26
⊲ Mutual information.
K
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
12 / 26
⊲ Mutual information.
L
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
12 / 26
⊲ Mutual information.
L K
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
12 / 26
⊲ Mutual information.
L K The maximum information available.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
12 / 26
⊲ Perceived information.
L K The maximum information available.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
12 / 26
⊲ Perceived information.
L K The maximum information available.
⊲ Security analysis.
Resistance against nowadays adversary.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
13 / 26
10−2 10−1 100 101 10−4 10−3 10−2 10−1 100 slope 1 slope 2
noise variance perceived information
unprotected masked Gaussian mixture masked Gaussian template
Information analysis can help to find the order of the small- est informative moment. E((X + σ2)d)
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
13 / 26
10−2 10−1 100 101 10−4 10−3 10−2 10−1 100 slope 1 slope 2
noise variance perceived information
unprotected masked Gaussian mixture masked Gaussian template
For unprotected device mean are different. For protected device mean are equals but covariance are different. Having the full distribution can help to discriminate keys ⇒ information in higher order.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
13 / 26
10−2 10−1 100 101 10−4 10−3 10−2 10−1 100 slope 1 slope 2
noise variance perceived information
unprotected masked Gaussian mixture masked Gaussian template
For unprotected device difference is still in the mean. For protected full distribution and Gaussian template model are close ⇒ few information in higher order.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
14 / 26
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
15 / 26
⊲ univariate leakage on 1 share :
l1 = l(X ⊕ m) + N
⊲ leakage function is linear (Hamming weight)
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
16 / 26
10−2 10−1 100 101 10−5 10−4 10−3 10−2 10−1 100 s l
e 1
noise variance perceived information
unprotected
l1 = Hw(X ⊕ m) + N
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
16 / 26
10−2 10−1 100 101 10−5 10−4 10−3 10−2 10−1 100 s l
e 1 s l
e 1
noise variance perceived information
unprotected C ′
12 Gaussian mixture
If random subset is used, then information about the key is available in the mean.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
16 / 26
10−2 10−1 100 101 10−5 10−4 10−3 10−2 10−1 100 s l
e 1 s l
e 1 s l
e 3
noise variance perceived information
unprotected C ′
12 Gaussian mixture
C12 Gaussian mixture
If carefully chosen subset is used, then information about the key is available in higher moment.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
16 / 26
10−2 10−1 100 101 10−5 10−4 10−3 10−2 10−1 100 s l
e 1 s l
e 1 s l
e 3 slope 4
noise variance perceived information
unprotected C ′
12 Gaussian mixture
C12 Gaussian mixture C16 Gaussian mixture
If carefully chosen subset is used, then information about the key is available in higher moment.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
16 / 26
10−2 10−1 100 101 10−5 10−4 10−3 10−2 10−1 100 s l
e 1 s l
e 1 s l
e 3 slope 4
noise variance perceived information
unprotected C ′
12 Gaussian mixture
C12 Gaussian mixture C16 Gaussian mixture
Such an attack is impossible for masking with 256 masks. Since only 1 share is observed.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
17 / 26
⊲ C12: information in 3rd moment ⊲ C16: information in 4th moment
As expected from previous works on leakage squeezing
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
18 / 26
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
19 / 26
⊲ bivariate leakage on both shares :
l1 = l(X ⊕ m) + N1, l2 = l(m) + N2
⊲ leakage function is linear (Hamming weight)
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
20 / 26
10−2 10−1 100 101 10−3 10−2 10−1 100 s l
e 2
noise variance perceived information
256 masks Gaussian mixture
l1 = Hw(X ⊕ m) + N1, l2 = Hw(m) + N2
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
20 / 26
10−2 10−1 100 101 10−3 10−2 10−1 100 s l
e 2
noise variance perceived information
256 masks Gaussian mixture 256 masks Gaussian template
Using Gaussian mixture allows us to obtain more informa- tion for low noise. ∃ useful information in higher moments that gradually vanishes as noise increasing.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
20 / 26
10−2 10−1 100 101 10−3 10−2 10−1 100 s l
e 2 s l
e 1
noise variance perceived information
256 masks Gaussian mixture 256 masks Gaussian template C ′
12 Gaussian mixture
If random subset is used, then information about the key is available in the mean.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
20 / 26
10−2 10−1 100 101 10−3 10−2 10−1 100 s l
e 2 s l
e 1
noise variance perceived information
256 masks Gaussian mixture 256 masks Gaussian template C ′
12 Gaussian mixture
C12 Gaussian mixture
If carefully chosen subset is used, then information about the key is available in the covariance matrix.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
20 / 26
10−2 10−1 100 101 10−3 10−2 10−1 100 s l
e 2 s l
e 1
noise variance perceived information
256 masks Gaussian mixture 256 masks Gaussian template C ′
12 Gaussian mixture
C12 Gaussian mixture C16 Gaussian mixture
If carefully chosen subset is used, then information about the key is available in the covariance matrix.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
21 / 26
⊲ C12: information in 2nd moment ⊲ C16: information in 2nd moment ⊲ uniform masking: information in 2nd moment
The results are similar as for uniform masking :)
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
22 / 26
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
23 / 26
⊲ univariate leakage on 1 share :
l1 = l(X ⊕ m) + N
⊲ leakage function is polynomial
l(X) =
aXi +
bXi × Xj +
cXi × Xj × Xk
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
24 / 26
10−2 10−1 100 101 10−5 10−4 10−3 10−2 10−1 100 s l
e 1
noise variance perceived information
unprotected Gaussian mixture
l(X) =
i aXi + i
i
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
24 / 26
10−2 10−1 100 101 10−5 10−4 10−3 10−2 10−1 100 s l
e 1 slope 4
noise variance perceived information
unprotected Gaussian mixture C16 Hamming weight
If a = 1, b = 0 and c = 0 we have Hamming weight model.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
24 / 26
10−2 10−1 100 101 10−5 10−4 10−3 10−2 10−1 100 s l
e 1 slope 4 slope 2
noise variance perceived information
unprotected Gaussian mixture C16 Hamming weight C16 a=0,b=1,c=0
If a = 0, b = 1 and c = 0 the degree of the leakage function is 2, hence the slope of the IT curve is 4
2.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
24 / 26
10−2 10−1 100 101 10−5 10−4 10−3 10−2 10−1 100 s l
e 1 slope 4 slope 2 slope 1.33
noise variance perceived information
unprotected Gaussian mixture C16 Hamming weight C16 a=0,b=1,c=0 C16 a=0,b=0,c=1
If a = 0, b = 0 and c = 1 the degree of the leakage function is 3, hence the slope of the IT curve is 4
3.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
25 / 26
⊲ Security order decreases with the degree of the
polynomial degp.
⊲ If the security for linear leakage function is of order d
then the security order becomes d′ = d/degp E((X)d) = E((X degp)d′)
⊲ No impact for uniform masking.
The security order is decreasing depending on the degree of the leakage function :(
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
26 / 26
⊲ Assumption fulfilled:
As excepted from previous works on leakage squeezing.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
26 / 26
⊲ Assumption fulfilled:
As excepted from previous works on leakage squeezing.
⊲ On the adversary condition :
small degradation for low noise
Similar security :)
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
26 / 26
⊲ Assumption fulfilled:
As excepted from previous works on leakage squeezing.
⊲ On the adversary condition :
small degradation for low noise
Similar security :)
⊲ On the physical condition :
Reduction of the slope depending on the degree of the leakage function:(
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
26 / 26
Shivam Bhasin, Claude Carlet, and Sylvain Guilley. Theory of masking with codewords in hardware: low-weight dth-order correlation-immune boolean functions. Cryptology ePrint Archive, Report 2013/303, 2013. http://eprint.iacr.org/. Maxime Nassar, Sylvain Guilley, and Jean-Luc Danger. Formal analysis of the entropy / security trade-off in first-order masking countermeasures against side-channel attacks. In Daniel J. Bernstein and Sanjit Chatterjee, editors, INDOCRYPT, volume 7107 of LNCS, pages 22–39. Springer, 2011. Emmanuel Prouff and Matthieu Rivain. A generic method for secure SBox implementation.
UCL Crypto Group
UCL/ICTEAM/ELEN
Leakage Squeezing
26 / 26
In Sehun Kim, Moti Yung, and Hyung-Woo Lee, editors, WISA, volume 4867 of LNCS, pages 227–244. Springer, 2007.