Low Randomness Masking and Shulfifgn: An Evaluation Using Mutual - - PowerPoint PPT Presentation
Low Randomness Masking and Shulfifgn: An Evaluation Using Mutual Information Kostas Papagiannopoulos kostaspap88@gmail.com kpcrypto.net Radboud University Nijmegen Digital Security Department The Netherlands 1 Overview Masking,
Kostas Papagiannopoulos kostaspap88@gmail.com kpcrypto.net Radboud University Nijmegen Digital Security Department The Netherlands
1
2
Masking and Shuffling Schemes Against Side-Channel Analysis
3
countermeasures against SCA
shares
Secret S S0 S1 S2 S3 S4 S5 S6 S7
3 [1] Suresh Chari, Charanjit S. Jutla, Josyula R. Rao, and Pankaj Rohatgi. Towards sound approaches to counteract power-analysis attacks. [2] Yuval Ishai, Amit Sahai, and David Wagner. Private circuits: Securing hardware against probing attacks
countermeasures against SCA
shares
π(π2) random elements for ISW multiplication with π shares [2]
Secret S S0 S1 S2 S3 S4 S5 S6 S7
3 [1] Suresh Chari, Charanjit S. Jutla, Josyula R. Rao, and Pankaj Rohatgi. Towards sound approaches to counteract power-analysis attacks. [2] Yuval Ishai, Amit Sahai, and David Wagner. Private circuits: Securing hardware against probing attacks
Sbox1 Sbox2 Sbox3 Sbox4
Sbox3 Sbox1 Sbox4 Sbox2
6 [3] Nicolas Veyrat-Charvillon, Marcel Medwed, Stéphanie Kerckhof, and François-Xavier Standaert. Shuffling against side-channel attacks: A comprehensive study with cautionary note [4] Donald E. Knuth. The Art of Computer Programming, Volume 2 (3rd Ed.): Seminumerical Algorithms
Sbox1 Sbox2 Sbox3 Sbox4
for π operations shuffled [4]
Sbox3 Sbox1 Sbox4 Sbox2
6 [3] Nicolas Veyrat-Charvillon, Marcel Medwed, Stéphanie Kerckhof, and François-Xavier Standaert. Shuffling against side-channel attacks: A comprehensive study with cautionary note [4] Donald E. Knuth. The Art of Computer Programming, Volume 2 (3rd Ed.): Seminumerical Algorithms
10 [5] Josep Balasch, Sebastian Faust, Benedikt Gierlichs, Clara Paglialonga, and François-Xavier Standaert. Consolidating inner product masking [6] Wouter de Groot, Kostas Papagiannopoulos, Antonio de La Piedra, Erik Schneider and Lejla Batina. Bitsliced masking and arm: Friends or foes? [7] Benjamin Gregoire and Kostas Papagiannopoulos and Peter Schwabe and Ko Stoffelen . Vectorizing Higher-Order Masking
pseudoRNG [5]
10 [5] Josep Balasch, Sebastian Faust, Benedikt Gierlichs, Clara Paglialonga, and François-Xavier Standaert. Consolidating inner product masking [6] Wouter de Groot, Kostas Papagiannopoulos, Antonio de La Piedra, Erik Schneider and Lejla Batina. Bitsliced masking and arm: Friends or foes? [7] Benjamin Gregoire and Kostas Papagiannopoulos and Peter Schwabe and Ko Stoffelen . Vectorizing Higher-Order Masking
pseudoRNG [5]
Cipher 62% RNG 38%
10 [5] Josep Balasch, Sebastian Faust, Benedikt Gierlichs, Clara Paglialonga, and François-Xavier Standaert. Consolidating inner product masking [6] Wouter de Groot, Kostas Papagiannopoulos, Antonio de La Piedra, Erik Schneider and Lejla Batina. Bitsliced masking and arm: Friends or foes? [7] Benjamin Gregoire and Kostas Papagiannopoulos and Peter Schwabe and Ko Stoffelen . Vectorizing Higher-Order Masking
pseudoRNG [5]
trueRNG [6]
Cipher 62% RNG 38%
10 [5] Josep Balasch, Sebastian Faust, Benedikt Gierlichs, Clara Paglialonga, and François-Xavier Standaert. Consolidating inner product masking [6] Wouter de Groot, Kostas Papagiannopoulos, Antonio de La Piedra, Erik Schneider and Lejla Batina. Bitsliced masking and arm: Friends or foes? [7] Benjamin Gregoire and Kostas Papagiannopoulos and Peter Schwabe and Ko Stoffelen . Vectorizing Higher-Order Masking
pseudoRNG [5]
trueRNG [6]
Cipher 62% RNG 38% Cipher 75% RNG 25%
10 [5] Josep Balasch, Sebastian Faust, Benedikt Gierlichs, Clara Paglialonga, and François-Xavier Standaert. Consolidating inner product masking [6] Wouter de Groot, Kostas Papagiannopoulos, Antonio de La Piedra, Erik Schneider and Lejla Batina. Bitsliced masking and arm: Friends or foes? [7] Benjamin Gregoire and Kostas Papagiannopoulos and Peter Schwabe and Ko Stoffelen . Vectorizing Higher-Order Masking
pseudoRNG [5]
trueRNG [6]
/dev/urandom [7]
Cipher 62% RNG 38% Cipher 75% RNG 25%
10 [5] Josep Balasch, Sebastian Faust, Benedikt Gierlichs, Clara Paglialonga, and François-Xavier Standaert. Consolidating inner product masking [6] Wouter de Groot, Kostas Papagiannopoulos, Antonio de La Piedra, Erik Schneider and Lejla Batina. Bitsliced masking and arm: Friends or foes? [7] Benjamin Gregoire and Kostas Papagiannopoulos and Peter Schwabe and Ko Stoffelen . Vectorizing Higher-Order Masking
pseudoRNG [5]
trueRNG [6]
/dev/urandom [7]
Cipher 62% RNG 38% Cipher 75% RNG 25% Cipher 1% RNG 99%
10 [5] Josep Balasch, Sebastian Faust, Benedikt Gierlichs, Clara Paglialonga, and François-Xavier Standaert. Consolidating inner product masking [6] Wouter de Groot, Kostas Papagiannopoulos, Antonio de La Piedra, Erik Schneider and Lejla Batina. Bitsliced masking and arm: Friends or foes? [7] Benjamin Gregoire and Kostas Papagiannopoulos and Peter Schwabe and Ko Stoffelen . Vectorizing Higher-Order Masking
Reducing the RNG overhead in masking with RRM
15
π¨ = π¦π§, π = ππ π¨0 = π¦0π§0 β π₯0 β π₯1 π¨1 = π¦1π§1 β ((π₯0β π¦0π§1) β π¦1π§0) β π₯2 π¨2 = π¦2π§2 β ((π₯1β π¦0π§2) β π¦2π§0)β ((π₯2β π¦1π§2) β π¦2π§1) π0 = π0π0 β π’0 β π’1 π1 = π1π1 β ((π’0β π0π1) β π1π0) β π’2 π2 = π2π2 β ((π’1β π0π2) β π2π0)β ((π’2β π1π2) β π2π1)
16
π¨0 = π¦0π§0 β π₯0 β π₯1 π¨1 = π¦1π§1 β ((π₯0β π¦0π§1) β π¦1π§0) β π₯2 π¨2 = π¦2π§2 β ((π₯1β π¦0π§2) β π¦2π§0)β ((π₯2β π¦1π§2) β π¦2π§1) π0 = π0π0 β π₯0 β π₯1 π1 = π1π1 β ((π₯0β π0π1) β π1π0) β π’2 π2 = π2π2 β ((π₯1β π0π2) β π2π0)β ((π’2β π1π2) β π2π1) Reduced Randomness cost by 2 random numbers
17
π¨0 = π¦0π§0 β π₯0 β π₯1 π¨1 = π¦1π§1 β ((π₯0β π¦0π§1) β π¦1π§0) β π₯2 π¨2 = π¦2π§2 β ((π₯1β π¦0π§2) β π¦2π§0)β ((π₯2β π¦1π§2) β π¦2π§1) π0 = π0π0 β π₯0 β π₯1 π1 = π1π1 β ((π₯0β π0π1) β π1π0) β π’2 π2 = π2π2 β ((π₯1β π0π2) β π2π0)β ((π’2β π1π2) β π2π1)
18 [8] Jean-Sebastien Coron. Formal Verification of Side-channel Countermeasures via Elementary Circuit Transformations.
π¨0 = π¦0π§0 β π₯0 β π₯1 π¨1 = π¦1π§1 β ((π₯0β π¦0π§1) β π¦1π§0) β π₯2 π¨2 = π¦2π§2 β ((π₯1β π¦0π§2) β π¦2π§0)β ((π₯2β π¦1π§2) β π¦2π§1) π0 = π0π0 β π₯0 β π₯1 π1 = π1π1 β ((π₯0β π0π1) β π1π0) β π₯2 π2 = π2π2 β ((π₯1β π0π2) β π2π0)β ((π₯2β π1π2) β π2π1) Reduced Randomness cost by 3 random numbers
19
π¨0 = π¦0π§0 β π₯0 β π₯1 π¨1 = π¦1π§1 β ((π₯0β π¦0π§1) β π¦1π§0) β π₯2 π¨2 = π¦2π§2 β ((π₯1β π¦0π§2) β π¦2π§0)β ((π₯2β π¦1π§2) β π¦2π§1) π0 = π0π0 β π₯0 β π₯1 π1 = π1π1 β ((π₯0β π0π1) β π1π0) β π₯2 π2 = π2π2 β ((π₯1β π0π2) β π2π0)β ((π₯2β π1π2) β π2π1)
gadgets
20
24
Recycling 2-mult ISW gadgets [2] 2-mult BBP gadgets [9] Security Order Security Order 1 2 3 1 2 3 Yes 1 4 8 1 2 6 No 2 6 12 2 4 8
[2] Yuval Ishai, Amit Sahai, and David Wagner. Private circuits: Securing hardware against probing attacks [9] Sonia Belaïd, Fabrice Benhamouda, Alain Passelègue, Emmanuel Prouff, Adrian Thillard, and Damien Vergnaud. Randomness complexity of private circuits for multiplication.
Randomness Cost Table
Let π occurrences of random number, emitting leakages π1, π2,β¦,ππ~ π(π, π)
1 π Οπ=1 π ππ ~ π(π, π π) ,
i.e. exploiting the recycling can de-noise the signal [10]
26 [10] Alberto Battistello, Jean-Sébastien Coron, Emmanuel Prouff, and Rina Zeitoun. Horizontal side-channel attacks and countermeasures on the ISW masking scheme [11] François-Xavier Standaert, Tal Malkin, and Moti Yung. A unified framework for the analysis of side-channel key recovery attacks.
Let π occurrences of random number, emitting leakages π1, π2,β¦,ππ~ π(π, π)
1 π Οπ=1 π ππ ~ π(π, π π) ,
i.e. exploiting the recycling can de-noise the signal [10]
analysis [11] C1: naive, doesnβt see recycling C2: smart, can see leakages from recycling
26 [10] Alberto Battistello, Jean-Sébastien Coron, Emmanuel Prouff, and Rina Zeitoun. Horizontal side-channel attacks and countermeasures on the ISW masking scheme [11] François-Xavier Standaert, Tal Malkin, and Moti Yung. A unified framework for the analysis of side-channel key recovery attacks.
29
take advantage of recycling
29
take advantage of recycling
shift the curve to the right
29
take advantage of recycling
shift the curve to the right
the security
29
take advantage of recycling
shift the curve to the right
the security
security and randomness cost
29
Reducing the RNG overhead in shuffling with RRS
29
35
Layer1 Block1 Layer2 Block1 Layer3 Block1 Layer1 Block2 Layer2 Block2 Layer3 Block2 Layer1 Block3 Layer2 Block3 Layer3 Block3 Shuffle Layer1 Shuffle Layer2 Shuffle Layer3 Layer1 Block4 Layer2 Block4 Layer3 Block4
Randomness cost:
35
Layer1 Block1 Layer2 Block1 Layer3 Block1 Layer1 Block2 Layer2 Block2 Layer3 Block2 Layer1 Block3 Layer2 Block3 Layer3 Block3 Shuffle Layer1 Shuffle Layer2 Shuffle Layer3 Layer1 Block4 Layer2 Block4 Layer3 Block4
partition factor π
π = 2
39
Layer1 Block1 Layer2 Block1 Layer3 Block1 Layer1 Block2 Layer2 Block2 Layer3 Block2 Layer1 Block3 Layer2 Block3 Layer3 Block3 Permutation Layer1 Permutation Layer2 Permutation Layer3 Layer1 Block4 Layer2 Block4 Layer3 Block4
partition factor π
π = 2
blocks
39
Layer1 Block1 Layer2 Block1 Layer3 Block1 Layer1 Block2 Layer2 Block2 Layer3 Block2 Layer1 Block3 Layer2 Block3 Layer3 Block3 Permutation Layer1 Permutation Layer2 Permutation Layer3 Layer1 Block4 Layer2 Block4 Layer3 Block4
34
Layer1 Block1 Layer2 Block1 Layer3 Block1 Layer1 Block2 Layer2 Block2 Layer3 Block2 Layer1 Block3 Layer2 Block3 Layer3 Block3 Shuffle Layer1 Shuffle Layer2 Shuffle Layer3 Layer1 Block4 Layer2 Block4 Layer3 Block4
them together, i.e. merge factor π
π = 2
35
Layer1 Block1 Layer2 Block1 Layer3 Block1 Layer1 Block2 Layer2 Block2 Layer3 Block2 Layer1 Block3 Layer2 Block3 Layer3 Block3 Shuffle Merged Layer 1,2 Layer1 Block4 Layer2 Block4 Layer3 Block4 Shuffle Layer3
them together, i.e. merge factor π
π = 2
36
Layer1 Block1 Layer2 Block1 Layer3 Block1 Layer1 Block2 Layer2 Block2 Layer3 Block2 Layer1 Block3 Layer2 Block3 Layer3 Block3 Shuffle Merged Layer 1,2 Layer1 Block4 Layer2 Block4 Layer3 Block4 Shuffle Layer3
can reduce the randomness cost
39
can reduce the randomness cost
amplification stage of shuffling
39
can reduce the randomness cost
amplification stage of shuffling
security and randomness cost
39
Towards parametric design for side-channel countermeasures
40
masking and shuffling
23
masking and shuffling
protection
23
48
e.g. π¦th-order masking with π§ recycled random numbers and merged shuffling of π¨ cipher layers
48
e.g. π¦th-order masking with π§ recycled random numbers and merged shuffling of π¨ cipher layers
48
Athens Tower, 1971
e.g. π¦th-order masking with π§ recycled random numbers and merged shuffling of π¨ cipher layers
48
Athens Tower, 1971 Turning Torso MalmΓΆ, 2005