Mind The Portability A Warriors Guide through Realistic Profiled - - PowerPoint PPT Presentation

Mind The Portability

A Warriors Guide through Realistic Profiled Side-channel Analysis

Shivam Bhasin1, Dirmanto Jap1, Anupam Chattopadhyay1, Stjepan Picek2, Annelie Heuser3, and Ritu Ranjan Shrivastwa4

1NTU, Singapore 2TU Delft, Netherlands 3IRISA, France 4Secure-IC France

NDSS 2020, San Diego 23-26 February 2020

Side-Channel Analysis (SCA)

2

Energy Timing reference Side-channel measurement Encryption requests

THEN NOW

What is SCA?

• Non-invasive (power, EM, timing, …)
• Powerful & practical. Ex:

– Keeloq – FPGA Bitstream encryption – Bitcoin wallets – …

• Applications: Secret key recovery and more …
• Serious threat to embedded systems

3

TA Attacked circuit EMA SPA, DPA, templates, etc. Time ⇒ Side-channel trace

Types of SCA

• Simple SCA (ex. Visual inspection)
• Non Profiled SCA (ex. DPA, CPA, other on the fly

statistical attacks)

• Profiled SCA (ex. Templates, Machine-Learning

based attacks)

4

In the following, we focus on profiled power/EM attacks on embedded devices targeting encryption algorithms for secret key recovery

Profiled SCA

• Target exploitation in few traces, ideally single trace
• Classification Algorithm: Template Attacks (TA) vs Machine Learning (ML)
• Deep Learning has shown great success with protected implementations
• Recent work with deep learning report successful attack in 100X less traces (500 vs 5).

5

Device1 Labels Tracestrain Classification Algorithm Device2 Traces Labelhypothesis Classification Algorithm Secret Key Profiled Model Profiling Phase

Known Key

Attack Phase

Unknown Key

Expectations vs Reality

6

Device1 Labels

Tracestrain

Classification Algorithm Device2 Traces Labelhypothesis Classification Algorithm Secret Key

E x p e c t e d

Profiled Model Profiling Phase

Known Key

Attack Phase

Unknown Key

Expectations vs Reality

7

Device1 Labels

Tracestrain

Classification Algorithm Device2 Traces Labelhypothesis Classification Algorithm Secret Key

Reality

E x p e c t e d

Profiled Model Profiling Phase

Known Key

Attack Phase

Unknown Key

Tracestest

Portability

• B and B’ are two copies of same device
• Differences between B and B’ are due to uncontrolled

variations in process, measurement setup, or other stochastic factors

• Portability denotes all settings in which an attacker can

conduct the training on the measurement data obtained from a clone device B’ and import the learned knowledge LB’ to model the actual device B, under similar parameter setup

8

Practical Study of Portability

9

Different Sources Of Portability: Process variation (chip, wires, PCB components, connectors), environmental factors, ...

Comparing Signal Quality

10

Comparing SCA Vulnerability

11

12

Same Device Different Device Same Key Different Key

> 2 X D e g r a d a t i

• n

Why Does It Happen?

13

!!! OVERFITTING !!!

Proposed Multi-Device Model

14

Device1 Labels Tracestrain Classification Algorithm Devicetest Tracestest Labelhypothesis Classification Algorithm Secret Key Profiled Model Profiling Phase

Known Key

Attack Phase

Unknown Key

Tracesval Device2 Device3

Proposed Multi-Device Model

• Multiple Device Model (MDM)

denotes all settings where attacker can conduct the training on measurement data from a number of similar devices (≥ 2), B’ = {B0’,..., Bn−1’} and import the learned knowledge LB’ to model the actual device B, under similar but uncontrolled parameter setup

15

> 10X improvements

Overcoming Human Error

• Electromagnetic measurements often

preferred over power measurements – Easy access – High SNR – Localized Leakage capture – …

• Extremely sensitive to probe position

(position, distance, and orientation)

• Error comes naturally when measuring
• n multiple devices
• We call this human error of placement
• A classical case of Portability

16

Overcoming Human Error

• Electromagnetic measurements often

preferred over power measurements – Easy access – High SNR – Localized Leakage capture – …

• Extremely sensitive to probe position

(position, distance, and orientation)

• Error comes naturally when measuring
• n multiple devices
• We call this human error of placement
• A classical case of Portability

17

MDM

Conclusions

• One must consider portability issues in machine

learning based SCA

• We proposed Multiple Device Model (MDM) to
• vercome portability
• Direct application to EM measurement
• Future Directions:

– Application to heterogenous devices – MDM with one device noise, process-variation models

18

Thank You !!!

19

Side-Channel Analysis (SCA)

20

Lets look at a basic CMOS cell

Side-Channel Analysis (SCA)

21

ENTROPY SOURCE ENTROPY EXTRACTION POST- PROCESSING ONLINE TEST

RAW OUTPUT TRNG OUTPUT ALARM

Extending from one cell to a full circuit Measure by Electromagnetic Probe

0 à 1 1 à 0

Random Number Generator

Expectations vs Reality

• Profiling and Testing device

MUST be distinct

• An aspect often overlooked

in profiled SCA research

• Leads to pessimistic security

evaluations

• A common issue for

certification labs evaluating security-critical products

• Known as Portability

22