More Practical Single-Trace Attacks on the Number Theoretic - PowerPoint PPT Presentation

SCIENCE PASSION TECHNOLOGY More Practical Single-Trace Attacks on the Number Theoretic Transform Peter Pessl, Robert Primas Graz University of Technology LATINCRYPT 2019, October 02 > www.iaik.tugraz.at

www.iaik.tugraz.at  Public-Key Crypto and Side-Channel Attacks  Power consumption trace of RSA decryption   Peter Pessl, Graz University of Technolgy 2 LATINCRYPT 2019, October 02

www.iaik.tugraz.at  Public-Key Crypto and Side-Channel Attacks  Power consumption trace of RSA decryption   Peter Pessl, Graz University of Technolgy 2 LATINCRYPT 2019, October 02

www.iaik.tugraz.at  Public-Key Crypto and Side-Channel Attacks 1 0 0 1 1 0 0 0 1 0 0 1 1 0 0 0  Power consumption trace of RSA decryption   Peter Pessl, Graz University of Technolgy 2 LATINCRYPT 2019, October 02

www.iaik.tugraz.at  Public-Key Crypto and Side-Channel Attacks 1 0 0 1 1 0 0 0 1 0 0 1 1 0 0 0  Power consumption trace of RSA decryption  Single-trace attacks are still a prime threat!  Peter Pessl, Graz University of Technolgy 2 LATINCRYPT 2019, October 02

www.iaik.tugraz.at But RSA is old news anyway. . . Lattice-based cryptography promising post-quantum replacement implementations: fast and constant time / control flow Do we still need to worry about single-trace attacks? no more instruction leakage protection efforts towards differential (multi-trace) attacks Peter Pessl, Graz University of Technolgy 3 LATINCRYPT 2019, October 02

www.iaik.tugraz.at But RSA is old news anyway. . . Lattice-based cryptography promising post-quantum replacement implementations: fast and constant time / control flow Do we still need to worry about single-trace attacks? no more instruction leakage protection efforts towards differential (multi-trace) attacks Peter Pessl, Graz University of Technolgy 3 LATINCRYPT 2019, October 02

www.iaik.tugraz.at Previously: yes, but Our previous work: single-trace attack on the NTT N umber T heoretic T ransform, common in many lattice schemes combine template attacks (device profiling) with belief propagation but. . . attacked variable-time implementation large templating effort ( ≈ a million multivariate templates) Peter Pessl, Graz University of Technolgy 4 LATINCRYPT 2019, October 02

www.iaik.tugraz.at Previously: yes, but Our previous work: single-trace attack on the NTT N umber T heoretic T ransform, common in many lattice schemes combine template attacks (device profiling) with belief propagation but. . . attacked variable-time implementation large templating effort ( ≈ a million multivariate templates) Peter Pessl, Graz University of Technolgy 4 LATINCRYPT 2019, October 02

www.iaik.tugraz.at Previously: yes, but Our previous work: single-trace attack on the NTT N umber T heoretic T ransform, common in many lattice schemes combine template attacks (device profiling) with belief propagation but. . . attacked variable-time implementation large templating effort ( ≈ a million multivariate templates) Can we do better? Peter Pessl, Graz University of Technolgy 4 LATINCRYPT 2019, October 02

www.iaik.tugraz.at Our Contribution Improve upon previous attack several improvements to belief propagation in this context change targets: encryption instead of decryption Attack constant-time ASM-optimized Kyber implementation massively reduced templating effort Peter Pessl, Graz University of Technolgy 5 LATINCRYPT 2019, October 02

www.iaik.tugraz.at Our Contribution Improve upon previous attack several improvements to belief propagation in this context change targets: encryption instead of decryption Attack constant-time ASM-optimized Kyber implementation massively reduced templating effort Peter Pessl, Graz University of Technolgy 5 LATINCRYPT 2019, October 02

www.iaik.tugraz.at Lattice-based Encryption (LPR, NewHope, Kyber, . . . ) "Noisy ElGamal" with polynomials in Z q [ x ] / � x n + 1 � Key Generation: generate small error polynomials s , e t = a · s + e pk = ( a , t ) , sk = s Encryption: generate small error polynomials r , e 1 , e 2 c 1 = a · r + e 1 c 2 = t · r + e 2 + m Decryption: m ≈ c 2 − s · c 1 Peter Pessl, Graz University of Technolgy 6 LATINCRYPT 2019, October 02

www.iaik.tugraz.at Lattice-based Encryption (LPR, NewHope, Kyber, . . . ) "Noisy ElGamal" with polynomials in Z q [ x ] / � x n + 1 � Key Generation: generate small error polynomials s , e t = a · s + e pk = ( a , t ) , sk = s Encryption: generate small error polynomials r , e 1 , e 2 c 1 = a · r + e 1 c 2 = t · r + e 2 + m Decryption: m ≈ c 2 − s · c 1 Peter Pessl, Graz University of Technolgy 6 LATINCRYPT 2019, October 02

www.iaik.tugraz.at Lattice-based Encryption (LPR, NewHope, Kyber, . . . ) "Noisy ElGamal" with polynomials in Z q [ x ] / � x n + 1 � Key Generation: generate small error polynomials s , e t = a · s + e pk = ( a , t ) , sk = s Encryption: generate small error polynomials r , e 1 , e 2 c 1 = a · r + e 1 c 2 = t · r + e 2 + m Decryption: m ≈ c 2 − s · c 1 Peter Pessl, Graz University of Technolgy 6 LATINCRYPT 2019, October 02

www.iaik.tugraz.at Lattice-based Encryption (LPR, NewHope, Kyber, . . . ) "Noisy ElGamal" with polynomials in Z q [ x ] / � x n + 1 � Key Generation: generate small error polynomials s , e t = a · s + e pk = ( a , t ) , sk = s Encryption: generate small error polynomials r , e 1 , e 2 c 1 = a · r + e 1 c 2 = t · r + e 2 + m Decryption: m ≈ c 2 − s · c 1 Peter Pessl, Graz University of Technolgy 6 LATINCRYPT 2019, October 02

www.iaik.tugraz.at Number Theoretic Transform Naive polynomial multiplication: O ( n 2 ) Better: N umber T heoretic T ransform (NTT) ≈ FFT in Z q [ x ] , runtime O ( n log n ) pointwise mult. of NTT-transformed: a · b = INTT ( NTT ( a ) ◦ NTT ( b )) Peter Pessl, Graz University of Technolgy 7 LATINCRYPT 2019, October 02

www.iaik.tugraz.at Number Theoretic Transform Naive polynomial multiplication: O ( n 2 ) Better: N umber T heoretic T ransform (NTT) ≈ FFT in Z q [ x ] , runtime O ( n log n ) pointwise mult. of NTT-transformed: a · b = INTT ( NTT ( a ) ◦ NTT ( b )) Peter Pessl, Graz University of Technolgy 7 LATINCRYPT 2019, October 02

www.iaik.tugraz.at Butterfly 𝑦 0 𝑦 ̂ 0 𝜕 𝑦 1 𝑦 ̂ 1 -1 Butterfly = 2-coefficient NTT Peter Pessl, Graz University of Technolgy 8 LATINCRYPT 2019, October 02

www.iaik.tugraz.at Butterfly Network 𝑦 0 𝑦 ̂ 0 𝜕 n 0 𝑦 2 𝑦 ̂ 1 -1 𝜕 n 0 𝑦 ̂ 2 𝑦 1 -1 0 1 𝜕 n 𝜕 n 𝑦 3 𝑦 ̂ 3 -1 -1 4-coefficient NTT Peter Pessl, Graz University of Technolgy 9 LATINCRYPT 2019, October 02

www.iaik.tugraz.at Previous Single-Trace Attack on the NTT Recover secret NTT input with: 𝑦 0 𝑦 ̂ 0 1. Template matching Profile power consumption of mult. 𝜕 Match profiles (templates) for 𝑦 1 𝑦 ̂ 1 probability distribution Peter Pessl, Graz University of Technolgy 10 LATINCRYPT 2019, October 02

www.iaik.tugraz.at Previous Single-Trace Attack on the NTT Recover secret NTT input with: 𝑦 0 𝑦 ̂ 0 1. Template matching Profile power consumption of mult. 𝜕 Match profiles (templates) for 𝑦 1 𝑦 ̂ 1 probability distribution Peter Pessl, Graz University of Technolgy 10 LATINCRYPT 2019, October 02

www.iaik.tugraz.at Previous Single-Trace Attack on the NTT Recover secret NTT input with: 𝑦 0 𝑦 ̂ 0 1. Template matching Profile power consumption of mult. 𝜕 Match profiles (templates) for 𝑦 1 𝑦 ̂ 1 -1 probability distribution Peter Pessl, Graz University of Technolgy 10 LATINCRYPT 2019, October 02

www.iaik.tugraz.at Previous Single-Trace Attack on the NTT Recover secret NTT input with: 𝑦 0 𝑦 ̂ 0 1. Template matching Profile power consumption of mult. 𝜕 Match profiles (templates) for 𝑦 1 𝑦 ̂ 1 -1 probability distribution Peter Pessl, Graz University of Technolgy 10 LATINCRYPT 2019, October 02

www.iaik.tugraz.at Previous Single-Trace Attack on the NTT Recover secret NTT input with: 𝑦 0 𝑦 ̂ 0 2. Belief propagation Represent NTT with a graphical model 𝜕 Pass beliefs along edges and update 𝑦 1 𝑦 ̂ 1 Repeat until convergence reached Peter Pessl, Graz University of Technolgy 11 LATINCRYPT 2019, October 02

www.iaik.tugraz.at Previous Single-Trace Attack on the NTT Recover secret NTT input with: 𝑦 0 𝑦 ̂ 0 2. Belief propagation Represent NTT with a graphical model 𝜕 Pass beliefs along edges and update 𝑦 1 𝑦 ̂ 1 Repeat until convergence reached Peter Pessl, Graz University of Technolgy 11 LATINCRYPT 2019, October 02

www.iaik.tugraz.at Previous Single-Trace Attack on the NTT Recover secret NTT input with: 2. Belief propagation 𝑦 0 𝑔 𝑦 ̂ 0 add Represent NTT with a graphical model Pass beliefs along edges and update Repeat until convergence reached 𝑦 1 𝑦 ̂ 1 𝑔 sub Peter Pessl, Graz University of Technolgy 11 LATINCRYPT 2019, October 02