Multi-Tuple Leakage Detection and the Dependent Signal Issue - PowerPoint PPT Presentation

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Multi-Tuple Leakage Detection and the Dependent Signal Issue Olivier Bronchain Tobias Schneider Fran¸ cois-Xavier Standaert CHES 2019, Atlanta, USA Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 1 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Table of Contents Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 2 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Content Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 3 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Side-Channel Issue Encryption on physical devices: ◮ Standard utilization P ’s Crypto C ’s Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 4 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Side-Channel Issue Encryption on physical devices: ◮ Standard utilization P ’s Crypto C ’s ◮ But with any physical signals l ’s Physical Trace Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 4 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Side-Channel Issue Encryption on physical devices: ◮ Standard utilization P ’s Crypto C ’s ◮ But with any physical signals ◮ Possibly containing secret information l ’s Physical Trace Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 4 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Side-Channel Issue Encryption on physical devices: ◮ Standard utilization P ’s Crypto C ’s ◮ But with any physical signals ◮ Possibly containing secret information l ’s Physical Trace Side-channel Attacks: ◮ Known to be hard to prevent ◮ Hard to evaluate as well Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 4 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Side-Channel Issue Encryption on physical devices: ◮ Standard utilization P ’s Crypto C ’s ◮ But with any physical signals ◮ Possibly containing secret information l ’s Physical Trace Two evaluation approaches: Side-channel Attacks: ◮ Attack based ◮ Known to be hard to prevent ◮ Leakage detection ◮ Hard to evaluate as well Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 4 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Attack Based Evaluation = ? Can directly mount attacks: P ’s Crypto C ’s 1. Collect measurements l ’s Physical Trace Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 5 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Attack Based Evaluation = ? Can directly mount attacks: P ’s Crypto C ’s 1. Collect measurements 2. Perform an attack l ’s Physical Trace Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 5 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Attack Based Evaluation = ? Can directly mount attacks: P ’s Crypto C ’s 1. Collect measurements 2. Perform an attack 3. Retrieve the correct sub-key l ’s Physical Trace Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 5 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Attack Based Evaluation = ? Can directly mount attacks: P ’s Crypto C ’s 1. Collect measurements 2. Perform an attack 3. Retrieve the correct sub-key l ’s This requires: Physical Trace 1. Long measurement period 2. Skilled/expert knowledge 3. Distinguish 1 sub-key within 256 Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 5 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Leakage Detection Based Evaluation Leakage detection searches for dependency between manipulated data and physical traces. Crypto Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 6 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Leakage Detection Based Evaluation Leakage detection searches for dependency between manipulated data and physical traces. 1 or 2 ◮ Feed the core with two different sets of inputs P 1 or P 2 Crypto C 1 or C 2 Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 6 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Leakage Detection Based Evaluation Leakage detection searches for dependency between manipulated data and physical traces. 1 or 2 ◮ Feed the core with two different sets of inputs P 1 or P 2 Crypto C 1 or C 2 ◮ Record the corresponding traces Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 6 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Leakage Detection Based Evaluation Leakage detection searches for dependency between manipulated data and physical traces. 1 or 2 ◮ Feed the core with two different sets of inputs P 1 or P 2 Crypto C 1 or C 2 ◮ Record the corresponding traces ◮ Observe differences between the two sets Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 6 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Leakage Detection Based Evaluation Leakage detection searches for dependency between manipulated data and physical traces. How does it compare with attack based 1 or 2 evaluations: ◮ Shortened measurement period (Possibly) P 1 or P 2 Crypto C 1 or C 2 ◮ No skilled/expert knowledge Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 6 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Leakage Detection Based Evaluation Leakage detection searches for dependency between manipulated data and physical traces. How does it compare with attack based 1 or 2 evaluations: ◮ Shortened measurement period (Possibly) P 1 or P 2 Crypto C 1 or C 2 ◮ No skilled/expert knowledge A good first check but: ◮ Risk of false positives and false negatives Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 6 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Content Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 7 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Leakage Detection Find a difference between the two sets: . Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 8 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Leakage Detection Find a difference between the two sets: 1. Select a point in time . Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 8 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Leakage Detection Find a difference between the two sets: 1. Select a point in time 2. Record traces to observe a distribution Distributions . Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 8 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Leakage Detection Find a difference between the two sets: 1. Select a point in time 2. Record traces to observe a distribution Distributions 3. Perform a statistical test Statistical Test . Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 8 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Leakage Detection Find a difference between the two sets: 1. Select a point in time 2. Record traces to observe a distribution Distributions 3. Perform a statistical test 4. Observe its binary output Statistical Test No difference found . Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 8 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Leakage Detection Find a difference between the two sets: 1. Select a point in time 2. Record traces to observe a distribution Distributions 3. Perform a statistical test 4. Observe its binary output Statistical Test Repeat with more measurements if needed No difference found . Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 8 / 20

Introduction Leakage Detection Multi-Tuple Leakage Detection Conclusion Leakage Detection Find a difference between the two sets: 1. Select a point in time 2. Record traces to observe a distribution Distributions 3. Perform a statistical test 4. Observe its binary output Statistical Test Repeat with more measurements if needed Difference found . Olivier Bronchain Multi-Tuple Leakage Detection and the Dependent Signal Issue 8 / 20