Physical Defaults & the Robust Probing Model Sebastian Faust, - - PowerPoint PPT Presentation
Composable Masking Schemes in the Presence of Physical Defaults & the Robust Probing Model Sebastian Faust, Vincent Grosso, Santos Merino Del Pozo, Clara Paglialonga, Franois-Xavier Standaert TU Darmstadt (Germany), Radbout University
Composable Masking Schemes in the Presence of Physical Defaults & the Robust Probing Model
Sebastian Faust, Vincent Grosso, Santos Merino Del Pozo, Clara Paglialonga, François-Xavier Standaert
TU Darmstadt (Germany), Radbout University Nijmegen (The Netherlands), DarkMatter LLC (UAE), UCLouvain (Belgium)
CHES 2018, Amsterdam, The Netherlands
Masking (e.g., Boolean π = ππ + ππ + β― + ππ) 1
Noisy leakages security: Goal (ideally): π β
π
MI(π;π΄) MI π; π΄ < MI ππ; ππ π
Masking (e.g., Boolean π = ππ + ππ + β― + ππ) 1
Noisy leakages security: Goal (ideally): π β
π
MI(π;π΄) MI π; π΄ < MI ππ; ππ π Bounded moment security:
π1,π2,β¦,ππβ1
ππ π
(π-1)th order statistical moment (ideally)
Bounded moment security:
π1,π2,β¦,ππβ1
ππ π
(π-1)th order statistical moment (ideally)
Masking (e.g., Boolean π = ππ + ππ + β― + ππ) 1
Noisy leakages security: Goal (ideally): π β
π
MI(π;π΄) MI π; π΄ < MI ππ; ππ π Probing security: Sets of (π-1) probes are of π (ideally)
π¦ = π¦1 + π¦2 + β― + π¦π
Security reductions 2
noisy leakages bounded moment probing
abstract-qualitative physical-qualitative physical-quantitative
[Barthe et al., Eurocrypt 2017]
[Duc et al., Eurocrypt 2014]
π¦ = π¦1 + π¦2 + β― + π¦π
What can go wrong? (e.g., when computing π. π) 3
π1π1 π1π2 π1π3 π2π1 π2π2 π2π3 π3π1 π3π2 π3π3 β π1 π2 π3
Example: probing π1 = π1. π1 + π2 + π3 reveals information on π (when π1 = 1) Issue #1. Lack of randomness (can break the independence assumption)
What can go wrong? (e.g., when computing π. π) 3
π1π1 π1π2 π1π3 π2π1 π2π2 π2π3 π3π1 π3π2 π3π3 + π
1
π
2
π
2
π
3
π
2
π
3
β π1 π2 π3
Issue #1. Lack of randomness (can break the independence assumption)
Β«refreshing gadgets Β»
the probing model
Β«refreshing gadgets Β»
the probing model
What can go wrong? (e.g., when computing π. π) 3
π1π1 π1π2 π1π3 π2π1 π2π2 π2π3 π3π1 π3π2 π3π3 + π
1
π
2
π
2
π
3
π
2
π
3
β π1 π2 π3
Issue #1. Lack of randomness (can break the independence assumption) Example: glitches (transcient values) Β« re-combine Β» the shares such that:
(detected in the bounded moment model)
ππ = π(π¦1 β π¦2 β π¦3) Issue #2. Physical defaults
(can break the independence assumption)
Β«refreshing gadgets Β»
the probing model
What can go wrong? (e.g., when computing π. π) 3
π1π1 π1π2 π1π3 π2π1 π2π2 π2π3 π3π1 π3π2 π3π3 + π
1
π
2
π
2
π
3
π
2
π
3
β π1 π2 π3
Issue #1. Lack of randomness (can break the independence assumption)
completeness Β» property
[β Theshold Implementations]
analyzed in the probing model! Issue #2. Physical defaults
(can break the independence assumption)
Security notions (and scalability) 4
π-probing security [ISW, 2004]: any π-tuple of shares in the protected circuit is independent
Security notions (and scalability) 4
π-probing security [ISW, 2004]: any π-tuple of shares in the protected circuit is independent
Problem: the cost of testing probing security increases (very) fast with circuit size and the # of shares (since β many tuples) [Barthe et al., Eurocrypt 2015]
Security notions (and scalability) 4
π1 internal probes π2 output probes π-probing security [ISW, 2004]: any π-tuple of shares in the protected circuit is independent of any sensitive variable π1 + π2 β€ π π-(Strong) Non Interference [Barthe et al., CCS 2016]: a circuit gadget (e.g., f1) is NI (SNI) if any set of π1 + π2 probes can be simulated with at most π1 + π2 (only π1) shares of each input D(input shares||probes) β D(input shares||simulation)
Security notions (and scalability) 4
π1 internal probes π2 output probes π-probing security [ISW, 2004]: any π-tuple of shares in the protected circuit is independent of any sensitive variable π1 + π2 β€ π π-(Strong) Non Interference [Barthe et al., CCS 2016]: a circuit gadget (e.g., f1) is NI (SNI) if any set of π1 + π2 probes can be simulated with at most π1 + π2 (only π1) shares of each input D(input shares||probes) β D(input shares||simulation)
Problem statement (simplified) 5
schemes ignore physical defaults such as glitches
π1π1 π1π2 π1π3 π2π1 π2π2 π2π3 π3π1 π3π2 π3π3 + π
1
π
2
π
2
π
3
π
2
π
3
Problem statement (simplified) 5
schemes ignore physical defaults such as glitches
π1π1 π1π2 π1π3 π2π1 π2π2 π2π3 π3π1 π3π2 π3π3 + π
1
π
2
π
2
π
3
π
2
π
3
x1 y1 x2 x3 y2 y3 f2 f1 f3
mitigate glitches but are
(β probing secure) β testing scales badly
mitigate glitches but are
(β probing secure) β testing scales badly
Problem statement (simplified) 5
schemes ignore physical defaults such as glitches
π1π1 π1π2 π1π3 π2π1 π2π2 π2π3 π3π1 π3π2 π3π3 + π
1
π
2
π
2
π
3
π
2
π
3
x1 y1 x2 x3 y2 y3 f2 f1 f3
(jointly!) robust against glitches and composable
(Refined) model and security definition 6
Glitch-extended probes: probing any output of a combinatorial sub- circuit allows the adversary to
Example: π1 gives π, π and π
π1
(Refined) model and security definition 6
Glitch-extended probes: probing any output of a combinatorial sub- circuit allows the adversary to
Example: π1 gives π, π and π
π1
Technical clarification: non-extended probes on the stable registersβ values have to be considered in the simulation too
π2
(Refined) model and security definition 6
Glitch-extended probes: probing any output of a combinatorial sub- circuit allows the adversary to
Example: π1 gives π, π and π
Definition: a gadget is glitch-robust π-SNI if it is π-SNI in the βglitch-extendedβ probing model
π1
Technical clarification: non-extended probes on the stable registersβ values have to be considered in the simulation too
π2
(Refined) model and security definition 6
Glitch-extended probes: probing any output of a combinatorial sub- circuit allows the adversary to
Example: π1 gives π, π and π
Definition: a gadget is glitch-robust π-SNI if it is π-SNI in the βglitch-extendedβ probing model
ππ
Technical clarification: non-extended probes on the stable registersβ values have to be considered in the simulation too
β Sharesβ fan in of robust gadgets should be minimum
π2
(Refined) model and security definition 6
Glitch-extended probes: probing any output of a combinatorial sub- circuit allows the adversary to
Example: π1 gives π, π and π
Definition: a gadget is glitch-robust π-SNI if it is π-SNI in the βglitch-extendedβ probing model
ππ
Technical clarification: non-extended probes on the stable registersβ values have to be considered in the simulation too
β Sharesβ fan in of robust gadgets should be minimum β Outputs of SNI gadgets should be stored in registers
ππ
ISW mult. is glitch-robust π-SNI in 2 cycles 7
Example with:
ISW mult. is glitch-robust π-SNI in 2 cycles 7
The adversary can observe:
β We need to describe a simulator using π1 shares/input
ISW mult. is glitch-robust π-SNI in 2 cycles 7
1,2
to simul. with 2 shares/input
ISW mult. is glitch-robust π-SNI in 2 cycles 7
1,2
1,2: random value
1,3): random value
ISW mult. is glitch-robust π-SNI in 2 cycles 7
1,2
1,2: random value
1,3): random value
ISW mult. is glitch-robust π-SNI in 2 cycles 7
1,2
1,2: random value
1,3): random value
ISW mult. is glitch-robust π-SNI in 2 cycles 7
1,2
1,2: random value
1,3): random value
ISW mult. is glitch-robust π-SNI in 2 cycles 7
1,2
1,2: random value
1,3): random value
ISW mult. is glitch-robust π-SNI in 2 cycles 7
1,2
ISW mult. is glitch-robust π-SNI in 2 cycles 7
1,2
1,2: random value
with 1 share/input impossible with an extended probe on π1)
How to compose (simply) 8
robust-SNI multiplications with one input refreshed in a robust-SNI manner
independently on each share
[Goudarzi & Rivain, Eurocrypt 2018], [Cassiers & Standaert, ePrint 2018]
How to compose (simply) 8
robust-SNI multiplications with one input refreshed in a robust-SNI manner
independently on each share
[Goudarzi & Rivain, Eurocrypt 2018], [Cassiers & Standaert, ePrint 2018]
β Allows building arbitrary
circuits without risk of glitches nor compositional flaws
How to compose (simply) 8
robust-SNI multiplications with one input refreshed in a robust-SNI manner
independently on each share
[Goudarzi & Rivain, Eurocrypt 2018], [Cassiers & Standaert, ePrint 2018]
β Allows building arbitrary
circuits without risk of glitches nor compositional flaws (Sufficient but not necessary!)
Conclusions 9
relevance of many designs ideas (e.g., Threshold
Implementations, Domain Oriented Masking, Unified Masking Approach, Generic Low Latency Masking, β¦)
robust against glitches and composable at any order
Other results 10
+ SNI (wo glitches) β glitch-robust SNI
(e.g., transitions-based leakages, coupling)
http://perso.uclouvain.be/fstandae/
Pseudo-composability a
π2 = π¦2 β π§2 + π¦2 β π§3 + π¦3 β π§2 + π¨2
π1 = π¦1 β π§1 + π¦1 β π§2 + π¦2 β π§1 + π¨1 π3 = π¦3 β π§3 + π¦1 β π§3 + π¦3 β π§1 + π¨3
Pseudo-composability a
π2 = π¦2 β π§2 + π¦2 β π§3 + π¦3 β π§2 + π¨2
π1 with a single share per input (lack of internal rand)
π1 = π¦1 β π§1 + π¦1 β π§2 + π¦2 β π§1 + π¨1 π3 = π¦3 β π§3 + π¦1 β π§3 + π¦3 β π§1 + π¨3