Provably Secure Higher-Order Masking of AES Matthieu Rivain - - PowerPoint PPT Presentation
Provably Secure Higher-Order Masking of AES Matthieu Rivain Emmanuel Prouff CryptoExperts Oberthur CHES 2010, Santa Barbara, Aug. 20 th CHES 2010 Provably Secure Higher-Order Masking of AES Outline 1 Introduction Higher-Order
CHES 2010 – Provably Secure Higher-Order Masking of AES
Higher-Order Masking ISW Scheme (CRYPTO’03)
Masking the S-box Masking the Whole AES Security Implementation Results
CHES 2010 – Provably Secure Higher-Order Masking of AES
Higher-Order Masking ISW Scheme (CRYPTO’03)
Masking the S-box Masking the Whole AES Security Implementation Results
CHES 2010 – Provably Secure Higher-Order Masking of AES
Every key-dependent variable x is shared into d + 1 variables
CHES 2010 – Provably Secure Higher-Order Masking of AES
Every key-dependent variable x is shared into d + 1 variables
CHES 2010 – Provably Secure Higher-Order Masking of AES
Every key-dependent variable x is shared into d + 1 variables
The masks (i ≥ 1): xi ← $
CHES 2010 – Provably Secure Higher-Order Masking of AES
Every key-dependent variable x is shared into d + 1 variables
The masks (i ≥ 1): xi ← $ The masked variable: x0 ← x ⊕ x1 ⊕ · · · ⊕ xd
CHES 2010 – Provably Secure Higher-Order Masking of AES
Every key-dependent variable x is shared into d + 1 variables
The masks (i ≥ 1): xi ← $ The masked variable: x0 ← x ⊕ x1 ⊕ · · · ⊕ xd Note: equiv. d + 1 out of d + 1 secret sharing of x
CHES 2010 – Provably Secure Higher-Order Masking of AES
Every key-dependent variable x is shared into d + 1 variables
The masks (i ≥ 1): xi ← $ The masked variable: x0 ← x ⊕ x1 ⊕ · · · ⊕ xd Note: equiv. d + 1 out of d + 1 secret sharing of x Computation carried out by processing the shares separately
CHES 2010 – Provably Secure Higher-Order Masking of AES
Bit x masked → x0, x1, . . . , xd Leakage : Li ∼ xi + N(µ, σ2)
CHES 2010 – Provably Secure Higher-Order Masking of AES
Bit x masked → x0, x1, . . . , xd Leakage : Li ∼ xi + N(µ, σ2) Number of leakage samples to distinguish
CHES 2010 – Provably Secure Higher-Order Masking of AES
Bit x masked → x0, x1, . . . , xd Leakage : Li ∼ xi + N(µ, σ2) Number of leakage samples to distinguish
CHES 2010 – Provably Secure Higher-Order Masking of AES
i mi = m and i ki = k
CHES 2010 – Provably Secure Higher-Order Masking of AES
i mi = m and i ki = k
security: ∀(iv1, iv2, . . . , ivd) ∈ {intermediate var. of E′}d :
CHES 2010 – Provably Secure Higher-Order Masking of AES
i mi = m and i ki = k
security: ∀(iv1, iv2, . . . , ivd) ∈ {intermediate var. of E′}d :
CHES 2010 – Provably Secure Higher-Order Masking of AES
[Schramm-Paar CT-RSA’06] ◮ secure only for d ≤ 2 [Coron-Prouff-Rivain CHES’07]
CHES 2010 – Provably Secure Higher-Order Masking of AES
[Schramm-Paar CT-RSA’06] ◮ secure only for d ≤ 2 [Coron-Prouff-Rivain CHES’07] [Rivain-Dottax-Prouff FSE’08] ◮ alternative solutions dedicated to d = 2
CHES 2010 – Provably Secure Higher-Order Masking of AES
[Schramm-Paar CT-RSA’06] ◮ secure only for d ≤ 2 [Coron-Prouff-Rivain CHES’07] [Rivain-Dottax-Prouff FSE’08] ◮ alternative solutions dedicated to d = 2
[Ishai-Sahai-Wagner CRYPTO’03] ◮ every wire/logic gate is masked at an arbitrary order d ◮ wires values ≡ intermediate variables
⇒ dth-order masking scheme
CHES 2010 – Provably Secure Higher-Order Masking of AES
AND gates encoding: ◮ Input: (ai)i, (bi)i s.t.
i ai = a, i bi = b
◮ Output: (ci)i s.t.
i ci = ab CHES 2010 – Provably Secure Higher-Order Masking of AES
AND gates encoding: ◮ Input: (ai)i, (bi)i s.t.
i ai = a, i bi = b
◮ Output: (ci)i s.t.
i ci = ab
CHES 2010 – Provably Secure Higher-Order Masking of AES
AND gates encoding: ◮ Input: (ai)i, (bi)i s.t.
i ai = a, i bi = b
◮ Output: (ci)i s.t.
i ci = ab
Example (d = 2):
CHES 2010 – Provably Secure Higher-Order Masking of AES
AND gates encoding: ◮ Input: (ai)i, (bi)i s.t.
i ai = a, i bi = b
◮ Output: (ci)i s.t.
i ci = ab
Example (d = 2):
CHES 2010 – Provably Secure Higher-Order Masking of AES
AND gates encoding: ◮ Input: (ai)i, (bi)i s.t.
i ai = a, i bi = b
◮ Output: (ci)i s.t.
i ci = ab
Example (d = 2):
CHES 2010 – Provably Secure Higher-Order Masking of AES
AND gates encoding: ◮ Input: (ai)i, (bi)i s.t.
i ai = a, i bi = b
◮ Output: (ci)i s.t.
i ci = ab
Example (d = 2):
CHES 2010 – Provably Secure Higher-Order Masking of AES
AND gates encoding: ◮ Input: (ai)i, (bi)i s.t.
i ai = a, i bi = b
◮ Output: (ci)i s.t.
i ci = ab
Example (d = 2):
CHES 2010 – Provably Secure Higher-Order Masking of AES
AND gates encoding: ◮ Input: (ai)i, (bi)i s.t.
i ai = a, i bi = b
◮ Output: (ci)i s.t.
i ci = ab
Example (d = 2):
CHES 2010 – Provably Secure Higher-Order Masking of AES
AND gates encoding: ◮ Input: (ai)i, (bi)i s.t.
i ai = a, i bi = b
◮ Output: (ci)i s.t.
i ci = ab
Example (d = 2):
CHES 2010 – Provably Secure Higher-Order Masking of AES
AND gates encoding: ◮ Input: (ai)i, (bi)i s.t.
i ai = a, i bi = b
◮ Output: (ci)i s.t.
i ci = ab
Example (d = 2):
CHES 2010 – Provably Secure Higher-Order Masking of AES
AND gates encoding: ◮ Input: (ai)i, (bi)i s.t.
i ai = a, i bi = b
◮ Output: (ci)i s.t.
i ci = ab
Example (d = 2):
CHES 2010 – Provably Secure Higher-Order Masking of AES
AND gates encoding: ◮ Input: (ai)i, (bi)i s.t.
i ai = a, i bi = b
◮ Output: (ci)i s.t.
i ci = ab
Example (d = 2):
CHES 2010 – Provably Secure Higher-Order Masking of AES
AND gates encoding: ◮ Input: (ai)i, (bi)i s.t.
i ai = a, i bi = b
◮ Output: (ci)i s.t.
i ci = ab
Example (d = 2):
CHES 2010 – Provably Secure Higher-Order Masking of AES
AND gates encoding: ◮ Input: (ai)i, (bi)i s.t.
i ai = a, i bi = b
◮ Output: (ci)i s.t.
i ci = ab
Example (d = 2):
CHES 2010 – Provably Secure Higher-Order Masking of AES
AND gates encoding: ◮ Input: (ai)i, (bi)i s.t.
i ai = a, i bi = b
◮ Output: (ci)i s.t.
i ci = ab
Example (d = 2):
CHES 2010 – Provably Secure Higher-Order Masking of AES
AND gates encoding: ◮ Input: (ai)i, (bi)i s.t.
i ai = a, i bi = b
◮ Output: (ci)i s.t.
i ci = ab
Example (d = 2):
Ishai et al. prove (d/2)th-order security
CHES 2010 – Provably Secure Higher-Order Masking of AES
AND gates encoding: ◮ Input: (ai)i, (bi)i s.t.
i ai = a, i bi = b
◮ Output: (ci)i s.t.
i ci = ab
Example (d = 2):
Ishai et al. prove (d/2)th-order security ◮ We prove dth-order security
CHES 2010 – Provably Secure Higher-Order Masking of AES
b b b b b b b b b b b b b b b b b b b b b
(ai)i c0 c1 c2 (bi)i $ $ $
CHES 2010 – Provably Secure Higher-Order Masking of AES
Important area overhead for the masked circuit ◮ A wire is encoded by d + 1 wires ◮ One AND gate encoded by
CHES 2010 – Provably Secure Higher-Order Masking of AES
Important area overhead for the masked circuit ◮ A wire is encoded by d + 1 wires ◮ One AND gate encoded by
◮ Example: AES S-box circuit
ISW No masking d = 1 d = 2 d = 3 200 gates 500 gates 1.1 Kgates 2 Kgates
CHES 2010 – Provably Secure Higher-Order Masking of AES
Important area overhead for the masked circuit ◮ A wire is encoded by d + 1 wires ◮ One AND gate encoded by
◮ Example: AES S-box circuit
ISW No masking d = 1 d = 2 d = 3 200 gates 500 gates 1.1 Kgates 2 Kgates
Practical security issue with glitches ◮ addition of synchronizing elements ⇒ additional overhead
CHES 2010 – Provably Secure Higher-Order Masking of AES
Important area overhead for the masked circuit ◮ A wire is encoded by d + 1 wires ◮ One AND gate encoded by
◮ Example: AES S-box circuit
ISW No masking d = 1 d = 2 d = 3 200 gates 500 gates 1.1 Kgates 2 Kgates
Practical security issue with glitches ◮ addition of synchronizing elements ⇒ additional overhead Not suitable for software implementations
CHES 2010 – Provably Secure Higher-Order Masking of AES
Higher-Order Masking ISW Scheme (CRYPTO’03)
Masking the S-box Masking the Whole AES Security Implementation Results
CHES 2010 – Provably Secure Higher-Order Masking of AES
Non-linearity ⇒ difficulty to mask
CHES 2010 – Provably Secure Higher-Order Masking of AES
Non-linearity ⇒ difficulty to mask We use the AES S-box structure: S = Exp ◦ Af ◮ Af: affine transformation over F8
2
◮ Exp : x → x254 over F256
CHES 2010 – Provably Secure Higher-Order Masking of AES
Non-linearity ⇒ difficulty to mask We use the AES S-box structure: S = Exp ◦ Af ◮ Af: affine transformation over F8
2
◮ Exp : x → x254 over F256 Masking Af is easy:
Af(x) = Af(x0) ⊕ Af(x1) ⊕ · · · ⊕ Af(xd) ⊕ 0x63 iff d is odd
CHES 2010 – Provably Secure Higher-Order Masking of AES
Non-linearity ⇒ difficulty to mask We use the AES S-box structure: S = Exp ◦ Af ◮ Af: affine transformation over F8
2
◮ Exp : x → x254 over F256 Masking Af is easy:
Af(x) = Af(x0) ⊕ Af(x1) ⊕ · · · ⊕ Af(xd) ⊕ 0x63 iff d is odd
For Exp we use an exponentiation algorithm ◮ approach used for 1st-order masking in
[Bl¨
◮ we want to design a dth-order secure exponentiation ◮ we need dth-order secure square and multiplication
CHES 2010 – Provably Secure Higher-Order Masking of AES
dth-order secure square ◮ squaring is linear over F256
0 ⊕ x2 1 ⊕ · · · ⊕ x2 d = x2
CHES 2010 – Provably Secure Higher-Order Masking of AES
dth-order secure square ◮ squaring is linear over F256
0 ⊕ x2j 1 ⊕ · · · ⊕ x2j d = x2j
CHES 2010 – Provably Secure Higher-Order Masking of AES
dth-order secure square ◮ squaring is linear over F256
0 ⊕ x2j 1 ⊕ · · · ⊕ x2j d = x2j
dth-order secure multiplication ◮ we generalize the ISW scheme to F256
CHES 2010 – Provably Secure Higher-Order Masking of AES
dth-order secure square ◮ squaring is linear over F256
0 ⊕ x2j 1 ⊕ · · · ⊕ x2j d = x2j
dth-order secure multiplication ◮ we generalize the ISW scheme to F256
Complexity: ◮ secure square: d + 1 squares ◮ secure mult: (d + 1)2 mult, 2d(d + 1) XOR, d(d + 1)/2 $8
CHES 2010 – Provably Secure Higher-Order Masking of AES
dth-order secure square ◮ squaring is linear over F256
0 ⊕ x2j 1 ⊕ · · · ⊕ x2j d = x2j
dth-order secure multiplication ◮ we generalize the ISW scheme to F256
Complexity: ◮ secure square: d + 1 squares ◮ secure mult: (d + 1)2 mult, 2d(d + 1) XOR, d(d + 1)/2 $8 Our goal: minimize the number of multiplications which are
CHES 2010 – Provably Secure Higher-Order Masking of AES
CHES 2010 – Provably Secure Higher-Order Masking of AES
2
CHES 2010 – Provably Secure Higher-Order Masking of AES
2
CHES 2010 – Provably Secure Higher-Order Masking of AES
2 4
CHES 2010 – Provably Secure Higher-Order Masking of AES
2 4
CHES 2010 – Provably Secure Higher-Order Masking of AES
2 16 4
CHES 2010 – Provably Secure Higher-Order Masking of AES
2 16 4
CHES 2010 – Provably Secure Higher-Order Masking of AES
2 16 4
CHES 2010 – Provably Secure Higher-Order Masking of AES
2 16 4
Total: 4 mult and 7
CHES 2010 – Provably Secure Higher-Order Masking of AES
2 16 4
Total: 4 mult and 7
Memory: 3 registers
CHES 2010 – Provably Secure Higher-Order Masking of AES
2 16 4
Total: 4 mult and 7
Memory: 3 registers LUT forˆ2,ˆ4 andˆ16
CHES 2010 – Provably Secure Higher-Order Masking of AES
i xi = x
i yi = x254
i )i
i zi = x2]
i yi = x3]
i )i
i wi = x12]
i yi = x15]
i )i
i yi = x240]
i yi = x252]
i yi = x254]
CHES 2010 – Provably Secure Higher-Order Masking of AES
i xi = x
i yi = x254
i )i
i zi = x2]
i yi = x3]
i )i
i wi = x12]
i yi = x15]
i )i
i yi = x240]
i yi = x252]
i yi = x254]
CHES 2010 – Provably Secure Higher-Order Masking of AES
i xi = x
i yi = x254
i )i
i zi = x2]
i yi = x3]
i )i
i wi = x12]
i yi = x15]
i )i
i yi = x240]
i yi = x252]
i yi = x254]
CHES 2010 – Provably Secure Higher-Order Masking of AES
i xi = x
i yi = x254
i )i
i zi = x2]
i yi = x3]
i )i
i wi = x12]
i yi = x15]
i )i
i yi = x240]
i yi = x252]
i yi = x254]
CHES 2010 – Provably Secure Higher-Order Masking of AES
Linear operations of encryption/key schedule (ShiftRows,
CHES 2010 – Provably Secure Higher-Order Masking of AES
Linear operations of encryption/key schedule (ShiftRows,
Key addition performed by adding each key-share to one
CHES 2010 – Provably Secure Higher-Order Masking of AES
CHES 2010 – Provably Secure Higher-Order Masking of AES
Algorithm split into several transformations applied to
CHES 2010 – Provably Secure Higher-Order Masking of AES
Algorithm split into several transformations applied to
Every transformation is locally secure ◮ all transformations are linear (straightforward security) except
the field multiplication
CHES 2010 – Provably Secure Higher-Order Masking of AES
Algorithm split into several transformations applied to
Every transformation is locally secure ◮ all transformations are linear (straightforward security) except
the field multiplication
◮ field multiplication secured using ISW scheme ◮ improved security proof for ISW scheme
CHES 2010 – Provably Secure Higher-Order Masking of AES
Algorithm split into several transformations applied to
Every transformation is locally secure ◮ all transformations are linear (straightforward security) except
the field multiplication
◮ field multiplication secured using ISW scheme ◮ improved security proof for ISW scheme
Local security for every transformation implies global security
CHES 2010 – Provably Secure Higher-Order Masking of AES
Method K cycles ms (31MHz) RAM (bytes) ROM (bytes) Unprotected Implementation Na. 3 0.1 32 1150 First-Order Masking [Messerges FSE’00] 10 0.3 256+35 1553 [Oswald+ FSE’05] 77 2.5 42 3195 Our scheme (d=1) 129 4 73 3153 Second-Order Masking [Schramm+ CT-RSA’06] 594 19 512+90 2336 [Rivain+ FSE’08] 672 22 256+86 2215 Our scheme (d=2) 271 9 79 3845 Third-Order Masking Our scheme (d=3) 470 15 103 4648
CHES 2010 – Provably Secure Higher-Order Masking of AES
Method K cycles ms (31MHz) RAM (bytes) ROM (bytes) Unprotected Implementation Na. 3 0.1 32 1150 First-Order Masking [Messerges FSE’00] 10 0.3 256+35 1553 [Oswald+ FSE’05] 77 2.5 42 3195 Our scheme (d=1) 129 4 73 3153 Second-Order Masking [Schramm+ CT-RSA’06] 594 19 512+90 2336 [Rivain+ FSE’08] 672 22 256+86 2215 Our scheme (d=2) 271 9 79 3845 Third-Order Masking Our scheme (d=3) 470 15 103 4648
Interpolation: 30d2 + 50d + 50 K cycles ◮ d = 4 : 730 Kc / 24 ms ◮ d = 5 : 1050 Kc / 34 ms
CHES 2010 – Provably Secure Higher-Order Masking of AES
Higher-Order Masking ISW Scheme (CRYPTO’03)
Masking the S-box Masking the Whole AES Security Implementation Results
CHES 2010 – Provably Secure Higher-Order Masking of AES
First masking scheme for software implementations of AES
Based on the work [Ishai-Sahai-Wagner CRYPTO’03] Generalization: secure field multiplication in software Improved security proof (d/2 → d), significant in practice On-going work: ◮ generalization to any S-box/SPN ◮ formal security model for dth-order secure implementations
CHES 2010 – Provably Secure Higher-Order Masking of AES