Randomness as countermeasures against Side Channel Attacks Nadia El - PowerPoint PPT Presentation

Randomness as countermeasures against Side Channel Attacks Nadia El Mrabet nadia.el-mrabet@emse.fr Mines St Etienne WRACH’2019, April 17, 2019

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures Presentation given here Randomness and SCA Nadia El Mrabet 1 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures In real life What could be vulnerable ? Randomness and SCA Nadia El Mrabet 2 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures In real life Existing attacks Randomness and SCA Nadia El Mrabet 3 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures In real life Existing attacks Randomness and SCA Nadia El Mrabet 4 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures In real life ◮ Industrials are building teams to protect their product (Apple, Google, Wawai...) Randomness and SCA Nadia El Mrabet 5 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures Attacks on Device Randomness and SCA Nadia El Mrabet 6 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures The most important point Figure – High level explanation of SCA Randomness and SCA Nadia El Mrabet 7 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures The most important point Figure – Selection according to guesses on the key Randomness and SCA Nadia El Mrabet 8 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures The most important point Figure – Real curve attack Randomness and SCA Nadia El Mrabet 9 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures The Countermeasures ◮ Physical Randomness and SCA Nadia El Mrabet 10 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures The Countermeasures ◮ Physical ◮ Algorithmic ◮ Arithmetical Randomness and SCA Nadia El Mrabet 10 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures Physical countermeasures Duplication of the circuit Dual rail technology Randomness and SCA Nadia El Mrabet 11 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures Physical countermeasures Protection of the circuit Shield Randomisation of the circuit Randomness and SCA Nadia El Mrabet 12 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures First arithmetical countermeasures Double and add algorithm Data: r = ( r N . . . r 0 ) 2 , P ∈ E Result: rP T ← P ; for i = N − 1 to 0 do T ← [ 2 ] T ; if r i = 1 then T ← T + P ; end end return T = [ r ] P Figure – SPA Algorithm 1: Double and add Randomness and SCA Nadia El Mrabet 13 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures First arithmetical countermeasures Handle the leakages T ← P ; for i = N − 1 to 0 do T ← 2 T ; if r i = 1 then T ← T + P ; else U ← T + P ; end return T = rP Algorithm 2: Double and add always Randomness and SCA Nadia El Mrabet 14 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures First arithmetical countermeasures Handle the leakages T ← P ; for i = N − 1 to 0 do T ← 2 T ; if r i = 1 then T ← T + P ; else U ← T + P ; end return T = rP Algorithm 4: Double and add always FAULT ATTACK STRIKES Randomness and SCA Nadia El Mrabet 14 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures First arithmetical countermeasures Handle the leakages T 0 ← P , T 1 ← 2 P ; T ← P ; for i = N − 1 to 0 do for i = N − 1 to 0 do if r i = 1 then T ← 2 T ; T 0 ← T 0 + T 1 , T 1 ← 2 T 1 if r i = 1 then else T ← T + P ; T 1 ← T 0 + T 1 , T 0 ← 2 T 0 else U ← T + P ; end end end return T = rP return T 0 Algorithm 6: Double and add Montgomery Algorithm 7: always ladder FAULT ATTACK STRIKES Randomness and SCA Nadia El Mrabet 14 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures First arithmetical countermeasures The Montgomery ladder is not sufficient ◮ Goubin’s attack : uses a special point (several variants, same method). ◮ Walter’s attack : uses leakage from the conditional branch. ◮ Correlation collision attack (vertical and horizontal). Template, deep learning attacks... Generic protection ◮ Constant time implementation : necessary but not sufficient. ◮ The less conditional branches is the better. Randomness and SCA Nadia El Mrabet 15 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures First arithmetical countermeasures Behind Montgomery ladder ◮ Joye’s double-add ◮ Add-Only ◮ Square Only (Remember Thomas presentation) ◮ Zero-less signed digit expansion ◮ Atomic block Randomness and SCA Nadia El Mrabet 16 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures First arithmetical countermeasures Behind Montgomery ladder ◮ Joye’s double-add [ Still safe ] ◮ Add-Only [ Correlation collision attacks ] ◮ Square Only (Remember Thomas presentation) [ Correlation collision attacks ] ◮ Zero-less signed digit expansion [ Still safe ] ◮ Atomic block [ Horizontal correlation collision attacks ] Randomness and SCA Nadia El Mrabet 16 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures The property of the cryptosystem ECC : representation of the curve ◮ Edwards curves, inverted Edwards curves ◮ Huff model, Hessian curves ◮ Jacobi curves Randomness and SCA Nadia El Mrabet 17 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures The property of the cryptosystem ECC : representation of the curve ◮ Edwards curves, inverted Edwards curves [ Template attacks ] ◮ Huff model, Hessian curves ◮ Jacobi curves Randomness and SCA Nadia El Mrabet 17 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures The property of the cryptosystem ECC : representation of the curve ◮ Edwards curves, inverted Edwards curves [ Template attacks ] ◮ Huff model, Hessian curves ◮ Jacobi curves ECC : representation of the points ◮ Unified formulaes for Weieirstrass ⇒ Goubin’s, Izu-Takagi’s attacks (special point) ⇒ Amiel et al’s attack : uses SCA to distinguish a S from a M ⇒ Horizontal attacks Randomness and SCA Nadia El Mrabet 17 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures The property of the cryptosystem ECC : randomisation of the scalar ◮ Coron’s countermeasure ◮ Exponentiation splitting ◮ Trichina-Bellezza’s countermeasure : kP = ( kr − 1 ) rP ◮ Regular representation of the scalar ◮ Euclidien chain (Remember Christophe, Jean-Marc, Nicolas presentations) ◮ Chevallier-Mames Self-Randomised Exponentiation Randomness and SCA Nadia El Mrabet 18 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures The property of the cryptosystem ECC : randomisation of the scalar ◮ Coron’s countermeasure [ Big attack ] ◮ Exponentiation splitting [ Big Mac attack ] ◮ Trichina-Bellezza’s countermeasure : kP = ( kr − 1 ) rP [ Still safe ] ◮ Regular representation of the scalar [ Correlation collision attacks ] ◮ Euclidien chain (Remember Christophe, Jean-Marc, Nicolas presentations) [ Big Mac attack ] ◮ Chevallier-Mames Self-Randomised Exponentiation [ Still safe ] Randomness and SCA Nadia El Mrabet 18 / 24

Side channel attacks Physical counter measures Algorithmic counter measures Arithmetical counter measures The property of the cryptosystem ECC : randomisation of the scalar ◮ Coron’s countermeasure [ Big attack ] ◮ Exponentiation splitting [ Big Mac attack ] ◮ Trichina-Bellezza’s countermeasure : kP = ( kr − 1 ) rP [ Still safe ] ◮ Regular representation of the scalar [ Correlation collision attacks ] ◮ Euclidien chain (Remember Christophe, Jean-Marc, Nicolas presentations) [ Big Mac attack ] ◮ Chevallier-Mames Self-Randomised Exponentiation [ Still safe ] ECC : A lot of counter measures, but much more attacks ! Randomness and SCA Nadia El Mrabet 18 / 24