Remote Timing Attacks are Practical by David Brumley and Dan Boneh - - PowerPoint PPT Presentation

▶
remote timing attacks are practical
SMART_READER_LITE
LIVE PREVIEW

Remote Timing Attacks are Practical by David Brumley and Dan Boneh - - PowerPoint PPT Presentation

Dec 16, 2023 419 likes •1.2k views

Remote Timing Attacks are Practical by David Brumley and Dan Boneh Presented by Seny Kamara in Advanced Topics in Network Security (600/650.624) Outline Traditional threat model in cryptography Side-channel attacks Kochers

slide-1
SLIDE 1

Remote Timing Attacks are Practical

by David Brumley and Dan Boneh Presented by Seny Kamara in Advanced Topics in Network Security (600/650.624)

slide-2
SLIDE 2

02/10/05

  • S. Kamara (600/650.624)

Outline

  • Traditional threat model in cryptography
  • Side-channel attacks
  • Kocher’s timing attack
  • Boneh & Brumley timing attack
  • Experiments
  • Countermeasures
slide-3
SLIDE 3

02/10/05

  • S. Kamara (600/650.624)

Traditional Crypto

  • Brute force attacks
  • large key
  • Mathematical attacks
  • reduction to hard problem
  • RSAP:
  • DHP:

(me mod n) → m (gx, gy) → gxy

slide-4
SLIDE 4

02/10/05

  • S. Kamara (600/650.624)
  • Attacker has access to:
  • Ciphertext
  • Algorithm

Traditional Crypto

slide-5
SLIDE 5

02/10/05

  • S. Kamara (600/650.624)
  • Attacker has access to:
  • Ciphertext
  • Algorithm
  • Physical observables from the device

Real-Life Crypto

slide-6
SLIDE 6

02/10/05

  • S. Kamara (600/650.624)

Side Channel Attacks

  • Paul Kocher in 1996
  • Recovers RSA and DSS signing key
  • Not taken seriously by cryptographers
  • Lot of attention from the press
slide-7
SLIDE 7

02/10/05

  • S. Kamara (600/650.624)
  • Timing analysis
  • Fault analysis
  • Differential fault analysis
  • Simple power analysis
  • Differential power analysis
  • EM analysis

Side Channel Attacks

slide-8
SLIDE 8

02/10/05

  • S. Kamara (600/650.624)

Side Channel Attacks

k

m

EM radiation c time

Power consumption

slide-9
SLIDE 9

02/10/05

  • S. Kamara (600/650.624)

Side Channel Attacks

e

m

Side channel

me mod n

Encryption

slide-10
SLIDE 10

02/10/05

  • S. Kamara (600/650.624)

Side Channel Attacks

d

m

Side channel

md mod n

Decryption/ Signing

slide-11
SLIDE 11

02/10/05

  • S. Kamara (600/650.624)
  • RSA signatures:
  • Modular exponentiation is computed using

square and multiply algorithm

  • Time of modular exponentiation is a

function of the bits of the exponent

  • Use time to recover exponent (signing key)

Kocher Timing Attack

sig(m) = md mod n

slide-12
SLIDE 12

02/10/05

  • S. Kamara (600/650.624)

Kocher Timing Attack

  • Recovers key bit by bit
  • Guesses key bit then verifies
  • Uses statistical analysis
  • Needs many samples of signing time
slide-13
SLIDE 13

02/10/05

  • S. Kamara (600/650.624)

Kocher Attack Target

sig(m) = md mod n

slide-14
SLIDE 14

02/10/05

  • S. Kamara (600/650.624)

Square and Multiply

1: INPUT: m, n, d 2: OUTPUT: x = md mod n 3: x := m 4: for i = n − 1 downto 0 do 5:

x := x2

6:

if di = 1 then

7:

x := x · m mod n

8:

end if

9: end for 10: return x

slide-15
SLIDE 15

02/10/05

  • S. Kamara (600/650.624)

Kocher Timing Attack

Bob

m1 s1 m2 s2

... ... Eve ... d

T(m1) T(m2)

slide-16
SLIDE 16

02/10/05

  • S. Kamara (600/650.624)

Kocher Timing Attack

Eve

m1 s1 m2 s2

... ... Eve ... 0?

T0(m2) T0(m1)

slide-17
SLIDE 17

02/10/05

  • S. Kamara (600/650.624)

Kocher Timing Attack

Eve

m1 s1 m2 s2

... ... Eve ... 1?

T1(m1) T1(m2)

slide-18
SLIDE 18

02/10/05

  • S. Kamara (600/650.624)

Kocher Timing Attack

  • Compare
  • vs
  • vs
  • will be correlated with correct guess

T0(mi) T(mi) T1(mi) T(mi) T(mi)

slide-19
SLIDE 19

02/10/05

  • S. Kamara (600/650.624)

Kocher Timing Attack

  • 1998 UCL experimental results:

Key size sample size 64 1 500-6 500 128 12 000-20 000 256 70 000-80 000 512 350 000

slide-20
SLIDE 20

02/10/05

  • S. Kamara (600/650.624)

Limit of Kocher Attack

  • Does not work when mod exp is optimized
slide-21
SLIDE 21

02/10/05

  • S. Kamara (600/650.624)

RSA with Sun Ze Th.

  • Sun Ze Th. aka CRT
  • m, d and n are order of 1024 bits
  • exponentiation of 1024 bit number by

another 1024 bit number taken modulo a third 1024 bit number

sig(m) = md mod n

slide-22
SLIDE 22

02/10/05

  • S. Kamara (600/650.624)

RSA with Sun Ze Th.

  • exponentiate mod q (512 bits)
  • exponentiate mod p (512 bits)
  • combine using SZT to get mod n (= pq)
slide-23
SLIDE 23

02/10/05

  • S. Kamara (600/650.624)

RSA with Sun Ze Th.

  • where
  • sig(m) = md mod n

n = pq m1 = m mod p m2 = m mod q d1 = d mod (p − 1) d2 = d mod (q − 1)

slide-24
SLIDE 24

02/10/05

  • S. Kamara (600/650.624)

RSA with Sun Ze Th.

  • s1 = md1

1 mod p

s2 = md2

2 mod q

CRT(s1, s2) = md mod n

slide-25
SLIDE 25

02/10/05

  • S. Kamara (600/650.624)

RSA with Sun Ze Th.

  • Modular exponentiation:
  • pre-processing
  • exponentiation mod p
  • exponentiation mod q
  • CRT
slide-26
SLIDE 26

02/10/05

  • S. Kamara (600/650.624)

RSA with Sun Ze Th.

  • Kocher’s attack does not work
  • Cannot get precise timings
  • Cannot repeat pre-processing without

factors

  • Most implementations use CRT
  • OpenSSL
slide-27
SLIDE 27

02/10/05

  • S. Kamara (600/650.624)

OpenSSL

  • SSL establishes encrypted and authenticated

channel between client and server

  • 1994
  • SSL v1 completed but never released
  • SSL v2 released with Navigator 1.1
  • SSL v2 PRNG broken
slide-28
SLIDE 28

02/10/05

  • S. Kamara (600/650.624)

OpenSSL

  • 1995
  • SSL v3 released (designed by Kocher)
  • SSL is ubiquitous
  • 1996
  • IETF standardizes SSL
slide-29
SLIDE 29

02/10/05

  • S. Kamara (600/650.624)

OpenSSL

  • 1998
  • OpenSSL 0.9.1c is released (based on

SSLeay)

  • mod_ssl for Apache is released
slide-30
SLIDE 30

02/10/05

  • S. Kamara (600/650.624)

OpenSSL

  • Most popular open source SSL

implementation

  • Most popular crypto library
  • 18% of all Apache servers use mod_ssl
  • stunnel
  • sNFS
slide-31
SLIDE 31

02/10/05

  • S. Kamara (600/650.624)

RSA in OpenSSL

  • Sun Ze Theorem
  • Modular exponentiation: sliding window
  • Modular reduction: Montgomery
  • Multi-precision multiplication: Karatsuba

sig(m) = md mod n

slide-32
SLIDE 32

02/10/05

  • S. Kamara (600/650.624)

Sliding Window

  • Extension of square and multiply
  • uses multiple bits of the exponent at once
  • makes attack more difficult
slide-33
SLIDE 33

02/10/05

  • S. Kamara (600/650.624)

Montgomery Reduction

  • Introduced in 1985 by Peter Montgomery
  • Performs modular multiplication efficiently
  • Transforms multiplication mod n to

multiplication mod R

slide-34
SLIDE 34

02/10/05

  • S. Kamara (600/650.624)

Montgomery Reduction

extra reduction

Algorithm 1 Montgomery Reduction

1: INPUT: x, y and q 2: OUTPUT: x · y mod q 3: RR−1 − qq∗ = 1 4: Ψ(x) := xR mod q 5: Ψ(y) := yR mod q 6: z := Ψ(x) × Ψ(y) = abR2 mod q 7: r := z × q∗ mod R 8: s := z+rq

R

9: if s > q then 10:

s := s − q

11: end if 12: return s

slide-35
SLIDE 35

02/10/05

  • S. Kamara (600/650.624)

Montgomery Reduction

  • Pr[extra reduction] = m mod q

2R m → q ⇒ Pr[reduction] m → q+ ⇒ Pr[reduction] m = q ⇒ Pr[reduction] = 0

slide-36
SLIDE 36

02/10/05

  • S. Kamara (600/650.624)

Karatsuba

  • Multi-precision multiplication
  • where and
  • Runs in
  • As opposed to
  • worst case

O(nlog2 3) O(n2) O(n · m) x · y |x| = n |y| = n

slide-37
SLIDE 37

02/10/05

  • S. Kamara (600/650.624)

Karatsuba

  • Used only if inputs have same length
  • OpenSSL:
  • if |x| = |y| then Karatsuba
  • if |x| != |y| then normal

O(nlog2 3) O(n2)

slide-38
SLIDE 38

02/10/05

  • S. Kamara (600/650.624)

Biases

  • What is the effect of these optimizations on

the exponentiation time?

slide-39
SLIDE 39

02/10/05

  • S. Kamara (600/650.624)

Montgomery Reduction

  • if m approaches q from below then slow
  • if m approaches q from above then fast
slide-40
SLIDE 40

02/10/05

  • S. Kamara (600/650.624)

Montgomery Reduction

Decryption time

q 2q 3q g Figure 1

slide-41
SLIDE 41

02/10/05

  • S. Kamara (600/650.624)

Multiplication

  • if |x| = |y| then fast
  • if |x| != |y| then slow
slide-42
SLIDE 42

02/10/05

  • S. Kamara (600/650.624)

Multiplication

g g < q g > q

Decryption time

Karatsuba Normal

slide-43
SLIDE 43

02/10/05

  • S. Kamara (600/650.624)

Boneh-Brumley Attack

hello e g or ghi error Eve Server

slide-44
SLIDE 44

02/10/05

  • S. Kamara (600/650.624)

Boneh-Brumley Attack

  • Kocher attack recovers signing key
  • Boneh-Brumley attack recovers factor
slide-45
SLIDE 45

02/10/05

  • S. Kamara (600/650.624)

Kocher Attack Target

sig(m) = md mod n

slide-46
SLIDE 46

02/10/05

  • S. Kamara (600/650.624)

Boneh-Brumley Target

sig(m) = md mod p · q

slide-47
SLIDE 47

02/10/05

  • S. Kamara (600/650.624)

Boneh-Brumley Target

  • n = pq
  • Knowing q we recover p

d = e−1 mod (p − 1)(q − 1)

slide-48
SLIDE 48

02/10/05

  • S. Kamara (600/650.624)

Boneh-Brumley Attack

CRT Square and multiply Montgomery Multiplication

m modq md mod q md mod R I · m

slide-49
SLIDE 49

02/10/05

  • S. Kamara (600/650.624)

Boneh-Brumley Attack

  • Recover bit of q
  • when we already have the top bits

sig(m) = md mod pq ith i − 1

slide-50
SLIDE 50

02/10/05

  • S. Kamara (600/650.624)

Timing Attack

  • q: smallest factor
  • g: same top bits as q (rest is all 0)
  • : g with bit set to
  • : decryption(g) - decryption( )

i − 1 ghi ith 1 ghi ∆

slide-51
SLIDE 51

02/10/05

  • S. Kamara (600/650.624)

Timing Attack

  • i = 4
  • q = 101 ?
  • g = 101 0...
  • g = 101 10...

hi

slide-52
SLIDE 52

02/10/05

  • S. Kamara (600/650.624)

Timing Attack

  • i = 4
  • q = 101 1 ?
  • g = 101 0...
  • g = 101 10...

hi

if then

q4 = 1 g < ghi < q

slide-53
SLIDE 53

02/10/05

  • S. Kamara (600/650.624)

Timing Attack

  • i = 4
  • q = 101 0 ?
  • g = 101 0...
  • g = 101 10...

hi

if then

g < q < ghi q4 = 0

slide-54
SLIDE 54

02/10/05

  • S. Kamara (600/650.624)

Boneh-Brumley Attack

Montgomery Multiplication T(g) slow (xtra reds) fast (kara)

ghi

T( ) fast slow (normal)

|∆|

large large

qi = 0 → g < q < ghi

slide-55
SLIDE 55

02/10/05

  • S. Kamara (600/650.624)

Boneh-Brumley Attack

Montgomery Multiplication T(g) slow (xtra reds) fast (kara)

ghi

T( ) fast slow (normal)

|∆|

large large

g < q < ghi

slide-56
SLIDE 56

02/10/05

  • S. Kamara (600/650.624)

Boneh-Brumley Attack

Montgomery Multiplication T(g) slow fast

ghi

T( ) slow fast

|∆|

small small

qi = 1 → g < ghi < q

slide-57
SLIDE 57

02/10/05

  • S. Kamara (600/650.624)

Boneh-Brumley Attack

Montgomery Multiplication T(g) slow fast

ghi

T( ) slow fast

|∆|

small small

g < ghi < q

slide-58
SLIDE 58

02/10/05

  • S. Kamara (600/650.624)

Timing Attack

  • if then and
  • is small
  • if then and
  • is large

q4 = 1 |∆| g < ghi < q q4 = 0 g < q < ghi |∆|

slide-59
SLIDE 59

02/10/05

  • S. Kamara (600/650.624)

Experimental Setup

  • RedHat Linux 7.3
  • 2.4 GHz Pentium 4
  • 1 GB of RAM
  • gcc 2.96
  • OpenSSL 0.9.7
slide-60
SLIDE 60

02/10/05

  • S. Kamara (600/650.624)

Number of Queries

  • Interprocess using TCP
  • Neighborhood size: for each bit measure

decryption time of many guesses (sliding window)

  • Sample size: for each guess measure multiple

times

slide-61
SLIDE 61

02/10/05

  • S. Kamara (600/650.624)

Number of Queries

slide-62
SLIDE 62

02/10/05

  • S. Kamara (600/650.624)

Number of Queries

  • Delta increases as neighborhood size

increases

  • Variance decreases as sample size increases
slide-63
SLIDE 63

02/10/05

  • S. Kamara (600/650.624)

Other Experiments

  • Tested using 3 different keys
  • Deltas are very sensitive to
  • execution environment (cache misses,

code offsets etc...)

  • compilation flags
slide-64
SLIDE 64

02/10/05

  • S. Kamara (600/650.624)

Network Experiments

  • Works against Apache+mod_ssl when

seperated by:

  • 1 switch
  • 3 routers and a number of switches
slide-65
SLIDE 65

02/10/05

  • S. Kamara (600/650.624)

Network

slide-66
SLIDE 66

02/10/05

  • S. Kamara (600/650.624)

Attack Results

  • Interprocess attack
  • 1024 bit key
  • Unoptimized: 350 000 queries
  • Optimized: 1.4 million queries
  • 2 hours
slide-67
SLIDE 67

02/10/05

  • S. Kamara (600/650.624)

More Details

  • Lucas will talk more about the experiments
slide-68
SLIDE 68

02/10/05

  • S. Kamara (600/650.624)

Countermeasures

  • Make running time independent of input
  • Montgomery: perform dummy reductions
  • Multiplication: always use Karatsuba

(shifts)

  • Make all operations take the same time
slide-69
SLIDE 69

02/10/05

  • S. Kamara (600/650.624)
  • Blinding

Countermeasures

Eve

(rem) (rem)d

rmd

r ∈R Zn

slide-70
SLIDE 70

02/10/05

  • S. Kamara (600/650.624)

Countermeasures

slide-71
SLIDE 71

02/10/05

  • S. Kamara (600/650.624)

Blinding

  • How do we know it prevents other attacks?
  • Blinding is not provably secure
  • What about template attacks?
slide-72
SLIDE 72

02/10/05

  • S. Kamara (600/650.624)

Impact

  • CERT advisory
  • At least 37 products vulnerable
  • 23 not vulnerable
  • 56 unknown
slide-73
SLIDE 73

02/10/05

  • S. Kamara (600/650.624)

Questions?

slide-74
SLIDE 74

02/10/05

  • S. Kamara (600/650.624)

Montgomery Reduction

  • and
  • Multiplication and division by powers of 2 is

efficient

x · y mod q → x · y mod 2k 2k > q gcd(2k, q) = 1

slide-75
SLIDE 75

02/10/05

  • S. Kamara (600/650.624)

Karatsuba

  • A × B = AHAL × BHBL

A × B = (2

n 2 AH + AL) × (2 n 2 BH + BL)

A × B = 2nAHBH + 2

n 2 (AHBL + ALBH) + ALBL

slide-76
SLIDE 76

02/10/05

  • S. Kamara (600/650.624)

Karatsuba

AHBL + ALBH = (AH + AL) × (BH + BL) − AHBH − ALBL

A × B = 2nAHBH + 2

n 2 (AHBL + ALBH) + ALBL

A × B = 2nAHBH + 2

n 2 [(AH + AL) × (BH + BL) − AHBH − ALBL] + ALBL

slide-77
SLIDE 77

02/10/05

  • S. Kamara (600/650.624)

Karatsuba

  • 3 multiplications and 2 shift and 7 additions
  • multiplications fit in registers (no overflows)