ROUND MODIFICATION ANALYSIS ON AES USING ELECTROMAGNETIC GLITCH Amine DEHBAOUI ¹ , Amir-Pasha MIRBAHA ² , Nicolas MORO ¹ , Jean-Max DUTERTRE ² , Assia TRIA ¹ COSADE 2013 Paris, France (1) (2)
OUTLINE Context Round Modification Analysis on AES Proposed Round Modification Analysis on AES Proposed Round Modification Analysis on AES Electromagnetic Glitch Injection Technique Concrete Results with EMG Conclusion 19 MARS 2013 | PAGE 2
CONTEXT : FAULT INJECTION Correct Ciphertext Plaintext 00001010101010101010 11001010101010101010 10011011101010100011 Faulty Ciphertext Ciphertext Fault injection means : Power supply glitch, Clock glitch, EM glitch, Laser shot … disturb the encryption/decryption process through unusual environmental conditions in order to : • reduce the encryption complexity (e.g. round reduction analysis), • differential fault analysis = comparison between correct and faulty ciphertexts. • safe errors, HW/SW reverse engineering , … retrieve information on the encryption process (i.e. information leakage) | PAGE 3 19 MARS 2013
Round Modification Analysis on AES CEA | 10 AVRIL 2012 | PAGE 4 19 MARS 2013
ADVANCED ENCRYPTION STANDARD 128 BITS REMINDER M Initial round cipher key K Rounds 1..9 round key K i Final round round key K 10 | PAGE 5 C
STATE-OF-THE-ART OF ROUND MODIFICATIONS ANALYSIS R ound M odification A nalysis M Initial round � R ound R eduction A nalysis cipher key K decrease the number of executed rounds � R ound A ddition A nalysis increase the number of executed rounds increase the number of executed rounds Rounds 1..9 round key � R ound A lteration A nalysis K i modification of the round order Final round round key K 10 | PAGE 6 C
STATE-OF-THE-ART OF ROUND MODIFICATIONS ANALYSIS R ound M odification A nalysis M Initial round � R ound R eduction A nalysis cipher key K H. Choukri et al. [2005] J.H. Park et al. [2011] iteration iteration K.S. Bae et al.[2011] K.S. Bae et al.[2011] Rounds 1..9 round key � R ound A ddition A nalysis K i J.M. Dutertre et al. #3 [2012] COMP ( RC , RC MAX ) � R ound A lteration A nalysis Final round round key J.M. Dutertre et al. #2 [2012] K 10 | PAGE 7 C
STATE-OF-THE-ART OF ROUND MODIFICATIONS ANALYSIS Attack Target Mean Type Encryption sequence Req. Key texts search average time ≈ 1 second H. Choukri et al. PIC16F877 Power Round 2 R 0 -R m [FDTC’05] 8-bit Glitch Reduction ≈ 10 hours J.H. Park et al. ATmega128 Laser Round 10 R 0 -R 1 -R 10 [ETRI’11] 8-bit Reduction ≈ 1 second K.S. Bae et al. ATmega128 Laser Round 2 R 0 ..R 8 -R 10 [ICCIT’11] 8-bit Reduction ≈ 1 second J.M. Dutertre et al. Unknown mcu Laser Round 3 R 0 ..R 8 -R m -R f #2 [HOST’12] 0.35µm 8-bit Alteration ≈ 1 hour & J.M. Dutertre et al. Unknown mcu Laser Round 3 R 0 ..R 9 -R m=10 -R f=11’ #3 [HOST’12] 0.35µm 8-bit Addition 30 minutes | PAGE 8
Proposed Round Modification Analysis on AES CEA | 10 AVRIL 2012 | PAGE 9 19 MARS 2013
PROPOSED ROUND MODIFICATIONS ANALYSIS K 9 Round 9… ⊕ ARK ⊕ ⊕ ⊕ Fault model : Instruction alteration M 9 CR++ CR++ CR++ CR++ CR=10 CR=10 CR=9 CR=9 CR=9 CR=9 CR=10 CR=10 SB SR Round 10 KS ⊕ ⊕ ⊕ ⊕ ARK K 10 C C (correct ciphertext) = SR o SB( M 9 ) ⊕ K 10 10 | PAGE 10 C (correct ciphertext) = FR ( M 9 ) ⊕ K 10
PROPOSED ROUND MODIFICATIONS ANALYSIS K 9 Round 9… ⊕ ARK ⊕ ⊕ ⊕ Fault model : Instruction alteration M 9 CR++ CR++ CR++ CR++ CR++ CR++ CR++ CR++ RC=10 RC=10 RC=10 RC=10 RC=9 RC=9 RC=9 RC=9 RC=10 RC=10 RC=9 RC=9 RC=9 RC=9 RC=10 RC=10 SB Round m=9’ Round f=10’ K’ 9 K’ K’ K’ 10 KS KS SR Round 10 ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ MC SB SR KS ARK ARK D SB( M 9’ ) SR o SB( M 9’ ) MC o SR o SB( M 9 ) M 9’ ⊕ ⊕ ⊕ ⊕ ARK D (faulty ciphertext) = SR o SB [MC o SR o SB( M 9 ) ⊕ K’ 9 ] ⊕ K’ 10 D (faulty ciphertext) = FR [ MR[ M 9 ] ⊕ K’ 9 ] ⊕ K’ 10 K 10 C C (correct ciphertext) = SR o SB( M 9 ) ⊕ K 10 11 C (correct ciphertext) = FR ( M 9 ) ⊕ K 10
PROPOSED ROUND MODIFICATIONS ANALYSIS D (faulty ciphertext) = FR [MR( M 9 ) ⊕ K’ 9 ] ⊕ K’ 10 1 plaintext C (correct ciphertext) = FR ( M 9 ) ⊕ K 10 2 plaintexts FR -1 ( D a ⊕ K’ 10 ) ⊕ FR -1 ( D b ⊕ K’ 10 ) = MC( C a ⊕ C b ) M a M b 2 hypothese on each K’ 10 byte (2^ 16 for a 128-bits AES key) Calculation time : < 1 second Alternative solution : 3 plaintexts, instead of 2 thus, 1 hypothesis for each K’ 10 byte | PAGE 12
Electromagnetic Glitch injection Technique CEA | 10 AVRIL 2012 | PAGE 13 19 MARS 2013
PRACTICAL ELECTROMAGNETIC GLITCH SETUP • Control computer • The target device • Motorized stage • Pulse generator • Coil antenna. • Pulse width : 10 ns • Rise and fall transition time : 2ns • Pulse amplitude : -200V / +200V The computer controls both the pulse generator (through a rs-232 link) and the target board (through a usb link). | PAGE 14
PRACTICAL ELECTROMAGNETIC GLITCH SETUP Target Description • Up-to-date 32-bit microcontroller • Designed in a cmos 130nm technology • Based on the arm Cortex-M3 processor. • Operating frequency is set to 24MHz. • Can detect several types of hardware faults. • Can detect several types of hardware faults. • When a specific type of hardware fault is detected, the processor raises its associated interrupt. | PAGE 15
Concrete Results with EMG CEA | 10 AVRIL 2012 | PAGE 16 19 MARS 2013
EMG PROFILE OF THE TARGET EM Channel : main strengths Does not require depackaging the target. Does target the upper metal Layer (Power/Ground or Clock networks). Logical Effect : • 180V injected EMG during 20ns • negative spike of less than 50ns width and instruction alteration 300mV amplitude. | PAGE 17
EXPERIMENTAL OUTLINE | PAGE 18
TIMING CARTOGRAPHY OF EMG EFFECT | PAGE 19
Conclusion CEA | 10 AVRIL 2012 | PAGE 20 19 MARS 2013
Conclusion Round Modification Analysis by targeting the round counter Fault induced at the end of the penultimate round Execution of a second penultimate round EMG Fault model : instruction alteration EMG Fault model : instruction alteration High occurrence rate / without triggering hardware interrupts 19 MARS 2013 | PAGE 21
Attack Target Mean Type Encryption sequence Req. Key texts search average time ≈ 1 H. Choukri et al. PIC16F877 Power Round 2 R 0 -R m [FDTC’05] 8-bit Glitch Reduction second ≈ 10 J.H. Park et al. ATmega128 Laser Round 10 R 0 -R 1 -R 10 [ETRI’11] [ETRI’11] 8-bit 8-bit Reduction Reduction hours hours ≈ 1 K.S. Bae et al. ATmega128 Laser Round 2 R 0 ..R 8 -R 10 [ICCIT’11] 8-bit Reduction second ≈ 1 J.M. Dutertre et al. Unknown mcu Laser Round 3 R 0 ..R 8 -R m -R f #2 [HOST’12] 0.35µm 8-bit Alteration second ≈ 1 hour J.M. Dutertre et al. Unknown mcu Laser Round 3 R 0 ..R 9 -R m=10 -R f=11’ #3 [HOST’12] 0.35µm 8-bit Addition & 30 minutes ≈ 1 Our experiment ARM Cortex-M3 EM Round 2 R 0 ..R 9 -R m=9’ -R f=10’ [COSADE’13] based 130nm Glitch Addition second 32-bit
Annexe : RMA Exceptionnel case CEA | 10 AVRIL 2012 | PAGE 23 19 MARS 2013
RMA – An Exceptional Case An exceptional case may happen when a byte value in D a is equal to K 9 the corresponding byte on the second encryption; Round 9… D a [ byte i ] = D b [ byte i ] ⊕ ⊕ ARK ⊕ ⊕ i.e. EMG M 9 CR++ CR++ CR++ CR++ CR++ CR++ CR++ CR++ CR=10 CR=10 CR=10 CR=10 CR=9 CR=9 CR=9 CR=9 CR=10 CR=10 CR=9 CR=9 CR=9 CR=9 CR=10 CR=10 SB Round m=9’ Round f=10’ K’ K’ 9 K’ 10 K’ KS KS SR Round 10 ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ MC SB SR KS ARK ARK D SB( M 9’ ) SR o SB( M 9’ ) MC o SR o SB( M 9 ) M 9’ ⊕ ⊕ ⊕ ⊕ ARK D (faulty ciphertext) = SR o SB[MC o SR o SB( M 9 ) ⊕ K’ 9 ] ⊕ K’ 10 K 10 C (correct ciphertext) = SR o SB( M 9 ) ⊕ K 10 C | PAGE 24
RMA – An Exceptional Case An exceptional case may happen when a byte value in D a is equal to the corresponding byte on the second encryption; D a [ byte i ] = D b [ byte i ] i.e. 32 43 F6 A8 88 5A 30 8D 31 31 98 A2 E0 37 07 34 19 84 B0 92 95 C8 B1 D9 C4 4E 4D 1E F2 C0 36 5E Round f=10’ 39 25 84 1D 02 DC 09 FB DC 11 85 97 19 6A 0B 32 39 25 84 1D 02 DC 09 FB DC 11 85 97 19 6A 0B 32 K’ 10 K’ 13 AB D8 4B 7B EA FA 58 47 58 48 A5 50 B3 B2 DC 49 4a b5 1f 3b 08 83 e0 d1 21 34 6b 32 cd 31 cb 8c fc 54 6b 3a 46 9e e0 b7 65 6d 0a 92 7b a0 e1 ⊕ ⊕ ⊕ ⊕ SR ARK D SR o SB( M 9’ ) | PAGE 25
RMA – An Exceptional Case Ronde 9… 49 4a b5 1f 3b 08 83 e0 d1 21 34 6b 32 cd 31 cb 8c fc 54 6b 3a 46 9e e0 b7 65 6d 0a 92 7b a0 e1 SB -1 o SR -1 ( D a ⊕ K’ 10 ) ⊕ SB -1 o SR -1 ( D b ⊕ K’ 10 ) = MC( C a ⊕ C b ) 2 8 hypotheses on K’ 10 [7] (byte [7] of K’ 10 ) on K’ 10 [7] (byte [7] of K’ 10 ) 2 8 x 2 15 = 2 23 hypotheses 2 8 x 2 15 = 2 23 hypotheses and 2 hypotheses on the whole-K’ 10 on each other K’ 10 byte to be examined by using C a and D a , and by calculating K’ 9 and K 10 calculation time : still less than 1 second | PAGE 26
Recommend
More recommend
