SLIDE 1
Side Channel Analysis & Countermeasures
Begül Bilgin
27 Dec. 2014 - IAM Alumni Meeting
Adversary Models
2
Side Channel Analysis & Countermeasures Begl Bilgin 27 Dec. - - PowerPoint PPT Presentation
Side Channel Analysis & Countermeasures Begl Bilgin 27 Dec. - - PowerPoint PPT Presentation
Side Channel Analysis & Countermeasures Begl Bilgin 27 Dec. 2014 - IAM Alumni Meeting Adversary Models 2 Adversary Models 2 Adversary Models Black-box Gray-box White-box 3 Adversary Models Black-box Gray-box White-box Key
SLIDE 2
SLIDE 3
Adversary Models
2
SLIDE 4
Adversary Models
Black-box Gray-box White-box
3
SLIDE 5
Adversary Models
Black-box Gray-box White-box
Crypto Algorithm
Key Ini Outi
3
SLIDE 6
Adversary Models
Black-box Gray-box White-box
Crypto Algorithm
Key Ini Outi
#Cryptanalysis
3
SLIDE 7
Adversary Models
Black-box Gray-box White-box
Crypto Algorithm
Key Ini Outi
#Cryptanalysis
#Differential Cryp. #Linear Cryp. #Brute Force Att.
3
SLIDE 8
Adversary Models
Black-box Gray-box White-box
Crypto Algorithm
Key Ini Outi
#Cryptanalysis
#Differential Cryp. #Linear Cryp. #Brute Force Att.
#Cube Att. #Related Key Att. #Meet-in-the-Middle Att. #Boomerang Att. #Impossible Diff. Att.
3
SLIDE 9
Adversary Models
Black-box Gray-box White-box
Crypto Algorithm
Key Ini Outi
Crypto Algorithm
3
SLIDE 10
Adversary Models
Black-box Gray-box White-box
Crypto Algorithm
Key Ini Outi
Crypto Algorithm
#Game Consoles #Set-top Boxes
3
SLIDE 11
Adversary Models
Black-box Gray-box White-box
Crypto Algorithm
Key Ini Outi
Crypto Algorithm Crypto Algorithm
3
SLIDE 12
Adversary Models
Black-box Gray-box White-box
Crypto Algorithm
Key Ini Outi
Crypto Algorithm Crypto Algorithm
3
SLIDE 13
Adversary Models
Black-box Gray-box White-box Non-invasive (Semi)-invasive
4
SLIDE 14
Adversary Models
Black-box Gray-box White-box Non-invasive (Semi)-invasive
4
SLIDE 15
Adversary Models
Black-box Gray-box White-box Non-invasive (Semi)-invasive
4
SLIDE 16
Adversary Models
Black-box Gray-box White-box Non-invasive (Semi)-invasive
Active Passive
- Light attacks
- Laser cutters
- …
- Photonic inspection
- Probing
- …
4
SLIDE 17
Adversary Models
Black-box Gray-box White-box Non-invasive (Semi)-invasive
Active Passive
- Light attacks
- Laser cutters
- …
- Photonic inspection
- Probing
- …
Active Passive
- Temperature
- r voltage change
- …
- Side channel
analysis
4
SLIDE 18
Adversary Models
Black-box Gray-box White-box Non-invasive (Semi)-invasive
Active Passive
- Light attacks
- Laser cutters
- …
- Photonic inspection
- Probing
- …
Active Passive
- Temperature
- r voltage change
- …
- Side channel
analysis
Timing EM, Power Analysis
Simple Differential
4
SLIDE 19
Adversary Models
Black-box Gray-box White-box Non-invasive (Semi)-invasive
Active Passive
- Light attacks
- Laser cutters
- …
- Photonic inspection
- Probing
- …
Active Passive
- Temperature
- r voltage change
- …
- Side channel
analysis
Timing EM, Power Analysis
Simple Differential Smart Card Protocol Testing Reverse Engineering Code Review
4
SLIDE 20
Adversary Models
Black-box Gray-box White-box Non-invasive (Semi)-invasive
Active Passive
- Light attacks
- Laser cutters
- …
- Photonic inspection
- Probing
- …
Active Passive
- Temperature
- r voltage change
- …
- Side channel
analysis
Timing EM, Power Analysis
Simple Differential Smart Card Protocol Testing Reverse Engineering Code Review
Passive EM, Power Analysis
Differential
4
SLIDE 21
Introduction to Power Analysis
5
SLIDE 22
6
Measurement Setup
Oscilloscope Clock Gen. & Power Supply Device Under Test
SLIDE 23
6
Measurement Setup
Oscilloscope Clock Gen. & Power Supply Device Under Test
- Instantaneous power over time
SLIDE 24
6
Measurement Setup
Oscilloscope Clock Gen. & Power Supply Device Under Test
- Instantaneous power over time
- Realistic ???
SLIDE 25
6
Measurement Setup
Oscilloscope Clock Gen. & Power Supply Device Under Test
- Instantaneous power over time
- Realistic ???
- Yes
SLIDE 26
6
Measurement Setup
Oscilloscope Clock Gen. & Power Supply Device Under Test
- Instantaneous power over time
- Realistic ???
- Yes
- Almost (Noise, trigger point, sampling rate etc.)
SLIDE 27
7
Power Analysis
SLIDE 28
7
Power Analysis
- Dominant technology: CMOS (Complementary metal oxide semiconductor)
- Low static power consumption
- High dynamic power consumption
- Power consumption depends on input
SLIDE 29
7
Power Analysis
- Dominant technology: CMOS (Complementary metal oxide semiconductor)
- Low static power consumption
- High dynamic power consumption
- Power consumption depends on input
- Signal switch consumes more power
- 0 → 0 : low
- 0 → 1 : high
- 1 → 0 : high
- 1 → 1 : low
SLIDE 30
7
Power Analysis
- Dominant technology: CMOS (Complementary metal oxide semiconductor)
- Low static power consumption
- High dynamic power consumption
- Power consumption depends on input
- Leakage of Enc(pt,key)
creates a fingerprint
[courtesy: P . Kocher]
- Signal switch consumes more power
- 0 → 0 : low
- 0 → 1 : high
- 1 → 0 : high
- 1 → 1 : low
SLIDE 31
8
Simple Power Analysis
SLIDE 32
8
Simple Power Analysis
- Analysis using one (pt, key) pair
SLIDE 33
8
Simple Power Analysis
- Analysis using one (pt, key) pair
- Pattern recognition
SLIDE 34
8
Simple Power Analysis
- Analysis using one (pt, key) pair
- Pattern recognition
- e.g. RSA exponentiation using sq-and-mult
- sig = ptskey
- Coprocessor optimized for squaring
SLIDE 35
8
Simple Power Analysis
- Analysis using one (pt, key) pair
- Pattern recognition
- e.g. RSA exponentiation using sq-and-mult
- sig = ptskey
- Coprocessor optimized for squaring
[courtesy: C.Clavier]
SLIDE 36
9
Simple Power Analysis
[courtesy: L.Batina]
SLIDE 37
9
Simple Power Analysis
Symmetric-key algorithm
[courtesy: L.Batina]
SLIDE 38
9
Simple Power Analysis
Symmetric-key algorithm
AES
[courtesy: L.Batina]
SLIDE 39
9
Simple Power Analysis
Symmetric-key algorithm
- Algorithm detection
AES
[courtesy: L.Batina]
SLIDE 40
9
Simple Power Analysis
Symmetric-key algorithm
- Algorithm detection
- Understanding the implementation
AES
[courtesy: L.Batina]
SLIDE 41
9
Simple Power Analysis
Symmetric-key algorithm
- Algorithm detection
- Understanding the implementation
- Key extraction is NOT easy !
AES
[courtesy: L.Batina]
SLIDE 42
9
Simple Power Analysis
Symmetric-key algorithm
- Algorithm detection
- Understanding the implementation
- Key extraction is NOT easy !
- Detailed information on the device
AES
[courtesy: L.Batina]
SLIDE 43
9
Simple Power Analysis
Symmetric-key algorithm
- Algorithm detection
- Understanding the implementation
- Key extraction is NOT easy !
- Detailed information on the device
- Generate templates
AES
[courtesy: L.Batina]
SLIDE 44
9
Simple Power Analysis
Symmetric-key algorithm
- Algorithm detection
- Understanding the implementation
- Key extraction is NOT easy !
- Detailed information on the device
- Generate templates
- Use math solvers
AES
[courtesy: L.Batina]
SLIDE 45
10
Differential Power Analysis
SLIDE 46
10
Differential Power Analysis
- Encryptions of different pt using the same key
SLIDE 47
10
Differential Power Analysis
- Encryptions of different pt using the same key
- Divide and conquer principle
- Attack using intermediate results (e.g. Sbox output)
- Depend on a few key bits
Sbox pti keyi ⊕
- uti
SLIDE 48
10
Differential Power Analysis
- Encryptions of different pt using the same key
- Divide and conquer principle
- Attack using intermediate results (e.g. Sbox output)
- Depend on a few key bits
Sbox pti keyi ⊕
- uti
- Power consumption variation is small
SLIDE 49
10
Differential Power Analysis
- Encryptions of different pt using the same key
- Divide and conquer principle
- Attack using intermediate results (e.g. Sbox output)
- Depend on a few key bits
Sbox pti keyi ⊕
- uti
- Power consumption variation is small
- Detectable using statistics
SLIDE 50
10
Differential Power Analysis
- Encryptions of different pt using the same key
- Divide and conquer principle
- Attack using intermediate results (e.g. Sbox output)
- Depend on a few key bits
Sbox pti keyi ⊕
- uti
- Power consumption variation is small
- Detectable using statistics
- Guess keyi
SLIDE 51
10
Differential Power Analysis
- Encryptions of different pt using the same key
- Divide and conquer principle
- Attack using intermediate results (e.g. Sbox output)
- Depend on a few key bits
Sbox pti keyi ⊕
- uti
- Power consumption variation is small
- Detectable using statistics
- Guess keyi
- Group traces
SLIDE 52
10
Differential Power Analysis
- Encryptions of different pt using the same key
- Divide and conquer principle
- Attack using intermediate results (e.g. Sbox output)
- Depend on a few key bits
Sbox pti keyi ⊕
- uti
- Power consumption variation is small
- Detectable using statistics
- Guess keyi
- Group traces
- Wrong key guess → random grouping, no difference
SLIDE 53
10
Differential Power Analysis
- Encryptions of different pt using the same key
- Divide and conquer principle
- Attack using intermediate results (e.g. Sbox output)
- Depend on a few key bits
Sbox pti keyi ⊕
- uti
- Power consumption variation is small
- Detectable using statistics
- Guess keyi
- Group traces
- Wrong key guess → random grouping, no difference
- Correct key guess → correct grouping, difference
SLIDE 54
11
Differential Power Analysis
pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e...
[courtesy: B.Gierlichs]
SLIDE 55
11
Differential Power Analysis
pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e... S(pt1 ⊕ key1)&1 1 1 1 1
key1=00
[courtesy: B.Gierlichs]
SLIDE 56
11
Differential Power Analysis
pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e... S(pt1 ⊕ key1)&1 1 1 1 1
key1=00
[courtesy: B.Gierlichs]
SLIDE 57
11
Differential Power Analysis
pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e... Take means S(pt1 ⊕ key1)&1 1 1 1 1
key1=00
[courtesy: B.Gierlichs]
SLIDE 58
11
Differential Power Analysis
pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e... Take means Take difference S(pt1 ⊕ key1)&1 1 1 1 1
key1=00
[courtesy: B.Gierlichs]
SLIDE 59
12
Differential Power Analysis
pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e...
[courtesy: B.Gierlichs]
SLIDE 60
12
Differential Power Analysis
pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e... S(pt1 ⊕ key1)&1 1 1 1
key1=2b
[courtesy: B.Gierlichs]
SLIDE 61
12
Differential Power Analysis
pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e... S(pt1 ⊕ key1)&1 1 1 1
key1=2b
[courtesy: B.Gierlichs]
SLIDE 62
12
Differential Power Analysis
pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e... S(pt1 ⊕ key1)&1 1 1 1
key1=2b
Take means
[courtesy: B.Gierlichs]
SLIDE 63
12
Differential Power Analysis
pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e... S(pt1 ⊕ key1)&1 1 1 1
key1=2b
Take means Take difference
[courtesy: B.Gierlichs]
SLIDE 64
12
Differential Power Analysis
pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e... S(pt1 ⊕ key1)&1 1 1 1
key1=2b
Take means Take difference
[courtesy: B.Gierlichs]
SLIDE 65
12
Differential Power Analysis
pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e... S(pt1 ⊕ key1)&1 1 1 1
key1=2b
Take means Take difference
D i f f e r e n c e
- f
M e a n s
[courtesy: B.Gierlichs]
SLIDE 66
13
Differential Power Analysis
Correlation Power Analysis
pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e...
SLIDE 67
13
Differential Power Analysis
Correlation Power Analysis
pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e... S(pt1 ⊕ key1) 82 62 7e 7b f6 e8 f3
key1=00
SLIDE 68
13
Differential Power Analysis
Correlation Power Analysis
pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e... S(pt1 ⊕ key1) 82 62 7e 7b f6 e8 f3
key1=00
Corr.
SLIDE 69
13
Differential Power Analysis
Correlation Power Analysis
pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e... S(pt1 ⊕ key1) 82 62 7e 7b f6 e8 f3
key1=00
Corr.
SLIDE 70
13
Differential Power Analysis
Correlation Power Analysis
pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e... S(pt1 ⊕ key1) 82 62 7e 7b f6 e8 f3
key1=00
Corr.
SLIDE 71
13
Differential Power Analysis
Correlation Power Analysis
pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e... S(pt1 ⊕ key1) 82 62 7e 7b f6 e8 f3
key1=00
SLIDE 72
13
Differential Power Analysis
Correlation Power Analysis
pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e... S(pt1 ⊕ key1) 82 62 7e 7b f6 e8 f3
key1=00
S(pt1 ⊕ key1) 12 cd 32 34 4a 11 fc
key1=2b
SLIDE 73
13
Differential Power Analysis
Correlation Power Analysis
pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e... S(pt1 ⊕ key1) HW(82) HW(62) HW(7e) HW(7b) HW(f6) HW(e8) HW(f3)
key1=00
S(pt1 ⊕ key1) HW(12) HW(cd) HW(32) HW(34) HW(4a) HW(11) HW(fc)
key1=2b
SLIDE 74
13
Differential Power Analysis
Correlation Power Analysis
pt 1234… abcd… 8aef… 0354... 7791… c80d… 7e9e... S(pt1 ⊕ key1) HW(82) HW(62) HW(7e) HW(7b) HW(f6) HW(e8) HW(f3)
key1=00
S(pt1 ⊕ key1) HW(12) HW(cd) HW(32) HW(34) HW(4a) HW(11) HW(fc)
key1=2b
Better leakage model → better attack
SLIDE 75
14
Differential Power Analysis
(Notes & Assumptions)
SLIDE 76
14
Differential Power Analysis
(Notes & Assumptions)
- Knowledge about the algorithm
SLIDE 77
14
Differential Power Analysis
(Notes & Assumptions)
- Knowledge about the algorithm
- Timing of the intermediate value computation
SLIDE 78
14
Differential Power Analysis
(Notes & Assumptions)
- Knowledge about the algorithm
- Timing of the intermediate value computation
- Perfectly aligned traces
SLIDE 79
14
Differential Power Analysis
(Notes & Assumptions)
- Knowledge about the algorithm
- Timing of the intermediate value computation
- Perfectly aligned traces
- No countermeasures
SLIDE 80
14
Differential Power Analysis
(Notes & Assumptions)
- Knowledge about the algorithm
- Timing of the intermediate value computation
- Perfectly aligned traces
- No countermeasures
- # of traces increase with noise
SLIDE 81
15
Countermeasures Against DPA
SLIDE 82
16
Countermeasures
SLIDE 83
16
Countermeasures
- Limit number of encryptions per key
SLIDE 84
16
Countermeasures
- Limit number of encryptions per key
- Distribution of key is difficult
SLIDE 85
16
Countermeasures
- Limit number of encryptions per key
- Distribution of key is difficult
- Leakage resilient algorithms
SLIDE 86
16
Countermeasures
- Limit number of encryptions per key
- Distribution of key is difficult
- Leakage resilient algorithms
- Performance drop
SLIDE 87
16
Countermeasures
- Limit number of encryptions per key
- Distribution of key is difficult
- Leakage resilient algorithms
- Performance drop
- Decrease Signal-to-Noise Ratio (SNR)
SLIDE 88
16
Countermeasures
- Limit number of encryptions per key
- Distribution of key is difficult
- Leakage resilient algorithms
- Performance drop
- Decrease Signal-to-Noise Ratio (SNR)
- Decreasing signal (~constant power imp., special cells)
SLIDE 89
16
Countermeasures
- Limit number of encryptions per key
- Distribution of key is difficult
- Leakage resilient algorithms
- Performance drop
- Decrease Signal-to-Noise Ratio (SNR)
- Decreasing signal (~constant power imp., special cells)
- Increasing noise (dummy operations, shuffling)
SLIDE 90
16
Countermeasures
- Limit number of encryptions per key
- Distribution of key is difficult
- Leakage resilient algorithms
- Performance drop
- Decrease Signal-to-Noise Ratio (SNR)
- Decreasing signal (~constant power imp., special cells)
- Increasing noise (dummy operations, shuffling)
- Breaking the correlation
SLIDE 91
16
Countermeasures
- Limit number of encryptions per key
- Distribution of key is difficult
- Leakage resilient algorithms
- Performance drop
- Decrease Signal-to-Noise Ratio (SNR)
- Decreasing signal (~constant power imp., special cells)
- Increasing noise (dummy operations, shuffling)
- Breaking the correlation
- Masking
SLIDE 92
17
S
(x ,y ,z , ...) (a ,b ,c , ...)
Boolean Masking
SLIDE 93
18
Boolean Masking
SLIDE 94
18
(x1,y1,z1, ...)
Boolean Masking
SLIDE 95
18
(x1,y1,z1, ...) (x2,y2,z2, ...) ⊕ = (x, y, z, ...)
Boolean Masking
SLIDE 96
18
(x1,y1,z1, ...) (x2,y2,z2, ...) ⊕ = (x, y, z, ...)
S1
(a1,b1,c1, ...)
S2
(a2,b2,c2, ...) ⊕
Boolean Masking
SLIDE 97
18
(x1,y1,z1, ...) (x2,y2,z2, ...) ⊕ = (x, y, z, ...) = (a, b, c, ...)
S1
(a1,b1,c1, ...)
S2
(a2,b2,c2, ...) ⊕
Boolean Masking
SLIDE 98
18
Random input/output shares ➡ Random intermediate values
(x1,y1,z1, ...) (x2,y2,z2, ...) ⊕ = (x, y, z, ...) = (a, b, c, ...)
S1
(a1,b1,c1, ...)
S2
(a2,b2,c2, ...) ⊕
Boolean Masking
SLIDE 99
18
Random input/output shares ➡ Random intermediate values
(x1,y1,z1, ...) (x2,y2,z2, ...) ⊕ = (x, y, z, ...) = (a, b, c, ...)
S1
(a1,b1,c1, ...)
S2
(a2,b2,c2, ...) ⊕
Boolean Masking
unshared shares mean var 0,0=0 1,5 1,5 1,1=3 1,5 1,5 1 0,1=1 1,5 0.5 1 1,0=2 1,5 0.5
SLIDE 100
18
Random input/output shares ➡ Random intermediate values
(x1,y1,z1, ...) (x2,y2,z2, ...) ⊕ = (x, y, z, ...) = (a, b, c, ...)
S1
(a1,b1,c1, ...)
S2
(a2,b2,c2, ...) ⊕
Boolean Masking
unshared shares mean var 0,0=0 1,5 1,5 1,1=3 1,5 1,5 1 0,1=1 1,5 0.5 1 1,0=2 1,5 0.5
SLIDE 101
18
Random input/output shares ➡ Random intermediate values
(x1,y1,z1, ...) (x2,y2,z2, ...) ⊕ = (x, y, z, ...) = (a, b, c, ...)
S1
(a1,b1,c1, ...)
S2
(a2,b2,c2, ...) ⊕
Boolean Masking
unshared shares mean var 0,0=0 1,5 1,5 1,1=3 1,5 1,5 1 0,1=1 1,5 0.5 1 1,0=2 1,5 0.5
✓ 1st-order DPA security x 2nd-order DPA security
SLIDE 102
19
(x1,y1,z1, ...) (x2,y2,z2, ...) ⊕ = (x, y, z, ...) = (a, b, c, ...)
S1
(a1,b1,c1, ...)
S2
(a2,b2,c2, ...) ⊕
Boolean Masking
SLIDE 103
19
(x1,y1,z1, ...) (x2,y2,z2, ...) ⊕ = (x, y, z, ...) = (a, b, c, ...)
S1
(a1,b1,c1, ...)
S2
(a2,b2,c2, ...) ⊕
Boolean Masking
dth-order DPA ⇄ d probing model
SLIDE 104
19
(x1,y1,z1, ...) (x2,y2,z2, ...) ⊕ = (x, y, z, ...) = (a, b, c, ...)
S1
(a1,b1,c1, ...)
S2
(a2,b2,c2, ...) ⊕
Boolean Masking
dth-order DPA ⇄ d probing model
SLIDE 105
19
(x1,y1,z1, ...) (x2,y2,z2, ...) ⊕ = (x, y, z, ...) = (a, b, c, ...)
S1
(a1,b1,c1, ...)
S2
(a2,b2,c2, ...) ⊕
Boolean Masking
dth-order DPA ⇄ d probing model
SLIDE 106
19
(x1,y1,z1, ...) (x2,y2,z2, ...) ⊕ = (x, y, z, ...) = (a, b, c, ...)
S1
(a1,b1,c1, ...)
S2
(a2,b2,c2, ...) ⊕
Boolean Masking
dth-order DPA ⇄ d probing model
SLIDE 107
19
(x1,y1,z1, ...) (x2,y2,z2, ...) ⊕ = (x, y, z, ...) = (a, b, c, ...)
S1
(a1,b1,c1, ...)
S2
(a2,b2,c2, ...) ⊕
Boolean Masking
dth-order DPA ⇄ d probing model #shares > d
SLIDE 108
19
(x1,y1,z1, ...) (x2,y2,z2, ...) ⊕ = (x, y, z, ...) = (a, b, c, ...)
S1
(a1,b1,c1, ...)
S2
(a2,b2,c2, ...) ⊕
Boolean Masking
dth-order DPA ⇄ d probing model # of traces increase exponentially with attack order #shares > d
SLIDE 109
19
(x1,y1,z1, ...) (x2,y2,z2, ...) ⊕ = (x, y, z, ...) = (a, b, c, ...)
S1
(a1,b1,c1, ...)
S2
(a2,b2,c2, ...) ⊕
Boolean Masking
dth-order DPA ⇄ d probing model # of traces increase exponentially with attack order glitches reduce the security #shares > d
SLIDE 110
20
Masking Secure Against Glitches
S1 (x1,y1,z1, ...) (a1,b1,c1, ...) S2 (x2,y2,z2, ...) (a2,b2,c2, ...) Ss (xs,ys,zs, ...) (as,bs,cs, ...) … … … ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ = = (x, y, z, ...) (a, b, c, ...)
SLIDE 111
20
Masking Secure Against Glitches
S1 (x1,y1,z1, ...) (a1,b1,c1, ...) S2 (x2,y2,z2, ...) (a2,b2,c2, ...) Ss (xs,ys,zs, ...) (as,bs,cs, ...) … … … ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ = = (x, y, z, ...) (a, b, c, ...)
SLIDE 112
20
Masking Secure Against Glitches
S1 (x1,y1,z1, ...) (a1,b1,c1, ...) S2 (x2,y2,z2, ...) (a2,b2,c2, ...) Ss (xs,ys,zs, ...) (as,bs,cs, ...) … … … ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ = = (x, y, z, ...) (a, b, c, ...)
SLIDE 113
20
Masking Secure Against Glitches
S1 (x1,y1,z1, ...) (a1,b1,c1, ...) S2 (x2,y2,z2, ...) (a2,b2,c2, ...) Ss (xs,ys,zs, ...) (as,bs,cs, ...) … … … ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ = = (x, y, z, ...) (a, b, c, ...)
Such as:
SLIDE 114
20
Masking Secure Against Glitches
S1 (x1,y1,z1, ...) (a1,b1,c1, ...) S2 (x2,y2,z2, ...) (a2,b2,c2, ...) Ss (xs,ys,zs, ...) (as,bs,cs, ...) … … … ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ = = (x, y, z, ...) (a, b, c, ...)
Such as:
- Threshold Implementations (ICICS’06, AsiaCrypt’14)
SLIDE 115
20
Masking Secure Against Glitches
S1 (x1,y1,z1, ...) (a1,b1,c1, ...) S2 (x2,y2,z2, ...) (a2,b2,c2, ...) Ss (xs,ys,zs, ...) (as,bs,cs, ...) … … … ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ = = (x, y, z, ...) (a, b, c, ...)
Such as:
- Threshold Implementations (ICICS’06, AsiaCrypt’14)
- Prouff & Roche (CHES’11) ~ BGW scheme
SLIDE 116
21
Thank You!
SLIDE 117
22
Announcements
- COSIC Course (Leuven, Belgium)
- 15-18 June 2015
- https://www.cosic.esat.kuleuven.be/course/index.shtml
- Summer School on Real-World Crypto and Privacy (Šibernik, Croatia)
- 31 May - 5 June 2015
- http://summerschool-croatia15.cs.ru.nl
- Summer School on Design and security of cryptographic algorithms (Italy)
- To be announced soon
(Courses)
SLIDE 118
23
Announcements
(Competitions)
- Cracking Telegram Encryption
- $300,000 award
- https://telegram.org/blog/cryptocontest
- NSUCRYPTO
- Siberian Student’s Olympiad in Cryptography with International
Participation
- http://www.nsucrypto.nsu.ru
- HACKMETU
- http://hackmetu.com