Side-Channel Plaintext-Recovery Attacks on Leakage-Resilient - PowerPoint PPT Presentation

Side-Channel Plaintext-Recovery Attacks on Leakage-Resilient Encryption Thomas Unterluggauer, Mario Werner, and Stefan Mangard, IAIK, Graz University of Technology 30. March 2017

Content Differential power analysis for key recovery Re-keying countermeasure: few data inputs Summary: Re-keying induces DPA that allows to recover constant plaintexts Streaming mode: first-order DPA Block mode: profiled second-order DPA Multi-party communication, memory encryption Particularly critical for long-term keys 30. March 2017 Thomas Unterluggauer, Graz University of Technology 2

Motivation K Symmetric cryptography, e.g., block cipher E Key K used for multiple p i , c i E p i c i Differential Power Analysis (DPA) n encryptions: E K ( p i ) ℓ Observe power consumption Statistical analysis reveals K 30. March 2017 Thomas Unterluggauer, Graz University of Technology 3

Motivation k i Protect implementation (masking) Change key frequently (re-keying) E p i c i Reduce input data complexity Leakage-resilient encryption ℓ Protects the key i Plaintext? 30. March 2017 Thomas Unterluggauer, Graz University of Technology 4

Leakage-Resilient Encryption Extends re-keying to messages of arbitrary length Secure (leak-free) initialization Derive session key k i from master key K Security proof: Assumption: bounded side-channel leakage of the used primitive Scheme’s total leakage on the key is bounded 30. March 2017 Thomas Unterluggauer, Graz University of Technology 5

Leakage-Resilient Streaming Mode [SPY + 10] n C A C A g k 0 E E k 1 k 2 … K C B C B E y 0 E y 1 p 0 c 0 p 1 c 1 30. March 2017 Thomas Unterluggauer, Graz University of Technology 6

Leakage-Resilient Block Mode [TS15] n C A C A g k 0 E k 1 E k 2 … K p 0 p 1 E E c 0 c 1 30. March 2017 Thomas Unterluggauer, Graz University of Technology 7

DPA on Leakage-Resilient Encryption 30. March 2017 Thomas Unterluggauer, Graz University of Technology 8

DPA on Streaming Mode (1) n C A C A g k 0 E k 1 E k 2 … K C B C B E y 0 E y 1 p 0 c 0 p 1 c 1 30. March 2017 Thomas Unterluggauer, Graz University of Technology 9

DPA on Streaming Mode (2) Encryption of constant p 0 with different keys k 0 , k ′ 0 , k ′′ 0 Leakage model for y 0 = c 0 ⊕ p 0 , e.g., HW Compute leakage for all possible values of p 0 Statistical distinguisher to get correct p 0 C B p 0 y 0 E k 0 c 0 30. March 2017 Thomas Unterluggauer, Graz University of Technology 10

DPA on Streaming Mode (3) Standard DPA on XOR Applies to all stream ciphers Key stream always changes: pad must not be reused Encryption of the same plaintext... 30. March 2017 Thomas Unterluggauer, Graz University of Technology 11

DPA on Streaming Mode: Evaluation Implementation of LR streaming mode Single AES core with one round per cycle Multiplexing: pad computation and key update Apply 128-bit pad to plaintext in parallel Sakura G board Spartan 6 LX75 FPGA @ 24 MHz Hardware trigger LeCroy WP725Zi @ 250 MS Correlation with byte-wise hypotheses 30. March 2017 Thomas Unterluggauer, Graz University of Technology 12

DPA on Streaming Mode: Evaluation 0.15 Correlation 0.1 0.05 0 10 , 000 20 , 000 30 , 000 40 , 000 Number of Traces 30. March 2017 Thomas Unterluggauer, Graz University of Technology 13

DPA on Block Mode (1) n C A C A g k 0 E k 1 E k 2 … K p 0 p 1 E E c 0 c 1 30. March 2017 Thomas Unterluggauer, Graz University of Technology 14

DPA on Block Mode (2) Encryption of constant p 0 with different keys k 0 , k ′ 0 , k ′′ 0 Block cipher: no simple leakage model using p 0 Unknown Plaintext Template Attacks [HTM09] Constant key and varying, unknown plaintext Idea: switch roles of key and plaintext p 0 E k 0 c 0 30. March 2017 Thomas Unterluggauer, Graz University of Technology 15

DPA on Block Mode (3) Profiling phase: templates for k 0 , 0 and v 0 Attack phase: Probabilities for k 0 , 0 and v 0 Joint probability of k 0 , 0 and v 0 → p 0 , 0 Many different keys to get unique p 0 , 0 k 0,0 p 0 E v 0 k 0 S p 0,0 … c 0 30. March 2017 Thomas Unterluggauer, Graz University of Technology 16

DPA on Block Mode: Evaluation Implementation of LR block mode AES: Byte-oriented C Implementation (AVR-Crypto-Lib) ChipWhisperer-Lite Atmel XMEGA128D4-U @ 7 . 4 MHz Sampling on board 29 . 5 MS Template building using 30 000 traces Hamming weight of a byte (key / sbox) Multivariate Gaussian templates (50 POI) 30. March 2017 Thomas Unterluggauer, Graz University of Technology 17

DPA on Block Mode: Evaluation · 10 − 4 3 S-box Key 2 Variance 1 0 0 500 1 , 000 1 , 500 2 , 000 2 , 500 3 , 000 Sample 30. March 2017 Thomas Unterluggauer, Graz University of Technology 18

DPA on Block Mode: Evaluation 1 0 . 8 Probability 0 . 6 0 . 4 0 . 2 0 0 1 , 000 2 , 000 3 , 000 4 , 000 5 , 000 Number of Traces 30. March 2017 Thomas Unterluggauer, Graz University of Technology 19

Applications Leakage rises with the amount of processed data Mixing constant with varying data Key vs. plaintext leakage Communication protocols SSL: fresh session key Download static file from, e.g., webserver LR encryption: transmission errors Constrained resources: re-encryption Key wrapping insufficient 30. March 2017 Thomas Unterluggauer, Graz University of Technology 20

Application: Memory Encryption RAM encryption: fresh key on startup, e.g., Intel SGX Critical if long-term key is loaded into RAM Plaintext recovery = key recovery Storage with LR encryption: Read-modify-write operations Key update when a part changes E.g., 1 byte in 128-bit block RAM encryption using counter mode: Pad computed from address and block counter Key changes on every copy and write-back 30. March 2017 Thomas Unterluggauer, Graz University of Technology 21

Conclusion Security of re-keying in LR encryption Protects the key from SCA Vulnerability: re-encryption of constant plaintexts 1st order DPA on stream cipher 2nd order template attack on block mode Classical setting: mixing constant with varying data Relevance: memory encryption and multi-party communication Use masking in these applications 30. March 2017 Thomas Unterluggauer, Graz University of Technology 22

Side-Channel Plaintext-Recovery Attacks on Leakage-Resilient Encryption Thomas Unterluggauer, Mario Werner, and Stefan Mangard, IAIK, Graz University of Technology 30. March 2017

References [HTM09] Neil Hanley, Michael Tunstall, and William P . Marnane. Unknown plaintext template attacks. In WISA 2009 , pages 148–162, 2009. [SPY + 10] Franc ¸ois-Xavier Standaert, Olivier Pereira, Yu Yu, Jean-Jacques Quisquater, Moti Yung, and Elisabeth Oswald. Leakage resilient cryptography in practice. In Towards Hardware-Intrinsic Security – Foundations and Practice , pages 99–134. 2010. [TS15] Mostafa M. I. Taha and Patrick Schaumont. Key updating for leakage resiliency with application to AES modes of operation. IEEE Trans. Information Forensics and Security , 10(3):519–528, 2015. 30. March 2017 Thomas Unterluggauer, Graz University of Technology 24