Single-Trace Attacks on Keccak Matthias J. Kannwischer 1 , Peter - PowerPoint PPT Presentation

Single-Trace Attacks on Keccak Matthias J. Kannwischer 1 , Peter Pessl 2 , Robert Primas 3 1 Radboud University, Nijmegen 2 Graz University of Technology (now with Infineon Technologies) 3 Graz University of Technology

Side-Channel Attacks on Hash Functions? ❼ Plain hashing has no secrets, but there are keyed uses ❼ HMAC? Classic DPA setting, threat is obvious. . . ❼ Keccak (SHA3/SHAKE) found ample new uses involving secrets ❼ . . . especially in post-quantum cryptography 1 Single-Trace Attacks on Keccak — CHES 2020

Side-Channel Attacks on Hash Functions? ❼ Keccak uses in PQC include ❼ derivation of a shared secret in a KEM ❼ expansion of a secret seed in KEMs and signatures ❼ hash-based signatures ❼ Above: side-channel attacker is limited to a single execution ❼ at most averaging, but still no DPA Are attacks even possible? Are countermeasures still needed? 2 Single-Trace Attacks on Keccak — CHES 2020

Our Contribution ❼ Practical single-trace attack on Keccak (software) implementations ❼ Soft-analytical side-channel attack (SASCA) 1. Template matching: retrieve probabilities of intermediates 2. Belief propagation: combine all probabilities to infer most likely key ❼ thus far: mainly applied to AES, but Keccak structurally very different ❼ Attack outcome ❼ key-recovery in a large array of settings, countermeasures cannot be omitted ❼ factors influencing the success rate: key size, bit width of device, structure of input 3 Single-Trace Attacks on Keccak — CHES 2020

❼ ❼ ❼ ❼ ❼ ❼ Keccak m 0 m 1 ❼ Sponge construction, 1600-bit state H 0 H 1 ⊕ ⊕ 0 r ... f f f f 0 c Absorb Squeeze 4 Single-Trace Attacks on Keccak — CHES 2020

❼ ❼ ❼ ❼ ❼ Keccak ❼ Sponge construction, 1600-bit state ❼ Keccak- f permutation 4 Single-Trace Attacks on Keccak — CHES 2020

❼ ❼ ❼ ❼ Keccak ❼ Sponge construction, 1600-bit state ❼ Keccak- f permutation ❼ θ - add column parities � � � 4 Single-Trace Attacks on Keccak — CHES 2020

❼ ❼ ❼ Keccak ❼ Sponge construction, 1600-bit state ❼ Keccak- f permutation ❼ θ - add column parities ❼ ρ - rotate lanes 4 Single-Trace Attacks on Keccak — CHES 2020

❼ ❼ Keccak ❼ Sponge construction, 1600-bit state ❼ Keccak- f permutation ❼ θ - add column parities ❼ ρ - rotate lanes ❼ π - reorder lanes 4 Single-Trace Attacks on Keccak — CHES 2020

❼ Keccak ❼ Sponge construction, 1600-bit state ❼ Keccak- f permutation ❼ θ - add column parities ❼ ρ - rotate lanes ❼ π - reorder lanes ❼ χ - SBox 4 Single-Trace Attacks on Keccak — CHES 2020

Keccak ❼ Sponge construction, 1600-bit state ❼ Keccak- f permutation ❼ θ - add column parities ❼ ρ - rotate lanes ❼ π - reorder lanes ❼ χ - SBox ❼ ι - add round constant 4 Single-Trace Attacks on Keccak — CHES 2020

Attack Setting ❼ Unprotected software implementation on a ➭ C ❼ (Part of) the input is secret m 0 m 1 H 0 ❼ and used only once ⊕ ⊕ 0 r ❼ Power measurements of a single execution ... f f f 0 c ❼ no differential SCA ❼ have to use (some sort of) templates 5 Single-Trace Attacks on Keccak — CHES 2020

Template Attacks on Hash Functions ❼ Typical restrictions of template attacks ❼ need templating device with known key ❼ poor portability of templates between devices ❼ Same for Keccak? ❼ often multiple calls inside a PK scheme, some with fully known data ❼ message hash during signing, re-encryption in decapsulation, . . . Profiling directly on target device! no separate profiling device needed, no portability problems 6 Single-Trace Attacks on Keccak — CHES 2020

Step 1: Template Matching ❼ Templating target: all loads/stores ❼ HW leakage along lanes 64 ❼ assign probability vector to each part ❼ Now: combine all side channel info to find most likely key ❼ efficient method: Soft Analytical Side-Channel Attacks (SASCA) [Veyrat-Charvillon et al., ASIACRYPT 2014] 7 Single-Trace Attacks on Keccak — CHES 2020

❼ ❼ ❼ ❼ Step 2: SASCA / Belief Propagation 1. model implementation as a factor graph ❼ variable nodes ❼ factor nodes ❼ example: X ⊕ Y = Z X Z Y 8 Single-Trace Attacks on Keccak — CHES 2020

❼ ❼ ❼ ❼ Step 2: SASCA / Belief Propagation 1. model implementation as a factor graph ❼ variable nodes ❼ factor nodes ❼ example: X ⊕ Y = Z X 2. incorporate leakage information in graph Z Y 8 Single-Trace Attacks on Keccak — CHES 2020

Step 2: SASCA / Belief Propagation 1. model implementation as a factor graph ❼ variable nodes ❼ factor nodes ❼ example: X ⊕ Y = Z X 2. incorporate leakage information in graph Z 3. run Belief Propagation Y ❼ goal: find marginals of variables ❼ message passing principle ❼ simplest version: enumerate inputs ❼ important: avoid circular reasoning 8 Single-Trace Attacks on Keccak — CHES 2020

Step 2: SASCA / Belief Propagation 1. model implementation as a factor graph ❼ variable nodes ❼ factor nodes ❼ example: X ⊕ Y = Z X 2. incorporate leakage information in graph Z 3. run Belief Propagation Y ❼ goal: find marginals of variables ❼ message passing principle ❼ simplest version: enumerate inputs ❼ important: avoid circular reasoning 8 Single-Trace Attacks on Keccak — CHES 2020

Step 2: SASCA / Belief Propagation 1. model implementation as a factor graph ❼ variable nodes ❼ factor nodes ❼ example: X ⊕ Y = Z X 2. incorporate leakage information in graph Z 3. run Belief Propagation Y ❼ goal: find marginals of variables ❼ message passing principle ❼ simplest version: enumerate inputs ❼ important: avoid circular reasoning 8 Single-Trace Attacks on Keccak — CHES 2020

Step 2: SASCA / Belief Propagation 1. model implementation as a factor graph ❼ variable nodes ❼ factor nodes ❼ example: X ⊕ Y = Z X 2. incorporate leakage information in graph Z 3. run Belief Propagation Y ❼ goal: find marginals of variables ❼ message passing principle ❼ simplest version: enumerate inputs ❼ important: avoid circular reasoning 8 Single-Trace Attacks on Keccak — CHES 2020

Step 2: SASCA / Belief Propagation 1. model implementation as a factor graph ❼ variable nodes ❼ factor nodes ❼ example: X ⊕ Y = Z X 2. incorporate leakage information in graph Z 3. run Belief Propagation Y ❼ goal: find marginals of variables ❼ message passing principle ❼ simplest version: enumerate inputs ❼ important: avoid circular reasoning 8 Single-Trace Attacks on Keccak — CHES 2020

Step 2: SASCA / Belief Propagation 1. model implementation as a factor graph ❼ variable nodes ❼ factor nodes ❼ example: X ⊕ Y = Z X 2. incorporate leakage information in graph Z 3. run Belief Propagation Y ❼ goal: find marginals of variables ❼ message passing principle ❼ simplest version: enumerate inputs ❼ important: avoid circular reasoning 8 Single-Trace Attacks on Keccak — CHES 2020

A First Factor Graph of Keccak ❼ Bitwise description ❼ each bit after each step is a variable ❼ Terrible performance . . . ❼ leakage on bytes/words, not bits ❼ lots of information lost during propagation 9 Single-Trace Attacks on Keccak — CHES 2020

Solution: Clustering ❼ Cluster multiple bits in a single variable node ❼ bits along a lane ❼ ideally: no spreading of side-channel info ❼ Cluster size vs. resource usage 64 ❼ runtime and memory: exp. in cluster size ❼ we support 8-bit and 16-bit clusters 10 Single-Trace Attacks on Keccak — CHES 2020

Clustering: Misalignment ❼ Problem: misalignment of clusters ❼ previous SASCA on AES: operations on bytes A ❼ Keccak operations not aligned ❼ Example: A ⊕ ROT( B , 4) ❼ Need to split clusters ROT(B, 4) ❼ requires extraction of marginals 11 Single-Trace Attacks on Keccak — CHES 2020

Clustering: Handling θ I ❼ Computation of column parity I ❼ 5-input ⊕ node (efficient propagation) ❼ enumeration of all possible values: 2 40 (8-bit cluster) I P ❼ solution: fast convolution of distributions using I Walsh-Hadamard transform I 12 Single-Trace Attacks on Keccak — CHES 2020

❼ ❼ ❼ Clustering: Further Considerations ❼ Handling χ ❼ break up clusters to deal with invertability 13 Single-Trace Attacks on Keccak — CHES 2020

Clustering: Further Considerations ❼ Handling χ ❼ break up clusters to deal with invertability A B C D ❼ Handling 32-bit leakage ❼ found efficient method to combine leakage ❼ convolution instead of enumeration 13 Single-Trace Attacks on Keccak — CHES 2020

Attack Runtime ❼ Open-source Python implementation of BP on Keccak https://github.com/keccaksasca/keccaksasca ❼ Restriction to first two rounds of Keccak- f ❼ Runtime per BP iteration (updating all nodes once) ❼ 8-bit clusters: ∼ seconds on single core ❼ 16-bit clusters: ∼ 1 minute using 44 cores ❼ 8-bit clusters sufficient in most cases ❼ BP: iterative algorithm, repeat until convergence. ❼ typically < 10 iterations 14 Single-Trace Attacks on Keccak — CHES 2020

Attack Evaluation ❼ Goal: recover secret input of Keccak- f ❼ Evaluation tool: leakage simulations ❼ noisy HW-leakage of loads/stores (at typical locations) ❼ for 8, 16, and 32-bit implementations ❼ vary noise σ , retrieve success rate ❼ Analyze impact of key size ❼ evaluate 128 and 256-bit keys 15 Single-Trace Attacks on Keccak — CHES 2020