A Quantitative, Experimental Approach to Measuring Processor Side-Channel Security

The role of the side channels in the continuous-variable quantum key distribution is studied. It is shown how the information leakage through a side channel from the trusted sender station increases the vulnerability of the protocols to the eavesdropping in the main quantum communication channel. Moreover, the untrusted noise infusion by an eavesdropper on the trusted receiving side breaks the security even for a purely attenuating main quantum channel. As a method to compensate for the effect of the side-channel leakage on the sender side, we suggest several types of manipulations on the side-channel input. It is shown that by applying the modulated coherent light on the input of the side channel that is optimally correlated to the modulation on the main signal and optionally, introducing additional squeezing in the case of the squeezed-state protocol, the negative influence of the lossy side channel on the sender side can be completely removed. For the trusted receiving side, the method of optimal monitoring of the residual noise from the side-channel noise infusion is suggested and shown to be able to completely eliminate the presence of the noisy side channel. We therefore prove that the side-channel effects can be completely removed using feasible operations if the trusted parties access the respective parts of the side channels.

The design of digital systems has its mainstay in the electronic design automation flows which act as crucial instruments to reduce the effort to realize complex computing platforms. In this work, we investigate the possibility of integrating side channel security analyses within the existing FPGA design flow, to provide a feedback to the hardware designer in a prompt and effective way. To this end, we realize an analysis framework which detects side channel leakage on the power consumption side channel at two well established checkpoints in hardware design, i.e., post synthesis and post implementation. We report the results of the proposed framework when integrated within the commercial Xilinx Vivado design toolchain. As a case study, we employ an open source SoC running a software version of the AES block cipher and provide a taxonomy of the side channel information leakage. The reported results highlight how our approach is able to provide precise insights on the sources of information leakage in the hardware design at hand. In particular, we show that the results of the simulations at post synthesis and post implementation stages provide complementary sets of insights on the information leakage, which, thanks to our methodology, can be traced back to architectural components which are the culprits of the said leakage.KeywordsDesign automation and toolsFPGA design flowSide channel analysis

Cyber-attacks stealing confidential information are becoming increasingly frequent and devastating as modern software systems store and manipulate greater amounts of sensitive data. Leaking information about private user data, such as the financial and medical records of individuals, trade secrets of companies and military secrets of states can have drastic consequences. Confidentiality of such private data is critical for users of these systems. Many software development practices, such as the encryption of packages sent over a network, aim to protect the confidentiality of private data by ensuring that an observer is unable to learn anything meaningful about a program’s secret input from its public output. Under these protections, the software system’s main communication channels, such as the content of the network packets it sends, or the output it writes to a public file, should not leak information about the private data. However, many software systems still contain serious security vulnerabilities. Side channels are an important class of information leaks where secret information can be captured through the observation of non-functional side effects of software systems. Potential side channels include those in execution time, memory usage, size and timings of network packets, and power consumption. Although side-channel vulnerabilities due to hardware (such as vulnerabilities that exploit the cache behavior) have been extensively studied [1] , [2] , [10] , [13] , [15] – [17] , [19] , [23] , software side channels have only recently become an active area of research, including recent results on software side-channel detection [4] , [8] , [11] , [12] , [18] , [22] , [24] and quantification [5] , [20] , [21] , and my own work on a static analysis framework for detection of software side-channels called CoCo-Channel [8] ) and a constraint caching framework to accelerate side-channel quantification called Cashew [9] .

The high-performance and energy-efficient encryption engines have emerged as a key component for modern System-On-Chip (SoC) in various platforms including servers, desktops, mobile, and IoT edge devices. A key bottleneck to secure operation of encryption engines is leakage of information through various side-channels. For example, an adversary can extract the secret key by performing statistical analysis on measured power and electromagnetic (EM) emission signatures generated by the hardware during encryption. Countermeasures to such side-channel attacks often come at high power, area, or performance overheads. Therefore, design of side-channel secure encryption engines is a critical challenge for high-performance and/or power-/energy efficient operations. This paper reviews that although low-power requirement imposes critical challenge for side-channel security, but circuit techniques traditionally developed for power management also present new opportunities for side-channel resistance. As a case study, we review the feasibility of using integrated voltage regulator and dynamic voltage frequency scaling normally used for efficient power management, for increasing power-side-channel resistance of AES engines. The hardware measurement results from test-chip fabricated in 130nm process are presented to demonstrate the impact of power management circuits on side-channel security.

Quantum key distribution systems are open systems in the sense that in addition to attacking quantum states in the quantum communication channel, the eavesdropper can obtain additional information about the transmitted key using passive radiation detection of the transmitting and receiving stations, as well as active probing of the state of the equipment through a fiber communication line. In this paper, we consider the cryptographic robustness of a quantum cryptography system that uses a protocol with phase coding based on strongly weakened coherent geometrically uniform states. Non-strict single-photon information states, as well as information leakage through side channels, are taken into account by the generalized Decoy State method, taking into account joint collective measurements of information quantum states and quantum states in side channels. An estimate of the secret key length is obtained, which is expressed only in terms of the observed values at the receiving station and the parameters of quantum states in the side channels.

Side channel attacks (SCAs) exploit the fact that security IC physical implementation of a cryptographic algorithm can leak information of the secret key. One of the most important SCA is Differential Power Analysis (DPA), that uses the power consumption dependence with the data processed to reveal critical information. To protect security devices against this issue, differential logic styles with constant power dissipation have been widely used. However, the right use of such circuits for secure applications needs not only a fully symmetric structure, but also removing any memory effect that could leak information. We propose an improved memory-less fully symmetric Xor/Xnor pull-down logic configuration, to be used with any differential technique, for immediate application in crypto-graphic secure applications.

In side channel attack (SCA) studies, it is widely believed that unprotected implementations leak information about the intermediate states of the internal cryptographic process. However, directly recovering the intermediate states is not common practice in today’s SCA study. Instead, most SCAs exploit the leakages in a “guess-and-determine” way, where they take a partial key guess, compute the corresponding intermediate states, then try to identify which one fits the observed leakages better. In this paper, we ask whether it is possible to take the other way around—directly learning the intermediate states from the side channel leakages. Under certain circumstances, we find that the intermediate states can be efficiently recovered with the well-studied Independent Component Analysis (ICA). Specifically, we propose several methods to convert the side channel leakages into effective ICA observations. For more robust recovery, we also present a specialized ICA algorithm which exploits the specific features of circuit signals. Experiments confirm the validity of our analysis in various circumstances, where most intermediate states can be correctly recovered with only a few hundred traces. Our approach brings new possibilities to the current SCA study, including building an alternative SCA distinguisher, directly attacking the middle encryption rounds and reverse engineering with fewer restrictions. Considering its potential in more advanced applications, we believe our ICA-based SCA deserves more research attention in the future study.

Embedded real-time systems are widely adopted in safety-critical domains such as aircrafts, automobiles and space vehicles. Unfortunately, with the sharp rise in the use of common-off-the-shelf components in systems and the drive towards remote communication through untrusted networks, such as WiFi, radio or cellular, the security is increasingly becoming the key consideration in real-time system design. In particular, the real-time system is vulnerable to side-channel attacks from the external networks, which attempt to infer the timing of task execution by exploiting the system deterministic execution patterns. In this paper, we present an enhanced online randomized scheduling strategy (named <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\mathsf {REORDER}$</tex-math></inline-formula> ++), which breaks the deterministic task execution pattern of systems by random priority inversions at run-time to counteract the timing side-channel attacks in dynamic-priority real-time systems. In order to realize the feasible priority inversions under real-time constraint, we propose an online priority inversion test to increase the opportunity of tasks' priority inversions by judging the feasibility of tasks' priority inversions at run-time. Owing to such online priority inversion test, <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\mathsf {REORDER}$</tex-math></inline-formula> ++ can generate highly randomized schedule of real-time tasks to mitigate the side-channel attack vulnerability. Experiments with synthesized task sets show that <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\mathsf {REORDER}$</tex-math></inline-formula> ++ significantly outperforms the existing approaches in terms of schedule randomness.

Hardware implementations of cryptographic algorithms are still vulnerable to side-channel attacks. Side-channel attacks that are based on multiple measurements of the same operation can be countered by employing masking techniques. In the presence of glitches, most of the currently known masking techniques still leak information during the computation of non-linear functions. We discuss a recently introduced masking method which is based on secret sharing and results in implementations that are provable resistant against first-order side-channel attacks, even in the presence of glitches. We reduce the hardware requirements of this method and show how to derive provable secure implementations of some non-linear building blocks for cryptographic algorithms. Finally, we provide a provable secure implementation of the block cipher Noekeon and verify the results.

The goal of this paper is to answer how much information is “transmitted” by the execution of particular sequence of instructions in a processor. Introducing such a measure would provide quantitative guidance for designing programs and computer hardware that minimizes inadvertent (side channel) information leakage, and would also help detect parts of a program or hardware design that have unusually high leakage (i.e., were designed to function as covert channel “transmitters”). To answer this question, we propose a new method to estimate the maximum information leakage through EM signals generated by the execution of instructions in a processor. We start by deriving a mathematical relationship between electromagnetic side-channel energy of individual instructions and the measured pairwise side-channel signal power. Then, we use this measure to calculate the transition probabilities needed for estimating capacity. Finally, we propose a new method to estimate side/covert channel capacity created by the execution of instructions in a processor and illustrate our results in several computer systems.

Information leakage is a signi cant problem in modern software systems. Information leaks due to side channels are especially hard to detect and analyze. In recent years, techniques have been developed for automated synthesis of adaptive side-channel attacks that recover secret values by iteratively generating inputs to reveal partial information about the secret based on the sidechannel observations. Prominent approaches of attack synthesis use symbolic execution, model counting, and meta-heuristics to maximize information gain. These approaches could bene t by reusing results from prior steps in each step. In this paper, we present an incremental approach to attack synthesis that reuses model counting results from prior iterations in each attack step to improve efficiency. Experimental evaluation demonstrates that our approach drastically improves performance, reducing the attack synthesis time by an order of magnitude.

Cryptographic algorithms and their specific instantiation in computing engines leak information both through information channels and physical channels (side-channels). CMOS circuits implementing these cryptographic algorithms engines leak information through its physical attributes. The overlooked vulnerabilities in communication, cryptographic, or other system protocols and software, leak computation internal state inadvertently. These are the explicitly designed computational channels which are Turing channels. An unintended, lower barrier leakage occurs, however, through the side channels or physical channels. An actual implementation of an abstract algorithm goes through a model refinement to include the physical properties of the underlying computing machinery. Since there are no constraints placed on many of the physical attributes not visible in the algorithm specification in an abstract model, any refinement is acceptable. This is where the problem occurs. Some of these implementations reveal significant details about the private control and data flow of the underlying computation. In general there are two approaches to solve this problem. First approach is to design cryptographic algorithms which can tolerate some information leakage. Second approach is to remove the correlation between the leaked information and the secret. We propose a novel circuit design technique which uses the second approach.

Code diversification has been proposed as a technique to mitigate code reuse attacks, which have recently become the predominant way for attackers to exploit memory corruption vulnerabilities. As code reuse attacks require detailed knowledge of where code is in memory, diversification techniques attempt to mitigate these attacks by randomizing what instructions are executed and where code is located in memory. As an attacker cannot read the diversified code, it is assumed he cannot reliably exploit the code. In this paper, we show that the fundamental assumption behind code diversity can be broken, as executing the code reveals information about the code. Thus, we can leak information without needing to read the code. We demonstrate how an attacker can utilize a memory corruption vulnerability to create side channels that leak information in novel ways, removing the need for a memory disclosure vulnerability. We introduce seven new classes of attacks that involve fault analysis and timing side channels, where each allows a remote attacker to learn how code has been diversified.

Many modern use cases of relational databases involve multi-tenancy. To allow a tenant to only access its data, relational database systems (RDBMSs) introduced row-level security (RLS). RLS enables specifying per-row access controls, which the database enforces by rewriting tenant queries to add an RLS policy filter that filters out rows the tenant is not allowed to view. Unfortunately, while RLS blocks queries from returning unauthorized data, side-effects of query execution can form a side-channel that leaks information about such secret data. This paper investigates how RLS query execution time can leak information about rows that the querying tenant is restricted from viewing. We show that in PostgreSQL and SQL Server, an attacker can craft index-using queries to learn whether a value they are not authorized to view exists in an RLS-protected table, and in some cases, how many times such a value exists in the table. Our attack succeeds in a realistic cloud setting: we successfully attack managed PostgreSQL and SQL Server database instances on AWS from virtual machines in the same and different data centers. To block the RLS time side-channel, we design a data-oblivious query scheme for the case of unique keys. We also analyze the trade-offs created by the data-oblivious approach for non-unique keys. To facilitate the evaluation of RLS attacks and defenses, we introduce a benchmark that supports multi-tenancy and RLS, which are not supported by established benchmarks such as YCSB. We implement our solution in PostgreSQL and show that it achieves security with minimal performance impact.

The ultimate goal of private function evaluation is the complete outsourcing of processing tasks to distrusted platforms (such as clouds), so that arbitrary functions can be evaluated without any leakage of secret information. Several successful concepts have been proposed in the past, the most striking one having been fully homomorphic encryption besides the well-known garbled circuits and multiparty computation. In this paper, we look at an idealized model of outsourced computation, which we call a cryptocomputer . This is a (theoretical) machine that works exactly like a real-life computer in the sense of understanding a standard assembly language, but retaining all its internal signals, registers, and memory encrypted at all times. The encryption is assumed under a key that is unknown to the attacker, and taken as secure (in any cryptographically meaningful way), so that no leakage of information from any ciphertext can be expected from programs with reasonable (polynomial) time complexity. Unfortunately, such a cryptocomputer is necessarily insecure, irrespectively of how the encryption looks like. In particular, we explicitly do not assume any specific form of security (chosen-ciphertext or other) or (a)symmetry of encryption; our attack works only on ciphertexts and makes no assumptions whatsoever on the encryption. We prove insecurity of the cryptocomputer by taking the encryption as a black box, and show how to decipher every signal in the computer by pure virtue of submitting proper instructions for execution. Our attack falls into the general category of side-channel attacks, however unlike other related attacks, does neither exploit physical nor any logical characteristics of the underlying platform (besides the execution flow being observable). Somewhat surprisingly, it turns out that although the problem that we consider is cryptographic, it seemingly has no cryptographic solution and apparently calls for an interdisciplinary approach from new directions.