Attacking RSA-Based Sessions in SSL/TLS

In side channel attack (SCA) studies, it is widely believed that unprotected implementations leak information about the intermediate states of the internal cryptographic process. However, directly recovering the intermediate states is not common practice in today’s SCA study. Instead, most SCAs exploit the leakages in a “guess-and-determine” way, where they take a partial key guess, compute the corresponding intermediate states, then try to identify which one fits the observed leakages better. In this paper, we ask whether it is possible to take the other way around—directly learning the intermediate states from the side channel leakages. Under certain circumstances, we find that the intermediate states can be efficiently recovered with the well-studied Independent Component Analysis (ICA). Specifically, we propose several methods to convert the side channel leakages into effective ICA observations. For more robust recovery, we also present a specialized ICA algorithm which exploits the specific features of circuit signals. Experiments confirm the validity of our analysis in various circumstances, where most intermediate states can be correctly recovered with only a few hundred traces. Our approach brings new possibilities to the current SCA study, including building an alternative SCA distinguisher, directly attacking the middle encryption rounds and reverse engineering with fewer restrictions. Considering its potential in more advanced applications, we believe our ICA-based SCA deserves more research attention in the future study.

Since the introduction of the first side-channel analyses in academia about 15 years ago, several physical attacks have been presented that exploit side-channel leakages to break implementations of cryptographic algorithms. This article deals with the same physical property of electronic devices, but focuses on the art of tailoring it for constructive uses. More precisely, two scenarios, i.e., hardware Trojans and IP watermarking, are illustrated in which the designer of an electronic circuit can add functionality by considering side channels as part of the available design space. Both applications use the same concept, i.e., deliberately leaking a secret through a side channel while keeping the introduced side channel hidden from adversaries and attackers. This article provides a broad overview of the existing works for both applications and should serve as a comprehensible introduction to the underlying field of research. This includes many subtle details that have not been discussed in literature yet, including existing shortcomings and possible improvements to the existing works. The solutions summarized in this article provide general guidelines for theorists and practitioners to use side channels constructively to achieve designs that are robust against detection and removal. Furthermore, we present an entirely new design of a Trojan side-channel. This architecture demonstrates the potential of a Trojan side-channel that is neatly tailored to the targeted implementation. The new design removes all non-invasive starting points a third party could use to analyze or get access to the secret-channel.

The role of the side channels in the continuous-variable quantum key distribution is studied. It is shown how the information leakage through a side channel from the trusted sender station increases the vulnerability of the protocols to the eavesdropping in the main quantum communication channel. Moreover, the untrusted noise infusion by an eavesdropper on the trusted receiving side breaks the security even for a purely attenuating main quantum channel. As a method to compensate for the effect of the side-channel leakage on the sender side, we suggest several types of manipulations on the side-channel input. It is shown that by applying the modulated coherent light on the input of the side channel that is optimally correlated to the modulation on the main signal and optionally, introducing additional squeezing in the case of the squeezed-state protocol, the negative influence of the lossy side channel on the sender side can be completely removed. For the trusted receiving side, the method of optimal monitoring of the residual noise from the side-channel noise infusion is suggested and shown to be able to completely eliminate the presence of the noisy side channel. We therefore prove that the side-channel effects can be completely removed using feasible operations if the trusted parties access the respective parts of the side channels.

Chip multiprocessor (CMP) suffers from growing threats on hardware security in recent years, such as side channel attack, hardware Trojan infection, chip clone, etc. In this paper, we propose a security-aware (SA) task mapping method to reduce the information leakage from CMP thermal side channel. First, we construct a mathematical function that can estimate the CMP security cost corresponding to a given mapping result. Then, we develop a greedy mapping algorithm that automatically allocates all threads of an application to a set of proper cores, such that the total security cost is optimized. Finally, we perform extensive experiments to evaluate our method. The experimental results show that our SA mapping effectively decreases the CMP side channel leakage. Compared to the two existing task mapping methods, Linux scheduler (LS; a standard Linux scheduler) and NoC-Sprinting (NS; a thermal-aware mapping technique), our method reduces side-channel vulnerability factor by up to 19% and 7%, respectively. Moreover, our method also gains higher computational efficiency, with improvement in million instructions per second achieving up to 100% against NS and up to 33% against LS.

A leakage assessment / evaluation and comparative analysis on various architectures of masked AES-128 cryptographic algorithm to mitigate the side channel attack is presented. In this work, unmasked and masked implementations of S-Box for AES-128 at micro architecture level and also generation of random mask using True random number generator based on Galois ring oscillator of polynomial 16 is implemented and discussed in detail. Side Channel Leakage is evaluated by Correlation Power Analysis (CPA) and Leakage assessment using Welch's t-test. The implementations are realized in SAKURA-G Side channel evaluation Board. This work quantifies the effectiveness of unmasked and masked AES implementations in side channel mitigation and also identifies the point of leakage and approximate number of traces required to identify the leakage on the adopted mitigation technique is also presented.

Modern computing systems typically have multiple users sharing hardware resources. While such shared hardware have typically been performance boosters, they have also led to inadvertent side-effects such as side channels. Caches, that present the largest attack surface, have been popular among adversaries for side channel attacks. In this work, we repurpose a classic cache performance metric namely, reuse distance, to capture the activity of an adversary in cache timing channels. We design Reuse-trap, an efficient cache side channel mitigation framework to record reuse distances during victim accesses and carefully inject noise to mislead the spy from inferring the victim’s activity. Our experimental results show that we can identify adversaries with zero false positives and make timing channels suffer from over 50% bit error rate on average.

Side-channel attacks are a prominent threat to the security of cryptographic implementations. Differently from the traditional black-box attacks, which exploit the inputs and outputs of cryptographic schemes, side-channel attacks partially access the inner working of the scheme as well, by observing the physical leakage emitted by the device executing cryptographic algorithms. A notable example is the class of power-analysis attacks, which exploits the power consumption of the underlying device to recover the secret keys of the implemented cryptosystem. Since their first presentation in the late 1990s, the problem of securing cryptographic systems in the presence of side-channel leakages received significant attention by the cryptographic community. In particular, the theory community has concentrated its research efforts on formally modeling the side-channel leakages and on designing cryptographic schemes \textit{provably} secure in such leakage models. However, conceiving a formal model that realistically captures possible physical leakages and constructing primitives sufficiently efficient to be deployed in practice are still challenging research objectives. This research area is usually referred to as leakage-resilient cryptography. In this dissertation, we examine three main research directions. The first one focuses on the technique of masking, which is the most popular approach to counteract power-analysis attacks. In this context, our work analyzes possible methods to improve the efficiency of masked implementations, with the goal of overcoming the decrease in performance, which is a common drawback of masking. In particular, we provide new and more efficient algorithms for the computation of basic operations in two kinds of masking schemes: the Boolean masking and the Inner Product masking. The second research direction of this work addresses the problem of formalizing security requirements for hardware implementations. While provable security of software-oriented masking has been studied since the origin of leakage resilient cryptography, the more complex task of formally proving the security of hardware-oriented masking is receiving attention by the community only recently. We discuss the different challenges of this field, and we introduce a new theoretical model, the robust probing model, capturing the conditions required for securely implementing complex algorithms in practice, providing a guide to practical implementers. Finally, the last part of this work is concerned with the protection of algorithms employed in lattice-based constructions, which are studied in the field of post-quantum cryptography. While several works investigate the application of masking schemes to standard cryptosystems, for most post-quantum schemes this is still an ongoing research. We contribute to this research area, by applying the masking countermeasure to a binomial sampler which is at the base of many lattice-based cryptosystems.

Dynamic restructuring of cryptographic implementations has been proposed as a viable countermeasure against power and electromagnetic-based Side Channel Attacks (SCA).These kind of countermeasures involve shuffling between functionally identical but structurally different realizations (known as variants) of a cryptographic circuit using Partial Reconfiguration.Previous studies show that the overall resistance of this countermeasure relies on the strength of individual variants.In this work we explore the possibility to use AMD Xilinx Vivado's implementation strategies to easily generate variants and evaluate their influence on the resistance of AES against SCA using various metrics.For different implementation strategies, we present leakage behavior for individual bits of the resulting AES realizations and also their impact on overall resistance against SCA. CCS Concepts Security and privacy Side-channel analysis and countermeasures.

Recently, several studies have been published on the application of deep learning to enhance Side-Channel Attacks (SCA). These seminal works have practically validated the soundness of the approach, especially against implementations protected by masking or by jittering. Concurrently, important open issues have emerged. Among them, the relevance of machine (and thereby deep) learning based SCA has been questioned in several papers based on the lack of relation between the accuracy, a typical performance metric used in machine learning, and common SCA metrics like the Guessing entropy or the key-discrimination success rate. Also, the impact of the classical side-channel countermeasures on the efficiency of deep learning has been questioned, in particular by the semiconductor industry. Both questions enlighten the importance of studying the theoretical soundness of deep learning in the context of side-channel and of developing means to quantify its efficiency, especially with respect to the optimality bounds published so far in the literature for side-channel leakage exploitation. The first main contribution of this paper directly concerns the latter point. It is indeed proved that minimizing the Negative Log Likelihood (NLL for short) loss function during the training of deep neural networks is actually asymptotically equivalent to maximizing the Perceived Information introduced by Renauld et al. at EUROCRYPT 2011 as a lower bound of the Mutual Information between the leakage and the target secret. Hence, such a training can be considered as an efficient and effective estimation of the PI, and thereby of the MI (known to be complex to accurately estimate in the context of secure implementations). As a second direct consequence of our main contribution, it is argued that, in a side-channel exploitation context, choosing the NLL loss function to drive the training is sound from an information theory point of view. As a third contribution, classical countermeasures like Boolean masking or execution flow shuffling, initially dedicated to classical SCA, are proved to stay sound against deep Learning based attacks.

Models and tools developed by the semiconductor community have matured over decades of use. As a result, hardware simulations can yield highly accurate and easily automated pre-silicon estimates for e.g. timing and area figures. In this work we design, implement, and evaluate CASCADE, a framework that combines a largely automated full-stack standard-cell design flow with the state of the art techniques for side channel analysis. We show how it can be used to efficiently evaluate side channel leakage prior to chip manufacturing. Moreover, it is independent of the underlying countermeasure and it can be applied starting from the earliest stages of the design flow. Additionally, we provide experimental validation through assessment of the side channel security of representative cryptographic circuits. We discuss aspects related to the performance, scalability, and utility to the designers. In particular, we show that CASCADE can evaluate information leakage with 1 million simulated traces in less than 4 hours using a single desktop workstation, for a design larger than 100kGE.

The design of digital systems has its mainstay in the electronic design automation flows which act as crucial instruments to reduce the effort to realize complex computing platforms. In this work, we investigate the possibility of integrating side channel security analyses within the existing FPGA design flow, to provide a feedback to the hardware designer in a prompt and effective way. To this end, we realize an analysis framework which detects side channel leakage on the power consumption side channel at two well established checkpoints in hardware design, i.e., post synthesis and post implementation. We report the results of the proposed framework when integrated within the commercial Xilinx Vivado design toolchain. As a case study, we employ an open source SoC running a software version of the AES block cipher and provide a taxonomy of the side channel information leakage. The reported results highlight how our approach is able to provide precise insights on the sources of information leakage in the hardware design at hand. In particular, we show that the results of the simulations at post synthesis and post implementation stages provide complementary sets of insights on the information leakage, which, thanks to our methodology, can be traced back to architectural components which are the culprits of the said leakage.KeywordsDesign automation and toolsFPGA design flowSide channel analysis

Mathematically secure cryptographic algorithms leak significant side-channel information through their power supplies when implemented on a physical platform. These side-channel leakages can be exploited by an attacker to extract the secret key of an embedded device. The existing state-of-the-art countermeasures mainly focus on power balancing, gate-level masking, or signal-to-noise (SNR) reduction using noise injection and signature attenuation, all of which suffer either from the limitations of high power/area overheads, throughput degradation or are not synthesizable. In this article, we propose a generic low-overhead digital-friendly power SCA countermeasure utilizing a physical Time-Varying Transfer Function (TVTF) by randomly shuffling distributed switched capacitors to significantly obfuscate the traces in the time domain. We evaluate our proposed technique utilizing a Matlab-based system-level simulation. Finally, we implement a 65nm CMOS prototype IC and evaluate our technique against power side-channel attacks (SCA). System-level simulation results of the TVTF-AES show ~5000× minimum traces to disclosure (MTD) improvement over the unprotected implementation with ~1.25× power and ~1.2× area overheads, and without any performance degradation. SCA evaluation with the prototype IC shows 3.4M MTD which is 500× greater than the unprotected solution.

Side channel attacks (SCA) are powerful tools to recover the secret keys of cryptographic devices by employing physical leakages of the devices. In practice, numerous countermeasures (e.g.random process interrupts) and unintentional factors (e.g.imprecise triggering) are able to significantly degrade the performance of side channel attacks (SCA) by producing misaligning leakage measurements. The main solution to over-coming influences of misalignment is to align these traces before mounting an attack. According to this view, this paper proposes a novel leakage alignment method based on the longest common subsequence (LCS) algorithm. Initially, the misaligned traces are preprocessed by non-uniform quantification to remove part of the noise and retain the key-dependent information. Subsequently, the quantified traces are converted into symbols for sequence comparison. Finally, the aligned traces are obtained by inserting and deleting operations. Experiments for different cryptographic implementations with different levels of noise are carried out on several different devices. The experimental results show that the proposed method is effective for countering leakage misalignment and robust under high noise. Especially, it is still effective for multi-channel leakage alignment.

Side-channel attacks compare side-channel leakage predictions or estimations with side-channel leakage measurements. The estimations are based on the exact value of a few select state bits. If it is impossible to calculate the value of the state bits, it is also impossible to estimate the side-channel leakage and a side-channel attack cannot be mounted. The leakage can be measured, but cannot be estimated. In this paper, we first give an analysis of the size of the search space related to the smallest subset of state bits. Then we propose some techniques to make side-channel leakage tolerant architectures. These are architectures of which it is more difficult to calculate the value of the state bits. The architectures still leak side-channel data. Yet, the information content is less easy to exploit

Recently, several studies have been published on the application of deep learning to enhance Side-Channel Attacks (SCA). These seminal works have practically validated the soundness of the approach, especially against implementations protected by masking or by jittering. Concurrently, important open issues have emerged. Among them, the relevance of machine (and thereby deep) learning based SCA has been questioned in several papers based on the lack of relation between the accuracy, a typical performance metric used in machine learning, and common SCA metrics like the Guessing entropy or the key-discrimination success rate. Also, the impact of the classical side-channel counter-measures on the efficiency of deep learning has been questioned, in particular by the semi-conductor industry. Both questions enlighten the importance of studying the theoretical soundness of deep learning in the context of side-channel and of developing means to quantify its efficiency, especially with respect to the optimality bounds published so far in the literature for side-channel leakage exploitation. The first main contribution of this paper directly concerns the latter point. It is indeed proved that minimizing the Negative Log Likelihood (NLL for short) loss function during the training of deep neural networks is actually asymptotically equivalent to maximizing the Perceived Information introduced by Renauld et al. at EUROCRYPT 2011 as a lower bound of the Mutual Information between the leakage and the target secret. Hence, such a training can be considered as an efficient and effective estimation of the PI, and thereby of the MI (known to be complex to accurately estimate in the context of secure implementations). As a second direct consequence of our main contribution, it is argued that, in a side-channel exploitation context, choosing the NLL loss function to drive the training is sound from an information theory point of view. As a third contribution, classical counter-measures like Boolean masking or execution flow shuffling, initially dedicated to classical SCA, are proved to stay sound against deep Learning based attacks.