Automated instantiation of side-channel attacks countermeasures for software cipher implementations

Researchers are exploring the use of convolutional neural networks (CNNs) in side-channel attacks to understand the weaknesses in cryptographic implementation. CNNs can learn hierarchical characteristics automatically from electromagnetic radiation or power usage during cryptographic processes. Researchers train CNNs on side-channel data to extract meaningful representations and deduce secret keys. Deep learning algorithms are helpful in evaluating the security of embedded systems, and CNNs are a feasible paradigm for profiling side-channel analysis attacks. In this paper, it has been introduced a VGG (Visual Geometry Group)-Net architecture, which is a typical deep convolutional neural network design with numerous layers. It uses the ASCAD dataset to conduct experiments. They found that VGG-Net architecture Side Channel Attacks (SCA) provides better results than the previously optimized CNN model by significantly reducing the number of side-channel traces required for successful attacks on desynchronized datasets. The researchers also discovered that synchronous traces serve as the pre-training source for VGG-Net architecture, functioning successfully in terms of jittering with minimal fine-adjusting after training

In this work, we present a systematic study of Side-Channel Attacks (SCA) and Fault Injection Attacks (FIA) on structured lattice-based schemes, with main focus on Kyber Key Encapsulation Mechanism (KEM) and Dilithium signature scheme, which are leading candidates in the NIST standardization process for Post-Quantum Cryptography (PQC). Through our study, we attempt to understand the underlying similarities and differences between the existing attacks while classifying them into different categories. Given the wide variety of reported attacks, simultaneous protection against all the attacks requires to implement customized protections/countermeasures for both Kyber and Dilithium. We therefore present a range of customized countermeasures, capable of providing defenses/mitigations against existing SCA/FIA, and incorporate several SCA and FIA countermeasures within a single design of Kyber and Dilithium. Among the several countermeasures discussed in this work, we present novel countermeasures that offer simultaneous protection against several SCA- and FIA-based chosen-ciphertext attacks for Kyber KEM. We implement the presented countermeasures within two well-known public software libraries for PQC: (1) pqm4 library for the ARM Cortex-M4-based microcontroller and (2) liboqs library for the Raspberry Pi 3 Model B Plus based on the ARM Cortex-A53 processor. Our performance evaluation reveals that the presented custom countermeasures incur reasonable performance overheads on both the evaluated embedded platforms. We therefore believe our work argues for usage of custom countermeasures within real-world implementations of lattice-based schemes, either in a standalone manner or as reinforcements to generic countermeasures such as masking.

Digital security practitioners are facing enormous challenge in face of the growing repertoire of physical attacks, e.g., Side Channel Attack (SCA) and Fault Injection Attack (FIA). Countermeasures to such threats are usually very different in nature and come with a significant performance penalty. While the FIA countermeasures rely on fault-detecting sensors or concurrent error detection schemes, SCA countermeasures are based on data masking or dual-rail logic circuits. Recently, a low-overhead FIA countermeasure has been proposed that utilises a ring oscillator circuit with Phase-Locked Loop (PLL). In this paper, we extend that countermeasure to further provide protection against SCA, thereby proposing PLL based Protection Against Physical attacks (PPAP). We demonstrate the PPAP on an FPGA prototype under rigorous SCA and FIA testing. We evaluate SCA resistance using the TVLA metric and observe a 2000x increase in SCA protection (in terms of number of traces) with PPAP. We further improve the security of PPAP using statistical analysis through an improved PPAP design (iPPAP) with an increase in SCA resistance of at least 5000x compared to the unprotected implementation with a minimal area overhead.

In this paper the effect of high-performance techniques for high speed applications in secure cryptographic implementations is studied. The use of dual pre charge logic styles with fine-grained pipelining with an overlapping three-phase clock scheme is studied, also including a correct distribution of the clock signal in the cryptographic implementation. To make this study, four different implementations of the Sbox-9 of the Kasumi algorithm have been implemented using an 90nm TSMC technology. Simulation-based DPA attacks have been carried out, showing how the proper synchronization of data signals gives better results in terms of power consumption and operating frequency, but affects negatively the security against side channel attacks, decreasing the number of input patterns needed to disclosure the secret key.

We show that a randomized addition-subtraction chains countermeasure against side channel attacks is vulnerable to SPA attack, a kind of side channel attack, under distinguishability between addition and doubling. A side channel attack is an attack that takes advantage of information leaked during execution of a cryptographic procedure. The randomized addition-subtraction chains countermeasure has been proposed by Oswald-Aigner, and is a random decision inserted into computations. However, its immunity to side channel attacks is still controversial. As for timing attack, a kind of side channel attack, the randomized addition-subtraction chains countermeasure is also vulnerable. Moreover, compared with other countermeasures against side channel attacks, the randomized addition-subtraction chains countermeasure, after being improved to prevent side channel attacks, is much slower.

The role of the side channels in the continuous-variable quantum key distribution is studied. It is shown how the information leakage through a side channel from the trusted sender station increases the vulnerability of the protocols to the eavesdropping in the main quantum communication channel. Moreover, the untrusted noise infusion by an eavesdropper on the trusted receiving side breaks the security even for a purely attenuating main quantum channel. As a method to compensate for the effect of the side-channel leakage on the sender side, we suggest several types of manipulations on the side-channel input. It is shown that by applying the modulated coherent light on the input of the side channel that is optimally correlated to the modulation on the main signal and optionally, introducing additional squeezing in the case of the squeezed-state protocol, the negative influence of the lossy side channel on the sender side can be completely removed. For the trusted receiving side, the method of optimal monitoring of the residual noise from the side-channel noise infusion is suggested and shown to be able to completely eliminate the presence of the noisy side channel. We therefore prove that the side-channel effects can be completely removed using feasible operations if the trusted parties access the respective parts of the side channels.

In side channel attack (SCA) studies, it is widely believed that unprotected implementations leak information about the intermediate states of the internal cryptographic process. However, directly recovering the intermediate states is not common practice in today’s SCA study. Instead, most SCAs exploit the leakages in a “guess-and-determine” way, where they take a partial key guess, compute the corresponding intermediate states, then try to identify which one fits the observed leakages better. In this paper, we ask whether it is possible to take the other way around—directly learning the intermediate states from the side channel leakages. Under certain circumstances, we find that the intermediate states can be efficiently recovered with the well-studied Independent Component Analysis (ICA). Specifically, we propose several methods to convert the side channel leakages into effective ICA observations. For more robust recovery, we also present a specialized ICA algorithm which exploits the specific features of circuit signals. Experiments confirm the validity of our analysis in various circumstances, where most intermediate states can be correctly recovered with only a few hundred traces. Our approach brings new possibilities to the current SCA study, including building an alternative SCA distinguisher, directly attacking the middle encryption rounds and reverse engineering with fewer restrictions. Considering its potential in more advanced applications, we believe our ICA-based SCA deserves more research attention in the future study.

Side-channel attacks (SCAs) using deep learning techniques have been mainly reported as profiled attacks, but in TCHES 2019, differential deep learning analysis (DDLA) was proposed by Timon as a non-profiled attack. In this attack method, deep learning models for all candidate keys are trained, and the key corresponding to the most suitable learning metrics such as loss and accuracy is assumed to be the correct key. Timon focused on a single bit (least significant bit (LSB) or most significant bit (MSB)) of the intermediate value during the operation of the cryptographic circuit and successfully revealed the correct key against the software implementation of the advanced encryption standard (AES). However, when we applied this method to our hardware implementation, we could not reveal all partial keys due to the existence of registers whose Hamming distance (HD) leakage is difficult to observe. In this paper, we propose a multi-bit DDLA that focuses on all bits to solve this problem. When a DDLA was performed on the hardware implemented AES without SCA countermeasures, the HD-ID labels, which had been used as a conventional profiled type DL-SCA method focusing on 8 bits, cannot reveal the 0, 4, 8, and 12th byte keys, but the proposed multi-bit method succeeds in revealing all key bytes. On the other hand, compared to correlated power analysis (CPA) which is a typical non-profiled attack that does not use deep learning, the number of waveforms required to reveal all keys is 1.6 times higher, so the DDLA with our proposed method is not so useful to the target without SCA countermeasures. Thus, we also evaluated the proposed method against FPGA-implemented RSM-AES and WDDL-AES, which have some resistance to SCA, and successfully revealed all keys against RSM and WDDL with 100,000 and 50,000 waveforms, respectively. This is a significant improvement over conventional CPA, which reveals less than half of the key bytes despite using twice as many waveforms as the proposed method. These results suggest that multi-bit DDLA is effective on non-profiled attacks against hardware-implemented AES circuit with SCA countermeasures.

When a software implementation of a security system is considered, side channel attacks are on the spot threat. Side-channel attacks, considered in this work, are a class of physical attacks in which an adversary tries to exploit physical information leakages such as timing information, power consumption, or electromagnetic radiation to estimate security system parameters during performing security algorithms. New system architecture features, such as larger cache sizes and multicore processors, have increased the prevalence of side channels, in addition to, the availability of measurement apparatuses to an attacker. Thus, software developers must be aware of the potential for side-channel attacks and plan appropriately. In this paper, we propose a software implementation of a hashing method based on SHA3-512 hashing algorithm that can counteract the side-channel attacks. To achieve our goal, we use three techniques, first, we shuffle the dataset, salt, and process selector arrays using "Fisher Yates" algorithm. Second, we use volatile memory objects to hold critical data. Finally, we apply the thread locking technique where at most one thread can access the critical objects at a time. Experimental results show that our proposed hashing method is more secure than other related methods. Although there is a trade-off between hashing security and hashing processing time, the processing time of the proposed hashing method is still acceptable.

In 1998, Boneh, Durfee and Frankel introduced partial key exposure attacks, a novel application of Coppersmith's method, to retrieve an RSA private key given only a fraction of its bits.This type of attacks is of particular interest in the context of side-channel attacks.By applying the exponent blinding technique as a countermeasure for side-channel attacks, the private exponent becomes randomized at each execution.Thus the attacker has to rely only on a single trace, significantly incrementing the noise, making the exponent bits recovery less effective.This countermeasure has also the side-effect of modifying the RSA equation used by partial key exposure attacks, in a way studied by Joye and Lepoint in 2012.We improve their results by providing a simpler technique in the case of known least significant bits and a better bound for the known most significant bits case.Additionally, we apply partial key exposure attacks to CRT-RSA when exponent blinding is used, a case not yet analyzed in literature.Our findings, for which we provide theoretical and experimental results, aim to reduce the number of bits to be recovered through side-channel attacks in order to factor an RSA modulus when the implementation is protected by exponent blinding.

Side-channel attacks have recently become one of primary threats that target modern computing devices. Several techniques have been proposed to improve the strength of side-channel attacks. Preprocessing is one of those techniques that improves the side-channel attacks by processing the measured leakage traces before performing the statistical analysis. The advantages of preprocessing techniques can potentially increase the performance and precision of side-channel attacks. Preprocessing of the measured leakage typically leads to faster side-channel attacks that require less number of measurements. A novel combined attack which utilizes the preprocessing techniques effectively is proposed in this work. Mutual information analysis (MIA) and correlation power analysis (CPA) are implemented for the preprocessing and attack steps interchangeably. For the first time, a combined attack is performed on a lightweight Prince cipher. The proposed preprocessing technique is demonstrated to reduce the required number of measurements to disclose a secret key by up to 25%.

Computers are complicated, and the security of modern software often depends on programmers anticipating and mitigating a dizzying assortment of vulnerability classes. Both researchers and adversaries continue to add additional complications based on hardware behavior to this mix, such as data-dependant power consumption, fault injection, cache timing attacks and transient execution - adding new attack surface which needs to be taken into account when building secure systems. In this dissertation, we look beyond the traditional attack surface, and find that many mitigations - across a variety of layers, from hardware to software - are compromised by faulty assumptions about the actual behavior of hardware. We begin close to the hardware, discovering that the relationship between two different forms of hardware attack - Fault Injection and Side-Channel Analysis - is so strong that we can find ways to apply power side-channel attack techniques directly to the results of voltage fault injection campaigns, without the need for an attacker to obtain power measurements. Next, we move to microarchitectural attacks - which rely on hardware behavior, but can be performed by software. By combining transient execution with unexpected - and unintended - CPU pipeline behavior, we show that the scope of software side-channel attacks can be expanded far beyond previous work, allowing both in-flight and 'stale' data to be stolen from the pipeline by an attacker, bypassing software mitigations by ignoring security domains entirely. Such attacks can be mitigated by isolating workloads on different cores - which do not share a pipeline. Unfortunately, we find that even this level of isolation can fail to prevent attackers from being able to leak critical data using side-channel attacks - such as random numbers used when generating cryptographic keys. Hence, these attacks must be mitigated in hardware. Finally, we investigate defenses against transient execution attacks such as Spectre which depend only on well-understood hardware behavior, but require software mitigations. We show that we can build efficient and practical software-based defenses which not only mitigate many Spectre attacks, but even harden software against architectural information leaks.

The design of digital systems has its mainstay in the electronic design automation flows which act as crucial instruments to reduce the effort to realize complex computing platforms. In this work, we investigate the possibility of integrating side channel security analyses within the existing FPGA design flow, to provide a feedback to the hardware designer in a prompt and effective way. To this end, we realize an analysis framework which detects side channel leakage on the power consumption side channel at two well established checkpoints in hardware design, i.e., post synthesis and post implementation. We report the results of the proposed framework when integrated within the commercial Xilinx Vivado design toolchain. As a case study, we employ an open source SoC running a software version of the AES block cipher and provide a taxonomy of the side channel information leakage. The reported results highlight how our approach is able to provide precise insights on the sources of information leakage in the hardware design at hand. In particular, we show that the results of the simulations at post synthesis and post implementation stages provide complementary sets of insights on the information leakage, which, thanks to our methodology, can be traced back to architectural components which are the culprits of the said leakage.KeywordsDesign automation and toolsFPGA design flowSide channel analysis

Cyber-attacks stealing confidential information are becoming increasingly frequent and devastating as modern software systems store and manipulate greater amounts of sensitive data. Leaking information about private user data, such as the financial and medical records of individuals, trade secrets of companies and military secrets of states can have drastic consequences. Confidentiality of such private data is critical for users of these systems. Many software development practices, such as the encryption of packages sent over a network, aim to protect the confidentiality of private data by ensuring that an observer is unable to learn anything meaningful about a program’s secret input from its public output. Under these protections, the software system’s main communication channels, such as the content of the network packets it sends, or the output it writes to a public file, should not leak information about the private data. However, many software systems still contain serious security vulnerabilities. Side channels are an important class of information leaks where secret information can be captured through the observation of non-functional side effects of software systems. Potential side channels include those in execution time, memory usage, size and timings of network packets, and power consumption. Although side-channel vulnerabilities due to hardware (such as vulnerabilities that exploit the cache behavior) have been extensively studied [1] , [2] , [10] , [13] , [15] – [17] , [19] , [23] , software side channels have only recently become an active area of research, including recent results on software side-channel detection [4] , [8] , [11] , [12] , [18] , [22] , [24] and quantification [5] , [20] , [21] , and my own work on a static analysis framework for detection of software side-channels called CoCo-Channel [8] ) and a constraint caching framework to accelerate side-channel quantification called Cashew [9] .

Dynamic restructuring of cryptographic implementations has been proposed as a viable countermeasure against power and electromagnetic-based Side Channel Attacks (SCA).These kind of countermeasures involve shuffling between functionally identical but structurally different realizations (known as variants) of a cryptographic circuit using Partial Reconfiguration.Previous studies show that the overall resistance of this countermeasure relies on the strength of individual variants.In this work we explore the possibility to use AMD Xilinx Vivado's implementation strategies to easily generate variants and evaluate their influence on the resistance of AES against SCA using various metrics.For different implementation strategies, we present leakage behavior for individual bits of the resulting AES realizations and also their impact on overall resistance against SCA. CCS Concepts Security and privacy Side-channel analysis and countermeasures.