Redundant Code-based Masking Revisited

Code-based masking schemes have been shown to provide higher theoretical security guarantees than Boolean masking. In particular, one interesting feature put forward at CARDIS 2016 and then analyzed at CARDIS 2017 was the so-called security order amplification: under the assumption that the leakage function is linear, it guarantees that an implementation performing only linear operations will have a security order in the bounded moment leakage model larger than $d-1$ , where $d$ is the number of shares. The main question regarding this feature is its practical relevance. First of all, concrete block ciphers do not only perform linear operations. Second, it may be that actual leakage functions are not perfectly linear (raising questions regarding what happens when one deviates from such assumptions). In this paper, we show that the issue of only linear operations can be provably avoided and that it is possible to obtain security order amplification for any functionality to implement. We then show that (not so) slightly non-linear leakage functions do not annihilate the nice properties (i.e., that the code-based schemes we consider remain interesting compared to the Boolean masking). We conclude with a performance evaluation of the proposals, showing that the performance overheads are moderate for a reasonable number of shares (we studied when the number of the shares $d=2,3,4$ ). In additiona, our results could be specified to the case of provable security for low entropy masking, which can be considered as a side bonus of our contributions. We give some preliminary results on how to construct the low entropy masking schemes with provable high security order against linear leakage.

Hardening cryptographic algorithms against sidechannel attacks is a complex but crucial task in today's hardware implementations. One of the most promising countermeasures is Boolean Masking. Designers spend much effort to optimise and customise their masking schemes, but many proposed masked implementations were eventually broken, because they are somehow flawed - not necessarily restricted to a specific error, but to an overall leakage problem. As today's EDA tools hardly support masking, the masking process is still a manual task for the designer. Even worse, due to the lack of capable EDA tools, after synthesis there is no guarantee that the masking still applies and is not optimised. Checking each and every gate of a netlist for masking flaws after synthesis is a time consuming, expensive, and infeasible task. In this paper, we propose a graph based method to reduce the number of gates to be checked. We also present a prototype implementation of our tool to help designers detecting flawed masking in their designs.

Side-channel attacks are a prominent threat to the security of cryptographic implementations. Differently from the traditional black-box attacks, which exploit the inputs and outputs of cryptographic schemes, side-channel attacks partially access the inner working of the scheme as well, by observing the physical leakage emitted by the device executing cryptographic algorithms. A notable example is the class of power-analysis attacks, which exploits the power consumption of the underlying device to recover the secret keys of the implemented cryptosystem. Since their first presentation in the late 1990s, the problem of securing cryptographic systems in the presence of side-channel leakages received significant attention by the cryptographic community. In particular, the theory community has concentrated its research efforts on formally modeling the side-channel leakages and on designing cryptographic schemes \textit{provably} secure in such leakage models. However, conceiving a formal model that realistically captures possible physical leakages and constructing primitives sufficiently efficient to be deployed in practice are still challenging research objectives. This research area is usually referred to as leakage-resilient cryptography. In this dissertation, we examine three main research directions. The first one focuses on the technique of masking, which is the most popular approach to counteract power-analysis attacks. In this context, our work analyzes possible methods to improve the efficiency of masked implementations, with the goal of overcoming the decrease in performance, which is a common drawback of masking. In particular, we provide new and more efficient algorithms for the computation of basic operations in two kinds of masking schemes: the Boolean masking and the Inner Product masking. The second research direction of this work addresses the problem of formalizing security requirements for hardware implementations. While provable security of software-oriented masking has been studied since the origin of leakage resilient cryptography, the more complex task of formally proving the security of hardware-oriented masking is receiving attention by the community only recently. We discuss the different challenges of this field, and we introduce a new theoretical model, the robust probing model, capturing the conditions required for securely implementing complex algorithms in practice, providing a guide to practical implementers. Finally, the last part of this work is concerned with the protection of algorithms employed in lattice-based constructions, which are studied in the field of post-quantum cryptography. While several works investigate the application of masking schemes to standard cryptosystems, for most post-quantum schemes this is still an ongoing research. We contribute to this research area, by applying the masking countermeasure to a binomial sampler which is at the base of many lattice-based cryptosystems.

Masking is a proven countermeasure to protect physical cryptographic implementations against power analysis side-channel attacks, such as differential power analysis (DPA). Boolean masking is one of several types of masking schemes that can be added to a cipher to increase its security. However, implementing a secure and efficient Boolean masking scheme across all components of a cipher, including non-linear transformations, can be challenging. In this research, a 1st order Boolean masking scheme is applied to the SCREAM authenticated cipher, a CAESAR Round Two candidate. The non-masked and masked versions of the full authenticated cipher are implemented in the Virtex-6 FPGA and compared in terms of throughput, area, and throughput-to-area (T/A) ratio. The SCREAM block cipher is then compared to a masked version of AES to determine the relative costs of masking among the two ciphers. The results show that the T/A ratio of the masked SCREAM full authenticated cipher is only 50% of the T/A ratio of the non-masked version, and that the masking cost of the SCREAM block cipher is roughly equal to that of an equivalently-masked version of the AES block cipher.

Masking schemes represent a well-researched and successful option to follow when considering side-channel countermeasures. Still, such measures increase the implementation cost in terms of power consumption, clock cycles, and random numbers generation. In fact, the higher the order of protection against side-channel adversaries, the higher the implementation cost of countermeasures. S-boxes represent the most vulnerable part in an implementation when considering side-channel adversary. In this paper, we investigate how to generate S-boxes that have improved resilience against varying orders of side-channel attacks while having minimal implementation costs. We examine whether S-boxes generated against a certain order of attack also represent a good solution when considering different order of attacks. We demonstrate that we successfully generated S-boxes resilient against a certain physical attack order but the improvements are small. As a result, S-boxes that are resilient against first order attacks stay resilient against higher-order attacks, which saves computational power during the design of higher-order side-channel attacks resilient S-boxes.

Recently, several studies have been published on the application of deep learning to enhance Side-Channel Attacks (SCA). These seminal works have practically validated the soundness of the approach, especially against implementations protected by masking or by jittering. Concurrently, important open issues have emerged. Among them, the relevance of machine (and thereby deep) learning based SCA has been questioned in several papers based on the lack of relation between the accuracy, a typical performance metric used in machine learning, and common SCA metrics like the Guessing entropy or the key-discrimination success rate. Also, the impact of the classical side-channel countermeasures on the efficiency of deep learning has been questioned, in particular by the semiconductor industry. Both questions enlighten the importance of studying the theoretical soundness of deep learning in the context of side-channel and of developing means to quantify its efficiency, especially with respect to the optimality bounds published so far in the literature for side-channel leakage exploitation. The first main contribution of this paper directly concerns the latter point. It is indeed proved that minimizing the Negative Log Likelihood (NLL for short) loss function during the training of deep neural networks is actually asymptotically equivalent to maximizing the Perceived Information introduced by Renauld et al. at EUROCRYPT 2011 as a lower bound of the Mutual Information between the leakage and the target secret. Hence, such a training can be considered as an efficient and effective estimation of the PI, and thereby of the MI (known to be complex to accurately estimate in the context of secure implementations). As a second direct consequence of our main contribution, it is argued that, in a side-channel exploitation context, choosing the NLL loss function to drive the training is sound from an information theory point of view. As a third contribution, classical countermeasures like Boolean masking or execution flow shuffling, initially dedicated to classical SCA, are proved to stay sound against deep Learning based attacks.

Recently, several studies have been published on the application of deep learning to enhance Side-Channel Attacks (SCA). These seminal works have practically validated the soundness of the approach, especially against implementations protected by masking or by jittering. Concurrently, important open issues have emerged. Among them, the relevance of machine (and thereby deep) learning based SCA has been questioned in several papers based on the lack of relation between the accuracy, a typical performance metric used in machine learning, and common SCA metrics like the Guessing entropy or the key-discrimination success rate. Also, the impact of the classical side-channel counter-measures on the efficiency of deep learning has been questioned, in particular by the semi-conductor industry. Both questions enlighten the importance of studying the theoretical soundness of deep learning in the context of side-channel and of developing means to quantify its efficiency, especially with respect to the optimality bounds published so far in the literature for side-channel leakage exploitation. The first main contribution of this paper directly concerns the latter point. It is indeed proved that minimizing the Negative Log Likelihood (NLL for short) loss function during the training of deep neural networks is actually asymptotically equivalent to maximizing the Perceived Information introduced by Renauld et al. at EUROCRYPT 2011 as a lower bound of the Mutual Information between the leakage and the target secret. Hence, such a training can be considered as an efficient and effective estimation of the PI, and thereby of the MI (known to be complex to accurately estimate in the context of secure implementations). As a second direct consequence of our main contribution, it is argued that, in a side-channel exploitation context, choosing the NLL loss function to drive the training is sound from an information theory point of view. As a third contribution, classical counter-measures like Boolean masking or execution flow shuffling, initially dedicated to classical SCA, are proved to stay sound against deep Learning based attacks.

A recent line of research has investigated a new profiling technique based on deep learning as an alternative to the well-known template attack. The related published works have demonstrated that Deep Learning based Side-Channel Attacks (DL-SCA) are very efficient when targeting cryptographic implementations protected with the common side-channel countermeasures such as Boolean masking, jitter and random delays insertion. In this paper, we assess the efficiency of this new profiling attack when targeting other commonly involved countermeasures. First, we target a more complex masking scheme based on Shamir's secret sharing and prove that this new profiling approach is still performing well. Second, we conduct a security evaluation of two side-channel countermeasures (shuffling and 1-amongst- N) against DL-SCA. The simulation and practical experiments prove, as expected, that these countermeasures are also vulnerable to these profiling attacks.

Masking is a very common countermeasure against side channel attacks. When combining Boolean and arithmetic masking, one must be able to convert between the two types of masking, and the conversion algorithm itself must be secure against side-channel attacks. An efficient high-order Boolean to arithmetic conversion scheme was recently described at CHES 2017, with complexity independent of the register size. In this paper we describe a simplified variant with fewer mask refreshing, and still with a proof of security in the ISW probing model. In practical implementations, our variant is roughly 25% faster.

This paper introduces an efficient technique to speed up the higher-order masking scheme of the advanced encryption standard (AES), in which the S-box computation is based on the composite field, using Intel's Supplemental Streaming SIMD Extensions 3 (SSSE 3) instruction set. Different side-channel attack (SCA) countermeasures are combined to mitigate more than one type of SCA. The proposed technique solves the problem of higher-order masking's negative impact on performance and removes the need for lookup tables by applying parallel processing at the data level using single instruction multiple data (SIMD) technology. We implemented the technique on a Linux machine with an Intel processor that supports SSSE3 instructions. The technique performed nine times faster than the second order masking scheme and was seven times faster than the third order masking scheme reported in the literature. The results that we achieved through applying SIMD technology make our proposed technique practical and attractive.

This work presented new Deep learning Side-channel Attack (DL-SCA) models that are based on Extreme Learning Machine (ELM). Unlike the conventional iterative backpropagation method, ELM is a fast learning algorithm that computes the trainable weights within a single iteration. Two models (Ensemble bpELM and CAE-ebpELM) are designed to perform SCA on AES with Boolean masking and desynchronization/jittering. The best models for both attack tasks can be trained 27x faster than MLP and 5x faster than CNN respectively. Verified and validated using ASCAD dataset, our models successfully recover all 16 subkeys using approximately 3K traces in the worst case scenario.

As is known, masking and hiding are two quite effective ways to perform protection against the side channel attacks. However, since recent years the effectiveness of side channel attack has been highly improved, the traditional way of masking has been invalidated, especially when it comes to High-Order DPA attacks, which presents a real practical threat according to the recent results. In this article, we present a countermeasure for DES with Rotating Masks and Secured S-boxes and we have implemented it in hardware. A mixed protection scheme is introduced. We use a method of rotating the masks after each computing round to protect the linear parts of the DES algorithm, while using a hiding technique to protect the non-linear part such as the S-boxes. In this way we are able to perform an intermedia level of protection between First-Order DPA and Second-Order DPA, meanwhile keeping the circuit being less area consuming compared with other masking schemes.

International audience

Masking schemes are classical countermeasures against Side-Channel Attacks on cryptographic implementations. This paper investigates the effectiveness of masking when the code does not run in constant time. We prove that in this case, a first-order Correlation Power Analysis can break an otherwise perfect masking scheme. Furthermore, with an in-depth leakage analysis on traces generated at a pre-silicon stage, we pinpoint the leaking instructions and recover a complex leakage model.

Designing a cryptographic algorithm requires to take into account various cryptanalytic threats. Since the 90’s, Side Channel Analysis (SCA) has become a major threat against cryptographic algorithms embedded on physical devices. Protecting implementation of ciphers against such attacks is a very dynamic topic of research and many countermeasures have been proposed to thwart these attacks. The most common countermeasure for block cipher implementations is masking, which randomizes the variables by combining them with one or several random values. In this paper, we propose to investigate the impact of the size of the words processed by an algorithm on the security against SCA. For this matter we describe two AES-like algorithms operating respectively on 4 and 16-bit words. We then compare them with the regular AES (8 bits) both in terms of complexity and security with respect to various masking schemes. Our results show that SCA is a determinant criterion for algorithms design and that cryptographers may have various possibilities depending on their security and complexity requirements.