Side Channel Attacks and Countermeasures

In this work, we present a systematic study of Side-Channel Attacks (SCA) and Fault Injection Attacks (FIA) on structured lattice-based schemes, with main focus on Kyber Key Encapsulation Mechanism (KEM) and Dilithium signature scheme, which are leading candidates in the NIST standardization process for Post-Quantum Cryptography (PQC). Through our study, we attempt to understand the underlying similarities and differences between the existing attacks while classifying them into different categories. Given the wide variety of reported attacks, simultaneous protection against all the attacks requires to implement customized protections/countermeasures for both Kyber and Dilithium. We therefore present a range of customized countermeasures, capable of providing defenses/mitigations against existing SCA/FIA, and incorporate several SCA and FIA countermeasures within a single design of Kyber and Dilithium. Among the several countermeasures discussed in this work, we present novel countermeasures that offer simultaneous protection against several SCA- and FIA-based chosen-ciphertext attacks for Kyber KEM. We implement the presented countermeasures within two well-known public software libraries for PQC: (1) pqm4 library for the ARM Cortex-M4-based microcontroller and (2) liboqs library for the Raspberry Pi 3 Model B Plus based on the ARM Cortex-A53 processor. Our performance evaluation reveals that the presented custom countermeasures incur reasonable performance overheads on both the evaluated embedded platforms. We therefore believe our work argues for usage of custom countermeasures within real-world implementations of lattice-based schemes, either in a standalone manner or as reinforcements to generic countermeasures such as masking.

Digital security practitioners are facing enormous challenge in face of the growing repertoire of physical attacks, e.g., Side Channel Attack (SCA) and Fault Injection Attack (FIA). Countermeasures to such threats are usually very different in nature and come with a significant performance penalty. While the FIA countermeasures rely on fault-detecting sensors or concurrent error detection schemes, SCA countermeasures are based on data masking or dual-rail logic circuits. Recently, a low-overhead FIA countermeasure has been proposed that utilises a ring oscillator circuit with Phase-Locked Loop (PLL). In this paper, we extend that countermeasure to further provide protection against SCA, thereby proposing PLL based Protection Against Physical attacks (PPAP). We demonstrate the PPAP on an FPGA prototype under rigorous SCA and FIA testing. We evaluate SCA resistance using the TVLA metric and observe a 2000x increase in SCA protection (in terms of number of traces) with PPAP. We further improve the security of PPAP using statistical analysis through an improved PPAP design (iPPAP) with an increase in SCA resistance of at least 5000x compared to the unprotected implementation with a minimal area overhead.

Many side channels including power consumption, electromagnetic emanation, optical radiation, and even sound have been studied since the first publication of a side channel attack at the end of the 1990s. Most of these channels can be relatively easily used for an overall analysis of the cryptographic system (implementation of efficient passive attacks) or for injection of faults. Until recently, only the optical channel allowed both analysis of locally leaked information and precise injection of faults (single-bit errors). Recent works showed that the near-field electromagnetic channel enables similar results to be obtained. Like the optical channel, the near-field electromagnetic channel allows both active and passive attacks, which, in addition, can be theoretically non-invasive and contactless. However, the cost of the attack bench that is needed to exploit the near-field electromagnetic channel is less than that of an optical channel. Recently, we showed that it is possible to use the near-field electromagnetic channel to perform an efficient active attack targeting the true random number generator (TRNG) based on ring oscillators. In cryptography, TRNGs are chiefly used to generate encryption keys and other critical security parameters, so the proposed active attack could have serious consequences for the security of the whole cryptographic system. Here, we present the coupling of a passive attack and an active attack. The proposed coupled attack first uses a spectral differential analysis of the TRNG electromagnetic radiation to obtain valuable information on the position of ring oscillators and their frequency range. This information is then used to tune the electromagnetic harmonic signal to temporarily synchronize the ring oscillators. In this paper, we propose a fault model of the entropy extractor which shows that the behavior of the ring oscillators changes, and that it occurs additional and unwanted “fake rising edges” of the clock signal which disturb the flip-flops involved in such TRNGs. The effectiveness of our proposed coupled attack questions the use of ring oscillators in the design of TRNGs.

Side-channel attacks are a prominent threat to the security of cryptographic implementations. Differently from the traditional black-box attacks, which exploit the inputs and outputs of cryptographic schemes, side-channel attacks partially access the inner working of the scheme as well, by observing the physical leakage emitted by the device executing cryptographic algorithms. A notable example is the class of power-analysis attacks, which exploits the power consumption of the underlying device to recover the secret keys of the implemented cryptosystem. Since their first presentation in the late 1990s, the problem of securing cryptographic systems in the presence of side-channel leakages received significant attention by the cryptographic community. In particular, the theory community has concentrated its research efforts on formally modeling the side-channel leakages and on designing cryptographic schemes \textit{provably} secure in such leakage models. However, conceiving a formal model that realistically captures possible physical leakages and constructing primitives sufficiently efficient to be deployed in practice are still challenging research objectives. This research area is usually referred to as leakage-resilient cryptography. In this dissertation, we examine three main research directions. The first one focuses on the technique of masking, which is the most popular approach to counteract power-analysis attacks. In this context, our work analyzes possible methods to improve the efficiency of masked implementations, with the goal of overcoming the decrease in performance, which is a common drawback of masking. In particular, we provide new and more efficient algorithms for the computation of basic operations in two kinds of masking schemes: the Boolean masking and the Inner Product masking. The second research direction of this work addresses the problem of formalizing security requirements for hardware implementations. While provable security of software-oriented masking has been studied since the origin of leakage resilient cryptography, the more complex task of formally proving the security of hardware-oriented masking is receiving attention by the community only recently. We discuss the different challenges of this field, and we introduce a new theoretical model, the robust probing model, capturing the conditions required for securely implementing complex algorithms in practice, providing a guide to practical implementers. Finally, the last part of this work is concerned with the protection of algorithms employed in lattice-based constructions, which are studied in the field of post-quantum cryptography. While several works investigate the application of masking schemes to standard cryptosystems, for most post-quantum schemes this is still an ongoing research. We contribute to this research area, by applying the masking countermeasure to a binomial sampler which is at the base of many lattice-based cryptosystems.

Side channel attacks are based on side channel information, which is information that is leaked from encryption systems. Implementing side channel attacks is possible if and only if an attacker has access to a cryptosystem (victim) or can interact with cryptosystem remotely to compute time statistics of information that collected from targeted system. Cache timing attack is a special type of side channel attack. Here, timing information caused by cache effect is collected and analyzed by an attacker to guess sensitive information such as encryption key or plaintext. Cache timing attack against AES was known theoretically until Bernstein carry out a real implementation of the attack. Fortunately, this attack can be a success only by exploiting bad implementation in software or hardware, not for algorithm structure weaknesses, and that means attack could be prevented if proper implementation has been used. For that reason, modification in software and hardware has been proposed as countermeasures. This paper reviews the technique applied in this attack, surveys the countermeasures against it, and evaluates the feasibility and usability of each countermeasure. We made comparison between these countermeasure based on certain aspect furthermore.

The additional information (side effects) in Elliptic Curve Cryptography (ECC) hardware can be used to attack cryptographic systems. Additional information related to time, power consumption and electromagnetic radiation. Side channel attacks have been done with SPA (Simple Power Analysis), DPA (Differential Power Analysis), SEMA (Simple Electromagnetic Analysis) and DEMA (Differential Electromagnetic Analysis). Some scalar multiplication algorithm can be used to countermeasure SPA attack on elliptic curve cryptography. In this study, conducted experiments side-channel attacks ECC hardware implementations use binary algorithms by observing power consumption of ECC processor on FPGA. Experimental of side-channel attack is conducted to guess the secret key for data encryption and decryption by looking at the physical differences on hardware side effects. In this study, side-channel attack experimental is successful 100% get the key by analyzing of power consumption ECC processor.

Cryptographic implementations are prune to Side Channel Analysis (SCA) attacks and Fault Injection (FI) attacks at the same time. Therefore, countermeasures protecting an implementation need to be evaluated against both attacks. The main contribution of this work is twofold. First, we propose an evaluation platform capable to perform emulated fault injection campaigns against modern MCUs and at the same time able to acquire experimental electromagnetic EM emissions and power traces of cryptographic computations to be used for SCA attacks. Second, we perform experimental evaluations of countermeasures protecting against both SCA and FI attacks which show that the injections of faults can dramatically reduce the effectiveness of SCA countermeasures. We evaluate two cryptographic algorithms, an AES and a PRESENT-Sbox implementation, which are protected employing different countermeasures protecting in parallel against FI and SCA attacks. The AES secure implementation is protected by hiding-based SCA countermeasures, while it uses a redundancy-based technique against FI attacks. On the other hand, the PRESENT Sbox is protected by a software implementation of a Dual-rail with Precharge Logic (DPL) countermeasure including fault detection capabilities. We present extensive experimental evaluations for the AES implementation and first results for PRESENT-Sbox showing that for both implementations the fault injections increase the efficiency of the SCA attacks and lead to very fast recoveries of the secret keys.

Many side-channel attacks on implementations of cryptographic algorithms have been developed in recent years demonstrating the ease of extracting the secret key. In response, various schemes to protect cryptographic devices against such attacks have been devised and some implemented in practice. Almost all of these protection schemes target an individual side-channel attack and consequently, it is not obvious whether a scheme for protecting the device against one type of side- channel attacks may make the device more vulnerable to another type of side-channel attacks. We examine in this paper the possibility of such a negative impact for the case where fault detection circuitry is added to a device (to protect it against fault injection attacks) and analyze the resistance of the modified device to power attacks. To simplify the analysis we focus on only one component in the cryptographic device (namely, the S-box in the AES and Kasumi ciphers), and perform power attacks on the original implementation and on a modified implementation with an added parity check circuit. Our results show that the presence of the parity check circuitry has a negative impact on the resistance of the device to power analysis attacks.

Elliptic Curve Cryptography operations rely heavily on the strong security of scalar multiplication. However, this operation is vulnerable to side channel (SCA) and fault injection (FA) attacks. The use of alternative arithmetic systems like Residue Number System (RNS) for all scalar multiplication underline operations has been proposed as an efficient countermeasure approach for the above attacks. In RNS, a number is represented as a set of smaller numbers, where each one is the result of the modular reduction with a given moduli basis. Under certain requirements, a number can be uniquely transformed from the integers to the RNS domain (and vice versa) and all arithmetic operations can be performed in RNS. This representation provides an inherent SCA and FA resistance to many attacks and can be further enhanced by additional RNS arithmetic manipulations or more traditional algorithmic countermeasures. In this paper, extending our previous work, we explore the potentials of RNS as an SCA and FA countermeasure. A description of RNS based SCA and FA resistance means is provided through appropriate scalar multiplication algorithmic variations, traces of the proposed algorithm are collected and the results are analyzed regarding the RNS countermeasure strength. More specifically, in this paper, a secure RNS based Montgomery Power Ladder based scalar multiplication algorithm is provided and is implemented on an ARM Cortex A7 processor. The implementation SCA-FA resistance is evaluated by collecting preliminary leakage trace results that validate our initial assumptions.

When a software implementation of a security system is considered, side channel attacks are on the spot threat. Side-channel attacks, considered in this work, are a class of physical attacks in which an adversary tries to exploit physical information leakages such as timing information, power consumption, or electromagnetic radiation to estimate security system parameters during performing security algorithms. New system architecture features, such as larger cache sizes and multicore processors, have increased the prevalence of side channels, in addition to, the availability of measurement apparatuses to an attacker. Thus, software developers must be aware of the potential for side-channel attacks and plan appropriately. In this paper, we propose a software implementation of a hashing method based on SHA3-512 hashing algorithm that can counteract the side-channel attacks. To achieve our goal, we use three techniques, first, we shuffle the dataset, salt, and process selector arrays using "Fisher Yates" algorithm. Second, we use volatile memory objects to hold critical data. Finally, we apply the thread locking technique where at most one thread can access the critical objects at a time. Experimental results show that our proposed hashing method is more secure than other related methods. Although there is a trade-off between hashing security and hashing processing time, the processing time of the proposed hashing method is still acceptable.

The use of machine learning algorithms in order to, not only, detect the adversarial intend behind side-channel attacks on cryptographic systems, but also to resist Differential Power Analysis (DPA) attacks. In particular, with the help of the DPA Challenge Dataset containing power traces of AES encryption operations, we propose a detailed step-by-step approach that includes data acquisition, preprocessing, feature extraction, and model assessment. The pre-processing includes noise reduction, normalization and segmental processing of the collected data for which basic statistical and frequency domain analysis can be used for extraction of relevant features. Support Vector Machines (SVMs) are then trained and tested in order to classify and in turn predict attack scenarios as per the subsequently derived features. As the outcome of the result pages show, the SVM model successfully classifies attack and non-attack traces at a rate of 88% on the validation set, which underlines the usage of machine learning to boost cryptographic security. Investigation of the feature relevance demonstrates that frequency-domain features, namely FFT coefficients are most impactful. The findings of this research prove that machine learning can be useful in preventing side-channel attacks apart from providing valuable information on enhancing the understanding of different defenses in cryptographic systems as well as future development of this domain.

The SASEBO-GIII board equipped with a 28-nm FPGA was developed for security evaluation against side-channel attacks (SCAs) and various other threats. SCAs are performed to extract a secret key inside a cryptographic module by analyzing its power consumption, electromagnetic radiation and other physical parameters. Since an increasing number of current consumer electronic devices provide hardware-accelerated cryptographic functionality for data encryption, device authentication, and so forth, SCAs are considered to be a serious problem in the electronics market. While previous SASEBO models mainly target SCA evaluation of a single cryptographic core, they are nevertheless insufficient for testing the security of integrated systems that consist of any combination of cryptographic, network, control and other modules. Providing high processing power with the latest Kintex-7 FPGA and considerable expandability with ANSI-standard FMC connectors, SASEBO-GIII is suitable for prototyping a wide variety of systems, such as home information appliances, content distribution systems and dynamic partial reconfiguration (DPR) systems, and offers a convenient environment for studying security issues in such integrated systems, for example, hardware trojans and counterfeit electronics. The configuration of the Kintex-7 FPGA is controlled by the other FPGA (Spartan-6), and therefore a user can verify the security of various types of device configuration processes, for example, DPR through ICAP or SelectMAP interfaces as well as though standard configuration interfaces such as BPI and JTAG. This paper presents the detailed architecture and features of SASEBO-GIII, and shows the results of an electromagnetic SCA attack against the standard AES block cipher implemented on the Kintex-7 FPGA.

This study explores data-driven detection of firmware/software Trojans in embedded systems <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">without</i> golden models. We consider embedded systems such as single board computers and industrial controllers. While prior literature considers side channel based anomaly detection, this study addresses the following central question: is anomaly detection feasible when using low-fidelity simulated data without using data from a known-good (golden) system? To study this question, we use data from a simulator-based proxy as a stand-in for unavailable golden data from a known-good system. Using data generated from the simulator, one-class classifier machine learning models are applied to detect discrepancies against expected side channel signal patterns and their inter-relationships. Side channels fused for Trojan detection include multi-modal <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">side channel</i> measurement data (such as Hardware Performance Counters, processor load, temperature, and power consumption). Additionally, fuzzing is introduced to increase detectability of Trojans. To experimentally evaluate the approach, we generate low-fidelity data using a simulator implemented with a component-based model and an information bottleneck based on Gaussian stochastic models. We consider example Trojans and show that fuzzing-aided golden-free Trojan detection is feasible using simulated data as a baseline.

This paper provides an end-to-end solution to defend against known microarchitectural attacks such as speculative execution attacks, fault-injection attacks, covert and side channel attacks, and unknown or evasive versions of these attacks. Current defenses are attack specific and can have unacceptably high performance overhead. We propose an approach that reduces the overhead of state-of-art defenses by over 95%, by applying defenses only when attacks are detected. Many current proposed mitigations are not practical for deployment; for example, InvisiSpec has 27% overhead and Fencing has 74% overhead while protecting against only Spectre attacks. Other mitigations carry similar performance penalties. We reduce the overhead for InvisiSpec to 1.26% and for Fencing to 3.45% offering performance and security for not only spectre attacks but other known transient attacks as well, including the dangerous class of LVI and Rowhammer attacks, as well as covering a large set of future evasive and zero-day attacks. Critical to our approach is an accurate detector that is not fooled by evasive attacks and that can generalize to novel zero-day attacks. We use a novel Generative framework, Evasion Vaccination (EVAX) for training ML models and engineering new security-centric performance counters. EVAX significantly increases sensitivity to detect and classify attacks in time for mitigation to be deployed with low false positives (4 FPs in every 1M instructions in our experiments). Such performance enables efficient and timely mitigations, enabling the processor to automatically switch between performance and security as needed.

Thanks to the seminal works of Kocher on side-channel attacks [1, 2] and Boneh et al. on fault injection attacks [3] in the 1990s, the domain of physical attacks has emerged as an active research domain as well as a potential threat on commercial devices. Practical hacks using physical attacks have been demonstrated on commercial products like NXP MiFare [4], KEELOQ [5], Sony PlayStation, etc. The threat becomes even bigger with the emergence of the Internet of Things (IoT), digital economy and identity. Digital economy is a push towards cashless society, encouraging digital banking with use of modern payment methods based on smartcards and now smartphones. Digital identity now uses biometric data, like fingerprints, to authenticate people. Several governments are giving a push for digital economy and identity. This has led to rapid adoption of mobile payments, cashless solutions, biometric identities. Often biometrics are linked to payment solution.