Cryptography Against Physical Attacks Dana Dachman-Soled University of Maryland Cryptography Public Key Encryption Digital Signatures Secure Multiparty Computation Attacks Even on provably secure schemes such as RSA Problem: Attacks were not captured by the theoretical threat model. Focus today: Secure Computation in the presence of Physical Attacks. Physical Attacks Can run implementation specific attacks Attacks that compromise the security of a system by exploiting physical properties of implementations. Leakage attackspassively leak some function of the honest partys secret state: Timing attacks [Kocher96,] Power attacks [Kocher-Jaffe-Jun99,] Acoustic attacks [Shamir-Tromer04] Examples of Physical Attacks Tampering attacksactively disrupt honest partys computation while observing input/output behavior. Fault attacks [Boneh-DeMillo-Lipton97, Biham-Shamir98,..] Radiation attacks Examples of Physical Attacks Roadmap Protection against tampering and leakage on Random Access Memory (RAM). Protection against tampering on circuit wires (fault induction). Roadmap Protection against tampering and leakage on Random Access Memory (RAM). Protection against tampering on circuit wires (fault induction). Non-Malleable Codes Standard way of protecting secret key stored in memory against tampering. A coding scheme has two algorithms: (Encode, Decode) Non-malleable codes: by tampering with the codeword, the underlying message is either the same or unrelated. Message m Codeword c=Encode(m) c - unchanged Encode(m) - Unrelated m Encode Leakage Resilient Codes Getting partial information about the codeword does not reveal the underlying message Codeword c=Encode(m) The underlying message ??? Partial codeword Problem Locally Decodable and Updatable Codes m1m1 m2m2 mnmn Message C1C1 C2C2 C3C3 C N-1 CNCN Codeword Encode Decode(i): Take input an index i, read a few blocks of the codeword and output m i Decode(i): Take input an index i, read a few blocks of the codeword and output m i Update(j, m): Take inputs an index j and a new message m, update a few blocks of the codeword Update(j, m): Take inputs an index j and a new message m, update a few blocks of the codeword Achieve all three properties! Leakage resilience, non-malleability, locality Non-malleability in our setting: Tampering function either: 1.Destroy several blocks (keeps others unchanged), or 2.Change everything to unrelated messages Putting It Together C1C1 C2C2 C3C3 C N-1 CNCN Decode(i) outputs Error while others unchanged C 1 C 2 C 3 C N-1 C N Decodes of all positions become unrelated Tamper and Leakage Resilience For RAM Computation CPU Random Access Memory (RAM) Our new code, together with an ORAM scheme, protects against physical attacks on random access memory. Store an encoding of Data in RAM-- Encode(ORAM(Data)) Write(j,m): Use Update(j,m) Read(i): Use Decode(i) Our Results [D, Liu, Shi, Zhou, TCC 15] Concepts: propose a new notion that captures all three properties Constructions: two efficient new constructions, achieving different levels of security Applications: using our new tool to protect RAM computation against memory attacks. Analogous to using regular non-malleable codes to protect circuit computation Encode(Data) Our code protects data against physical attacks! Future/Ongoing Work Beyond hardware tampering, Locally Decodable and Updatable Non-Malleable Codes seem to be useful in server-client settings as well. Server is infected with a virus which both downloads sensitive data but also modifies data. Assume the virus is limited in how much data it can download at once. Construct locally decodable and updatable non-malleable codes against a class of leakage and tampering functions that correspond to capabilities of virus (bounded retrieval). Roadmap Protection against tampering and leakage on Random Access Memory (RAM). Protection against tampering on circuit wires (fault induction). Public input Example: Circuit computes a signature using: Secret key stored in memory Public message submitted by adversary Public input Choose tampering function Tamper with constant (1/k) fraction of total number of wires Public input Receive output of tampered circuit Security: Learn nothing beyond input/output behavior of untampered circuit. Attacker can run the circuit and tamper over and over. Tampering with memory is persistent. Our Results [D, Kalai, CRYPTO 12 & TCC 14] Memory: S = ECC(s) Encoding of Input Circuit Computation PCPP Computation PCPP Verification Error CascadeOutput Input: x X = ECC(x) b Future/Ongoing Work Protect against simultaneous leakage and tampering. Protect against larger classes of tampering Tampering on some subset of wires depends on the values of another subset of wires. Thank you! Dana Dachman-Soled