Embed Size (px)
Citation preview
TOWARDS SECURE CRYPTOGRAPHIC SOFTWARE IMPLEMENTATION AGAINST SIDE-CHANNEL POWER ANALYSIS ATTACKS
Northeastern University Energy-Efficient and Secure Systems Lab
Outline • Details of Keccak • Previous attacks on Keccak
• Side-channel attacks on R1 • Conclusion
6/17/2015 2
Details of Keccak (1) • Selected as the winner of the NIST hash function
competition on October 2, 2012 • Draft FIPS PUB 202, May 2014
• SHA3-224, SHA3-256, SHA3-384, SHA3-512, SHAKE128, SHAKE256
• Internal state size: 1600 (5×5×64)
• In this paper:
• 320 key bits, fill the first plane
6/17/2015 3
Details of Keccak (2)
6/17/2015 4
23} ... 1 0,{i ),(R R i1i ∈=+ θρπχι
Details of Keccak (3) • µ is a linear operation which involves 11 input bits and
outputs a single bit. S'(x,y,z) = S(x,y,z) © (© 4i=0 S(x-1,i,z))© (© 4i=0 S(x+1,i,z-1)).
6/17/2015 5
Details of Keccak (4) • ½ is the permutation over the bits along the z-axis. • ¼ changes x and y of the bits
6/17/2015 6
Details of Keccak (5) • Â is the only non-linear step
• ¶ is addition with a constant number
6/17/2015 7
Outline • The details of Keccak • Previous attacks on Keccak
• Side-channel attacks on R1
• Conclusion
6/17/2015 Side-Channel Analysis of MAC-Keccak Hardware Implementations 8
Side-channel attacks on µ (1) • Previous papers focus on µ
• The first step of Keccak • Intermediate variables are stored in registers for software
implementations • Hardware implementations also have leakage of µ because of
Keccak properties
6/17/2015 9
M. Taha and P. Schaumont. Dierential power analysis of MAC-keccak at any key-length. In International Workshop on Security, pages 68-82, Nov. 2013. M. Taha and P. Schaumont. Side-channel analysis of MAC-Keccak. In IEEE International Symposium on Hardware-Oriented Security and Trust (HOST), pages 125{130, June 2013. P. Luo, Y. Fei, X. Fang, A. Ding, M. Leeser, and D. Kaeli. Power analysis attack on hardware implementation of MAC-keccak on FPGAs. In ReConFigurable Computing and FPGAs (ReConFig), 2014 International Conference on, pages 1-7, Dec 2014.
Outline • The details of Keccak • Previous attacks on Keccak
• Side-channel attacks on R1
• Conclusion
6/17/2015 10
Side-channel attacks on R1 (1)
6/17/2015 11
bits.key 6least at involves bits One (2)low; toois SNRbit One (1)
:Conclusion
bits.key 2 involvesbit Each ; of bits 3 involvesbit Each
out
outout
ππχ
••
Side-channel attacks on R1 (2)
6/17/2015 12
5 bits of each row operate on each other, thus 11 key bits in total. Attackable?
Side-channel attacks on R1 (3)
6/17/2015 13
bitskey 11 thusbit,key a also is )2,0,2(
)62,4,1( )62,4,1( )0,4,4()23,3,0( )23,3,0( )0,4,3()25,2,4( )25,2,4( )0,4,2(
)9,1,3( )9,1,3( )0,4,1()2,0,2( )2,0,2( )0,4,0(
:get tohow known, is )0440
04400440:distance Hamming
1
1
1
1
1
1
1
P
PRPRPRPRPR
R,],:P([
)),],:([), R,],:HD(P([
out
out
out
out
out
↔↔↔↔↔↔↔↔↔↔
θθθθθ
Side-channel attacks on R1 (4)
6/17/2015 14
changed.not are valuesthe bits, ofposition thechangeonly and ρπ
)62,4,1( )62,4,1( )0,4,4()23,3,0( )23,3,0( )0,4,3()25,2,4( )25,2,4( )0,4,2(
)9,1,3( )9,1,3( )0,4,1()2,0,2( )2,0,2( )0,4,0(
1
1
1
1
1
PRPRPRPRPR
out
out
out
out
out
↔↔↔↔↔↔↔↔↔↔
θθθθθ
Side-channel attacks on R1 (5)
6/17/2015 15
)61,0,2()62,0,1()22,0,1()23,0,4()24,0,0()25,0,3(
)8,0,4( )9,0,2()1,0,3( )2,0,1( )2,0,2(
:recover can weWhat
5
4
3
2
1
PPkgPPkgPPkgPPkg
PPPkg
⊕=⊕=⊕=⊕=
⊕⊕=
)62,4,1( )62,4,1( )0,4,4()23,3,0( )23,3,0( )0,4,3()25,2,4( )25,2,4( )0,4,2(
)9,1,3( )9,1,3( )0,4,1()2,0,2( )2,0,2( )0,4,0(
1
1
1
1
1
PRPRPRPRPR
out
out
out
out
out
↔↔↔↔↔↔↔↔↔↔
θθθθθ
Side-channel attacks on R1 (6)
6/17/2015 16
Side-channel attacks on R1 (7)
6/17/2015 17
Side-channel attacks on R1 (8)
• Combine 2-bit XORs and 3-bit XORs to recover key bits • There are 320 identical 2-bit XORs and 3-bit XORs
6/17/2015 18
63}. ... 1 {0,z ...}, 1 {0, x 1)}z1,0,S(xz)1,0,{S(xKG
1)}z1,0,S(xz)S(x,0,z)1,0,{S(xKG
2
1
∈∈
−+⊕−=−+⊕⊕−=
Outline • Details of Keccak • Previous attacks on Keccak
• Side-channel attacks on R1 • Conclusion
6/17/2015 Side-Channel Analysis of MAC-Keccak Hardware Implementations 19
Conclusion • The first round output of Keccak can be attacked • Attacking methods are different for software/hardware
implementations • Countermeasures should be added
6/17/2015 20
THANKS!
http://tescase.coe.neu.edu/
http://tescase.coe.neu.edu/
![New Conditional Cube Attack on Keccak Keyed ModesThe cube attack [DS09] was introduced by Dinur and Shamir at EUROCRYPT 2009. In their work, an output bit of a symmetric cryptographic](https://img.pdfslide.us/doc/110x75/5e900d775f66b770c51965c8/new-conditional-cube-attack-on-keccak-keyed-modes-the-cube-attack-ds09-was-introduced.jpg)
![SENSACIà N, PERCEPCIà N Y RAZONAMIENTOS€¦ · ï µ o µ W ] v µ o µ o µ v o µ À ] À µ v ] v ] À ] µ } } v ] µ Ç ^ µ _ µ](https://img.pdfslide.us/doc/110x75/6032fd624538023875270df3/sensacif-n-percepcif-n-y-razonamientos-o-w-v-o-o-v-o-.jpg)
![BKM INDUSTRIES LIMITED€¦ · 13. dZ }u vÇ] }v v }µ Z vÀ] }vu v v µ o]Ì v µ o }µ ]v µ ]v o ÁÇXt µ Ç}µ } µ Ç}µ u]o Á] ZÇ}µ } ] } ÇW ] v } v o µ } v Ç}µ Z vvµoZ](https://img.pdfslide.us/doc/110x75/5f7aa2ab21740547403de5fd/bkm-industries-limited-13-dz-u-v-v-v-z-v-vu-v-v-ooe-v-o-.jpg)
![CX Playbook (final) - actiac.org Playbook.pdf · ^ À ] µ µ µ µ](https://img.pdfslide.us/doc/110x75/5f9654b19de95b57da28eea5/cx-playbook-final-playbookpdf-.jpg)
