scholarly journals When one vulnerable primitive turns viral: Novel single-trace attacks on ECDSA and RSA

2020 ◽  
pp. 196-221
Author(s):  
Alejandro Cabrera Aldaya ◽  
Billy Bob Brumley
Keyword(s):  
Side Channel ◽  
Security Threats ◽  
Integer Factorization ◽  
Success Rates ◽  
Side Channel Attacks ◽  
Side Channel Analysis ◽  
Factorization Problem ◽  
Integer Factorization Problem ◽  
Channel Analysis ◽  
Single Trace

Microarchitecture based side-channel attacks are common threats nowadays. Intel SGX technology provides a strong isolation from an adversarial OS, however, does not guarantee protection against side-channel attacks. In this paper, we analyze the security of the mbedTLS binary GCD algorithm, an implementation that offers interesting challenges when compared for example with OpenSSL, due to the usage of very tight loops in the former. Using practical experiments we demonstrate the mbedTLS binary GCD implementation is vulnerable to side-channel analysis using the SGX-Step framework against mbedTLS based SGX enclaves.We analyze the security of some use cases of this algorithm in this library, resulting in the discovery of a new vulnerability in the ECDSA code path that allows a single-trace attack against this implementation. This vulnerability is three-fold interesting: It resides in the implementation of a countermeasure which makes it more dangerous due to the false state of security the countermeasure currently offers. It reduces mbedTLS ECDSA security to an integer factorization problem. An unexpected GCD call inside the ECDSA code path compromises the countermeasure. We also cover an orthogonal use case, this time inside the mbedTLS RSA code path during the computation of a CRT parameter when loading a private key. The attack also exploits the binary GCD implementation threat, showing how a single vulnerable primitive leads to multiple vulnerabilities. We demonstrate both security threats with end-to-end attacks using 1000 trials each, showing in both cases single-trace attacks can be achieved with success rates very close to 100%.

scholarly journals Single Trace Side Channel Analysis on NTRU Implementation

2018 ◽  
Vol 8 (11) ◽  
pp. 2014 ◽  
Author(s):  
Soojung An ◽  
Suhri Kim ◽  
Sunghyun Jin ◽  
HanBit Kim ◽  
HeeSeok Kim
Keyword(s):  
Power Consumption ◽  
Quantum Computer ◽  
Side Channel ◽  
Side Channel Attacks ◽  
Side Channel Analysis ◽  
Channel Analysis ◽  
Post Quantum Cryptography ◽  
Single Trace ◽  
Secure Implementation ◽  
Single Power

As researches on the quantum computer have progressed immensely, interests in post-quantum cryptography have greatly increased. NTRU is one of the well-known algorithms due to its practical key sizes and fast performance along with the resistance against the quantum adversary. Although NTRU has withstood various algebraic attacks, its side-channel resistance must also be considered for secure implementation. In this paper, we proposed the first single trace attack on NTRU. Previous side-channel attacks on NTRU used numerous power traces, which increase the attack complexity and limit the target algorithm. There are two versions of NTRU implementation published in succession. We demonstrated our attack on both implementations using a single power consumption trace obtained in the decryption phase. Furthermore, we propose a countermeasure to prevent the proposed attacks. Our countermeasure does not degrade in terms of performance.

scholarly journals Variety of Scalable Shuffling Countermeasures against Side Channel Attacks

2016 ◽  
Author(s):  
Nikita Veshchikov ◽  
Stephane Fernandes Medeiros ◽  
Liran Lerman
Keyword(s):  
Block Cipher ◽  
Fixed Number ◽  
Side Channel ◽  
Small Data ◽  
Side Channel Attacks ◽  
Side Channel Analysis ◽  
Cryptographic System ◽  
Channel Analysis ◽  
Iot Devices ◽  
Time Overhead

IoT devices have very strong requirements on all the resources such as memory, randomness, energy and execution time. This paper proposes a number of scalable shuffling techniques as countermeasures against side channel analysis. Some extensions of an existing technique called Random Start Index (RSI) are suggested in this paper. Moreover, two new shuffling techniques Reverse Shuffle (RS) and Sweep Swap Shuffle (SSS) are described within their possible extensions. Extensions of RSI, RS and SSS might be implemented in a constrained environment with a small data and time overhead. Each of them might be implemented using different amount of randomness and thus, might be fine-tuned according to requirements and constraints of a cryptographic system such as time, memory, available number of random bits, etc. RSI, RS, SSS and their extensions are described using SubBytes operation of AES-128 block cipher as an example, but they might be used with different operations of AES as well as with other algorithms. This paper also analyses RSI, RS and SSS by comparing their properties such as number of total permutations that might be generated using a fixed number of random bits, data complexity, time overhead and evaluates their resistance against some known side-channel attacks such as correlation power analysis and template attack. Several of proposed shuffling schemes are implemented on a 8-bit microcontroller that uses them to shuffle the first and the last rounds of AES-128.  

scholarly journals Key Bit-Dependent Side-Channel Attacks on Protected Binary Scalar Multiplication †

2018 ◽  
Vol 8 (11) ◽  
pp. 2168 ◽  
Author(s):  
Bo-Yeon Sim ◽  
Junki Kang ◽  
Dong-Guk Han
Keyword(s):  
Success Rate ◽  
Electromagnetic Emission ◽  
Scalar Multiplication ◽  
Statistical Characteristics ◽  
Side Channel ◽  
Secret Key ◽  
Side Channel Analysis ◽  
Software Implementations ◽  
Channel Analysis ◽  
Single Trace

Binary scalar multiplication, which is the main operation of elliptic curve cryptography, is vulnerable to side-channel analysis. It is especially vulnerable to side-channel analysis using power consumption and electromagnetic emission patterns. Thus, various countermeasures have been reported. However, they focused on eliminating patterns of conditional branches, statistical characteristics according to intermediate values, or data inter-relationships. Even though secret scalar bits are directly loaded during the check phase, countermeasures for this phase have not been considered. Therefore, in this paper, we show that there is side-channel leakage associated with secret scalar bit values. We experimented with hardware and software implementations, and experiments were focused on the Montgomery–López–Dahab ladder algorithm protected by scalar randomization in hardware implementations. We show that we could extract secret key bits with a 100% success rate using a single trace. Moreover, our attack did not require sophisticated preprocessing and could defeat existing countermeasures using a single trace. We focused on the key bit identification functions of mbedTLS and OpenSSL in software implementations. The success rate was over 94%, so brute-force attacks could still be able to recover the whole secret scalar bits. We propose a countermeasure and demonstrate experimentally that it can be effectively applied.

scholarly journals Improved Filtering Techniques for Single- and Multi-Trace Side-Channel Analysis

Cryptography ◽  
2021 ◽  
Vol 5 (3) ◽  
pp. 24
Author(s):  
Dor Salomon ◽  
Amir Weiss ◽  
Itamar Levi
Keyword(s):  
Information Gain ◽  
Computational Cost ◽  
Statistical Characteristics ◽  
Side Channel ◽  
Band Pass Filter ◽  
Pass Filter ◽  
Side Channel Analysis ◽  
Main Challenge ◽  
Channel Analysis ◽  
Single Trace

Side-channel analysis (SCA) attacks constantly improve and evolve. Implementations are therefore designed to withstand strong SCA adversaries. Different side channels exhibit varying statistical characteristics of the sensed or exfiltrated leakage, as well as the embedding of different countermeasures. This makes it crucial to improve and adapt pre-processing and denoising techniques, and abilities to evaluate the adversarial best-case scenario. We address two popular SCA scenarios: (1) a single-trace context, modeling an adversary that captures only one leakage trace, and (2) a multi-trace (or statistical) scenario, that models the classical SCA context. Given that horizontal attacks, localized electromagnetic attacks and remote-SCA attacks are becoming evermore powerful, both scenarios are of interest and importance. In the single-trace context, we improve on existing Singular Spectral Analysis (SSA) based techniques by utilizing spectral property variations over time that stem from the cryptographic implementation. By adapting overlapped-SSA and optimizing over the method parameters, we achieve a significantly shorter computation time, which is the main challenge of the SSA-based technique, and a higher information gain (in terms of the Signal-to-Noise Ratio (SNR)). In the multi-trace context, a profiling strategy is proposed to optimize a Band-Pass Filter (BPF) based on a low-computational cost criterion, which is shown to be efficient for unprotected and low protection level countermeasures. In addition, a slightly more computationally intensive optimized ’shaped’ filter is presented that utilizes a frequency-domain SNR-based coefficient thresholding. Our experimental results exhibit significant improvements over a set of various implementations embedded with countermeasures in hardware and software platforms, corresponding to varying baseline SNR levels and statistical leakage characteristics.

scholarly journals Single Trace Analysis against HyMES by Exploitation of Joint Distributions of Leakages

2020 ◽  
Vol 10 (5) ◽  
pp. 1831
Author(s):  
ByeongGyu Park ◽  
Suhri Kim ◽  
Seokhie Hong ◽  
HeeSeok Kim ◽  
Seog Chung Seo
Keyword(s):  
Side Channel ◽  
Nonlinear Functions ◽  
Side Channel Analysis ◽  
The Public ◽  
Joint Distributions ◽  
Encryption And Decryption ◽  
Channel Analysis ◽  
Post Quantum Cryptography ◽  
Single Trace ◽  
Code Based Cryptography

Beginning with the proposal of the McEliece cryptosystem in 1978, code-based cryptography has positioned itself as one of main categories in post-quantum cryptography (PQC). To date, the algebraic security of certain variants of McEliece cryptosystems has been challenged many times, although some of the variants have remained secure. However, recent studies on code-based cryptography have focused on the side-channel resistance since previous studies have indicated that the existing algorithms were vulnerable to side-channel analysis. In this paper, we propose the first side-channel attack on the Hybrid McEliece Scheme (HyMES) using only a single power consumption trace. HyMES is a variant of the McEliece system that provides smaller keys, along with faster encryption and decryption speed. By exploiting joint distributions of nonlinear functions in the decryption process, we were able to recover the private key of HyMES. To the best of our knowledge, this is the first work proposing a side-channel analysis based on a joint distribution of the leakages on the public-key system.

scholarly journals EM-X-DL: Efficient Cross-device Deep Learning Side-channel Attack With Noisy EM Signatures

2022 ◽  
Vol 18 (1) ◽  
pp. 1-17
Author(s):  
Josef Danial ◽  
Debayan Das ◽  
Anupam Golder ◽  
Santosh Ghosh ◽  
Arijit Raychowdhury ◽  
...  
Keyword(s):  
Deep Learning ◽  
Deep Neural Network ◽  
Signal To Noise Ratio ◽  
Side Channel ◽  
Leakage Detection ◽  
High Confidence ◽  
Side Channel Analysis ◽  
Channel Analysis ◽  
Single Trace ◽  
Processing Techniques

This work presents a Cross-device Deep-Learning based Electromagnetic (EM-X-DL) side-channel analysis (SCA) on AES-128, in the presence of a significantly lower signal-to-noise ratio (SNR) compared to previous works. Using a novel algorithm to intelligently select multiple training devices and proper choice of hyperparameters, the proposed 256-class deep neural network (DNN) can be trained efficiently utilizing pre-processing techniques like PCA, LDA, and FFT on measurements from the target encryption engine running on an 8-bit Atmel microcontroller. In this way, EM-X-DL achieves >90% single-trace attack accuracy. Finally, an efficient end-to-end SCA leakage detection and attack framework using EM-X-DL demonstrates high confidence of an attacker with <20 averaged EM traces.

Reduction of the integer factorization complexity upper bound to the complexity of the Diffie–Hellman problem

2021 ◽  
Vol 31 (1) ◽  
pp. 1-4
Author(s):  
Mikhail A. Cherepnev
Keyword(s):  
Upper Bound ◽  
Polynomial Algorithm ◽  
Integer Factorization ◽  
Factorization Problem ◽  
Diffie Hellman ◽  
Integer Factorization Problem

Abstract We construct a probabilistic polynomial algorithm that solves the integer factorization problem using an oracle solving the Diffie–Hellman problem.

Sign in / Sign up

Export Citation Format

Share Document