On the Simplicity of Converting · 8/21/2013 · Amir Moradi, Oliver Mischke Embedded Security...

On the Simplicity of Converting Leakages from Multivariate to Univariate

21. Aug. 2013

Amir Moradi, Oliver MischkeEmbedded Security Group + Hardware Security GroupRuhr University Bochum, Germany

Embedded Security Group

Outline Definitions, Masking, etc. Target masking scheme The story behind our findings Practical issues

CHES 2013 | Santa Barbara | 21. Aug 2013 Amir Moradi

Masking Well‐known SCA countermeasure

Masking Well‐known SCA countermeasure to make the SC leakages independent of expected intermediate values

Masking Well‐known SCA countermeasure to make the SC leakages independent of expected intermediate values Randomness is required

Masking Well‐known SCA countermeasure to make the SC leakages independent of expected intermediate values Randomness is required Let’s consider the most common one, Boolean Masking

kp S(p⊕k)

kp S(p⊕k) masked

S(p⊕k)⊕m'm m'→

Univariate vs. Multivariate Attacks

kp S(p⊕k) masked

DPA/CPA/MIA

kp S(p⊕k) masked

DPA/CPA/MIA bivariate MIA

combining: DPA/CPA

kp S(p⊕k) masked

combining: DPA/CPA

multiply: 2nd order bivariate

kp S(p⊕k) masked

combining: DPA/CPA

multiply: 2nd order bivariatesquaring: 2nd order univariate

kp S(p⊕k) masked

combining: DPA/CPA

multiply: 2nd order bivariate

addition: 1st order bivariate

squaring: 2nd order univariate

Masking in Hardware

maskedSbox

i⊕m S(i)⊕m'

Masking in Hardware Pre‐computing the masked tables in software

maskedSbox

i⊕m S(i)⊕m'

– Sequential operations, Time consuming, Low efficiency

maskedSbox

i⊕m S(i)⊕m'

– Sequential operations, Time consuming, Low efficiency High efficiency is desired in HARDWARE

– amongst the main reasons

maskedSbox

i⊕m S(i)⊕m'

– amongst the main reasons ad‐hoc/heuristic schemes

maskedSbox

i⊕m S(i)⊕m'

– amongst the main reasons ad‐hoc/heuristic schemes Processing the mask (m) and masked data (i⊕m) simultaneously

maskedSbox

i⊕m S(i)⊕m'

– joint distribution of SC leakages mainly because of GLITCHES– possible attacks

maskedSbox

i⊕m S(i)⊕m'

Systematic schemes

maskedSbox

i⊕m S(i)⊕m'

Systematic schemes– Threshold Implementation, Security against 1st order attacks

maskedSbox

i⊕m S(i)⊕m'

Systematic schemes– Threshold Implementation, Security against 1st order attacks

Desired: security against univariate attacks of any order

maskedSbox

i⊕m S(i)⊕m'

Target Scheme Prouff, Roche: Higher‐Order Glitches Free Implementation of the AES

Using Secure Multi‐party Computation Protocols. CHES 2011.

Using Secure Multi‐party Computation Protocols. CHES 2011. Multi‐party computation + Shamir’s secret sharing

Using Secure Multi‐party Computation Protocols. CHES 2011. Multi‐party computation + Shamir’s secret sharing Basic GF(28) operations, e.g., addition is easy

– Multiplication needs more effort

– Multiplication needs more effort An Sbox computation

Our goal– Hardware implementation using minimum settings– Using a Virtex‐5 FPGA (SASEBO‐GII)

Target Scheme ‐ Design

Target Scheme ‐ Performance

Target Scheme ‐ Performance 66 clock cycles for Inversion, 66 clock cycles for Affine

– One Sbox in 132 clock cycles

– One Sbox in 132 clock cycles One full SubBytes in 132 × 16 = 2112 clock cycles

– One Sbox in 132 clock cycles One full SubBytes in 132 × 16 = 2112 clock cycles One full MixColumns + AddRoundKey in 12 × 16 = 192 clock cycles

Hard to convince the industry sector?

Hard to convince the industry sector? getting close to software?

Hard to convince the industry sector? getting close to software? Gaining univariate resistance at what price?

Target Scheme ‐ Evaluation

Target Scheme ‐ Evaluation A variant by processing all three shares at the same time

Target Scheme ‐ Evaluation

Target Scheme ‐ Evaluation Original Design, 3MHz

Measurement Setup

Standard Setup

Measurement Setup

Standard SetupAmplified Setup

Target Scheme – Evaluation (Standard Setup) Original Design, 3MHz

Standard vs. Amplified Setup Exemplary Design

SAKURA‐G

Efficiency as a Factor

Efficiency as a Factor Original Design, Standard Setup, 24MHz

Summing Up / Future Issues

Summing Up / Future Issues Cost of univariate resistance

– security‐performance tradeoff– processing the shares consecutively

a light at the end of the tunnel by [pure] masking in hardware?

a light at the end of the tunnel by [pure] masking in hardware?– slowly reaching the software performance?

• making a processor by giant hardware?

• making a processor by giant hardware?– relatively easy ways to combine the leakages

• measurement setup & high clock freq.

What to do when evaluating a countermeasure / product?

What to do when evaluating a countermeasure / product?– without any addition/modification on measurement setup?

• not fair, the attacker may do it

What to do when evaluating a countermeasure / product?– without any addition/modification on measurement setup?

• not fair, the attacker may do it

– with any sophisticated measurement setup?• not fair, its security relies on a univariate leak‐free scheme

Thanks!Any questions?

Embedded Security Group, Ruhr University Bochum, Germany

amir.moradi@rub.de

On the Simplicity of Converting · 8/21/2013 · Amir Moradi, Oliver Mischke Embedded Security...

Documents

Transcript of On the Simplicity of Converting · 8/21/2013 · Amir Moradi, Oliver Mischke Embedded Security...

Introduction to Embedded Security

Grand Embedded Security US04

Security in Embedded systems

Healthy Habits for the Quilter Mary Mischke, PT, DPT, OCS Jake Mischke, PT, DPT, OCS, FAAOMPT.

Embedded Systems Security

EMBEDDED SECURITY DIGEST - Maxim Integrated€¦ · Embedded Security Digest 4 WANT TO AVOID COUNTERFEITING? …

Security Issues for Embedded Devices

Ute Mischke, Judith Mahnkopf, Andreas Gericke und Markus Venohrfis.freshwatertools.eu/files/MARS_casestudies/CS_Central... · 2017. 10. 13. · Basin Report Middle Elbe, Mischke et

Embedded Web Server â€” Security

Java Embedded Network Intrusion Security

Kaspersky Embedded Systems Security · 2019-11-14 · Kaspersky Embedded Systems Security All-in-one security designed for embedded systems The embedded systems market is growing

Embedded Web Server — Security - Lexmarkpublications.lexmark.com/.../EWS_HSP_Security_AdminGuide_Lexmar… · Embedded Web Server — Security Administrator's Guide September 2014

IDnomic Embedded Security - Atos

Low Power Embedded Security: Thumbpod embedded biometrics project

Embedded Security Integration Systemimg.tradekey.com/images/uploadedimages/brochures/2/2/...Embedded Security Integration System Integrated Security Network Security Recorder Brief

Kaspersky Embedded Systems Security

Robert Mischke German Aerospace Center (DLR) EclipseCon … · 2017-12-06 · Eclipse RCP, external Plugins, Libraries, … > Robert Mischke > EclipseCon Europe 2012 > 10/24/2012

Strengthening Security In Embedded Solutions WhitePaperStrengthening Security in Embedded IoT Solutions PAGE 2 The Threat to Embedded Systems In the Internet of Things (IoT), security

Embedded Security System - Case Study

Security for Embedded Systems - phytec.in