Ridge-based Profiled Differential Power Analysis

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID:SESSION ID:
#RSAC
Yu Yu
Ridge-based Profiled Differential Power
Analysis
CRYP-F01
Research Professor
Shanghai J...

#RSAC
Outline
2
Introduction
(Profiled) Differential power analysis
Profiling phase
Exploitation phase
Our contributions
R...

#RSAC
Outline
3
Introduction
(Profiled) Differential power analysis
Profiling phase
Exploitation phase
Our contributions
R...

#RSAC
(profiled) Difference power analysis
4
Two phases:
profiling
Exploitation
Leakage of :
L(·) is leakage function
Powe...

#RSAC
Outline
5
Introduction
(Profiled) Differential power analysis
Profiling phase
Exploitation phase
Our contributions
R...

#RSAC
Classical profiling
6
The leakage follows Gaussian distribution:
For each intermediate variable z: The adversary fin...

#RSAC
LR-based profiling
7

#RSAC
LR-based profiling
8

#RSAC
Pro and con of LR-based profiling
9

#RSAC
Outline
10
Introduction
(Profiled) Differential power analysis
Profiling phase
Exploitation phase
Our contributions
...

#RSAC
Exploitation phases
11

#RSAC
Outline
12
Introduction
(Profiled) Differential power analysis
Profiling phase
Exploitation phase
Our contributions
...

#RSAC
Our contributions
13
(to mitigate the overfitting issue) New profiling method based on
ridge-regression
An optimized...

#RSAC
Outline
14
Introduction
(Profiled) Differential power analysis
Profiling phase
Exploitation phase
Our contributions
...

#RSAC
Construction of ridge-based profiling
15

#RSAC
Parameter optimization
16

#RSAC
Optimized parameter is related to the noise level
17
simulation-based experiment
trace number = 2000

#RSAC
Outline
18
Introduction
(Profiled) Differential power analysis
Profiling phase
Exploitation phase
Our contributions
...

#RSAC
Variance of the coefficients
19

#RSAC
Variance of the coefficients
20
Figure: The variances of the coefficients for degrees (of the model) and λ. The
left...

#RSAC
Variance of the coefficients
21
Figure: The variances of the coefficients for degrees (of the model) and λ. The
left...

#RSAC
Outline
22
Introduction
(Profiled) Differential power analysis
Profiling phase
Exploitation phase
Our contributions
...

#RSAC
How the coefficients shrink in the ridge-based
profiling?
23

#RSAC
Outline
24
Introduction
(Profiled) Differential power analysis
Profiling phase
Exploitation phase
Our contributions
...

#RSAC
Setup
25
Profiling methods:
ridge-based profiling
LR-based profiling
classical profiling
Target intermediate variabl...

#RSAC
A comparison of different profilings for leakage
degree 8
26

#RSAC
A comparison of different profilings for leakage
degree 4
27

#RSAC
A comparison of different profilings for leakage
degree 1
28

#RSAC
A comparison of different profilings for with
‘conservatively’ degree of model
29
The adversary may have no knowledg...

#RSAC
Degrees of leakage function and model are 1 and
4 respectively
30

#RSAC
Degrees of leakage function and model are 2 and
4 respectively
31

#RSAC
Outline
32
Introduction
(Profiled) Differential power analysis
Profiling phase
Exploitation phase
Our contributions
...

#RSAC
Practical experiments
33
test board:
SAKURA-X
oscilloscope:
LeCroy
waverunner
610Zi

#RSAC
First setting
34

#RSAC
Second setting (robust profiling)
35

#RSAC
Summary
36
Ridge-based profiling can save significant factors in the number of traces
they need to build a satisfyin...

#RSAC
37
THANK YOU
Question?

SESSION ID:SESSION ID:
#RSAC
Si Gao
My Traces Learn What You Did in the
Dark: Recovering Secret Signals without
Key Guesse...

#RSAC
Outline
Applications in SCA
ICA-based signal recovery
Preliminaries
Introduction
Summary

#RSAC
Outline
Applications in SCA
ICA-based signal recovery
Preliminaries
Introduction
Summary

#RSAC
Introduction
Side Channel Analysis (SCA)
Exploit the computation leakages
— Leakages depend on the intermediate state

#RSAC
Introduction
Traditional SCA flow (Non-profiled)
Guess-and-determine
— Step 1: take a key guess
Eve
Encryption Algor...

#RSAC
Introduction
Traditional SCA flow (Non-profiled)
Guess-and-determine
— Step 2: Compute the intermediate states from ...

#RSAC
Introduction
Traditional SCA flow (Non-profiled)
Guess-and-determine
— Step 3: Compute the expected leakages of the ...

#RSAC
Introduction
Traditional SCA flow (Non-profiled)
Guess-and-determine
— Step 4: Finding out the most likely key guess...

#RSAC
Introduction
Traditional SCA flow (Non-profiled)
Question: did Eve actually recover the intermediate states x?
— Onl...

#RSAC
Introduction
Traditional SCA flow (Non-profiled)
Cons
— The key guess space should be small
— Known plaintext/cipher...

#RSAC
Introduction
Traditional SCA flow (Non-profiled)
Limitations: only works for the first/last few rounds
— The related...

#RSAC
Introduction
Traditional SCA flow (Non-profiled)
Limitations: Side Channel Analysis for Reverse Engineering
— Cannot...

#RSAC
Introduction
A New Model (Non-profiled)
Directly exploit the leakages, without the pre-determined list
A much harder...

#RSAC
Introduction
Notes on profiled attacks
Much stronger pre-conditions
— The Attacker gets an identical encryption devi...

#RSAC
Outline
Applications in SCA
ICA-based signal recovery
Preliminaries
Introduction
Summary

#RSAC
Preliminaries
Blind Source Separation (BSS)
n people were talking simultaneously
m microphones placed in different p...

#RSAC
Preliminaries
Blind Source Separation (BSS)
unknown sources：n conversations
unknown mix matrix：the mix features of m...

#RSAC
Preliminaries
Independent Component Analysis (ICA)
Blind sources S=(s1,s2,…,sn)
Linear mix matrix A
m observations Y...

#RSAC
Preliminaries
Independent Component Analysis (ICA)
ICA assumptions
— Independence: the sources are independent of ea...

#RSAC
Outline
Applications in SCA
ICA-based signal recovery
Preliminaries
Introduction
Summary

#RSAC
ICA-based signal recovery
ICA versus SCA: Similarities
n bits intermediate state X
Assume the leakage s.t. the weigh...

#RSAC
ICA-based signal recovery
ICA versus SCA: Differences
Number of observations: m v.s. 1
Level of Noise: low v.s. high...

#RSAC
ICA-based signal recovery
Constructing multi-channel observations
XOR constant
— If a binary source s is XORed with ...

#RSAC
ICA-based signal recovery
Constructing multi-channel observations
XOR constant
Whitening Transformation
 0,1s
 ...

#RSAC
ICA-based signal recovery
Noise tolerance
Noise affects the performance of ICA
— ICA usually works in cases where SN...

#RSAC
ICA-based signal recovery
Specialized ICA for SCA
A specialized ICA based on EM-ICA

#RSAC
Outline
Applications in SCA
ICA-based signal recovery
Preliminaries
Introduction
Summary

#RSAC
Applications in SCA
Experimental Setting
Target Implementation
— Unprotected software implementation of DES
— 8 bit ...

#RSAC
Applications in SCA
New SCA distinguisher
Attack one of the Sbox in the first round
— Recover the intermediate state...

#RSAC
Applications in SCA
New SCA distinguisher
Attack one of the Sbox in the first round
— Key rank: CPA (HW) v.s. ICA

#RSAC
Applications in SCA
Extending SCA to the Middle Rounds
Recovering the 8 Sboxes’ outputs in the second round
— 4-bit ...

#RSAC
Applications in SCA
Extending SCA to the Middle Rounds
Recovering the 8 Sboxes’ outputs in the second round
— 80% su...

#RSAC
Applications in SCA
Reverse Engineering on Sbox
A customized DES with secret Sboxes
— Attacker controls the plaintex...

#RSAC
Applications in SCA
Reverse Engineering on Sbox
A customized DES with secret Sboxes
— Leakage point selection:
 Man...

#RSAC
Applications in SCA
Reverse Engineering on Sbox
A customized DES with secret Sboxes

#RSAC
Applications in SCA
Reverse Engineering on Feistel Round Function
A customized Feistel cipher (both S and P are alte...

#RSAC
Applications in SCA
Reverse Engineering on Feistel Round Function
A customized Feistel cipher (both S and P are alte...

#RSAC
Applications in SCA
Reverse Engineering on Feistel Round Function
A customized Feistel cipher (both S and P are alte...

#RSAC
Outline
Applications in SCA
ICA-based signal recovery
Preliminaries
Introduction
Summary

#RSAC
Summary
SCA ≠ guess-and-determine
Directly recover the secret intermediate states without any key guess
— Proposed a...

#RSAC
Thanks for your attention!

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 78 Ad

View on Slideshare

1 of 78 Ad