Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

katagaitai CTF workshop #10 AESに対する相関電力解析

1,507 views

Published on

2018年2月24日および3/18に開催したkatagaitai CTF勉強会の資料です。RHme3のTracing the Traces問題とBkP CTF2014のDifferential Powerを扱っています。DESに対する差分電力解析 (DPA) およびAESに対する相関電力解析 (CPA) を説明します。

Published in: Technology
  • Be the first to comment

katagaitai CTF workshop #10 AESに対する相関電力解析

  1. 1. katagaitai workshop #10 Crypto by trmr
  2. 2. • T • C F • 22 3 • T 3 • F 3 C
  3. 3. • 9C9 9 C9 Nx eN • # F # E MN oP • # E k tgRhL78 • # ( sE 7240 • # ( E 865l Sx Nn • # ( E 1 C l Sx Nn • # ) sE ( gN I3 C 0 C C A • # ) sE ) x P • # ) E Sx • # sE x P • # sE x P • # E # ia • # E x P
  4. 4. • ( C t dg : o V • R( C S( T Fnp ws • ( E • • : • 5 ) • t bcfi • ( • r • : : : 5 A : • ce k • R M ce kH E • chla uyHmIE
  5. 5. • i M • e Wt t • e W t • e W rh a c y H • rh B y H • d W ku • H 6 ( 2 ( w • e W S tx o 2 l a c ) 2 2 HG
  6. 6. & • 50772842 • F H c • a • ::01 eF DC • 2 2892 e EDA DC • T S •
  7. 7. • xt ro xt xt b e k • xt ro xt 8c l :e • ro xt 8c l :e • ro a g c b e k xt (+ xt xt . xt a y )/(
  8. 8. • w : c n • - R Iue j A cS9 • j w l a M 9 n • - F t i M 9 I C t n • n w • 9 9T A d S9 • kdn w • okd I C cS9
  9. 9. • eoimGf w u c c Ta • v wW u sSa • w r u pO • w hjod gGf 0 B Pa W • w hjod • klntgGf O • Qb_ q a BB E E/ 1 B /:. . : ./. : /:. 1B / 1 A B 1 B/ B
  10. 10. • • ba • 1 • 1 •
  11. 11. • /03 /4D4 0 6 AD 3D4 4 • fed • 18 D8 bc ed • Kb • ( 5 D S f • 23. 28 36 8 E : . : D a DDA - 6 6 D : F 6 6 8 4 AE5 64D 9 A ( 4 6 F8 ) 6E 8 D 9 A ( A 9
  12. 12. ( ( ) ) • +1 1 54 2 (528 4 6 + ( • 4 m K h 4 S m • + ( A m 4 • ) 1 6 1 ) 84 1 g c • 4 4 i • ei D C 4 c • 4 ) d • ) g c • ) • ei D C 4 l c • b 4 S P m+
  13. 13. ( • 2 • E(86 24 2 • ) 1 K • 25 8 • E 3 86 24 2 • 2 8 • E 86 24 2
  14. 14. • • F1 • F A • A 1 6
  15. 15. ! • U R : 8 • • E 4 4 8 • E 4 7K 4 8 • 4 8 1 T56 OP U
  16. 16. • 586 • • K F 1
  17. 17. • )- 0 10 ) 82 -8 0 0 • ()-AN • - S E • PA D SR )- A 9 0
  18. 18. ) ( ( ) • + ( w (03 • 62 (03 A S • E Rw (03 w • - 62) W od c • 80 62) 0 :nt c • -1 ) u • Rb w i od c • + ( RK c • • Rw w r
  19. 19. ( • : • 8 : AC M B • ) M A RKb - • : B X • 2 1: S R • ( AS
  20. 20. • p pE CH rlf Ksa e • S ) : 9 9 2 Brl E p • 4 : 2 9 2 0 4 i m D f p • 4332 2 40 9 2 0 4 i A ns p • S ) ( 42 B)9 2 0 49 9 2 0 4 ) • )9 2 0 49 9 2 0 4 ) P okH i c A ns p
  21. 21. • 2C D 4 • I C • F I C • , A I C PD 4
  22. 22. • C 9 BH9D A5 IE E ) su hdpm tb nf j • . hdpm tbP Se K i • c 2 • c a nf • nf wg rtP S ol 5 2B 9D" 1BE 5 15::9" 5A 9A 5 A 1 A ::9D9A 5 CBH9D 5A5 IE E J AA 5 A 9DA5 BA5 ,DIC B B I ,BA:9D9A 9 CD A 9D" 9D A" 9 9 69D " ((( 2 c a nf
  23. 23. • 2 6 • + 6 • 6 2 2 2 2 6
  24. 24. • - ( 2 -( e i a e BA i • P B a • D7 a P B a P B D7 a D f a f a
  25. 25. • E ? • 3 b i 2 e • 1 0 e : - 1 D D ?D K68 • 1 0 D = S • 1 0 D K i E - 1 - 1 - 1 1 0 1 0 1 0
  26. 26. • b W 2 1 • b - W • i i W 0 2 • W 0 9 b b W b W W W b - W 9 9 9 9 9
  27. 27. 3 • E b= : • 1 0 S • S K - 3 2D 2D= 2D 6 • 2DK S e • 2D e S K E - - - ( )
  28. 28. • ( : C • () S S C C • A P AE3B 1 • S 1C • DBA 6 (
  29. 29. ! • OS E6USD E3 • = E6= 4 2 • PT 3 PT • R ) ( D 162 A OS E
  30. 30. • 1 : • 5 S • t p5 • 4 5 • S 6 2 2 • 2 • 6 i 8 6 840 6 • S e 8 b 0 S 7 3 • S 7 p
  31. 31. • 0 4 • P6 1 UO • S P b R D 3E T P )(
  32. 32. • - e • p1 0 Sb 31 0 • p1 Sb 31 0 i i W W 1 W 1 W 1 05 W W W W 6 p1 0 i i W W W W 1 05 W W W W 6 p1 0
  33. 33. • ( (122 10 1 2 0 63 3 oit w : • ) aD • s ) ( • e 12 n Pb • b • t lr P C A P • lr t • t • y P b t oii P
  34. 34. • ρ",$ X : • Y: • X , 73 • • %&' (, ) = + ( − -( ) − -) • -( ( Y • + ( ( Y • . ( = +[ ( − -( 0] • ρ",$ 1 1- • ρ",$ = 234 ",$ 5 " 5 $ = 6 "78" $78$ 6[ "78" 9]6[ $78$ 9]
  35. 35. • 2 1-0 B • b so = e • 1- e 2 1-0 B K EA S • 1- :B e p B • 1- K B e 3 K 8 1- 1- 1- K
  36. 36. • ρ",$ - Y : • , 30 • 19 , 30 : 30 X : 30 30
  37. 37. • SD D 4B • P E E D B B • b 1 D 0:CA e
  38. 38. • d b [ 7 6 5 x • 6 3 d i 16 p • 6 3 d 16 p • 6 3 16 r 7 6 5 • 7 6 5 28 16 - • 6 3 7 6 5 : ] • 6 3 x s u • 6 3 s uB ]S W 16 Bt e: 6 3 : 16 p • 6 3 6 3 : i 24 y : 16 16 i 6 3 o
  39. 39. • 1 • - K [o : e B 4- 6 2 S • 4- 6 2 S 05 e - • u • 1 • s - ] : 8 S K] p b 8 u B i 8 • s - t 8 S Kt pb 8 u B i 8 e - ( 8 3 ( ) 8
  40. 40. • P ( 4 ) A • P ) • 4C 4 )
  41. 41. • ) ( ))( ( ( • D • !"#(%&) = ∑&*+ ,-. /0 %& + 2 − /.(2) • S m o fb m fb/. i 4., … , 40 n fb/0 5 c!"#(%&)を取得 o SAD(%&)4 %& AD 5 D e
  42. 42. • S () 4: • ρ",$ = ∑'() * +',,-+, .',/-./ ∑'() * +',,-+, 0 ∑'() * .',/-./ 0 • 1 6 () • 2 B • 3 B • ℎ : 4: • 5 B
  43. 43. b 1 E 1 2 27 ℎ",$ − ℎ$ d B A 7 &",' − (&' b 1 E 1 ) 8 0 ℎ",$ S 84 ℎ",$ − ℎ$ を取得 d B A *7 &",' − (&' S e ), *7 S ρ$,' = ∑"./ 0 ℎ",$ − ℎ$ &",' − (&' ∑"./ 0 ℎ",$ − ℎ$ 1 ∑"./ 0 &",' − (&' 1 e ), *7 2$,'
  44. 44. • R il C • . • ) ( ) / • c ) ( ) / • . / 9 . / 9 / / ?4. 9 4 . 4 . A 9 4. . . 49 . 4 .9 4 4 9 / .9 9 /4 9 9 9 . A 9 4. 9 49 A9 A • n • T mk e a fd EhD • o g MC
  45. 45. ( ) • be ogit A7 A7 @7 S d r ogit d y c 1E 7 : 49 7 #$# 3E> 0 < $ ,$ , $ 125 -7 :E F 7@> 7 :E F. 49 7 O hpsk l u Te Od • 49 7 iumn t v 7 > F 7@@ C9 7 • 49 7 A7 @7 • C Oa O C9 7 C9 7 , .@C7: E79 F#A7 C9 7 , .F7 A7 E79 F# #A7 $
  46. 46. )( • ). 5 • : 5 : S • • ( M • 5 :. " : : 5 5 " : : " 5 . :" "5 1 : 5 : " ":2 =
  47. 47. ( ) !" #", … , #& !& 5 2 '()(+,)を取得 SAD(+,) +, def synchronize(trace, reference, window, max_offset): reference_window = reference[window[0]:window[1]] sad = [0] *(max_offset * 2 + 1) for x in range(0, max_offset * 2 + 1): trace_slice = trace[window[0]-max_offset + x:window[1]-max_offset + x] sad[x] = np.sum(np.abs(reference_window - trace_slice)) sad_idx = np.argmin(sad) offset = -max_offset + sad_idx synchronized_trace = trace if offset < 0: synchronized_trace = np.concatenate(([0] * abs(offset), synchronized_trace[:-abs(offset)])) elif offset > 0: synchronized_trace = np.concatenate((synchronized_trace[abs(offset):], [0]*abs(offset))) return synchronized_trace
  48. 48. ( )
  49. 49. ( 4 4 ! 4 ℎ#,% ℎ#,% − ℎ% を取得 B ' S 4 (#,) − *() b + ∑#-. / ℎ#,% − ℎ% (#,) − *() ∑#-. / ℎ#,% − ℎ% 0 ∑#-. / (#,) − *() 0 ρ%,) = ∑#-. / ℎ#,% − ℎ% (#,) − *() ∑#-. / ℎ#,% − ℎ% 0 ∑#-. / (#,) − *() 0 d 5 ρ%,) ! for k_idx in range(16): # determine key index cpaoutput = [0] *256 # follow valiables may not be need maxcpa = [0] *256 for kguess in range(256): # determine word key candidate sumnum = np.zeros(NUM_POINTS) sumden1 = np.zeros(NUM_POINTS) sumden2 = np.zeros(NUM_POINTS) hyp = np.zeros(NUM_TRACES) for t_idx in range(NUM_TRACES): # hypothesis hamming weight hyp[t_idx] = humming[addkey_subbytes(pt_list[t_idx][k_idx], kguess)] h_mean = np.mean(hyp, dtype=np.float64) t_mean = np.mean(sync_traces, axis = 0, dtype = np.float64) for t_idx in range(NUM_TRACES): hdiff = (hyp[t_idx] - h_mean) tdiff = sync_traces[t_idx] - t_mean sumnum = sumnum + (hdiff * tdiff) sumden1 = sumden1 + hdiff * hdiff sumden2 = sumden2 + tdiff * tdiff cpaoutput[kguess] = sumnum / np.sqrt(sumden1 * sumden2) maxcpa[kguess] = max(abs(cpaoutput[kguess])) bestguess[k_idx] = np.argmax(maxcpa) print "best guess key [{0}] is {1:02x}".format(k_idx, bestguess[k_idx])
  50. 50. 12 52 8 1 $ python CPA.py best guess key [1] is fe best guess key [2] is ba best guess key [3] is be best guess key [4] is de best guess key [5] is ad best guess key [6] is be best guess key [7] is ef best guess key [8] is 00 best guess key [9] is 01 best guess key [10] is 02 best guess key [11] is 03 best guess key [12] is 04 best guess key [13] is 05 best guess key [14] is 06 best guess key [15] is 07 Best key guess: CAFEBABEDEADBEEF0001020304050607
  51. 51. • , : : • tlu w c • a W g bd M Lro • Ud chn • m ( a W x • . / 6 / / : : : 5 • , ( ) / • ei , • Ud c CR p • ) / s
  52. 52. • 0 20 3 • 0 20 5 • W L • 0 20 5 F5C W • $ T • + 7 = $
  53. 53. ) ( ( • . c • • . .5 N S W f .8 _ • = aei lC • hg .8 f #Save as ChipWhisperer project tc = TraceContainerNative() for i in range(0, ntraces): tc.addWave(traces['samples'][i]) tc.addTextin(inp[i]) tc.addTextout(out[i]) tc.addKey([0]*16) os.mkdir('rhme3') tc.saveAllTraces('rhme3') tc.config.setConfigFilename('rhme3/rhme.cfg') tc.config.saveTrace()
  54. 54. ) ( ( • . • .5 • . 5 9 • C
  55. 55. ) ( • - - c • • 0 P e 6 a d • a d • • P P T 1 R
  56. 56. )( • 1 -1 6 : R 1 6: a • :1 - 6 :1 • 1 6: R W a • :1 6: eG • d D M E I • : 6: A S b fc • : 0 PM #
  57. 57. )(
  58. 58. ) ( • A • 1 • R • 3 T 6
  59. 59. • • ( ) • E • H C 4 6 I C F • E F S T 4 C • F 6
  60. 60. 0
  61. 61. • f • 0 8850/ 9 98 0: 60 0: 8 4 0 .: 9 48 8 0 /8 5 8 0 50 0 8 5 8 8 . 0 .: 9 :4 2 81 ) . : . 0: 8 0 0: 4.0 9 ) ( ( :4 2 0 .: 9 • e • ip y ʼ va wrk ou 4 h dn • ʼ va 6 m • s g • xc • b h ʼ tva wrk ou 4 h m ((
  62. 62. ) ( • 2 8 7 61 : 1 • 28 2 8 7 2 7.1 • 7 EA • 2 8 7 61 add $t1, $zero, $zero# clear out $t1 ; 00004820 addi $t1, $t1, 0x9e# TEA magic is 0x9e3779b7 ; 2129009E sll $t1, $t1, 8# shift out making room in the bottom 4; 00094a00 addi $t1, $t1, 0x37 ; 21290037
  63. 63. ) ( • 8 • : • • 8 6 : {'j1istE9p': [0, … , 0], 'EXdxTejF': [0, … , 0], … }
  64. 64. () • + 1( • s0 0 • 0 0 3 9^ e i • m 3 ) 3 41 0 • s 3 k • + 1( • s0 + • )b 3 3 • + t 9 = 6b m 3 • m 3 ) 3 41 0 • 0 a • s 0 k • d: s k9e lw $t8, $zero, 8# k0 mem[8-23] = k ; 8c180008 lw $s7, $zero, 12# k1 ; 8C17000C lw $s6, $zero, 16# k2 ; 8C160010 lw $t3, $zero, 20# k3 now our keys are in registers ; 8c0b0014 sll $s4, $t6, 4# (v1 << 4) ; 000ea100 add $s4, $s4, $t8# +k0 part 1 is in s4 ; 0298a020
  65. 65. ) ( • S Z vtoe yr lfPh • s M u Pb i F zgTC jw • / 0 0 /3 c S • R C Makp • 3 : 3 . / 0 • m Makp • 3 : /7 . 0/ / : 7 :
  66. 66. ( • 5 07 211070 92. 65 07 6 G • • CU P • 570 2 • H • B
  67. 67. • # # / 4 4 M • 4 0 @ 120 1 1 T • 5 • 120 1 1 7 S @ #
  68. 68. • 2 8: .3 . /40 7 1 : 3880 : 750 3 1 0 • o kG h • 08 S • o S n • 08 o c b • o c b g a • • o Z • i 2 me
  69. 69. • S • 3 + 7+4 • +4+ 7+4 • 44+ 7+4 • P DCA • 3 3+4+4 W DCA • W DCA • DCA
  70. 70. 9 SK 6 B DP 5 S 5 EED MC .DMI HM 5SM 0HEEDPDMRH K O UDP M K H MMS K 4MRDPM RH M K /P OR K F / MEDPDMBD OPHMFDP .DPKHM 3DHCDKADPF 1PHB .PHDP / PH R O D /K THDP MC 2P MBH KHTHDP / PPDK RH M O UDP M K H UHR KD J FD CDK 4MRDPM RH M K PJ O M /P OR FP O HB 3 PCU PD MC 1 ADCCDC RD OPHMFDP .DPKHM 3DHCDKADPF mk hai j f_c n 0H ku l bg d e vsw n t t , RRO ,""UUU HO F IO" DBSPHR "DMB" PRB PC"M CD R K 1. o r , RRO,"" R B SDB B IO" 6 : "OCE" 1. 9 :DO PR 5 O MD D OCE / HO H ODPDP UHJH, RRO ,""UHJH MDU D B "/ PPDK RH M 9 UDP M K H ypzku77 , RRO ,""UHJH BKSA SDB B IO"/ 2" KJHR"W O

×