Algebraic Side-channel Attacks Research Articles

A comprehensive tolerant algebraic side-channel attack over modern ciphers using constraint programming

A comprehensive tolerant algebraic side-channel attack over modern ciphers using constraint programming

Algebraic Side Channel Attack on Trivium and Grain Ciphers

Solving a system of multivariate quadratic equations obtained through algebraic cryptanalysis is a nondeterministic polynomial time-complete problem. Owing to the trend of stream ciphers based on nonlinear update, the success of algebraic attacks has been limited to their reduced variants. On the other hand, side channel attacks (SCAs), although require a continued access to the target device for capturing leakages, are a potent threat against the stream ciphers. Algebraic SCA (ASCA) combines and solves equations obtained through algebraic cryptanalysis and partial SCA of cipher implementation. ASCA is successfully being applied against block ciphers since 2009; however, there is no existing published work on ASCA against stream ciphers as per our knowledge. In this paper, we propose an idea of mounting ASCA on stream ciphers, and we demonstrated it through the application of ASCA on trivium and grain stream ciphers.

Exploiting the Incomplete Diffusion Feature: A Specialized Analytical Side-Channel Attack Against the AES and Its Application to Microcontroller Implementations

Algebraic side-channel attack (ASCA) is a typical technique that relies on a general solver to solve the equations of a cipher and its side-channel leaks. It falls under analytical side-channel attack and can recover the entire key at once. Many ASCAs are proposed against the AES, and they utilize the Grobner basis-based, SAT-based, or optimizer-based solver. The advantage of the general solver approach is its generic feature, which can be easily applied to different cryptographic algorithms. The disadvantage is that it is difficult to take into account the specialized properties of the targeted cryptographic algorithms. The results vary depending on what type of solver is used, and the time complexity is quite high when considering the error-tolerant attack scenarios. Thus, we were motivated to find a new approach that would lessen the influence of the general solver and reduce the time complexity of ASCA. This paper proposes a new analytical side-channel attack on AES by exploiting the incomplete diffusion feature in one AES round. We named our technique incomplete diffusion analytical side-channel analysis (IDASCA). Different from previous ASCAs, IDASCA adopts a specialized approach to recover the secret key of AES instead of the general solver. Extensive attacks are performed against the software implementation of AES on an 8-bit microcontroller. Experimental results show that: 1) IDASCA can exploit the side-channel leaks in all AES rounds using a single power trace; 2) it has less time complexity and more robustness than previous ASCAs, especially when considering the error-tolerant attack scenarios; and 3) it can calculate the reduced key search space of AES for the given amount of side-channel leaks. IDASCA can also interpret the mechanism behind previous ASCAs on AES from a quantitative perspective, such as why ASCA can work under unknown plaintext/ciphertext scenarios and what are the extreme cases in ASCAs.

Research on Hamming Weight-Based Algebraic Side-Channel Attacks on SMS4

We evaluate the resistance of SMS4 against algebraic side-channel attack(ASCA) based on the Hamming weight(HW) model.Firstly,SMS4 is described as a set of equations involving the public and key variables and the power leakages of the encryption are measured.Secondly,the HWs of immediate bytes are deduced through the template analysis and additional equations are generated.Thirdly,the sat-solver is adopted to recover the key.Experiment results show that SMS4 is vulnerable to ASCA.In the known-plaintext scenario,four rounds consecutive HW leakages or twenty-six rounds randomly distributed HW leakages in two traces are enough to recover the 128 bits master key.In the unknown-plaintext scenario,the HW leakages of the first five rounds in two traces are enough to recover the full key.We also show that SMS4 implemented with masking countermeasures is also vulnerable to ASCA.In known-plaintext scenario,the HW leakages of 14 rounds in two traces are enough to recover the full key.To improve the feasibility of the attack,an error tolerant ASCA is proposed.The mater key of SMS4 can be recovered with the leakages of the first 10 rounds in two traces,even when the error rate of HW deductions is 60%.Our work can also be used to attack other block-ciphers.

A comprehensive study of multiple deductions-based algebraic trace driven cache attacks on AES

Existing trace driven cache attacks (TDCAs) can only analyze the cache events in the first two rounds or the last round of AES, which limits the efficiency of the attacks. Recently, Zhao et al. proposed the multiple deductions-based algebraic side-channel attack (MDASCA) to cope with the errors in leakage measurements and to exploit new leakage models. Their preliminary results showed that MDASCA can improve TDCAs and attack the AES implemented with a compact lookup table of 256 bytes. This paper performs a comprehensive study of MDASCA-based TDCAs (MDATDCA) on most of the AES implementations that are widely used. First, the key recovery in TDCA is depicted by an abstract model regardless of the specific attack techniques. Then, the previous work of TDCAs on AES is classified into three types and its limitations are analyzed. How to utilize the cache events with MDATDCA is presented and the overhead is also calculated. To evaluate MDATDCA on AES, this paper constructs a mathematical model to estimate the maximal number of leakage rounds that can be utilized and the minimal number of cache traces required for a successful MDATDCA. Extensive experiments are conducted under different implementations, attack scenarios and key lengths of AES. The experimental results are consistent with the theoretical analysis. Many improvements are achieved. For the first time, we show that TDCAs on AES-192 and AES-256 become possible with the MDATDCA technique. Our work attests that combining TDCAs with algebraic techniques is a very efficient way to improve cache attacks.

Improved algebraic side-channel attack on AES

In this paper, we present improvements of the algebraic side-channel analysis of the Advanced Encryption Standard (AES) proposed in the works of M. Renauld and F.-X. Standaert. In particular, we optimize the algebraic representation of both the AES block cipher and obtained side-channel information, in the form of Hamming weights of intermediate states, in order to speed up the attack and increase its success rate. We study the performance of our improved attack in both known and unknown plaintext/ciphertext attack scenarios. Our experiments indicate that in both cases the amount of required side-channel information is less than the one required in the attacks introduced earlier. Furthermore, we introduce a method for handling erroneous side-channel information, which allows our improved algebraic side-channel attack (IASCA) to partially escape the assumption of an error-free environment and thus become applicable in practice. We demonstrate the practical use of our IASCA by inserting predictions from a single-trace template attack.

Analysis of the algebraic side channel attack

At CHES 2009, Renauld, Standaert and Veyrat-Charvillon introduced a new kind of attack called algebraic side-channel attacks (ASCA). They showed that side-channel information leads to effective algebraic attacks. These results are mostly experiments since strongly based on the use of a SAT solver. This article presents a theoretical study to explain and to characterize the algebraic phase of these attacks. We study more general algebraic attacks based on Gröbner methods. We show that the complexity of the Gröbner basis computations in these attacks depends on a new notion of algebraic immunity defined in this paper, and on the distribution of the leakage information of the cryptosystem. We also study two examples of common leakage models: the Hamming weight and the Hamming distance models. For instance, the study in the case of the Hamming weight model gives that the probability of obtaining at least 64 (resp. 130) linear relations is about 50% for the substitution layer of PRESENT (resp. AES). Moreover if the S-boxes are replaced by functions maximizing the new algebraic immunity criterion then the algebraic attacks (Gröbner and SAT) are intractable. From this theoretical study, we also deduce an invariant which can be easily computed from a given S-box and provides a sufficient condition of weakness under an ASCA. This new invariant does not require any sophisticated algebraic techniques to be defined and computed. Thus, for cryptographic engineers without an advanced knowledge in algebra (e.g. Gröbner basis techniques), this invariant may represent an interesting tool for rejecting weak S-boxes.