First-order Leakage Research Articles

Information Theoretic Evaluation of Raccoon's Side-Channel Leakage

Raccoon is a lattice-based scheme submitted to the NIST 2022 call for additional post-quantum signatures. One of its main selling points is that its design is intrinsically easy to mask against side-channel attacks. So far, Raccoon's physical security guarantees were only stated in the abstract probing model. In this paper, we discuss how these probing security results translate into guarantees in more realistic leakage models. We also highlight that this translation differs from what is usually observed (e.g., in symmetric cryptography), due to the algebraic structure of Raccoon's operations. For this purpose, we perform an in-depth information theoretic evaluation of Raccoon's most innovative part, namely the AddRepNoise function which allows generating its arithmetic shares on-the-fly. Our results are twofold. First, we show that the resulting shares do not enforce a statistical security order (i.e., the need for the side-channel adversary to estimate higher-order moments of the leakage distribution), as usually expected when masking. Second, we observe that the first-order leakage on the (large) random coefficients manipulated by Raccoon cannot be efficiently turned into leakage on the (smaller) coefficients of its long-term secret. Concretely, our information theoretic evaluations for relevant leakage functions also suggest that Raccoon's masked implementations can ensure high security with less shares than suggested by a conservative analysis in the probing model.

A secure and highly efficient first-order masking scheme for AES linear operations

Due to its provable security and remarkable device-independence, masking has been widely accepted as a noteworthy algorithmic-level countermeasure against side-channel attacks. However, relatively high cost of masking severely limits its applicability. Considering the high tackling complexity of non-linear operations, most masked AES implementations focus on the security and cost reduction of masked S-boxes. In this paper, we focus on linear operations, which seems to be underestimated, on the contrary. Specifically, we discover some security flaws and redundant processes in popular first-order masked AES linear operations, and pinpoint the underlying root causes. Then we propose a provably secure and highly efficient masking scheme for AES linear operations. In order to show its practical implications, we replace the linear operations of state-of-the-art first-order AES masking schemes with our proposal, while keeping their original non-linear operations unchanged. We implement four newly combined masking schemes on an Intel Core i7-4790 CPU, and the results show they are roughly 20% faster than those original ones. Then we select one masked implementation named RSMv2 due to its popularity, and investigate its security and efficiency on an AVR ATMega163 processor and four different FPGA devices. The results show that no exploitable first-order side-channel leakages are detected. Moreover, compared with original masked AES implementations, our combined approach is nearly 25% faster on the AVR processor, and at least 70% more efficient on four FPGA devices.

Side-channel countermeasures utilizing dynamic logic reconfiguration: Protecting AES/Rijndael and Serpent encryption in hardware

Dynamic logic reconfiguration is a concept that allows for efficient on-the-fly modifications of combinational circuit behavior in both ASIC and FPGA devices. The reconfiguration of Boolean functions is achieved by modification of their generators (e.g., shift register-based look-up tables) and it can be controlled from within the chip, without the necessity of any external intervention. This hardware polymorphism can be utilized for the implementation of side-channel attack countermeasures, as demonstrated by Sasdrich et al. for the lightweight cipher PRESENT.In this work, we adapt these countermeasures to two of the AES finalists, namely Rijndael and Serpent. Just like PRESENT, both Rijndael and Serpent are block ciphers based on a substitution–permutation network. We describe the countermeasures and adjustments necessary to protect these ciphers using the resources available in modern Xilinx FPGAs. We describe our implementations and evaluate the side-channel leakage and effectiveness of different countermeasures combinations using a methodology based on Welch’s t-test. Furthermore, we attempt to break the protected AES/Rijndael implementation using second-order DPA/CPA attacks.We did not detect any significant first-order leakage from the fully protected versions of our implementations. Using one million power traces, we detect second-order leakage from Serpent encryption, while AES encryption second-order leakage is barely detectable. We show that the countermeasures proposed by Sasdrich et al.are, with some modifications, successfully applicable to AES and Serpent.

High-Speed Masking for Polynomial Comparison in Lattice-based KEMs

With the NIST post-quantum standardization competition entering the second round, the interest in practical implementation results of the remaining NIST candidates is steadily growing. Especially implementations on embedded devices are often not protected against side-channel attacks, such as differential power analysis. In this regard, the application of countermeasures against side-channel attacks to candidates of the NIST standardization process is still an understudied topic. Our work aims to contribute to the NIST competition by enabling a more realistic judgment of the overhead cost introduced by side-channel countermeasures that are applied to lattice-based KEMs that achieve CCA-security based on the Fujisaki-Okamoto transform. We present a novel higher-order masking scheme that enables an efficient comparison of polynomials as previous techniques based on arithmetic-to-Boolean conversions renders this (generally inexpensive) component extremely expensive in the masked case. Our approach has linear complexity in the number of shares compared to quadratic complexity of previous contributions and it applies to lattice based schemes with prime modulus. It comes with a proof in the probing model and an efficient implementation on an ARM Cortex-M4F microcontroller which was defined as a preferred evaluation platform for embedded implementations by NIST. Our algorithm can be executed in only 1.5-2.2 milliseconds on the target platform (depending on the masking order) and is therefore well suited even for lightweight applications. While in previous work, practical side-channel experiments were conducted using only 5,000 - 100,000 power traces, we confirm the absence of first-order leakage in this work by collecting 1 million power traces and applying the t-test methodology.

Machine-Learning-Based Side-Channel Leakage Detection in Electronic System-Level Synthesis

Security critical hardware devices in CPS must experience security testing including side-channel leakage detection, which aims to provide earlier assessment before coming into service. Due to the exponential nature of ESLS, performing fast and efficient leakage detection is a critical task in the context of security evaluation for DSE. However, the traditional method of leakage detection is always time-consuming and costly. To overcome this limitation, this article investigates the strategies of leveraging the emerging ML techniques to achieve faster and more effective leakage detection. A clustering-based methodology is proposed as an alternative method for first-order leakage detection. We further confirm the effectiveness and rapidity of the proposed method by launching clustering-based analysis on seven different benchmarks. The proposed method provides almost the same quality of results as the non-specific t-test while substantially reducing the efforts on security evaluation in CPS.

Leak Point Locating in Hardware Implementations of Higher-Order Masking Schemes

Secure masking schemes have been proven in theory to be secure countermeasures against side-channel attacks. The security framework proposed by Ishai, Sahai, and Wagner, known as the Ishai–Sahai–Wagner scheme, is one of the most acceptable secure models of the existing $d$ th-order masking schemes, where $d$ represents the masking order and plays the role of a security parameter. However, a gap may exist between scheme and design. Several analyses have determined that the glitch has been regarded as the main challenge of masking in hardware designs. A practical method of locating the precise position of leakage points (LPs) in the original hardware design is very rare. Existing research on this glitch mainly focuses on the first-order leakages; however, higher-order analysis can combine several shares to recover the secret key. In this paper, we propose a practical method, sensitive glitch location (SGL) method to locate the less order leakage in hardware design. Specifically, the SGL method can locate any-order of LP in the hardware implementation of $d$ th-order masking schemes. We conducted experiments and verified that the time complexity of SGL on the $d$ th-order masking schemes is ${O(nm)}$ , where $m$ is the number of signals and $n$ is the number of shares in masking scheme. It can therefore be regarded as an efficient tool for the masking designs. In addition, we analyzed the $d$ th-order masking scheme proposed by Rivain and Prouff (2010) along with the SecMult algorithm from the Rivain–Prouff countermeasure, which has been analyzed by our SGL. The experimental results verified that a higher-order leakage may exist in certain hardware designs, even the masking scheme has been proven as a secure countermeasure. To the best of our knowledge, SGL is the first tool that can be used to locate any-order of power/electromagnetic LP in hardware designs. It thus shows the weakness in the original design file of hardware implementations. This property can help designers directly improve the real security of the designs. Moreover, SGL returns the path of the leakages, which can elucidate the original cause and propagation of the weakness.

Hardware Masking, Revisited

MaskingHardware masking schemes have shown many advances in the past few years. Through a series of publications their implementation cost has dropped significantly and flaws have been fixed where present. Despite these advancements it seems that a limit has been reached when implementing masking schemes on FPGA platforms. Indeed, even with a correct transition from the masking scheme to the masking realization (i.e., when the implementation is not buggy) it has been shown that the implementation can still exhibit unexpected leakage, e.g., through variations in placement and routing. In this work, we show that the reason for such unexpected leakages is the violation of an underlying assumption made by all masking schemes, i.e., that the leakage of the circuit is a linear sum of leakages associated to each share. In addition to the theory of VLSI which supports our claim, we perform a wide range of experiments based on an FPGA) to find out under what circumstances this causes a masked hardware implementation to show undesirable leakage. We further illustrate case studies, where publicly-known secure designs exhibit first-order leakage when being operated at certain conditions.

Lightweight Side Channel Resistance: Threshold Implementations of S<sc>imon</sc>

As networking has become major innovation driver for the Internet of Things as well as Networks on Chips, the need for effective cryptography in hardware is on a steep rise. Both cost and overall system security are the main challenges in many application scenarios, rather than high throughput. In this work we present area-optimized implementations of the lightweight block cipher S imon . All presented cores are protected against side channel attacks using threshold implementation, which applies secret sharing of different orders to prevent exploitable leakages. Implementation results show that, on FPGAs, the higher-order protected S imon core can be smaller than an unprotected AES core at the same security level against classic cryptanalysis. Also, the proposed secure cores consume less than 30 percent the power of any unprotected AES. Security of the proposed cores is validated by provable arguments as well as practical t-test based leakage detection methods. In fact, we show that the first-order protected S imon core does not have first-order leakage and is secure up to 10 million observations against higher-order attacks. The second-order secure implementation could not be exploited at all with up to 100 million observations.

In situ biostimulation of petroleum hydrocarbon degradation by nitrate and phosphate injection using a dipole well configuration

The main aim of this study was to explore the feasibility of source zone bioremediation by nitrate and nutrient injection in a crude-oil contaminated aquifer using a recirculating well dipole. Groundwater pumped from a downgradient well at a rate of 2.5m3h−1 was enriched with bromide (tracer), nitrate and ammonium phosphate and injected in a well 40m upgradient. The test was run for 49days with solute injection, followed by 65days of dipole operation without solute addition. The resulting bromide breakthrough curve allowed quantifying a first-order leakage coefficient of 0.017day−1 from the dipole, whereas from the nitrate data a first-order nitrate consumption rate of 0.075day−1 was determined. Dissolved hydrocarbon concentrations including benzene decreased to non-detect in 84days but experienced important rebounds after ending circulation. Nitrite accumulated temporarily but was consumed entirely when solute injection stopped. The mass balance calculations revealed that about 83% of the nitrate was used for hydrocarbon degradation, with the remaining being used for oxidation of reduced sulfur. A reactive transport model was used for the delineation of the treated zone. This model suggested that denitrification influenced flow and transport in the dipole. It is concluded that successful promotion of denitrifying hydrocarbon degradation is easily obtained in this aquifer and enables to abate dissolved concentrations, and that dipole configuration is a good option.