First-order Side-channel Attacks Research Articles

Research on group distribution leakage analysis method for RSM

Side channel attack is a new and simple attack idea, and its proposal has created a significant threat to the security of cryptographic devices. With the continuous development of deep learning techniques, deep learning-based side channel attacks have enabled the attack techniques to reach new heights, but the attack efficiency and training time have become new problems. In order to improve the attack efficiency, researchers have proposed a large number of leakage analysis methods, which can effectively extract the intervals with significant leakage in the energy consumption curve and reduce the training parameters and data volume. In order to deal with side channel attacks, researchers have proposed various resistance strategies, among which masking protection is the simplest and widely used way. RSM rotating S-box masking scheme is a particularly important masking protection scheme, which uses a first-order masking scheme to randomize the leakage energy consumption of sensitive information using random masks, thus making the algorithm resistant to first-order side channel attacks. For this type of masking algorithm, this paper proposes a new leakage analysis algorithm, namely "Group Distribution Difference" (GDD). This algorithm is based on the distribution difference of energy consumption, and the energy consumption frequency in the group is calculated instead of the probability distribution. The KL distance is used to calculate the difference between groups and find out the leakage interval, so as to achieve an efficient attack.

Distance similarity measure based profiling attacks against masked chips

The attack price of higher order side channel attacks (HOSCA) grows exponentially with the mask order. When the mask order is larger than 3, HOSCA can be inapplicable. In light of this, the distance similarity measure based profiling attack (DSMPA) is proposed. In DSMPA, the leakage property of masks can be characterised in a profiling scenario and the so called templates can be obtained. Then, DSM can be used to recover mask values with templates. With mask values recovered, the effect of masking disappears and one can use first-order side-channel attacks to recover the secret key used by a masked chip. The key-recovery efficiency of DSMPA is evaluated in real scenarios, and the advantage of DSMPA over HOSCA in terms of the key-recovery efficiency can be obvious under the success rate metric. Overall, the contribution of this work may provide evaluators a powerful tool to evaluate the security of masked chips.

A Memory Hierarchy Protected against Side-Channel Attacks

In the vulnerability analysis of System on Chips, memory hierarchy is considered among the most valuable element to protect against information theft. Many first-order side-channel attacks have been reported on all its components from the main memory to the CPU registers. In this context, memory hierarchy encryption is widely used to ensure data confidentiality. Yet, this solution suffers from both memory and area overhead along with performance losses (timing delays), which is especially critical for cache memories that already occupy a large part of the spatial footprint of a processor. In this paper, we propose a secure and lightweight scheme to ensure the data confidentiality through the whole memory hierarchy. This is done by masking the data in cache memories with a lightweight mask generator that provides masks at each clock cycle without having to store them. Only 8-bit Initialization Vectors are stored for each mask value to enable further recomputation of the masks. The overall security of the masking scheme is assessed through a mutual information estimation that helped evaluate the minimum number of attack traces needed to succeed a profiling side-channel attack to 592 K traces in the attacking phase, which provides an acceptable security level in an analysis where an example of Signal to Noise Ratio of 0.02 is taken. The lightweight aspect of the generator has been confirmed by a hardware implementation that led to resource utilization of 400 LUTs.

Resilient uniformity: applying resiliency in masking

Threshold Implementations are known countermeasures defending against side-channel attacks via the use of masking techniques. While sufficient properties are known to defend against first-order side-channel attacks, it is not known how to achieve higher-order security. This work generalizes the Threshold Implementation notion of uniformity and proves it achieves second-order protection. The notion is applied to create a second-order masking of the Present cipher with a low randomness cost.

Attacking and Defending Masked Polynomial Comparison for Lattice-Based Cryptography

In this work, we are concerned with the hardening of post-quantum key encapsulation mechanisms (KEM) against side-channel attacks, with a focus on the comparison operation required for the Fujisaki-Okamoto (FO) transform. We identify critical vulnerabilities in two proposals for masked comparison and successfully attack the masked comparison algorithms from TCHES 2018 and TCHES 2020. To do so, we use first-order side-channel attacks and show that the advertised security properties do not hold. Additionally, we break the higher-order secured masked comparison from TCHES 2020 using a collision attack, which does not require side-channel information. To enable implementers to spot such flaws in the implementation or underlying algorithms, we propose a framework that is designed to test the re-encryption step of the FO transform for information leakage. Our framework relies on a specifically parametrized t-test and would have identified the previously mentioned flaws in the masked comparison. Our framework can be used to test both the comparison itself and the full decapsulation implementation.

DOMREP–An Orthogonal Countermeasure for Arbitrary Order Side-Channel and Fault Attack Protection

Protection against physical attacks is a major requirement for cryptographic implementations on devices which can be accessed by attackers. Side-channel and fault injection attacks are the most common types of physical attacks. In this work we present a novel generic solution for simultaneous protection against side-channel and fault attacks with arbitrary order. We combine domain oriented masking and repetition codes in an orthogonal way and call this approach DOMREP. The resistance against side-channel attacks and fault attacks can be scaled independently of each other, for the protection against higher-order side-channel analysis and the injection of multiple faults including SIFA. We develop the generic concept of orthogonal protection, and implement the DOMREP concept on GIMLI, a round two NIST LWC competition candidate, on a Xilinx Artix-7 FPGA. Our implementation of GIMLI is verified to be resistant against univariate first-order side-channel attacks by TVLA. The resistance against SIFA is verified by means of fault emulation of single as well as multiple bit faults. Our implementation of GIMLI achieves the expected security level according to these measurements. We also provide numbers for the area overhead for our protected implementation of GIMLI.

Spin Me Right Round Rotational Symmetry for FPGA-Specific AES

The effort in reducing the area of AES implementations has largely been focused on Application-Specific Integrated Circuits (ASICs) in which a tower field construction leads to a small design of the AES S-box. In contrast, a naïve implementation of the AES S-box has been the status-quo on Field-Programmable Gate Arrays (FPGAs). A similar discrepancy holds for masking schemes – a wellknown side-channel analysis countermeasure – which are commonly optimized to achieve minimal area in ASICs.In this paper we demonstrate a representation of the AES S-box exploiting rotational symmetry which leads to a 50% reduction of the area footprint on FPGA devices. We present new AES implementations which improve on the state of the art and explore various trade-offs between area and latency. For instance, at the cost of increasing 4.5 times the latency, one of our design variants requires 25% less look-up tables (LUTs) than the smallest known AES on Xilinx FPGAs by Sasdrich and Güneysu at ASAP 2016. We further explore the protection of such implementations against first-order side-channel analysis attacks. Targeting the small area footprint on FPGAs, we introduce a heuristic-based algorithm to find a masking of a given function with d + 1 shares. Its application to our new construction of the AES S-box allows us to introduce the smallest masked AES implementation on Xilinx FPGAs, to-date.

Masking ring-LWE

In this paper, we propose a masking scheme to protect ring-LWE decryption from first-order side-channel attacks. In an unprotected ring-LWE decryption, the recovered plaintext is computed by first performing polynomial arithmetic on the secret key and then decoding the result. We mask the polynomial operations by arithmetically splitting the secret key polynomial into two random shares; the final decoding operation is performed using a new bespoke masked decoder. The outputs of our masked ring-LWE decryption are Boolean shares suitable for derivation of a symmetric key. Thus, the masking scheme keeps all intermediates, including the recovered plaintext, in the masked domain. We have implemented the masking scheme on both hardware and software. On a Xilinx Virtex-II FPGA, the masked ring-LWE processor requires around 2000 LUTs, a $$20~\%$$ increase in the area with respect to the unprotected architecture. A masked decryption operation takes 7478 cycles, which is only a factor $$2.6\times $$ larger than the unprotected decryption. On a 32-bit ARM Cortex-M4F processor, the masked software implementation costs around $$5.2\times $$ more cycles than the unprotected implementation.

Intra-Masking Dual-Rail Memory on LUT Implementation for SCA-Resistant AES on FPGA

In current countermeasure design trends against differential power analysis (DPA), security at gate level is required in addition to the security algorithm. Several dual-rail pre-charge logics (DPL) have been proposed to achieve this goal. Designs using ASIC can attain this goal owing to its backend design restrictions on placement and routing. However, implementing these designs on field programmable gate arrays (FPGA) without information leakage is still a problem because of the difficulty involved in the restrictions on placement and routing on FPGA. This article describes our novel masked dual-rail pre-charged memory approach, called “intra-masking dual-rail memory (IMDRM) on LUT”, and its implementation on FPGA for Side-Channel Attack-resistant (SCA-resistant) AES. In the proposed design, all unsafe nodes, such as unmasking and masking, and parts of dual-rail memory with unsafe buses (buses that are not masked) are packed into a single LUT. This makes them balanced and independent of the placement and routing tools. Inputs and outputs of all LUTs are masked, and so can be considered safe signals. Several LUTs can be combined to create a safe SBox. The design is independent of the cryptographic algorithm, and hence, it can be applied to available cryptographic standards such as DES or AES as well as future standards. It requires no special placement or route constraints in its implementation. A correlation power analysis (CPA) attack on 1,000,000 traces of AES implementation on FPGA showed that the secret information is well protected against first-order side-channel attacks. Even though the number of LUTs used for memory in this implementation is seven times greater than that of the conventional unprotected single-rail memory table-lookup AES and three times greater than the implementation based on a composite field, it requires a smaller number of LUTs than all other advanced SCA-resistant implementations such as the wave dynamic differential logic, masked dual-rail pre-charge logic, and threshold.

First-order side channel attacks on Zhang’s countermeasures

Zhang’s three countermeasures are known to be secure against certain first-order side channel attacks such as differential power analysis and correlation power analysis. This security comes from the countermeasures’ use of random points to blind the message and random integers to blind the secret scalar. In this paper, we propose first-order side channel attack methods that can perfectly break these three countermeasures. Even though Zhang’s countermeasures use random points and random integers our attacks are made possible by the fact that intermediate values computed by these countermeasures are dependent on specific values that we can guess. The experimental results verify that the proposed attack methods can successfully break existing countermeasures.