Hamming Weight Model Research Articles

Pincering SKINNY by Exploiting Slow Diffusion

Lightweight cryptography is an emerging field where designers are testing the limits of symmetric cryptography. We investigate the resistance against sidechannel attacks of a new class of lighter blockciphers, which use a classic substitution–permutation network with slow diffusion and many rounds.Among these ciphers, we focus on SKINNY, a primitive used up to the final round ofNIST’s recent lightweight standardisation effort. We show that the lack of diffusion in the key scheduler allows an attacker to combine leakage from the first and the last rounds, effectively pincering its target. Furthermore, the slow diffusion used by its partial key-absorption and linear layers enable, on both sides, to target S-Boxes from several rounds deep.As some of these S-boxes leak on the same part of the key, full key recovery exploiting all leakage requires a clever combining strategy. We introduce the use of cluster graph inference (an established tool from probabilistic graphical model theory) to enhance both unprofiled or profiled differential power analysis, enabling us to handlethe increase of S-Boxes with their intertwined leakage.We evaluate the strength of our attack both in the Hamming weight model and against two implementations running on an STM32F303 ARM Cortex-M4 hosted on a ChipWhisperer target board, showing that our attack reduces the number of traces required to attack SKINNY by a factor of around 2.75.

NeuroSCA: Evolving Activation Functions for Side-Channel Analysis

The choice of activation functions can significantly impact the performance of neural networks. Due to an ever-increasing number of new activation functions being proposed in the literature, selecting the appropriate activation function becomes even more difficult. Consequently, many researchers approach this problem from a different angle, in which instead of selecting an existing activation function, an appropriate activation function is evolved for the problem at hand. In this paper, we demonstrate that evolutionary algorithms can evolve new activation functions for side-channel analysis (SCA), outperforming ReLU and other activation functions commonly applied to that problem. More specifically, we use Genetic Programming to define and explore candidate activation functions (neuroevolution) in the form of mathematical expressions that are gradually improved. Experiments with the ASCAD database show that this approach is highly effective compared to results obtained with standard activation functions and that it can match the state-of-the-art results from the literature. More precisely, the obtained results for the ASCAD fixed key dataset demonstrate that the evolved activation functions can improve the current state-of-the-art by achieving a guessing entropy of 287 for the Hamming weight model and 115 for the Identity leakage model, compared to 447 and 120 obtained in the literature.

Template Attack of LWE/LWR-Based Schemes with Cyclic Message Rotation

The side-channel security of lattice-based post-quantum cryptography has gained extensive attention since the standardization of post-quantum cryptography. Based on the leakage mechanism in the decapsulation stage of LWE/LWR-based post-quantum cryptography, a message recovery method, with templates and cyclic message rotation targeting the message decoding operation, was proposed. The templates were constructed for the intermediate state based on the Hamming weight model and cyclic message rotation was used to construct special ciphertexts. Using the power leakage during operation, secret messages in the LWE/LWR-based schemes were recovered. The proposed method was verified on CRYSTAL-Kyber. The experimental results demonstrated that this method could successfully recover the secret messages used in the encapsulation stage, thereby recovering the shared key. Compared with existing methods, the power traces required for templates and attack were both reduced. The success rate was significantly increased under the low SNR, indicating a better performance with lower recovery cost. The message recovery success rate could reach 99.6% with sufficient SNR.

Local Search Trajectories over S-box space

A local search method is developed and applied to create trajectories over S-box spaces in this work. These trajectories show a strong linear correlation between confusion coefficient variance, transparency order, modified transparency order, and revised transparency order under the Hamming weight model. When the confusion coefficient variance values increase, the values of transparency order, modified transparency order beta zero, and revised transparency order beta zero decrease, reflecting the same theoretical resistance against side-channel attacks by power consumption. From the best of our knowledge, it is the first time that Local Search trajectories are used to discover relations between cryptography properties. The experimental results and comparisons provide evidence of the capabilities of the proposal to handle the cryptography problems.

Deep Learning-based Attacks on Masked AES Implementation

<p>To ensure the confidentiality of the message, the AES (Advanced Encryption Standard) block cipher algorithm can be widely used. Furthermore, an implementation of masked AES is often used to resist side-channel attacks. To recover secret keys embedded in cryptographic devices with masked AES, we present some side-channel attacks based on deep learning models in profiling and non-profiling scenarios. The proposed method which applies the mask value profiling technique represents new approaches for extracting the secret key. To defeat the masked AES implementation, deep learning models such as multi-layer perceptron and convolutional neural networks are developed. In a non-profiling scenario, we adopt the DDLA (Differential Deep Learning Analysis) to extract sensitive information such as the secret key. The main idea of our method is that it is possible to adopt a new binary labeling method to conduct the DDLA based on the HW (Hamming Weight) model. We show several experiments using real power traces measured from the ChipWhisperer platform in profiling attacks and the ASCAD dataset in non-profiling attacks respectively. Whether we target naïve or masked AES implementation, the experimental results show the predominant key recovery accuracy.</p> <p> </p>

Power Analysis Attack Based on Hamming Weight Model without Brute Force Cracking

Power analysis attack is an attack method to obtain the key in cryptographic chip by analyzing the power information of the cryptographic chip. Machine learning has been widely used in power analysis attacks in recent years. Machine learning can effectively establish the model between the power traces and the SBOX output value or the HM (Hamming) weight of the SBOX output value so that the SBOX output value or the HM weight of the SBOX output value can be obtained through the power traces. HM weight model is widely used because it has less classification of nine and can achieve better machine learning accuracy. However, in the HM weight model, the key cannot be obtained directly by obtaining the median HM weight; instead, the key needs to be deduced by brute force cracking of the median HM weight. Usually, the brute force cracking of a byte key requires 51 enumeration times on average. The HM weight distribution of the SBOX output value is unbalanced, so the power analysis attack based on the HM weight model without brute force cracking is proposed in this paper. Based on the HM weight of the SBOX output value, the method selects the best plaintext for the next power analysis attack, and Euclidean distance is chosen as the optimal plaintext selection judgment algorithm. It makes the HM weight distribution of the SBOX output value more evenly, thus reducing the possible key space and confirming the key more easily. This scheme does not require brute force cracking. It only needs to input 3.332 plaintexts on average and up to 4 plaintexts to determine the unique key, which effectively improves the efficiency of the power analysis attack. In this paper, the authors test the DPA competition V4 data set and Kizhvatov’s data set with random defense. Experiments show that this scheme enjoys the high accuracy of the HM weight model in machine learning. Compared with the Whole Byte scheme, the accuracy based on this scheme can be increased by about 360%. Compared with the brute force cracking HM weight scheme, the guessing entropy can be decreased by about 1700%.

On the Modified Transparency Order of n , m -Functions

The concept of transparency order is introduced to measure the resistance of n , m -functions against multi-bit differential power analysis in the Hamming weight model, including the original transparency order (denoted by TO ), redefined transparency order (denoted by RTO ), and modified transparency order (denoted by MTO ). In this paper, we firstly give a relationship between MTO and RTO and show that RTO is less than or equal to MTO for any n , m -functions. We also give a tight upper bound and a tight lower bound on MTO for balanced n , m -functions. Secondly, some relationships between MTO and the maximal absolute value of the Walsh transform (or the sum-of-squares indicator, algebraic immunity, and the nonlinearity of its coordinates) for n , m -functions are obtained, respectively. Finally, we give MTO and RTO for (4,4) S-boxes which are commonly used in the design of lightweight block ciphers, respectively.

Co-relation scan attack analysis (COSAA) on AES: A comprehensive approach

Scan based DfT is indispensable for IC testing in the semiconductor chip industry to ensure correctness of chip, both functionally and structurally. Since a higher degree of fault coverage is essential, cryptographic ICs rely on it as a standard technique during manufacturing test. Yet an invaluable tradeoff needs to be met between security and testability, because it is the observability and controllability of the sequential memory elements in the scan chain which are enhanced to facilitate testing. Well designed differential scan attacks which make use of this feature can prove to be critically pervasive to leak secret keys embedded in cryptochips. Use of response compactors ensure test cost reduction. Existing differential scan attacks target Hamming weight pairs that are unique. The motivation of our work lies in the fact that carefully fabricating additional bits in order to transform a unique Hamming weight to a non-unique one, existing attacks can be defended. In this paper, we propose Co-relation scan attack (COSAA) on AES crypto-system which can work even in the presence of test response compaction. We show our attack technique to be lethal against any possible Hamming weight model which means that the designer needs to prevent the circuit under test from a relatively broader attack surface. Our experiments show the proposed attack can successfully recover the secret key of AES with XOR compaction in 24 milliseconds using an average desktop machine.

Power analysis attack resilient block cipher implementation based on 1‐of‐4 data encoding

Side-channel attacks pose an inevitable challenge to the implementation of cryptographic algorithms, and it is important to mitigate them. This work identifies a novel data encoding technique based on 1-of-4 codes to resist differential power analysis attacks, which is the most investigated category of side-channel attacks. The four code words of the 1-of-4 codes, namely (0001, 0010, 1000, and 0100), are split into two sets: set-0 and set-1. Using a select signal, the data processed in hardware is switched between the two encoding sets alternately such that the Hamming weight and Hamming distance are equalized. As a case study, the proposed technique is validated for the NIST standard AES-128 cipher. The proposed technique resists differential power analysis performed using statistical methods, namely correlation, mutual information, difference of means, and Welch's t-test based on the Hamming weight and distance models. The experimental results show that the proposed countermeasure has an area overhead of 2.3× with no performance degradation comparatively.

Research and Implementation on Power Analysis Attacks for Unbalanced Data

In the power analysis attack, when the Hamming weight model is used to describe the power consumption of the chip operation data, the result of the random forest (RF) algorithm is not ideal, so a random forest classification method based on synthetic minority oversampling technique (SMOTE) is proposed. It compensates for the problem that the random forest algorithm is affected by the data imbalance and the classification accuracy of the minority classification is low, which improves the overall classification accuracy rate. The experimental results show that when the training set data is 800, the random forest algorithm predicts the correct rate of 84%, but the classification accuracy of the minority data is 0%, and the SMOTE-based random forest algorithm improves the prediction accuracy of the same set of test data by 91%. The classification accuracy rate of a few categories has increased from 0% to 100%.

Secure STT-MRAM Bit-Cell Design Resilient to Differential Power Analysis Attacks

Spin-transfer torque magnetic random access memory (STT-MRAM) is a promising nonvolatile memory technology for various applications from low power to high-density memory. However, STT-MRAM is prone to power analysis attacks due to its asymmetric resistive states and switching behavior. This noninvasive class of attacks is a serious threat to system security. To reduce the correlation between the data and the power consumption of the memory, a countermeasure based on a resilient cell design with a symmetrical structure is proposed in this article. The standard cell and the proposed cell have been attacked and their resiliencies are compared. When attacked with a correlation power analysis (CPA), the proposed bit cell attacked with the hamming weight (HW) model is 100 times more resilient compared to the standard STT-MRAM cell. The proposed bit cell attacked with the hamming distance (HD) or the STT power models is more than 500 times more resilient compared to the standard STT-MRAM cell.

Count Your Toggles: a New Leakage Model for Pre-Silicon Power Analysis of Crypto Designs

Power analysis attack is a form of side channel attack which can recover the key of a cryptographic algorithm running on some device. In this work we propose CAD based methodology to perform power analysis on pre-silicon gate-level netlist of cryptographic algorithm. We first build a new leakage model of the critical component present in crypto design by approximating it’s dynamic power consumption from the toggle count information. Then using the power model we perform power attack to recover key using power trace of crypto design. We validated our methodology on PRESENT like cipher structure and also compared our leakage model with popular Hamming distance and Hamming weight models, where we found our model requires very less number of power traces to recover keys with high correlation. We further extended our model to work by counting the number of toggles, that can be exploited by the circuit designers to early detect if their crypto design is vulnerable to any leakage or by tool developers to induct security awareness in their flow. Finally, we integrated our methodology with hybrid testing framework for first order side channel analysis to certify crypto-implementations from pre-silicon power analysis.

The Curse of Class Imbalance and Conflicting Metrics with Machine Learning for Side-channel Evaluations

We concentrate on machine learning techniques used for profiled sidechannel analysis in the presence of imbalanced data. Such scenarios are realistic and often occurring, for instance in the Hamming weight or Hamming distance leakage models. In order to deal with the imbalanced data, we use various balancing techniques and we show that most of them help in mounting successful attacks when the data is highly imbalanced. Especially, the results with the SMOTE technique are encouraging, since we observe some scenarios where it reduces the number of necessary measurements more than 8 times. Next, we provide extensive results on comparison of machine learning and side-channel metrics, where we show that machine learning metrics (and especially accuracy as the most often used one) can be extremely deceptive. This finding opens a need to revisit the previous works and their results in order to properly assess the performance of machine learning in side-channel analysis.

Multivariate High-Order Attacks of Shuffled Tables Recomputation

Masking schemes based on tables recomputation are classical countermeasures against high-order side-channel attacks. Still, they are known to be attackable at order d in the case the masking involves d shares. In this work, we mathematically show that an attack of order strictly greater than d can be more successful than an attack at order d. To do so, we leverage the idea presented by Tunstall, Whitnall and Oswald at FSE 2013: We exhibit attacks which exploit the multiple leakages linked to one mask during the recomputation of tables. Specifically, regarding first-order table recomputation, improved by a shuffled execution, we show that there is a window of opportunity, in terms of noise variance, where a novel highly multivariate third-order attack is more efficient than a classical bivariate second-order attack. Moreover, we show on the example of the high-order secure table computation presented by Coron at EUROCRYPT 2014 that the window of opportunity enlarges linearly with the security order d. These results extend that of the CHES '15 eponymous paper. Here, we also investigate the case of degree one leakage models and formally show that the Hamming weight model is the less favorable to the attacker. Eventually, we validate our attack on a real ATMEL smartcard.

New Methods of Template Attack Based on Fault Sensitivity Analysis

Fault Sensitivity Analysis (FSA) is a side-channel attack that utilizes the sensitive delay of circuits to retrieve the key in cryptographic systems. In this paper, we propose the concept of right or wrong collision (RWC) rate and use it to build templates on two S-boxes, one is the target of the attack and the other is used as a reference. Compared to the traditional Hamming weight model which has eight different values, our template model is two-dimensional with 256 different values and has the potential to significantly reduce the number of plaintext required to reveal the key. Attack experiments show that our template attack can successfully break the masked AES algorithm with only one clock frequency. Furthermore, we propose two improved template attack methods that can reduce the complexity for building templates to 1/256 and 9/256 of the original method, respectively. The improved method with different frequencies also improves the efficiency of template matching by 86.3 percent. Finally and most importantly, our methods can be used to break masked AES where the S-boxes do not have to be implemented by parallel AND gates, a major limitation of the current Hamming weight models.

Redefining the transparency order

In this paper, we consider the multi-bit Differential Power Analysis (DPA) in the Hamming weight model. In this regard, we revisit the definition of Transparency Order ($$\mathsf {TO}$$TO) from the work of Prouff (FSE 2005) and find that the definition has certain limitations. Although this work has been quite well referred in the literature, surprisingly, these limitations remained unexplored for almost a decade. We analyse the definition from scratch, modify it and finally provide a definition with better insight that can theoretically capture DPA in Hamming weight model for hardware implementation with precharge logic. At the end, we confront the notion of (revised) transparency order with attack simulations in order to study to what extent the low transparency order of an s-box impacts the efficiency of a side channel attack against its processing. To the best of our knowledge, this is the first time that such a critical analysis is conducted (even considering the original notion of Prouff). It practically confirms that the transparency order is indeed related to the resistance of the s-box against side-channel attacks, but it also shows that it is not sufficient alone to directly achieve a satisfying level of security. Regarding this point, our conclusion is that the (revised) transparency order is a valuable criterion to consider when designing a cryptographic algorithm, and even if it does not preclude to also use classical countermeasures like masking or shuffling, it enables to improve their effectiveness.

Mutual information analysis: higher-order statistical moments, efficiency and efficacy

The wide attention given to the mutual information analysis (MIA) is often connected to its statistical genericity, denoted flexibility in this paper. Indeed, MIA is expected to lead to successful key recoveries with no reliance on a priori knowledge about the implementation (impacted by the error modeling made by the attacker. and with as minimum assumptions as possible about the leakage distribution, i.e. able to exploit information lying in any statistical moment and to detect all types of functional dependencies), up to the error modeling which impacts its efficiency (and even its effectiveness). However, emphasis is put on the powerful generality of the concept behind the MIA, as well as on the significance of adequate probability density functions (PDF) estimation which seriously impacts its performance. By contrast to its theoretical advantages, MIA suffers from underperformance in practice limiting its usage. Considering that this underperformance could be explained by suboptimal estimation procedures, we studied in-depth MIA by analyzing the link between the setting of tuning parameters involved in the commonly used nonparametric density estimation, namely kernel density estimation, with respect to three criteria: the statistical moment where the leakage prevails, MIA’s efficiency and its flexibility according to the classical Hamming weight model. The goal of this paper was, therefore, to cast some interesting light on the field of PDF estimation issues in MIA for which much work has been devoted to finding improved estimators having their pros and cons, while little attempt has been made to identify whether existing classical methods can be practically improved or not according to the degree of freedom offered by hyperparameters (when available). We show that some ‘optimal’ estimation procedures following a problem-based approach rather than the systemic use of heuristics following an accuracy-based approach can make MIA more efficient and flexible and a practical guideline for tuning the hyperparameters involved in MIA should be designed. The results of this analysis allowed us defining a guideline based on a detailed comparison of MIA’s results across various simulations and real-world datasets (including publicly available ones such as DPA contest V2 and V4.1).

Analysis of the algebraic side channel attack

At CHES 2009, Renauld, Standaert and Veyrat-Charvillon introduced a new kind of attack called algebraic side-channel attacks (ASCA). They showed that side-channel information leads to effective algebraic attacks. These results are mostly experiments since strongly based on the use of a SAT solver. This article presents a theoretical study to explain and to characterize the algebraic phase of these attacks. We study more general algebraic attacks based on Gröbner methods. We show that the complexity of the Gröbner basis computations in these attacks depends on a new notion of algebraic immunity defined in this paper, and on the distribution of the leakage information of the cryptosystem. We also study two examples of common leakage models: the Hamming weight and the Hamming distance models. For instance, the study in the case of the Hamming weight model gives that the probability of obtaining at least 64 (resp. 130) linear relations is about 50% for the substitution layer of PRESENT (resp. AES). Moreover if the S-boxes are replaced by functions maximizing the new algebraic immunity criterion then the algebraic attacks (Gröbner and SAT) are intractable. From this theoretical study, we also deduce an invariant which can be easily computed from a given S-box and provides a sufficient condition of weakness under an ASCA. This new invariant does not require any sophisticated algebraic techniques to be defined and computed. Thus, for cryptographic engineers without an advanced knowledge in algebra (e.g. Gröbner basis techniques), this invariant may represent an interesting tool for rejecting weak S-boxes.

Enhanced correlation power analysis attack against trusted systems

AbstractPower analysis attacks pose a serious threat to the security of many trusted systems. The principle of power analysis attacks is based on the assumption that the power consumption of an electronic device is proportional to the Hamming weight (HW) of the data being processed. However, this power model is defective as it is deviated from the CMOS circuit power consumption theory where power consumption is largely dependent on the switching ability, i.e., the Hamming distance (HD) of the data being processed. This paper presents an HD power analysis model which emulates Hamming distance based on probability distribution of HW, thus conjointly achieving better feasibility and accuracy. The experiment of CPA analysis on smart card chips running DES (Data Encryption Standard) and AES (Advanced Encryption Standard) encryption demonstrates that the proposed model can achieve 10% ∼ 18% better results compared to the existing HW model, which suggests higher success rate of discerning the secret key from the trusted systems. Copyright © 2010 John Wiley & Sons, Ltd.

Security analysis of higher-order Boolean masking schemes for block ciphers (with conditions of perfect masking)

Side-channel attacks are an important class of cryptanalytic techniques against cryptographic' implementations and masking is a frequently considered solution to improve the resistance of a cryptographic implementation against side-channel attacks. The security of higher-order Boolean masking schemes in various contexts is analysed. The results presented are 2-fold. First, the definitions of higher-order side-channel attacks with the related security notions are formalised and certain security weaknesses in recently proposed masking schemes are put forward. Second, the conditions upon which a substitution box in a block cipher can be perfectly masked by Boolean values in order to counteract side-channel attacks are investigated. That is, can the leakages' statistical distributions at a masked S-box output (over all possible masks) be independent of the secret key targeted in the attacks? The consequences of this requirement are studied in two commonly considered leakage models, namely the Hamming weight and distance models, and conditions on the substitution boxes are derived. As a result of the analysis, it appears that these conditions are not achievable as they lead to evident cryptanalytic weaknesses. Thus, it is formally confirmed that masking cannot be used as a stand-alone countermeasure and cannot offer provable security against side-channel attacks.