Higher-order Side-channel Attacks Research Articles

Distance similarity measure based profiling attacks against masked chips

The attack price of higher order side channel attacks (HOSCA) grows exponentially with the mask order. When the mask order is larger than 3, HOSCA can be inapplicable. In light of this, the distance similarity measure based profiling attack (DSMPA) is proposed. In DSMPA, the leakage property of masks can be characterised in a profiling scenario and the so called templates can be obtained. Then, DSM can be used to recover mask values with templates. With mask values recovered, the effect of masking disappears and one can use first-order side-channel attacks to recover the secret key used by a masked chip. The key-recovery efficiency of DSMPA is evaluated in real scenarios, and the advantage of DSMPA over HOSCA in terms of the key-recovery efficiency can be obvious under the success rate metric. Overall, the contribution of this work may provide evaluators a powerful tool to evaluate the security of masked chips.

Redundancy AES Masking Basis for Attack Mitigation (RAMBAM)

In this work, we present RAMBAM, a novel concept of designing countermeasures against side-channel attacks and the Statistical Ineffective Fault Attack (specifically SIFA-1) on AES that employs redundant representations of finite field elements. From this concept, we derive a family of protected hardware implementations of AES. A fundamental property of RAMBAM is a security parameter d that along with other attributes of the scheme allows for making trade-offs between gate count, maximal frequency, performance, level of robustness to the first and higher-order side-channel attacks, and protection against SIFA-1. We present an analytical model that explains how the scheme reduces the leakage and how the design choices affect it. Furthermore, we demonstrate experimentally how different design choices achieve the required goals. In particular, the compact version exhibits a gate count as low as 12.075 kGE, while maintaining adequate protection. The performance-oriented version provides latency as low as one round per cycle, thus combining protection against SCA and SIFA-1 with high performance which is one of the original design goals of AES. Finally, we assess the leakage of the scheme for the first and the second (bivariate) orders using TVLA methodology on an FPGA implementation and observe resilience to at least 348M traces with 16 Sboxes.

Theoretical Estimation on the Success Rate of the Asymptotic Higher Order Optimal Distinguisher

Abstract Since its first publication at ASIACRYPT 2014, higher order optimal distinguisher (HOOD) has been the most efficient style of higher order side channel attacks that can be used to evaluate the physical security of a masking device. In practice, the efficiency of HOOD can be empirically evaluated with the success rate (SR) metric. In the empirical evaluation, a large number of power traces are needed, and HOOD should be repeated thousands of times under the values of different parameters, which can make the evaluation process cumbersome and the evaluation price high. In light of this, the exact relationship between the SR of the asymptotic HOOD and the values of different parameters is theoretically built, and the soundness of the theoretical analysis is empirically verified in both the simulated scenario and the real scenario. Then, by setting the values of different parameters, the SR of the asymptotic HOOD can be theoretically estimated. Here, as the signal-to-noise ratio of a masking device approaches to zero, the SR of the asymptotic HOOD approaches to the SR of HOOD. Overall, this contribution may help evaluators to efficiently evaluate the physical security of a masking device with HOOD.

Non-Profiled Deep Learning-Based Side-Channel Preprocessing With Autoencoders

In recent years, deep learning-based side-channel attacks have established their position as mainstream. However, most deep learning techniques for cryptanalysis mainly focused on classifying side-channel information in a profiled scenario where attackers can obtain a label of training data. In this paper, we introduce a novel approach with deep learning for improving side-channel attacks, especially in a non-profiling scenario. We also propose a new principle of training that trains an autoencoder through the noise from real data using noise-reduced labels. It notably diminishes the noise in measurements by modifying the autoencoder framework to the signal preprocessing. We present convincing comparisons on our custom dataset, captured from ChipWhisperer-Lite board, that demonstrate our approach outperforms conventional preprocessing methods such as principal component analysis and linear discriminant analysis. Furthermore, we apply the proposed methodology to realign de-synchronized traces that applied hiding countermeasures, and we experimentally validate the performance of the proposal. Finally, we experimentally show that we can improve the performance of higher-order side-channel attacks by using the proposed technique with domain knowledge for masking countermeasures.

Multiple leakage samples based higher order optimal distinguisher

In practice, in order to recover the secret key used by a masking device, higher order side channel attacks (HOSCA) are needed. In HOSCA, physical leakages corresponding to the processing of different sensitive intermediate values can be exploited to recover the secret key used by the target device. At ASIACRYPT 2014, Bruneau et al. proposed higher order optimal distinguisher (HOOD) to recover the secret key used by the target device, and they proved that among different styles of HOSCA, HOOD shows the best efficiency in different scenarios. In HOOD, in order to recover the secret key used by the target device, physical leakages at one leakage sample corresponding to the processing of a certain sensitive intermediate value are exploited. However, there exist more than one leakage sample that correspond to the processing of a certain sensitive intermediate value, and physical leakages contained in multiple leakage samples can be exploited to recover the secret key used by the target device. In light of this, we propose multiple leakage samples based HOOD (MLS-HOOD). We note that with MLS-HOOD, physical leakages of the target device can be sufficiently exploited to efficiently recover its secret key. In fact, we will show its advantage over HOOD and another style of HOSCA in both simulated and real scenarios.

Security analysis of higher-order Boolean masking schemes for block ciphers (with conditions of perfect masking)

Side-channel attacks are an important class of cryptanalytic techniques against cryptographic' implementations and masking is a frequently considered solution to improve the resistance of a cryptographic implementation against side-channel attacks. The security of higher-order Boolean masking schemes in various contexts is analysed. The results presented are 2-fold. First, the definitions of higher-order side-channel attacks with the related security notions are formalised and certain security weaknesses in recently proposed masking schemes are put forward. Second, the conditions upon which a substitution box in a block cipher can be perfectly masked by Boolean values in order to counteract side-channel attacks are investigated. That is, can the leakages' statistical distributions at a masked S-box output (over all possible masks) be independent of the secret key targeted in the attacks? The consequences of this requirement are studied in two commonly considered leakage models, namely the Hamming weight and distance models, and conditions on the substitution boxes are derived. As a result of the analysis, it appears that these conditions are not achievable as they lead to evident cryptanalytic weaknesses. Thus, it is formally confirmed that masking cannot be used as a stand-alone countermeasure and cannot offer provable security against side-channel attacks.