Recover Secret Keys Research Articles

Survey: Recovering cryptographic keys from partial information, by example

Side-channel attacks targeting cryptography may leak only partial or indirect information about the secret keys. There are a variety of techniques in the literature for recovering secret keys from partial information. In this work, we survey several of the main families of partial key recovery algorithms for RSA, (EC)DSA, and (elliptic curve) Diffie-Hellman, the classical public-key cryptosystems in common use today. We categorize the known techniques by the structure of the information that is learned by the attacker, and give simplified examples for each technique to illustrate the underlying ideas.

Higher-Order DCA Attacks on White-Box Implementations with Masking and Shuffling Countermeasures

On white-box implementations, it has been proven that differential computation analysis (DCA) can recover secret keys without time-costly reverse engineering. At CHES 2021, Seker et al. combined linear and non-linear masking protections (SEL masking) to prevent sensitive variables from being predicted by DCA. At Eurocrypt 2021, Biryukov and Udovenko introduced a public dummy shuffling construction (BU shuffling) to protect sensitive functions. In this paper, we extend higher-order DCA (HO-DCA) to higher-degree context for exploiting the vulnerabilities against the state-of-the-art countermeasures. The data-dependency HO-DCA (DDHO-DCA), which is proposed at CHES 2020, is improved to successfully recover the correct key of SEL masking. In specific, our improved DDHO-DCA can also enhance the attack result of #100 which is the third winning challenge in WhibOx 2019. Since the XOR phase plays the same role as linear masking, we prove that a specific BU shuffling is vulnerable to HO-DCA attacks. Furthermore, we demonstrate that the combination of SEL masking and the specific BU shuffling still cannot defeat our higher-degree HO-DCA and improved DDHO-DCA attacks.

Deep Learning-based Attacks on Masked AES Implementation

<p>To ensure the confidentiality of the message, the AES (Advanced Encryption Standard) block cipher algorithm can be widely used. Furthermore, an implementation of masked AES is often used to resist side-channel attacks. To recover secret keys embedded in cryptographic devices with masked AES, we present some side-channel attacks based on deep learning models in profiling and non-profiling scenarios. The proposed method which applies the mask value profiling technique represents new approaches for extracting the secret key. To defeat the masked AES implementation, deep learning models such as multi-layer perceptron and convolutional neural networks are developed. In a non-profiling scenario, we adopt the DDLA (Differential Deep Learning Analysis) to extract sensitive information such as the secret key. The main idea of our method is that it is possible to adopt a new binary labeling method to conduct the DDLA based on the HW (Hamming Weight) model. We show several experiments using real power traces measured from the ChipWhisperer platform in profiling attacks and the ASCAD dataset in non-profiling attacks respectively. Whether we target naïve or masked AES implementation, the experimental results show the predominant key recovery accuracy.</p> <p> </p>

Deep learning side-channel attack against hardware implementations of AES

In the field of image recognition, machine learning technologies, especially deep learning, have been rapidly advancing alongside the advances of hardware such as GPUs. In image recognition, in general, large numbers of labeled images to be identified are input to a neural network, and repeatedly learning the images enables the neural network to identify objects with high accuracy. A new profiling side-channel attack method, the deep learning side-channel attack (DL-SCA), utilizes the neural network’s high identifying ability to unveil a cryptographic module’s secret key from side-channel information. In DL-SCAs, the neural network is trained with power waveforms captured from a target cryptographic module, and the trained network extracts the leaky part that depends on the secret. However, at this stage, the main target of investigation has been software implementation, and studies regarding hardware implementation, such as ASIC, are somewhat lacking. In this paper, we first depict deep learning techniques, profiling side-channel attacks, and leak models to clarify the relation between secret and side channels. Next, we investigate the use of DL-SCA against hardware implementations of AES and discuss the problem derived from the Hamming distance model and ShiftRow operation of AES. To solve the problem, we propose a new network training method called “mixed model dataset based on round-round XORed value.” We prove that our proposal solves the problem and gives the attack capability to neural networks. We also compare the attack performance and characteristics of DL-SCA to conventional analysis methods such as correlation power analysis and conventional template attack. In our experiment, a dedicated ASIC chip for side-channel analysis is utilized and the chip is also equipped with a side-channel countermeasure AES. We show how DL-SCA can recover secret keys against the side-channel countermeasure circuit. Our results demonstrate that DL-SCA can be a more powerful option against side-channel countermeasure implementations than conventional SCAs.

System-Level Non-interference of Constant-Time Cryptography. Part II: Verified Static Analysis and Stealth Memory

This paper constitutes the second part of a paper published in Barthe et al. (J Autom Reason, 2017. https://doi.org/10.1007/s10817-017-9441-5 ). Cache-based attacks are a class of side-channel attacks that are particularly effective in virtualized or cloud-based environments, where they have been used to recover secret keys from cryptographic implementations. One common approach to thwart cache-based attacks is to use constant-time implementations, i.e. those which do not branch on secrets and do not perform memory accesses that depend on secrets. However, there is no rigorous proof that constant-time implementations are protected against concurrent cache-attacks in virtualization platforms with shared cache. We propose a new information-flow analysis that checks if an x86 application executes in constant-time, and show that constant-time programs do not leak confidential information through the cache to other operating systems executing concurrently on virtualization platforms. Our static analysis targets the pre-assembly language of the CompCert verified compiler. Its soundness proof is based on a connection between CompCert semantics and our idealized model of virtualization, and uses isolation theorems presented in Part I. We then extend our model of virtualization platform and our static analysis to accommodate stealth memory, a countermeasure which provisions a small amount of private cache for programs to carry potentially leaking computations securely. Stealth memory induces a weak form of constant-time, called S-constant-time, which encompasses some widely used cryptographic implementations. Our results provide the first rigorous analysis of stealth memory and S-constant-time, and the first tool support for checking if applications are S-constant-time. We formalize our results using the Coq proof assistant and we demonstrate the effectiveness of our analyses on cryptographic implementations, including PolarSSL AES, DES and RC4, SHA256 and Salsa20.

Chosen message strategy to improve the correlation power analysis

Nowadays cryptographic circuits are subject to attacks that no longer focus on the algorithm but on its physical implementation. Attacks exploiting information leaked by the hardware implementation are called side-channel attacks (SCA). In particular, the popular correlation power analysis (CPA) is known by its effectiveness. This paper presents a new method for an original optimisation of the CPA to recover secret keys with less power consumption traces than what is expected from the standard CPA. This improvement is done by choosing appropriate plaintexts, both non-adaptively and adaptively. A mathematical proof of the proposed procedure is provided for any cryptographic device with any known leakage model. The proposed technique is tested on the advanced encryption system (AES) S-box input (resp. output) implemented in an ATMega 163 smartcard, with hamming weight leakage model.

Practical improvements of side-channel attacks on AES: feedback from the 2nd DPA contest

Side-channel analyses constitute a major threat for embedded devices, because they allow an attacker to recover secret keys without the device being aware of the sensitive information theft. They have been proved to be efficient in practice on many deployed cryptosystems. Even during the standardization process for the AES, many scientists have raised the attention on the potential vulnerabilities against implementation-level attacks Chari et al. (A Cautionary Note Regarding Evaluation of AES Candidates on Smart-cards, 133–147, 1999). The evaluation of devices against side-channel attacks is now common practice, especially in ITSEFs. This procedure has even been formalized recently Standaert et al. (EUROCRYPT LNCS 5479:443–461, 2009). The framework suggests to estimate the leakage via an information theoretic metric, and the performance of real attacks thanks to either the success rates or the guessing entropy metrics. The DPA contests are a series of international challenges that allow researchers to improve existing side-channel attacks or develop new ones and compare their effectiveness on several reference sets of power consumption traces using a common methodology. In this article, we focus on the second edition of this contest, which targeted a FPGA-based implementation of AES. This article has been written jointly with several of the participants who describe their tactics used in their attacks and their improvements beyond the state of the art. In particular, this feedback puts to the fore some considerations seldom described in the scientific literature, yet relevant to increase the convergence rate of attacks. These considerations concern in particular the correction of acquisition defects such as the drifting side-channel leakage, the identification of the most leaking samples, the order in which subkeys are attacked, how to exploit subkeys that are revealed easily to help retrieve subkeys that leak less, and non-linear leakage models.

Biclique cryptanalysis on lightweight block cipher: HIGHT and Piccolo

Biclique cryptanalysis is an attack that improves the computational complexity by finding a biclique which is a kind of bipartite graph. We present a single-key full-round attack of lightweight block ciphers, HIGHT and Piccolo by using biclique cryptanalysis. In this paper, a 9-round biclique is constructed for HIGHT and a 4-round biclique for Piccolo. These new bicliques are used to recover secret keys for the full rounds of HIGHT, Piccolo-80 and Piccolo-128, the computational complexity of 2125.93, 279.34 and 2127.36, respectively. The computational complexity of attacking HIGHT by a biclique cryptanalysis is reduced from 2126.4. This is the first full-round attack on both Piccolo-80 and Piccolo-128.

Improved cryptanalysis of a knapsack-based probabilistic encryption scheme

Wang et al. [B. Wang, Q. Wu, Y. Hu, Information Sciences 177 (2007)] proposed a knapsack-based probabilistic encryption scheme with non-binary coefficients which enjoys a high density larger than 1.06 in the worst case. In this work, we successfully attack this scheme by showing that a public key and a restriction on system parameters allow the attacker to recover a secret key in a cubic time complexity using modular equations. This approach is much more efficient than the previous attack by Youssef [A.M. Youssef, Information Sciences 179 (2009)], in which lattice basis reductions are used. Recovering secret keys can be done within 4h and 4days when n=100 and 200, respectively. A simple modification that helps resist known attacks is also discussed.

Homomorphic Property-Based Concurrent Error Detection of RSA: A Countermeasure to Fault Attack

Fault-based attacks, which recover secret keys by deliberately introducing fault(s) in cipher implementations and analyzing the faulty outputs, have been proved to be extremely powerful. In this paper, we propose a novel Concurrent Error Detection (CED) scheme to counter fault-based attack against RSA by exploiting its multiplicative homomorphic property. Specifically, the proposed CED scheme verifies if Π <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i=1</sub> <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</sup> E(m <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i</sub> ) ≡ EΠ <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i=1</sub> <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">k</sup> m <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i</sub> (mod n) (mod n) where E could be either RSA encryption, or decryption, or signature, or verification process. Upon a mismatch, all the ciphertexts will be suppressed. The time overhead is 1/k and k can be used to trade-off the time overhead with memory overhead and output latency. Recognizing that an RSA device could be subject to a combination of several side-channel attacks, the proposed scheme enables an easy divide-and-concur solution-any fine-tuned architecture, for example, a power-attack-resistant architecture, can be equipped with fault-attack resistance easily without disturbing its original resistance. This advantage distinguishes the proposed scheme over the existing countermeasures.

Tamper Proofing by Design Using Generalized Involution-Based Concurrent Error Detection for Involutional Substitution Permutation and Feistel Networks

Secure operation of cryptographic algorithms is critical to the success of secure transactions. Fault-based attacks that recover secret keys by deliberately introducing fault(s) in cipher implementations and analyzing the faulty outputs have been proven to be extremely powerful. Substitution Permutation Networks (SPN) and Feistel Networks (FN) are the two important classes of Symmetric Block Ciphers. Some SPN ciphers and all FN Ciphers satisfy the involution property. A function F is an involution if F(F(x)) = x. In this paper, we investigate tamper proofing techniques that use low cost involution-based time redundancy concurrent error detection (CED) schemes for involutional SPN and FN symmetric block ciphers. We incorporated this tamper proofing by design technique in a hardware implementation of the 128-bit ANUBIS SPN cipher (an involution variant of the Advanced Encryption Standard (AES)) and the 128-bit TwoFish FN cipher (an AES finalist). We performed fault simulation at both the algorithm and the gate level to show that the low-cost involution-based CED schemes, in addition to detecting all transient faults, can detect all single-bit permanent faults and > 99 percent of all multiple-bit permanent faults. Consequently, this low cost CED technique can protect the crypto device against Differential Fault Analysis (DFA) attacks.