Template Attacks Research Articles

New Methods of Template Attack Based on Fault Sensitivity Analysis

Fault Sensitivity Analysis (FSA) is a side-channel attack that utilizes the sensitive delay of circuits to retrieve the key in cryptographic systems. In this paper, we propose the concept of right or wrong collision (RWC) rate and use it to build templates on two S-boxes, one is the target of the attack and the other is used as a reference. Compared to the traditional Hamming weight model which has eight different values, our template model is two-dimensional with 256 different values and has the potential to significantly reduce the number of plaintext required to reveal the key. Attack experiments show that our template attack can successfully break the masked AES algorithm with only one clock frequency. Furthermore, we propose two improved template attack methods that can reduce the complexity for building templates to 1/256 and 9/256 of the original method, respectively. The improved method with different frequencies also improves the efficiency of template matching by 86.3 percent. Finally and most importantly, our methods can be used to break masked AES where the S-boxes do not have to be implemented by parallel AND gates, a major limitation of the current Hamming weight models.

The Cognition Is Not Enough: Another Look on Existing Interesting Points Chosen Methods

For classical template attacks, many papers suggested a guideline of choosing interesting points which is still not proven. Up to now, many different methods of choosing interesting points were introduced. However, it is still unclear that which approach will lead to the best classification performance for template attacks. We comprehensively evaluate and compare the classification performance of template attacks when using different methods of choosing interesting points. Evaluation results show that the Correlation power analysis based method and the Sum of squared pairwise t-differences based method will lead to the best classification performance. We find that some methods of choosing interesting points provide the same results in the same circumstance. Finally, we correctly prove the guideline of choosing interesting points is correct by presenting a new way of conducting template attacks.

프로파일링 단계에서 파형 선별을 통한 템플릿 공격의 성능 향상

프로파일링 단계에서 파형 선별을 통한 템플릿 공격의 성능 향상

Template attacks exploiting static power and application to CMOS lightweight crypto‐hardware

SummaryA new class of template attacks aiming at recovering the secret key of a cryptographic core from measurements of its static power consumption is presented in this paper. These attacks exploit the dependence of the static current of Complementary metal–oxide–semiconductor Integrated Circuits on the input vector and the maximum likelihood decision rule as a statistical distinguisher. In the proposed Template Attacks Exploiting Static Power (TAESP), we take advantage of the temperature dependence of static currents in order to build a new multivariate approach able to extract relevant information from cryptographic devices. As a validation case study, we consider the PRESENT‐80 block cypher algorithm and its implementation on a 40 nm Complementary metal–oxide–semiconductor process. Monte Carlo and corner simulations at transistor level are used to show the effectiveness of the TAESP in the presence of die‐to‐die and intra‐die process variations. A real attack scenario is then built by adding Gaussian noise to current samples extracted from transistor‐level simulations. The univariate TAESP in which just one temperature is considered to build the templates is compared against the multivariate TAESP in which measurements at different controlled temperatures are exploited. This comparison shows that using just a few different temperatures to build multivariate templates allows to strongly increase the effectiveness of the attack. Copyright © 2016 John Wiley & Sons, Ltd.

Variety of Scalable Shuffling Countermeasures against Side Channel Attacks

IoT devices have very strong requirements on all the resources such as memory, randomness, energy and execution time. This paper proposes a number of scalable shuffling techniques as countermeasures against side channel analysis. Some extensions of an existing technique called Random Start Index (RSI) are suggested in this paper. Moreover, two new shuffling techniques Reverse Shuffle (RS) and Sweep Swap Shuffle (SSS) are described within their possible extensions. Extensions of RSI, RS and SSS might be implemented in a constrained environment with a small data and time overhead. Each of them might be implemented using different amount of randomness and thus, might be fine-tuned according to requirements and constraints of a cryptographic system such as time, memory, available number of random bits, etc. RSI, RS, SSS and their extensions are described using SubBytes operation of AES-128 block cipher as an example, but they might be used with different operations of AES as well as with other algorithms. This paper also analyses RSI, RS and SSS by comparing their properties such as number of total permutations that might be generated using a fixed number of random bits, data complexity, time overhead and evaluates their resistance against some known side-channel attacks such as correlation power analysis and template attack. Several of proposed shuffling schemes are implemented on a 8-bit microcontroller that uses them to shuffle the first and the last rounds of AES-128.

Template attack on SPA and FA resistant implementation of Montgomery ladder

Hardware implementations of the well-known Rivest–Shamir–Adleman (RSA) algorithm have been shown to be vulnerable to power and fault analysis (FA) attacks. To implement protected designs of RSA-Chinese remainder theorem in embedded devices, like smart cards or RFIDs, the one needs to find solutions which require less computations as well as incurs low storage overheads. One such efficient scheme was proposed by Joye et al. in CHES'02 and it was claimed to be secure against both simple power analysis (SPA) and FA attacks. In this study, the authors demonstrate a template attack (TA) against Joye's countermeasure and show that the scheme can be broken with a low number of power traces. In addition, the authors report the experimental results of the proposed attack against an implementation of Joye's scheme on a Xilinx Microblaze soft-core processor of SASEBO-W standard side-channel analysis board. The authors used least squares support vector machine (LS-SVM) based binary classifiers to analyse the collected power traces. The authors also describe the potential threat posed by cache timing attacks on Joye's ladder in presence of a concurrently running spy process and outline a probable countermeasure to the posed attacks.

How many interesting points should be used in a template attack?

Considering that one can fully characterize and exploit the power leakages of the reference device in the process of recovering the secret key used by the target device, template attack (TA) is broadly accepted as the strongest power analysis attack from the perspective of information theory. In order to fully exploit the power leakages of the reference device, one usually has to concern the power leakages at different interesting points. Then, a natural question is how many interesting points should be used in a TA? We note that the number of interesting points one uses directly decides the profiling efficiency of TA. In light of this, we evaluate the optimal number of interesting points in simulated scenarios, and the evaluation results bring us an empirically useful formula. Then, in order to validate the empirical formula, we perform TA using power traces provided by DPA Contest v4.1. In the real scenario, the correlation method is used to select the interesting points, and the S-Box output of the 1st round AES encryption is chosen as the target intermediate value. Evaluation results show that the empirical formula is indeed correct and can be useful in practice.

Towards optimal leakage exploitation rate in template attacks

Under the assumption that one has a reference device identical or similar to the target device, and thus be well capable of characterizing power leakages of the target device, template attacks are widely accepted to be the most powerful side-channel attacks. However, the question of whether template attacks are really optimal in terms of the leakage exploitation rate is still unclear. In this paper, we present a negative answer to this crucial question by introducing a normalization process into classical template attacks. Specifically, our contributions are two-fold. On the theoretical side, we prove that normalized template attacks are better in terms of the leakage exploitation rate than classical template attacks; on the practical side, we evaluate the key-recovery efficiency of normalized template attacks, classical template attacks, and PCA-based template attacks. Evaluation results show that, compared with both classical template attacks and PCA-based template attacks, normalized template attacks are more effective. We note that, the normalization process does not depend on any special conditions and the computational price of the normalization process is of extremely low, and thus, it is very easy-to-implement in practice. Therefore, the normalization process should be integrated into classical template attacks as a necessary step, so that one can better understand practical threats of this kind of side-channel attacks. Copyright © 2016 John Wiley & Sons, Ltd.

Leakage Prototype Learning for Profiled Differential Side-Channel Cryptanalysis

Profiling in side-channel cryptanalysis is a powerful tool to assess the resistance of embedded cryptographic implementations and therefore embodies a powerful attack. The adversary has to have access to a second device, similar to the device under test, that he fully controls to conduct a profiling of physically observable information about secret internals. By knowledge of implementation details the adversary is able to nearly defeat any countermeasure, at least those of algorithmic nature. To date there exist different branches, including template attacks, stochastic model, and machine learning based approaches. In this work we propose a new attack called leakage prototype learning that aims for determining unbiased side-channel leakages instead of estimating them. Furthermore, it encompasses the locating, respectively selection, of leakage dependent time-instants with clear criteria. For one thing we provide a deep theoretical analysis by discussing mathematical foundations and properties, and for another thing a thorough analysis by practical means including performance comparisons to meaningful variants of several common profiled side-channel attacks.

An Improved Combinational Side-Channel Attack on S-Box in Block Cipher

After using side-channel information leaked by the FPGA chip which is embedded with a block cipher algorithm, there is a scheme called improved combinational side-channel attack. This scheme mainly aimed at logical circuits implemented in S-box in background of power consumption attack and we make a level of models by power consumption in combinational logic circuits which is engendered by glitches different from traditional sequential logical circuits which is engendered by flip in the output of register with the Hamming model. In addition, we take advantage of match algorithm in a linear model and in multivariate Gaussian model from template attack to process an important data twice and the key would be recovered. At last, we make a comparison between Hamming model and our model. And prove that this paper improved the attacking efficiency and accuracy and also provided a clue to the security cipher chip from countermeasures.

Electromagnetic side-channel attack based on PSO directed acyclic graph SVM

Machine learning has a powerful potential for performing the template attack (TA) of cryptographic device. To improve the accuracy and time consuming of electromagnetic template attack (ETA), a multi-class directed acyclic graph support vector machine (DAGSVM) method is proposed to predict the Hamming weight of the key. The method needs to generate K(K1)/2 binary support vector machine (SVM) classifiers and realizes the K-class prediction using a rooted binary directed acyclic graph (DAG) testing model. Further, particle swarm optimization (PSO) is used for optimal selection of DAGSVM model parameters to improve the performance of DAGSVM. By exploiting the electromagnetic emanations captured while a chip was implementing the RC4 algorithm in software, the computation complexity and performance of several multi-class machine learning methods, such as DAGSVM, one-versus-one (OVO)SVM, one-versus-all (OVA)SVM, Probabilistic neural networks (PNN), K-means clustering and fuzzy neural network (FNN) are investigated. In the same scenario, the highest classification accuracy of Hamming weight for the key reached 100%, 95.33%, 85%, 74%, 49.67% and 38% for DAGSVM, OVOSVM, OVASVM, PNN, K-means and FNN, respectively. The experiment results demonstrate the proposed model performs higher predictive accuracy and faster convergence speed.

Mahalanobis distance similarity measure based distinguisher for template attack

Under the assumption that power leakages at different interesting points follow multivariate normal distribution, maximum likelihood principle MLP can be used as an efficient distinguisher for temp...

A machine learning approach against a masked AES

Side-channel attacks challenge the security of cryptographic devices. A widespread countermeasure against these attacks is the masking approach. Masking combines sensitive variables with secret random values to reduce its leakage. In 2012, Nassar et al. (DATE, pp 1173–1178. IEEE, 2012) presented a new lightweight (low-cost) boolean masking countermeasure to protect the implementation of the Advanced Encryption Standard (AES) block-cipher. This masking scheme represents the target algorithm of the DPAContest V4 (http://www.dpacontest.org/home/, 2013). In this paper, we present the first machine learning attack against a specific masking countermeasure (more precisely the low-entropy boolean masking countermeasure of Nassar et al.), using the dataset of the DPAContest V4. We succeeded to extract each targeted byte of the key of the masked AES with \(7.8\) traces during the attacking phase with a strategy based solely on machine learning models. Finally, we compared our proposal with (1) a stochastic attack, (2) a strategy based on template attack and (3) a multivariate regression attack. We show that an attack based on a machine learning model reduces significantly the number of traces required during the attacking step compared to these profiling attacks when analyzing the same leakage information.

RETRACTED: A study on clustering-based power trace classification for side channel attacks

Template attack (TA) is an effective method to perform side channel attacks, which assumes that the attacker has the full control of a cryptographic device before attacking a similar one. In this paper, a TA method using semi-supervised learning strategy is used to relax this assumption. The effectiveness of our proposed method is confirmed by software simulations, in which the data are collected from the experiment that conducted on an 8 bit microcontroller. From the comparison that made between two supervised machine learning methods and the proposed one, it shows that the method in this paper has a higher success rate of key recovery.

Mahalanobis distance similarity measure based distinguisher for template attack

Under the assumption that power leakages at different interesting points follow multivariate normal distribution, maximum likelihood principle MLP can be used as an efficient distinguisher for template attack TA. Therefore, in key-recovery, one uses MLP to recover the correct key. In pattern recognition, Mahalanobis distance similarity measure MDSM is usually used to measure the similarity of two vectors in terms of their distance. A merit of MDSM is that, when measuring the similarity of two vectors, one takes the cross correlation between different variables into consideration. In this paper, we investigate the application of MDSM as a distinguisher in TA. We will show that there exists a certain relationship between MLP-based TA and MDSM-based TA under the assumption that the covariance matrices of different templates are identical. However, in MDSM-based TA, power leakages at different interesting points are not required to follow multivariate normal distribution. We perform practical experiments to evaluate the key-recovery efficiency of MDSM-based TA. Experimental results verify that, in the same attack scenario, the key-recovery efficiency of MDSM-based TA can be higher than that of MLP-based TA. Copyright © 2014 John Wiley & Sons, Ltd.

Template Attack with Adjustment Waveforms in Frequency Domain and its Evaluation

Recently, several illegal attacks against cryptographic circuits were reported. The template attack is one of the most dreadful attacks. To secure the safety of electronic devices in the future, into which cryptographic circuits have been incorporated, template attacks must be thoroughly studied. Therefore, this paper proposes a new template attack. It performs power analysis in frequency domain in order to improve the performance of analysis, while all previous template attacks perform in time domain. Moreover, the proposed template attack introduces an alignment technique and a selection technique of waveforms. The alignment technique, which corrects positions of waveforms, is suitable for template attacks. The selection technique utilizes equalization of the hamming-distance on each state to reduce noises of an analysis. Several experiments using cryptographic LSI prove the validity of the proposed method.

Power analysis attack: an approach based on machine learning

In cryptography, a side-channel attack is any attack based on the analysis of measurements related to the physical implementation of a cryptosystem. Nowadays, the possibility of collecting a large amount of observations paves the way to the adoption of machine learning techniques, i.e., techniques able to extract information and patterns from large datasets. The use of statistical techniques for side-channel attacks is not new. Techniques like the template attack have shown their effectiveness in recent years. However, these techniques rely on parametric assumptions and are often limited to small dimensionality settings, which limit their range of application. This paper explores the use of machine learning techniques to relax such assumptions and to deal with high dimensional feature vectors.

Random Forest profiling attack on advanced encryption standard

Random Forest, a non-parametric classifier, is proposed for byte-wise profiling attack on advanced encryption standard AES and shown to improve results on PIC microcontrollers, especially in high-dimensional variable spaces. It is shown in this research that data collected from 40 PIC microcontrollers exhibited highly non-Gaussian variables. For the full-dimensional dataset consisting of 50,000 variables, Random Forest correctly extracted all 16 bytes of the AES key. For a reduced set of 2,700 variables captured during the first round of the encryption, Random Forest achieved success rates as high as 100% for cross-device attacks on 40 PIC microcontrollers from four different device families. With further dimensionality reduction, Random Forest still outperformed classical template attack for this dataset, requiring fewer traces and achieving higher success rates with lower misclassification rate. The importance of analysing the system noise in choosing a classifier for profiling attack is examined and demonstrated through this work.

A New Second-Order Side Channel Attack Based on Linear Regression

Since the preliminary works of Kocher et al. in the nineties, studying and enforcing the resistance of cryptographic implementations against side channel analysis (SCA) is became a dynamic and prolific area of embedded security. Stochastic attacks, introduced by Schindler et al., form one of the main families of SCA and they offer a valuable alternative to template attacks which are known to be among the most efficient ones. However, stochastic attacks, as long as template attacks, have been initially designed for adversaries with a perfect copy of the target device in hand. Such a prerequisite makes them a pertinent tool when studying the implementations resistance against the most powerful adversaries, but it limits their pertinence as a cryptanalytic technique. Indeed, getting open access to a copy of the device under attack is difficult in practice and, even when possible, it remains difficult to exploit templates acquired on one device to attack another one. In light of this observation, several papers have been published to adapt stochastic attacks for contexts where the above prerequisite is no longer needed. They succeeded in defining practical attacks against unprotected implementations but no work was published until now to explain how stochastic attacks can be applied against secure implementations. In this paper, we deal with this issue. We first extend the previous analyses of stochastic attacks to highlight their core foundations. Then, we explain how they can be generalized to defeat first-order masking techniques, which are the main SCA countermeasures. Eventually, we illustrate the interest of the new attack by a series of experiments on simulated and real curves.

Improved algebraic side-channel attack on AES

In this paper, we present improvements of the algebraic side-channel analysis of the Advanced Encryption Standard (AES) proposed in the works of M. Renauld and F.-X. Standaert. In particular, we optimize the algebraic representation of both the AES block cipher and obtained side-channel information, in the form of Hamming weights of intermediate states, in order to speed up the attack and increase its success rate. We study the performance of our improved attack in both known and unknown plaintext/ciphertext attack scenarios. Our experiments indicate that in both cases the amount of required side-channel information is less than the one required in the attacks introduced earlier. Furthermore, we introduce a method for handling erroneous side-channel information, which allows our improved algebraic side-channel attack (IASCA) to partially escape the assumption of an error-free environment and thus become applicable in practice. We demonstrate the practical use of our IASCA by inserting predictions from a single-trace template attack.