sidechannel attack pitfalls侧信道攻击陷阱.pptVIP

Side-Channel Attack Pitfalls Kris Tiri Side-Channels Information leakage from implementation Example: safecracker feels tumblers impactingand opens lock without trying each combination Similarly: hacker observes time/power and cracks cipher without trying each key Device in normal operation, no physical harm Covert channel without conspiracy/consent Side-Channel Attacks in a Nutshell Power Analysis Example Unprotected ASIC AESwith 128-bit datapath, key scheduling Measurement: Ipeak in round 11 Estimation: HamDistance of 8 internal bits Comparison: correlation Key bits easily found despite algorithmic noise 128-bit key under 3 min. New Design Dimension Mitigations conflict with common design goals Resistance analysis, precise mitigation cost not always well understood Design trade-offs difficult to make Side-Channel Pitfalls Resource sharing Reduces HW to implement certain functionality Results in interaction and competition Create + facilitate observation side-channel info Optimization features Improves a system’s performance/cost Typical case optimized, corner case leaks info Create side-channel info Increased visibility/functionality Provides more information or introduces new interactions Facilitate observation side-channel info Example using Cache Attacks Resource sharing Cache accesses observed by spy process evicting cached data of crypto Optimization features Cache implemented to overcome latency penalty Increased visibility Performance counters provide accurate picture Side-Channel Classification Simple attacks e.g. textbook square-and-multiply RSA algorithm Number of measurements, not simplicity attack Requires precise knowledge of implementation and effect on measurement sample Relatively easy to protect from Differential attacks Many observations Statistical techniques Leakage channel Timing, power / EMA Mitigation Strategies Timing attacks Typically target variable instruction flow? main focus on public key ciphers Exponent an