Eloi Sanfelix - Hardware security: Side Channel Attacks [RootedCON 2011]
•Download as PPTX, PDF•
1 like•2,442 views
This document discusses hardware security and side channel attacks. It introduces side channel analysis techniques like differential power analysis and fault injection attacks. It explains how an attacker can use power traces or faults to deduce secret keys by forming hypotheses about intermediate values. Countermeasures are discussed like random delays, double checking results, and protecting code flow integrity. Developers are advised to get their systems tested since side channel vulnerabilities can be subtle.
Report
Share
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (13)
Similar to Eloi Sanfelix - Hardware security: Side Channel Attacks [RootedCON 2011]
Similar to Eloi Sanfelix - Hardware security: Side Channel Attacks [RootedCON 2011] (20)
More from RootedCON
More from RootedCON (20)
Eloi Sanfelix - Hardware security: Side Channel Attacks [RootedCON 2011]
- 1. Hardware Security: Side Channel AttacksEloi Sanfelixeloi@riscure.com
- 2. Protecting your deviceTips for developersIntroduction: Secure hardware and attacksSide Channel AnalysisConclusionPerturbation attacksAgenda
- 3. Protecting your deviceTips for developersIntroduction: Secure hardware and attacksSide Channel AnalysisConclusionPerturbation AttacksAgenda
- 5. Example: smart cardsISO 7816Image source: dhgate.com
- 6. Secure device attack typesLogicalInvasiveSide Channel
- 7. AgendaProtecting your deviceTips for developersIntroduction: Secure hardware and attacksConclusionPerturbation AttacksSide Channel Analysis
- 8. Side Channels IRL8Iraq invades Kuwait...
- 9. A different threat modelBut we also need toBeware of leakageProtect run-time integrityCommon paradigmDo not trust inputPreserve confidentiality and integrity in outputLocal: at input / outputPervasive: throughout codeCodeCode▼
- 10. Side channel attacksPassive (SCA): Read ‘hidden’ signalstimingpower consumptionelectromagnetic emissionActive (FI): Signal injectionpower glitcheselectromagnetic pulses10
- 12. 12Smart card power reader
- 13. Power / EM tracesSignal leakage from busses, registers, ALUs, etc PIN verification attempts
- 14. 'Simple' Power AnalysisAnalyse few traces (vs statistical analysis)
- 15. Example: COMP128-1 crypto algorithm
- 16. C code: x = table_512[k+d]k+d < 256k+d ≥ 256
- 17. Data influenceExample trace of software DES on smart card
- 18. Leaks hamming weight of dataProfit! (data)noise
- 19. Statistical data detectionWhere is data processed in presence of noise?Statistical data detection00001111Where is data processed in presence of noise?
- 20. Collect many traces with different data (n > 1000)
- 21. Use known uniformly random input/output data
- 22. We focus on one bit of one variable in the processGroup by known dataAverage traceSubtractDifferential trace
- 23. Differential traceInput: n traces with known variable (e.g. input or output)
- 24. Output: 1 trace with indication where bit causes trace differencesBut…you promised keys !?Keys are used in small chunks
- 25. Mixed with input data Use hypothesis testing!H0H1H2H3
- 26. Hypothesis incorrectGroup traces according to hypothesis
- 27. If the actual data does not match the hypothesis:
- 28. We group the wrong traces
- 29. Statistically, the averages will be similar
- 30. Result: noiseAverage trace0Subtract1010110Group by wrong data
- 31. Hypothesis correctGroup traces according to hypothesis
- 32. If the actual data does match the hypothesis:
- 33. Only differences in measurement caused by different data between averages
- 34. Result: peaks!Average trace0Subtract0001111Group by right data
- 35. Tricky...
- 36. DPA on (3)DES K1K2K15K16?!
- 37. Use hypothesis testingHypothesis testing; each 6-bit subkey value leads to different hypothesis for the sbox outputSbox outputH0H1...H63Tracesn
- 38. Calculate differential tracesSbox outputH0H1H56H63n64 differential traces
- 39. Find best candidate64 differential tracesRepeat for other sboxes and rounds for full key
- 40. DEMOs
- 41. Reality checkSmart card manufacturers know about DPA
- 42. Often difficult finding correct filtering and alignment
- 44. Countermeasures in hard- and software
- 45. On embedded systems, not so much...AgendaProtecting your deviceTips for developersSide Channel AnalysisConclusionPerturbation attacksIntroduction: Secure hardware and attacks
- 46. Fault InjectionChip/Hardware operating conditionsTemperatureFrequencyPower supply (input voltage)Localized energy increase (Laser, EM, others?)Fault injection modifies operating conditionsBring chip outside normal situation to make it fail
- 48. Voltage glitching10A power dip at the moment of reading a memory cell
- 49. Fault Injection EffectsLaser/voltageglitchData/Memory manipulation
- 50. Fault Injection EffectsLaser/voltageglitchProgram flow manipulation
- 51. Differential Fault AnalysisCorrect resultCorrect resultCorrect resultCorrect resultDFAFaulty resultFaulty resultFaulty resultFaulty result
- 52. RSA and RSA-CRTRSA works with modular exponentiationsRSA-CRT splits big exponentiation in two smaller onesS = Md(mod n)dp = d mod (p-1)dq = d mod (q-1)K = p-1 mod qSp = Mdp mod pSq = Mdq mod qS = ( ( (Sq - Sp)*K ) mod q ) * p + Sp
- 53. Bellcore attack on RSA-CRTSuppose single fault into one exponentiationNow, subtract S’ from SNow take gcd(s-s’,n)gcd(x*p,p*q) = pCompute q=n/p and you’re done!An attack variant exists that only requires S’ and MS’ = ( ( (S’q - Sp)*K ) mod q ) * p + SpS - S’ = (((Sq - Sp)*K) mod q)*p - (((S’q - Sp)*K) mod q)*p = (x1-x2)*p mod N
- 55. AgendaProtecting your deviceTips for developersSide Channel AnalysisConclusionPerturbation AttacksIntroduction: Secure hardware and attacks
- 56. SCA CountermeasuresApplication levelNEVER brew your own cryptoIntroduce random delays between critical functionsAvoid branches related to secret dataSee helpful patterns in reference [1]Operating System levelMasking and hiding countermeasures. See e.g. [2],[3]Have your systems testedSide channel vulnerabilities can be very subtle!
- 57. Fault Injection countermeasuresDouble check critical resultsEncrypt-Decrypt-CompareTwo comparisons in authentication checksAdd a random wait between the two checksProtect code flow integrityIntroduce ‘shadow program counters’Never output wrong resultsMost DFA attacks are based on this!See more at [1]
- 58. Protecting your deviceTips for developersSide Channel AnalysisPerturbation AttacksIntroduction: Secure hardware and attacksConclusionAgenda
- 59. ConclusionDevices under attacker’s controlPhysical threats need to be consideredComplete protection very difficultCountermeasures based on increasing attack effortSide channel problems are difficult to spotCompiler and hardware behavior could break your code!Impossible to know without testing
- 61. References[1] Secure Application Programming in the Presence of Side Channel Attacks – Download link[2] Power Analysis Attacks – http://www.dpabook.org[3] Cryptography Research Inc. – DPA Countermeasures[4] Riscure – Publications[5] E. Bhiam, A.Shamir – Differential Fault Analysis of Secret Key Cryptosystems