Introduction to Software Countermeasures For Embedded Cryptography

Transcription

1 Introduction to Software Countermeasures For Embedded Cryptography David Vigilant UMPC Master, 1 st December, 2017

2 Outline 1 Context and Motivations 2 Basic Rules and Countermeasures Examples Regarding Timing Attacks Regarding SPA-SEMA Regarding Statistical Side-Channel Attacks Regarding Fault Attacks 3 Application Examples for some Cryptographic Algorithms Application examples for RSA-CRT Application examples for AES Conclusion 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 2 / 89

3 Outline 1 Context and Motivations 2 Basic Rules and Countermeasures Examples Regarding Timing Attacks Regarding SPA-SEMA Regarding Statistical Side-Channel Attacks Regarding Fault Attacks 3 Application Examples for some Cryptographic Algorithms Application examples for RSA-CRT Application examples for AES Conclusion 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 3 / 89

4 Resistance of Embedded Implementations Given a key size, the cryptographic algorithm has an inherent theoretical resistance to cryptanalysis But One implementation on one machine has its own resistance regarding implementation attacks 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 4 / 89

5 Attacks on Embedded Implementations Different techniques may be use to infer sensitive data of a cryptographic implementation: Timing Attacks (TA) Simple Side-Channel Attacks (SSCA) Statistical Side-Channel Attacks (DSCA) Fault Attacks (FA) ) Attack set up may be easier to put in place on embedded implementation, since the attacker has the device in hand 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 5 / 89

6 Attacks on Embedded Implementations Timing Attacks (TA) : Measure the crypto process timing for several input values ) From timing exploitation, sensitive data may be inferred 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 6 / 89

7 Attacks on Embedded Implementations Simple Side-Channel Attacks (SSCA) : Simple Power Analysis (SPA) : Measure power consumption of devices Simple ElectroMagnetism Analysis (SEMA) : Measure electromagnetic field emanated from devices ) From the exploitation of a trace of one execution, sensitive data may be inferred 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 7 / 89

8 Attacks on Embedded Implementations Statistical Side-Channel Attacks (DSCA) : Differential Power Analysis (DPA/DEMA) Correlation Power Analysis (CPA/CEMA) Linear Regression Analysis (LRA) Template Analysis (TPA) / Deep Learning Attacks (DLA) ) From traces of several executions, statistics may be exploited to deduce information about sensitive data 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 8 / 89

9 Attacks on Embedded Implementations Fault Attacks (FA) : Disturb the computation (Program flow or Data) by different ways Temperature Voltage/Clock Glitch EM injection Laser... ) From the exploitation of faulty (and correct) results or behaviors, sensitive data may be inferred 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 9 / 89

10 Hardware Limitations It seems difficult to implement protections all in hardware (HW): Surface limitation: ) Implementing insecure crypto algorithms all in HW can even be too costly HW imperfection (increased under extreme conditions): ) The combination of HW and software(sw) countermeasures(cms) may give more confidence Remark A lot of very efficient HW countermeasures exist, they are not discussed here 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 10 / 89

11 Embedded Crypto - Hardware Architecture Example of architecture in embedded devices: ) Coprocessor may implement arithmetic operations (e.g modular multiplication) ) Coprocessor may implement block ciphers with some CMs 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 11 / 89

12 Embedded Crypto - Hardware Architecture Embedded devices have typically limited resources: CPU: 8, 16, or 32 bits instructions Frequency: several dozens of Megahertz RAM: 1 or 2 Kbytes at most for crypto implementation NVM reserved for constants and program: several dozens of Kbytes ) The overhead added by the countermeasure must be monitored carefully 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 12 / 89

13 Certification and Resistance Assessment In the context of the certification (Common Criteria, EMVCo,...) of a product: Source code may be audited to detect weaknesses Implementation attacks may be tested in practice by mandated labs Vulnerabilities may lead to the failure of certification 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 13 / 89

14 Countermeasures and Intellectual Property Innovative countermeasures may be patented: It may protect from counterfeit Its usage may be licensed 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 14 / 89

15 Out of scope Definition White Box Crypto (WBC) is the name for embedded crypto running in an environment totally manageable by the attacker. In particular, the attacker has access to and has control of: Every processor register (including Program Counter) Every memory cell Code execution (i.e. complete debuging capability) ) WBC implementations need dedicated countermeasures ) WBC countermeasures are out of the scope of this presentation 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 15 / 89

16 Outline 1 Context and Motivations 2 Basic Rules and Countermeasures Examples Regarding Timing Attacks Regarding SPA-SEMA Regarding Statistical Side-Channel Attacks Regarding Fault Attacks 3 Application Examples for some Cryptographic Algorithms Application examples for RSA-CRT Application examples for AES Conclusion 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 16 / 89

17 Avoid Vulnerabilities regarding TA Rule Avoid any timing difference linked to input data and/or internal sensitive data that could lead to the secret recovery Countermeasure Balanced Branches: Balance sensitive "if...then..." branches by injecting events Countermeasure No Branch: Eliminate branches and design programs with constant timing 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 17 / 89

18 Avoid Vulnerabilities regarding TA Example: A user must be authenticated by entering a 8 byte key The program grants access to the user only if the key value is the expected one The program runs on an 8-bit CPU Remark: The expected security strength is st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 18 / 89

19 Avoid Vulnerabilities regarding TA Example (continued): Entered Key : x0 x1 x2 x3 x4 x5 x6 x7 Expected Key : k0 k1 k2 k3 k4 k5 k6 k7 Naive program: if x0 = k0 then if x1 = k1 then if x2 = k2 then if x3 = k3 then if x4 = k4 then if x5 = k5 then if x6 = k6 then if x7 = k7 then "user granted" else "failure" Each byte is compared one by one by the program 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 19 / 89

20 Avoid Vulnerabilities regarding TA Example (continued): Entered Key : x0 x1 x2 x3 x4 x5 x6 x7 Expected Key : k0 k1 k2 k3 k4 k5 k6 k7 Naive program: if x0 = k0 then if x1 = k1 then if x2 = k2 then if x3 = k3 then if x4 = k4 then if x5 = k5 then if x6 = k6 then if x7 = k7 then "user granted" else "failure" Each byte is compared one by one by the program 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 19 / 89

21 Avoid Vulnerabilities regarding TA Example (continued): Entered Key : x0 x1 x2 x3 x4 x5 x6 x7 Expected Key : k0 k1 k2 k3 k4 k5 k6 k7 Naive program: if x0 = k0 then if x1 = k1 then if x2 = k2 then if x3 = k3 then if x4 = k4 then if x5 = k5 then if x6 = k6 then if x7 = k7 then "user granted" else "failure" The attacker tries the 2 8 possible values for the i th byte, i starting from 0 The attacker measures the process timing 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 20 / 89

22 Avoid Vulnerabilities regarding TA Example (continued): Entered Key : x0 x1 x2 x3 x4 x5 x6 x7 Expected Key : k0 k1 k2 k3 k4 k5 k6 k7 Naive program: if x0 = k0 then if x1 = k1 then if x2 = k2 then if x3 = k3 then if x4 = k4 then if x5 = k5 then if x6 = k6 then if x7 = k7 then "user granted" else "failure" The attacker tries the 2 8 possible values for the i th byte, i starting from 0 The attacker measures the process timing 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 21 / 89

23 Avoid Vulnerabilities regarding TA Example (continued): Entered Key : x0 x1 x2 x3 x4 x5 x6 x7 Expected Key : k0 k1 k2 k3 k4 k5 k6 k7 Naive program: if x0 = k0 then if x1 = k1 then if x2 = k2 then if x3 = k3 then if x4 = k4 then if x5 = k5 then if x6 = k6 then if x7 = k7 then "user granted" else "failure" The attacker tries the 2 8 possible values for the i th byte, i starting from 0 The attacker measures the process timing If the guess is incorrect, the program ends after the comparison Shorter timing 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 22 / 89

24 Avoid Vulnerabilities regarding TA Example (continued): Entered Key : x0 x1 x2 x3 x4 x5 x6 x7 Expected Key : k0 k1 k2 k3 k4 k5 k6 k7 Naive program: if x0 = k0 then if x1 = k1 then if x2 = k2 then if x3 = k3 then if x4 = k4 then if x5 = k5 then if x6 = k6 then if x7 = k7 then "user granted" else "failure" The attacker tries the 2 8 possible values for the i th byte, i starting from 0 The attacker measures the process timing If the guess is correct, the program executes the next comparison Longer timing 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 23 / 89

25 Avoid Vulnerabilities regarding TA Example (continued): Entered Key : x0 x1 x2 x3 x4 x5 x6 x7 Expected Key : k0 k1 k2 k3 k4 k5 k6 k7 Naive program: if x0 = k0 then if x1 = k1 then if x2 = k2 then if x3 = k3 then if x4 = k4 then if x5 = k5 then if x6 = k6 then if x7 = k7 then "user granted" else "failure" The attacker tries the 2 8 possible values for the i th byte, i starting from 0 The attacker measures the process timing ) The security strength can be decreased to = 2 11!! 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 24 / 89

26 Avoid Vulnerabilities regarding TA Countermeasure Balanced Branches: Balance sensitive "if...then..." branches by injecting events Equal = 0, Difference = 1, Status = 0 for (i from 0 to 7) do { if xi = ki then Status = Equal else Status = Difference } if Status = Equal then "user granted" else "failure" (Timing balance to be verified practically) 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 25 / 89

27 Avoid Vulnerabilities regarding TA Countermeasure No Branch: Eliminate branches and design programs with constant timing Status = 0 for (i from 0 to 7) do Status = Status (xi ki) if Status = 0 then "user granted" else "failure" 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 26 / 89

28 Avoid Vulnerabilities regarding SPA-SEMA Rule Avoid any flow difference (leading to a difference in the trace) linked to input data and/or internal sensitive data that could lead to the secret recovery Countermeasure Balanced Branches: Introduce or Modify events to remove differences in the flow Countermeasure No Branch: Eliminate branches and design programs with constant flow 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 27 / 89

29 Avoid Vulnerabilities regarding SPA-SEMA Example: Implementation of a binary exponentiation algorithm Compute S = m d mod N, d =(d 0, d 1,...,d L 1 ) 2 Naive Binary Algorithm: A = 1 for (i from 0 to L 1) do { A = A A mod N if d i = 1 then A = A m mod N } return(a) 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 28 / 89

30 Avoid Vulnerabilities regarding SPA-SEMA Example: Implementation of a binary exponentiation algorithm Compute S = m d mod N, d =(d 0, d 1,...,d L 1 ) 2 Naive Binary Algorithm Trace: 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 29 / 89

31 Avoid Vulnerabilities regarding SPA-SEMA Example: Implementation of a binary exponentiation algorithm Compute S = m d mod N, d =(d 0, d 1,...,d L 1 ) 2 Naive Binary Algorithm Trace: 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 30 / 89

32 Avoid Vulnerabilities regarding SPA-SEMA Example (Continued): Countermeasure Balanced Branches: Introduce events to remove differences in the flow Square and Multiply Always Algorithm: A = 1 for (i from 0 to L 1) do { A = A A mod N if d i = 1 then A = A m mod N else B = A m mod N} (Dummy Multiplication) return(a) +33% process timing compared to naive method (Flow balance to be verified practically) 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 31 / 89

33 Avoid Vulnerabilities regarding SPA-SEMA Example (Continued): Countermeasure No Branch: Design programs with constant flow Montgomery Ladder Algorithm: A 0 = 1, A 1 = m for (i from 0 to L 1) do { A d i = A d i A di mod N A di = A 2 d i mod N } return(a 0 ) +33% process timing compared to naive method (Flow balance to be verified practically) 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 32 / 89

34 Avoid Vulnerabilities regarding DSCA Rule Given the power of an attacker, detect and remove the appearance of all intermediate sensitive values, that could lead to the secret recovery 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 33 / 89

35 Avoid Vulnerabilities regarding DSCA Example: The attacker is able to exploit a hamming weight leakage by CPA The attacker can choose the value of a byte X In the algorithm, X should be XORed with a sensitive byte Y 1 The attacker acquires power traces for different input values 2 The attacker localizes the targeted XOR, and synchronizes curves on this operation 3 For each of the 2 8 guesses, the attacker calculates the correlation coefficient between the hamming weight of XOR result, and the samples of the power traces acquired 4 The attacker can reduce the space of possible values for Y, if the correct guess gives one of the best scores 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 34 / 89

36 Avoid Vulnerabilities regarding DSCA Countermeasure Secret Sharing: If the attacker has the power to realize a DSCA of order n 1 If a sensitive value X is targeted The sensitive value X can be split in n random shares, X 0, X 1, X n 1 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 35 / 89

37 Avoid Vulnerabilities regarding DSCA Countermeasure Secret Sharing: If the attacker has the power to realize a DSCA of order n 1 If a sensitive value X is targeted The sensitive value X can be split in n random shares, X 0, X 1, X n 1 Example: Additive sharing X = X 1 + X 2, where X 1 and X 2 are random values Only X 1 and X 2 are manipulated in the implementation 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 36 / 89

38 Avoid Vulnerabilities regarding DSCA Countermeasure Secret Sharing: If the attacker has the power to realize a DSCA of order n 1 If a sensitive value X is targeted The sensitive value X can be split in n random shares, X 0, X 1, X n 1 Example: Boolean sharing X = X 1 X 2 X 3, where X 1, X 2 and X 3 are random values Only X 1, X 2 and X 3 are manipulated in the implementation 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 37 / 89

39 Avoid Vulnerabilities regarding DSCA Example: The attacker is able to exploit a hamming weight leakage by CPA The attacker can choose the value of a byte X In the algorithm, X should be XORed with a sensitive byte Y Program using the secret sharing countermeasure: Generate a random byte Z 0 Z 1 = Y Z 0 Z 1 = Z 1 X store Z 0 in RAM store Z 1 in RAM... ) the sensitive value Z is shared among Z 0 and Z 1 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 38 / 89

40 Avoid Vulnerabilities regarding DSCA Example: The attacker is able to exploit a hamming distance (HD) leakage by CPA The attacker can choose the value of a byte X In the algorithm, X should be XORed with a sensitive byte Y Program using the secret sharing countermeasure: Generate a random byte Z 0 Z 1 = Y Z 0 Z 1 = Z 1 X store Z 0 in RAM store Z 1 in RAM Z 0 and Z 1 transit on the BUS successively, BUS would pass from Z 0 to Z 1, HD = Z... 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 39 / 89

41 Avoid Vulnerabilities regarding DSCA Example: The attacker is able to exploit a hamming distance (HD) leakage by CPA The attacker can choose the value of a byte X In the algorithm, X should be XORed with a sensitive byte Y Program using the secret sharing countermeasure: Generate a random byte Z 0 Z 1 = Y Z 0 Z 1 = Z 1 X store Z 0 in RAM store Z 1 in RAM Z 0 and Z 1 transit on the BUS successively, BUS would pass from Z 0 to Z 1, HD = Z... 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 39 / 89

42 Avoid Vulnerabilities regarding DSCA Countermeasure Blinding - Randomization (Mathematical Context): Randomize a variable X into a random data X 0 such that good mathematical properties are kept (result can be recovered), and the targeted value does not appear. 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 40 / 89

43 Avoid Vulnerabilities regarding DSCA Example: Group exponentiation in ((Z/NZ), ), S = m d mod N, d is sensitive The attacker is able to choose values for m The attacker is able to exploit a hamming weight model leakage on successive powers of m mod N The attacker performs a DPA for each bit of d, building 2 sets depending on the hamming weight (high or small) of some bytes of the targeted intermediate powers of m Program using the Blinding countermeasure: Generate R a random number N 0 = N R S 0 = m d mod N 0 S = S 0 mod N 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 41 / 89

44 Avoid Vulnerabilities regarding DSCA Example: We define a group G as follows: : { (x, y) 2 (F p F p ) y 2 = x 3 + ax + b mod p } with p prime, and 4a b 2 mod p 6= 0 We define an addition law over : P + Q = R if P 6= Q, R is the intersection of the line passing through P and Q with, R is the opposite of R regarding the x axis if P = Q, R is the intersection of the tangent of in P, R is the opposite of R regarding the x axis We define 1 such that P + 1 = P, 8P 2. If the line passing through P and Q has no other intersection with, then P + Q = 1 (or P + P = 1) G, G =< g >, s.t. n.g = 1, n large prime These groups are commonly used in cryptography 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 42 / 89

45 Avoid Vulnerabilities regarding DSCA Example (continued): We consider the point multiplication S = d.m, d is a sensitive value M 2 G, d 2 N The attacker is able to choose values for the point M The attacker is able to exploit a hamming weight model leakage of the x-coordinate of successive multiples of M The attacker performs a DPA for each bit of d, building 2 sets depending on the x-coordinate hamming weight (high or small) on some bytes of the targeted intermediate multiples of M Program using the Blinding countermeasure: Generate r a random number d 0 = d +(n r) S = d 0.M 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 43 / 89

46 Avoid Vulnerabilities regarding DSCA Coming back to Previous Example: 1 The attacker acquires power traces for different input values 2 The attacker localizes the targeted XOR operation, and synchronizes curves on this operation 3 For each of the 2 8 guesses, the attacker calculates the correlation coefficient between the hamming weight of XOR result, and the power traces acquired 4 The attacker can reduce the space of possible values for Y, if the correct guess gives one of the best scores ) One critical step for the attacker is the timing localization of a specific sensitive operation, and its synchronization over multiple traces 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 44 / 89

47 Avoid Vulnerabilities regarding DSCA Rule Remove the possibility for an attacker to find "easily" a sensitive manipulation. Remove also the possibility to synchronize "easily" this manipulation over multiple traces 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 45 / 89

48 Avoid Vulnerabilities regarding DSCA Countermeasure Desynchronization: Introduce dummy events of random duration, before and/or after the targeted manipulation. Example: Program using the desynchronization (sensitive XOR X Generate a random R i=0 while ((+ + i)! = R) dummy operation Z = X Y... Y): 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 46 / 89

49 Avoid Vulnerabilities regarding DSCA Countermeasure Order Randomization of Operations: Perform operations in an unpredictable order, different each time, to avoid an easy synchronization on sensitive events Example: Program using the Order Randomization of Operations (sensitive XORs X i Y i, i = 0...7): for i from 0 to 7 in random order Z i = X i Y i ) Harder for the attacker to locate the XOR for a specific index 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 47 / 89

50 Avoid Vulnerabilities regarding FA-DFA Example: Program disturbance Program for a PIN verification: if ENTERED_PIN = STORED_PIN then GrantAccess() else Mute() 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 48 / 89

51 Avoid Vulnerabilities regarding FA-DFA Example: Program disturbance Normal behavior: The user enters a wrong PIN Program for a PIN verification: if ENTERED_PIN = STORED_PIN then GrantAccess() else Mute() 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 49 / 89

52 Avoid Vulnerabilities regarding FA-DFA Example: Program disturbance Faulty behavior: The user enters a wrong PIN, program is disturbed Program for a PIN verification: if ENTERED_PIN = STORED_PIN then ( Fault injected GrantAccess() else Mute() 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 50 / 89

53 Avoid Vulnerabilities regarding FA-DFA Rule Remove the possibility for an attacker to find "easily" the key timing in the program for an exploitable fault injection See previous countermeasures 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 51 / 89

54 Avoid Vulnerabilities regarding FA-DFA Rule Warning when executing or not fake operations depending on the secret value 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 52 / 89

55 Avoid Vulnerabilities regarding FA-DFA Example: Square and Multiply Always Algorithm: A = 1 for (i from 0 to L 1) do { A = A A mod N if d i = 1 then A = A m mod N else B = A m mod N } return(a) 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 53 / 89

56 Avoid Vulnerabilities regarding FA-DFA Example: Square and Multiply Always Algorithm: A = 1 for (i from 0 to L 1) do { A = A A mod N if d i = 1 then A = A m mod N ( Fault Injected else B = A m mod N } return(a) If the attacker introduces a fault in a real multiplication, result is faulty 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 54 / 89

57 Avoid Vulnerabilities regarding FA-DFA Example: Square and Multiply Always Algorithm: A = 1 for (i from 0 to L 1) do { A = A A mod N if d i = 1 then A = A m mod N else B = A m mod N ( Fault Injected } return(a) If the attacker introduces a fault in a fake multiplication, result is safe 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 55 / 89

58 Avoid Vulnerabilities regarding FA-DFA Rule Put error detectors in the code to guarantee the correct execution of the program 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 56 / 89

59 Avoid Vulnerabilities regarding DSCA Countermeasure Consistency check: Use verifications of consistency. Check that the program executes and ends as expected Example: Program using consistency check (inverse operation): C = AES 128 encrypt(p, K) X = AES 128 decrypt(c, K) if X 6= P "Fault Detected" There are many ways of checking consistency 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 57 / 89

60 Outline 1 Context and Motivations 2 Basic Rules and Countermeasures Examples Regarding Timing Attacks Regarding SPA-SEMA Regarding Statistical Side-Channel Attacks Regarding Fault Attacks 3 Application Examples for some Cryptographic Algorithms Application examples for RSA-CRT Application examples for AES Conclusion 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 58 / 89

61 RSA-CRT system RSA-CRT parameters: (N, e) Public key (p, q, d p, d q, i q ) Private key 8 N = p q, (p, q large primes) gcd((p 1), e) =1 >< gcd((q 1), e) =1 such that d p = e 1 mod (p 1) d q = e >: 1 mod (q 1) i q = q 1 mod p 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 59 / 89

62 Application examples for RSA-CRT Process of a naive RSA-CRT signature Input: m, p, q, d p, d q, i q, N m p = m mod p S p = m dp p mod p m q = m mod q S q = m dq q mod q S = S q + q (i q (S p S q ) mod p) return S 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 60 / 89

63 Application examples for RSA-CRT Process of a naive RSA-CRT signature Input: m, p, q, d p, d q, i q, N m p = m mod p S p = m dp p mod p m q = m mod q S q = m dq q mod q S = S q + q (i q (S p S q ) mod p) return S 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 61 / 89

64 Application examples for RSA-CRT Process of a naive RSA-CRT signature Input: m, p, q, d p, d q, i q, N m p = m mod p Vulnerability to TA S p = m dp p mod p m q = m mod q Vulnerability to TA S q = m dq q mod q S = S q + q (i q (S p S q ) mod p) return S An attacker could proceed by dichotomy to find min(p, q) ) If m < min(p, q), no modular reduction ) If m min(p, q), modular reduction 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 62 / 89

65 Application examples for RSA-CRT Process of a naive RSA-CRT signature (+Vulnerability Corrected) Input: m, p, q, d p, d q, i q, N m = m + N m p = m mod p S p = m dp p mod p m q = m mod q S q = m dq q mod q S = S q + q (i q (S p S q ) mod p) return S ) whatever m, modular reduction 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 63 / 89

66 Application examples for RSA-CRT Process of a naive RSA-CRT signature Input: m, p, q, d p, d q, i q, N m p = m mod p S p = m dp p mod p m q = m mod q S q = m dq q mod q = i q (S p S q ) mod p S = S q + q RETURN(S) 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 64 / 89

67 Application examples for RSA-CRT Process of a naive RSA-CRT signature Input: m, p, q, d p, d q, i q, N m p = m mod p S p = m dp p mod p m q = m mod q S q = m dq q mod q = i q (S p S q ) mod p S = S q + q ( Let us considering sensitivity to DSCA RETURN(S) 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 65 / 89

68 Application examples for RSA-CRT DSCA on the recombination in RSA-CRT 1 The attacker makes several acquisitions and collects the signature results 2 The attacker tries to discover q byte per byte from MSB to LSB (most to least significant) 3 The attacker makes an hypothesis for the i th byte : b = 2 8 b + hypothesis(q i ) (Starting from b = 0) 4 The attacker computes! = S/b 5 The attacker tries to correlate! with when it is manipulated in the recombination 6 If the guess for the byte is correct,! values are highly correlated with 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 66 / 89

69 Application examples for RSA-CRT Process of a naive RSA-CRT signature (+Vulnerability Corrected) Input: m, p, q, d p, d q, i q, N, e m p = m mod p S p = m dp p mod p m q = m mod q S q = m dq q mod q i p = p 1 mod q S = p i p S q + q i q S p mod N RETURN(S) ) Remove the appearance of by using Gauss formula for the recombination 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 67 / 89

70 Application examples for RSA-CRT Process of a naive RSA-CRT signature Input: m, p, q, d p, d q, i q, N m p = m mod p S p = m dp p mod p m q = m mod q S q = m dq q mod q S = S q + q (i q (S p S q ) mod p) return S 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 68 / 89

71 Application examples for RSA-CRT Process of a naive RSA-CRT signature (with FA effect) Input: m 2 Z N, p, q, d p, d q, i q m p = m mod p S p = m dp mod p ( Fault Injection m q = m mod q S q = m dq mod q S = S q + q (i q (S p S q ) mod p) return S ) Vulnerability to FA: gcd(s S mod N, N) =q 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 69 / 89

72 Application examples for RSA-CRT Process of a naive RSA-CRT signature (with FA effect) Why gcd(s S mod N, N) =q?? ( S S mod q S is s.t. S 6= S mod p ( S S mod N 0 mod q S S mod N is s.t. S S mod N 6= 0 mod p ) S S mod N is a multiple of q 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 70 / 89

73 Application examples for RSA-CRT Process of a naive RSA-CRT signature (+Vulnerability Corrected) Input: m, p, q, d p, d q, i q, N, e m p = m mod p S p = m dp p mod p m q = m mod q S q = m dq q mod q S = S q + q (i q (S p S q ) mod p) if (S e mod N = m) RETURN(S) else "Fault Detected" Use a consistency check with inverse operation 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 71 / 89

74 Application examples for RSA-CRT Process of a naive RSA-CRT signature (+ Shamir CM FA), e not available Input: m, p, q, d p, d q, i q, N select t a small random Compute d s.t. d mod (p 1) =d p and d mod (q 1) =d q m p = m mod pt S pt = m d p mod pt m q = m mod qt S qt = m d q mod qt S p = S pt mod p, S q = S qt mod q, S = S q + q (i q (S p S q ) mod p) if (S pt mod t = S qt mod t) RETURN(S) else "Fault Detected" Use a consistency check with modulus extension 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 72 / 89

75 Application examples for AES-128 Process of a naive AES-128 Input: K = 16 byte Key P = 16 byte Plaintext State P RoundKey K AddRoundKey(State, RoundKey) Round 0 while(round < 9) { SubBytes(State) ShiftRow(State) MixColumn(State) KeySchedule(RoundKey, Round) AddRoundKey(State, RoundKey) Round ++ } SubBytes(State) ShiftRow(State) 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 73 / 89

76 Application examples for AES-128 Process of a naive AES-128 Input: K = 16 byte Key P = 16 byte Plaintext State P RoundKey K AddRoundKey(State, RoundKey) ( Considering sensitivity to DSCA Round 0 while(round < 9) { SubBytes(State) ShiftRow(State) MixColumn(State) KeySchedule(RoundKey, Round) AddRoundKey(State, RoundKey) Round ++ } SubBytes(State) ShiftRow(State) 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 74 / 89

77 Application examples for AES-128 Secret sharing and AddRoundKey: Split the state S = S 0, S 1,...,S 15 into 2 shares: S1 and S2 s.t. S = S1 S2 Thus AddRoundKey operation on state S = S 0, S 1,...,S 15 can be performed for one of the 2 shares: e.g. S1 = S1 Values of S1 and S2 before and after AddRoundKey not predictable K 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 75 / 89

78 Application examples for AES-128 Process of a naive AES-128 Input: K = 16 byte Key P = 16 byte Plaintext State P RoundKey K AddRoundKey(State, RoundKey) Round 0 while(round < 9) { SubBytes(State) ShiftRow(State) MixColumn(State) KeySchedule(RoundKey, Round) AddRoundKey(State, RoundKey) Round ++ } SubBytes(State) ShiftRow(State) 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 76 / 89

79 Application examples for AES-128 Process of a naive AES-128 Input: K = 16 byte Key P = 16 byte Plaintext State P RoundKey K AddRoundKey(State, RoundKey) Round 0 while(round < 9) { SubBytes(State) ( Considering sensitivity to DSCA at round 0 ShiftRow(State) MixColumn(State) KeySchedule(RoundKey, Round) AddRoundKey(State, RoundKey) Round ++ } SubBytes(State) ShiftRow(State) 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 77 / 89

80 Application examples for AES-128 The SubBytes operation: Aply 16 times (each byte) a non linear operation: {0, 1} 8!{0, 1} 8 Can be seen as an inversion composed with an affine transformation in GF(2 8 ) Can be implemented as a Look Up Table (LUT) of 256 bytes 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 78 / 89

81 Application examples for AES-128 Secret sharing and SubBytes with LUT: The basic method Split the 16-byte state S = S 0 S 1... S 15 into 2 shares maskeds and T: S = maskeds with 16-byte parameter T = X X... X, X 2 [0, 255] SubBytes operation on state S = S 0, S 1,...,S 15 can be performed on the share maskeds but with a modified Substitution Box (pre-computation): for y from 0 to 255 Sbox 0 [y X] =Sbox[y] X T ) Requires 256 extra bytes in RAM ) There are much more elaborate methods 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 79 / 89

82 Outline 1 Context and Motivations 2 Basic Rules and Countermeasures Examples Regarding Timing Attacks Regarding SPA-SEMA Regarding Statistical Side-Channel Attacks Regarding Fault Attacks 3 Application Examples for some Cryptographic Algorithms Application examples for RSA-CRT Application examples for AES Conclusion 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 80 / 89

83 Conclusion It is not always easy to verify that a countermeasure is efficient By Code Audit But Compiler could remove countermeasures But Cache could create vulnerabilities Practical Realization of the Attacks May be costly to realize all possible attacks But if no vulnerability found, was the attack set up efficient? 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 81 / 89

84 Conclusion It is not always easy to verify that a countermeasure is efficient Hand Methods List exhaustively all intermediate variables (regarding DSCA) List exhaustively all fault effects (regarding FA) How to be confident that the list is exhaustive? Towards the usage of Formal Methods Use trusted provers to prove the resistance For now, mainly used for fault resistance assessment only ) Difficult to guarantee that the abstraction level is correct ) Proof is often correct only for a specific implementation (HW specific) 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 82 / 89

85 Conclusion It is not always easy to identify the assets Assets may be different depending on the application RSA signature S = m d mod N RSA decipher S = m d mod N 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 83 / 89

86 Conclusion It is not always easy to identify the assets Assets may be different depending on the application RSA signature S = m d mod N RSA decipher S = m d mod N 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 84 / 89

87 Conclusion It is not always easy to identify the assets Assets may be different depending on the application RSA cipher m = S e mod N RSA verification m = S e mod N 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 85 / 89

88 Conclusion It is not always easy to identify the assets Assets may be different depending on the application RSA cipher m = S e mod N RSA verification m = S e mod N Comparison that comes after 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 86 / 89

89 Conclusion It is not always easy to identify all attack paths All existing attacks should be considered: the list is huge Attacks are always in motion, new ones appear regularly 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 87 / 89

90 Some must references (not exhaustive) On the Importance of Eliminating Errors in Cryptographic Computations, Boneh et al., BellCore Report, 96 Method and apparatus for protecting PK schemes from timing and fault attacks, Shamir 97 DPA, Kocher et al. CHES 99 Timing Attacks on Implementations of DH, RSA, DSS, and Other Systems, Kocher et al, 99 DES and DPA: the "Duplication" Method, Goubin et al., CHES 99 Resistance against DPA for ECC, Coron et al, CHES 99 1 st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 88 / 89

91 Some must references (not exhaustive) PKCS#1: RSA Cryptographic Standard, RSA Laboratory ANSI X9.63, Public Key Cryptography for the financial Industry FIPS 197: AES, NIST, 01 A Sound Method for Switching between Boolean and Arithmetic Masking, Goubin et al., CHES 01 The Montgomery Powering Ladder, Joye et al., CHES 02 DFA on AES, Dusart et al, 03 CPA with a leakage model, Brier et al., CHES st December, 2017 Introduction to Software Countermeasures For Embedded Cryptography 89 / 89