revealing the secrets of success · 7 institut mines-tÉlÉcom revealing the secrets of success, a....

Post on 24-Aug-2020

3 Views

Category:

Documents

0 Downloads

Preview:

Click to see full reader

TRANSCRIPT

INSTITUT MINES-TÉLÉCOM

Revealing the secrets of successTheoretical efficiency of side-channel distinguishers

Annelie Heuser, Sylvain Guilley, Olivier Rioul

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL

Outline

2

‣Motivation ‣ State of the art‣ New metric: success metric (SM)‣ Empirical evaluation‣ Closed-form expression of SM‣ Outlook

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL

Problem Statement

3

Interclass Information Analysis

Kolmogorov-Smirnov AnalysisLinear Regression

Linear Correlation Analysis

Difference of Means

Mutual Information Analysis

Empirically‣ Real measurements (portable?)‣ Simulations (model suitable?)

How to compare side-channel distinguishers?

Theoretically‣ Is this realistic?

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL

State of the Art

[Standaert+09] Unified framework for the analysis of side-channel key recovery attacks‣ Estimated success rate (o-th order)‣ Estimated guessing entropy

4

EmpiricalCriteria

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL

[WhitnallOswald11] A fair evaluation framework for comparing side-channel distinguisher‣ Theoretical evaluation criteria

(e.g., nearest distinguishing margin)‣ Distinguisher is provided with full information about the

leakage‣ New insights in the theoretical behavior

5

TheoreticalCriteria

State of the Art

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL6

[Fei+12] Algorithmic confusion analysis for DPA‣ Closed-form expression of one-bit DPA for the

success rate using a multivariate normal CDF

Algorithmic confusion coefficient

Signal-to-noise ratio

Number of traces

State of the Art

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL7

TheoreticalCriteria

EmpiricalCriteria

displays the practical outcome

ad-hoc computation

displays the theoretical distinguishability

equivalent to the practical outcome?

State of the Art

coincides with the empirical success rate

New metric

more insights on parameters

Closed-form expression

reflects relevant parameters

only DPA;multivariate CDF estimation

“simple“ closed-form expression for any additive distinguisher

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL8

measured leakage with

RV modeling the key

secret key on the device

sensitive variable depending on the key

sensitive variable - correct key guess

Notation

Side-channel Model

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL9

distinguisher

difference

estimateddifference

Distinguisher

Notation

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL10

EstimationBias

EstimationVariance

such that the mean-squared error of the estimation is given by

Statistical parameter from Estimation Theory

Notation

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL11

Failure rate

To derive our new metric we start with the theoretical success rate:

Success Metric

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL12

1. Union bound

Normal approximation Chebyshev/ Chernov bound

Approximate the failure rate:

Failure rate

Success Metric

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL13

2. Normal Approximation

exponentially for large m

Success Metric

Assumption

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL14

3. First order approximation

Since we achieved exponentially convergence

FR = 1 - SR

Success Metric

Relation to failure rate Normal approximation

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL15

Derived from the theoretical success rate through approximations, we define the success metric as

Success Metric

Roughly speaking

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL16

is the first DES Sbox

in each setting we conducted 300 experiments

Empirical Evaluation

‣ Correlation Power Analysis (CPA)‣ Mutual Information Analysis (MIA)‣ Histograms‣ Parzen window

‣ Kolmogorov-Smirnov Analysis (KSA)

Setup

Distinguisher

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL17

Noise level = 4

Empirical Evaluation

SR and SM coincide

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL18

Relative Distinguishing Margin

Empirical Evaluation

[WhitnallOswald11]

TheoreticalCriteria

does not depends on‣ number of traces‣ estimation method

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL19

Using 50 traces

Empirical Evaluation

Using 500 traces

SM depends on the number of traces

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL20

Using 500 traces

Empirical Evaluation

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL21

Closed-form expressions for additive distinguisher

Success Metric

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL22

==

One-bit models

[Fei+12] only valid for one-bit models

Generalized Confusion Coefficient

We assume that that the sensitive variable is normalized

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL23

CPA

one-bit DPA

Closed-form Expression

‣ Introduced the success metric that is derived from the theoretical success rate

‣ Success metric coincide with the empirical success rate

‣ We are able to make predictions about crossings that are not visible in the SR

‣ Extended the idea of confusion‣ Derived a closed-form expression for the

success metric that is easier to compute

‣ Explain the ranking of various distinguishers

‣ Determine the influence of the leakage model ‣ Sbox‣ Mask‣ nonlinear relationship

between X and Y*‣ Determine the influence of the

estimation

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL24

Conclusion & Future Work

Future Work

Conclusion

INSTITUT MINES-TÉLÉCOM REVEALING THE SECRETS OF SUCCESS, A. HEUSER, S. GUILLEY, O. RIOUL

Questions?

25

top related