38 research outputs found
Similar operation template attack on RSA-CRT as a case study
A template attack, the most powerful side-channel attack methods, usually first builds the leakage profiles from a controlled profiling device, and then uses these profiles to recover the secret of the target device. It is based on the fact that the profiling device shares similar leakage characteristics with the target device. In this study, we focus on the similar operations in a single device and propose a new variant of the template attack, called the similar operation template attack (SOTA). SOTA builds the models on public variables (e.g., input/output) and recovers the values of the secret variables that leak similar to the public variables. SOTA’s advantage is that it can avoid the requirement of an additional profiling device. In this study, the proposed SOTA method is applied to a straightforward RSA-CRT implementation. Because the leakage is (almost) the same in similar operations, we reduce the security of RSA-CRT to a hidden multiplier problem (HMP) over GF(q), which can be solved byte-wise using our proposed heuristic algorithm. The effectiveness of our proposed method is verified as an entire prime recovery procedure in a practical leakage scenario
Secret Key Leakage from Public Key Perturbation of DLP-based Cryptosystems
Finding efficient countermeasures for cryptosystems against fault attacks is challenged by a constant discovery of flaws in designs. Even elements, such as public keys, that do not seem critical must be protected. From the attacks against RSA, we develop a new attack of DLP-based cryptosystems, built in addition on a lattice analysis to recover DSA public keys from partially known nonces. Based on a realistic fault model, our attack only requires 16 faulty signatures to recover a 160-bit DSA secret key within a few minutes on a standard PC. These results significantly improves the previous public element fault attack in the context of DLP-based cryptosystems
Reconfigurable Architectures for Cryptographic Systems
Field Programmable Gate Arrays (FPGAs) are suitable platforms for implementing cryptographic
algorithms in hardware due to their flexibility, good performance and low power consumption.
Computer security is becoming increasingly important and security requirements
such as key sizes are quickly evolving. This creates the need for customisable hardware designs
for cryptographic operations capable of covering a large design space. In this thesis we explore
the four design dimensions relevant to cryptography - speed, area, power consumption and
security of the crypto-system - by developing parametric designs for public-key generation and
encryption as well as side-channel attack countermeasures. There are four contributions.
First, we present new architectures for Montgomery multiplication and exponentiation based
on variable pipelining and variable serial replication. Our implementations of these architectures
are compared to the best implementations in the literature and the design space is explored in
terms of speed and area trade-offs.
Second, we generalise our Montgomery multiplier design ideas by developing a parametric
model to allow rapid optimisation of a general class of algorithms containing loops with dependencies
carried from one iteration to the next. By predicting the throughput and the area of
the design, our model facilitates and speeds up design space exploration.
Third, we develop new architectures for primality testing including the first hardware architecture
for the NIST approved Lucas primality test. We explore the area, speed and power
consumption trade-offs by comparing our Lucas architectures on CPU, FPGA and ASIC.
Finally, we tackle the security issue by presenting two novel power attack countermeasures
based on on-chip power monitoring. Our constant power framework uses a closed-loop
control system to keep the power consumption of any FPGA implementation constant. Our
attack detection framework uses a network of ring-oscillators to detect the insertion of a shunt
resistor-based power measurement circuit on a device's power rail. This countermeasure is
lightweight and has a relatively low power overhead compared to existing masking and hiding
countermeasures
Side-Channel Analysis: Countermeasures and Application to Embedded Systems Debugging
Side-Channel Analysis plays an important role in cryptology, as
it represents an important class of attacks against cryptographic
implementations, especially in the context of embedded systems
such as hand-held mobile devices, smart cards, RFID tags, etc.
These types of attacks bypass any intrinsic mathematical security
of the cryptographic algorithm or protocol by exploiting observable
side-effects of the execution of the cryptographic operation that
may exhibit some relationship with the internal (secret) parameters
in the device. Two of the main types of side-channel attacks are
timing attacks or timing analysis, where the relationship between
the execution time and secret parameters is exploited; and power
analysis, which exploits the relationship between power consumption
and the operations being executed by a processor as well as the
data that these operations work with. For power analysis, two
main types have been proposed: simple power analysis (SPA) which
relies on direct observation on a single measurement, and
differential power analysis (DPA), which uses multiple
measurements combined with statistical processing to extract
information from the small variations in power consumption
correlated to the data.
In this thesis, we propose several countermeasures to these
types of attacks, with the main themes being timing analysis
and SPA. In addition to these themes, one of our contributions
expands upon the ideas behind SPA to present a constructive
use of these techniques in the context of embedded systems
debugging.
In our first contribution, we present a countermeasure against
timing attacks where an optimized form of idle-wait is proposed
with the goal of making the observable decryption time constant
for most operations while maintaining the overhead to a minimum.
We show that not only we reduce the overhead in terms of execution
speed, but also the computational cost of the countermeasure,
which represents a considerable advantage in the context of
devices relying on battery power, where reduced computations
translates into lower power consumption and thus increased
battery life. This is indeed one of the important themes for
all of the contributions related to countermeasures to side-
channel attacks.
Our second and third contributions focus on power analysis;
specifically, SPA. We address the issue of straightforward
implementations of binary exponentiation algorithms (or scalar
multiplication, in the context of elliptic curve cryptography)
making a cryptographic system vulnerable to SPA. Solutions
previously proposed introduce a considerable performance
penalty. We propose a new method, namely Square-and-Buffered-
Multiplications (SABM), that implements an SPA-resistant binary
exponentiation exhibiting optimal execution time at the cost of
a small amount of storage --- O(\sqrt(\ell)), where \ell is the
bit length of the exponent. The technique is optimal in the
sense that it adds SPA-resistance to an underlying binary
exponentiation algorithm while introducing zero computational
overhead.
We then present several new SPA-resistant algorithms that result
from a novel way of combining the SABM method with an alternative
binary exponentiation algorithm where the exponent is split in
two halves for simultaneous processing, showing that by combining
the two techniques, we can make use of signed-digit representations
of the exponent to further improve performance while maintaining
SPA-resistance. We also discuss the possibility of our method
being implemented in a way that a certain level of resistance
against DPA may be obtained.
In a related contribution, we extend these ideas used in SPA and
propose a technique to non-intrusively monitor a device and trace
program execution, with the intended application of assisting in
the difficult task of debugging embedded systems at deployment
or production stage, when standard debugging tools or auxiliary
components to facilitate debugging are no longer enabled in the
device. One of the important highlights of this contribution is
the fact that the system works on a standard PC, capturing the
power traces through the recording input of the sound card
One Truth Prevails: A Deep-learning Based Single-Trace Power Analysis on RSA–CRT with Windowed Exponentiation
In this paper, a deep-learning based power/EM analysis attack on the state-of-the-art RSA–CRT software implementation is proposed. Our method is applied to a side-channel-aware implementation with the Gnu Multi-Precision (MP) Library, which is a typical open-source software library. Gnu MP employs a fixed-window exponentiation, which is the fastest in a constant time, and loads the entire precomputation table once to avoid side-channel leaks from multiplicands. To conduct an accurate estimation of secret exponents, our method focuses on the process of loading the entire precomputation table, which we call a dummy load scheme. It is particularly noteworthy that the dummy load scheme is implemented as a countermeasure against a simple power/EM analysis (SPA/SEMA). This type of vulnerability from a dummy load scheme also exists in other cryptographic libraries. We also propose a partial key exposure attack suitable for the distribution of errors inthe secret exponents recovered from the windowed exponentiation. We experimentally show that the proposed method consisting of the above power/EM analysis attack, as well as a partial key exposure attack, can be used to fully recover the secret key of the RSA–CRT from the side-channel information of a single decryption or a signature process
Tamper-Resistant Arithmetic for Public-Key Cryptography
Cryptographic hardware has found many uses in many ubiquitous and pervasive security devices with a small form factor, e.g. SIM cards, smart cards, electronic security tokens, and soon even RFIDs. With applications in banking, telecommunication, healthcare, e-commerce and entertainment, these devices use cryptography to provide security services like authentication, identification and confidentiality to the user. However, the widespread adoption of these devices into the mass market, and the lack of a physical security perimeter have increased the risk of theft, reverse engineering, and cloning. Despite the use of strong cryptographic algorithms, these devices often succumb to powerful side-channel attacks. These attacks provide a motivated third party with access to the inner workings of the device and therefore the opportunity to circumvent the protection of the cryptographic envelope. Apart from passive side-channel analysis, which has been the subject of intense research for over a decade, active tampering attacks like fault analysis have recently gained increased attention from the academic and industrial research community. In this dissertation we address the question of how to protect cryptographic devices against this kind of attacks. More specifically, we focus our attention on public key algorithms like elliptic curve cryptography and their underlying arithmetic structure. In our research we address challenges such as the cost of implementation, the level of protection, and the error model in an adversarial situation. The approaches that we investigated all apply concepts from coding theory, in particular the theory of cyclic codes. This seems intuitive, since both public key cryptography and cyclic codes share finite field arithmetic as a common foundation. The major contributions of our research are (a) a generalization of cyclic codes that allow embedding of finite fields into redundant rings under a ring homomorphism, (b) a new family of non-linear arithmetic residue codes with very high error detection probability, (c) a set of new low-cost arithmetic primitives for optimal extension field arithmetic based on robust codes, and (d) design techniques for tamper resilient finite state machines
Side-channel Attacks on Blinded Scalar Multiplications Revisited
In a series of recent articles (from 2011 to 2017), Schindler et al. show that exponent/scalar blinding is not as effective a countermeasure as expected against side-channel attacks targeting RSA modular exponentiation and ECC scalar multiplication. Precisely, these works demonstrate that if an attacker is able to retrieve many randomizations of the same secret, this secret can be fully recovered even when a significative proportion of the blinded secret bits are erroneous. With a focus on ECC, this paper improves the best results of Schindler et al. in the specific case of structured-order elliptic curves. Our results show that larger blinding material and higher error rates can be successfully handled by an attacker in practice. This study also opens new directions in this line of work by the proposal of a three-steps attack process that isolates the attack critical path (in terms of complexity and success rate) and hence eases the development of future solutions
Security and Privacy in Heterogeneous Wireless and Mobile Networks: Challenges and Solutions
abstract: The rapid advances in wireless communications and networking have given rise to a number of emerging heterogeneous wireless and mobile networks along with novel networking paradigms, including wireless sensor networks, mobile crowdsourcing, and mobile social networking. While offering promising solutions to a wide range of new applications, their widespread adoption and large-scale deployment are often hindered by people's concerns about the security, user privacy, or both. In this dissertation, we aim to address a number of challenging security and privacy issues in heterogeneous wireless and mobile networks in an attempt to foster their widespread adoption. Our contributions are mainly fivefold. First, we introduce a novel secure and loss-resilient code dissemination scheme for wireless sensor networks deployed in hostile and harsh environments. Second, we devise a novel scheme to enable mobile users to detect any inauthentic or unsound location-based top-k query result returned by an untrusted location-based service providers. Third, we develop a novel verifiable privacy-preserving aggregation scheme for people-centric mobile sensing systems. Fourth, we present a suite of privacy-preserving profile matching protocols for proximity-based mobile social networking, which can support a wide range of matching metrics with different privacy levels. Last, we present a secure combination scheme for crowdsourcing-based cooperative spectrum sensing systems that can enable robust primary user detection even when malicious cognitive radio users constitute the majority.Dissertation/ThesisPh.D. Electrical Engineering 201
Secure group key agreement
As a result of the increased popularity of group-oriented applications and protocols, group communication occurs in many different settings: from network multicasting to application layer tele- and video-conferencing. Regardless of the application environment, security services are necessary to provide communication privacy and integrity. This thesis considers the problem of key management in a special class of groups, namely dynamic peer groups. Key management, especially in a group setting, is the corner stone for all other security services. Dynamic peer groups require not only initial key agreement but also auxiliary key agreement operations such as member addition, member exclusion and group fusion. We discuss all group key agreement operations and present a concrete protocol suite, CLIQUES, which offers all of these operations. By providing the first formal model for group key establishment and investigating carefully the underlying cryptographic assumptions as well as their relations, we formally prove the security of a subset of the protocols based on the security of the Decisional Diffie-Hellman assumption; achieving as a side-effect the first provably secure group key agreement protocolMit der Verbreitung offener Netze, insbesondere des Internets, fand auch
die Gruppenkommunikation eine rasante Verbreitung. Eine Vielzahl heutiger
Protokolle sind gruppen-orientiert: angefangen bei Multicast-Diensten
in der Netzwerkschicht bis hin zu Videokonferenzsystemen auf der Anwendungsschicht. Alle diese Dienste haben Sicherheitsanforderungen wie Vertraulichkeit und Integrität zu erfüllen, die den Einsatz kryptographischer
Techniken und die Verfügbarkeit gemeinsamer kryptographischen Schlüssel
oft unumgänglich machen.
In der folgenden Doktorarbeit betrachte ich dieses grundlegendste Problem
der Gruppenkommunikation, nämlich das Schlüsselmanagement, für dynamische Gruppen, die sogenannten "Dynamic Peer-Groups\u27;. Die Dynamik dieser Gruppen erfordert nicht nur initialen Schlüsselaustausch innerhalb einer Gruppe sondern auch sichere und effiziente Verfahren für die Aufnahme neuer und den Ausschluß alter Gruppenmitglieder. Ich diskutiere alle dafür notwendigen Dienste und präsentiere CLIQUES, eine Familie von Protokollen, die diese Dienste implementiert. Ich gebe erstmalig eine formale Definition fü sicheres Gruppen-Schlüsselmanagement und beweise die Sicherheit der genannten Protokolle basierend auf einer kryptographischen Standardannahme, der "Decisional Diffie-Hellman\u27; Annahme. Diese Sicherheitsbetrachtung wird durch eine detaillierte Untersuchung dieser Annahme und ihrer Relation zu verwandten Annahmen abgeschlossen
Secure group key agreement
As a result of the increased popularity of group-oriented applications and protocols, group communication occurs in many different settings: from network multicasting to application layer tele- and video-conferencing. Regardless of the application environment, security services are necessary to provide communication privacy and integrity. This thesis considers the problem of key management in a special class of groups, namely dynamic peer groups. Key management, especially in a group setting, is the corner stone for all other security services. Dynamic peer groups require not only initial key agreement but also auxiliary key agreement operations such as member addition, member exclusion and group fusion. We discuss all group key agreement operations and present a concrete protocol suite, CLIQUES, which offers all of these operations. By providing the first formal model for group key establishment and investigating carefully the underlying cryptographic assumptions as well as their relations, we formally prove the security of a subset of the protocols based on the security of the Decisional Diffie-Hellman assumption; achieving as a side-effect the first provably secure group key agreement protocolMit der Verbreitung offener Netze, insbesondere des Internets, fand auch
die Gruppenkommunikation eine rasante Verbreitung. Eine Vielzahl heutiger
Protokolle sind gruppen-orientiert: angefangen bei Multicast-Diensten
in der Netzwerkschicht bis hin zu Videokonferenzsystemen auf der Anwendungsschicht. Alle diese Dienste haben Sicherheitsanforderungen wie Vertraulichkeit und Integrität zu erfüllen, die den Einsatz kryptographischer
Techniken und die Verfügbarkeit gemeinsamer kryptographischen Schlüssel
oft unumgänglich machen.
In der folgenden Doktorarbeit betrachte ich dieses grundlegendste Problem
der Gruppenkommunikation, nämlich das Schlüsselmanagement, für dynamische Gruppen, die sogenannten "Dynamic Peer-Groups';. Die Dynamik dieser Gruppen erfordert nicht nur initialen Schlüsselaustausch innerhalb einer Gruppe sondern auch sichere und effiziente Verfahren für die Aufnahme neuer und den Ausschluß alter Gruppenmitglieder. Ich diskutiere alle dafür notwendigen Dienste und präsentiere CLIQUES, eine Familie von Protokollen, die diese Dienste implementiert. Ich gebe erstmalig eine formale Definition fü sicheres Gruppen-Schlüsselmanagement und beweise die Sicherheit der genannten Protokolle basierend auf einer kryptographischen Standardannahme, der "Decisional Diffie-Hellman'; Annahme. Diese Sicherheitsbetrachtung wird durch eine detaillierte Untersuchung dieser Annahme und ihrer Relation zu verwandten Annahmen abgeschlossen