15 research outputs found
An information theoretic necessary condition for perfect reconstruction
This article proposes a new information theoretic necessary condition for
reconstructing a discrete random variable based on the knowledge of a set
of discrete functions of . The reconstruction condition is derived from the
Shannon's Lattice of Information (LoI) \cite{Shannon53} and two entropic
metrics proposed respectively by Shannon and Rajski.
This theoretical material being relatively unknown and/or dispersed in
different references, we provide a complete and synthetic description of the
LoI concepts like the total, common and complementary informations with
complete proofs. The two entropic metrics definitions and properties are also
fully detailled and showed compatible with the LoI structure. A new geometric
interpretation of the Lattice structure is then investigated that leads to a
new necessary condition for reconstructing the discrete random variable
given a set ,..., of elements of the lattice generated by
.
Finally, this condition is derived in five specific examples of
reconstruction of from a set of deterministic functions of : the
reconstruction of a symmetric random variable from the knowledge of its sign
and of its absolute value, the reconstruction of a binary word from a set of
binary linear combinations, the reconstruction of an integer from its prime
signature (Fundamental theorem of arithmetics) and from its reminders modulo a
set of coprime integers (Chinese reminder theorem), and the reconstruction of
the sorting permutation of a list from a set of 2-by-2 comparisons. In each
case, the necessary condition is shown compatible with the corresponding
well-known results.Comment: 17 pages, 9 figure
Side-Channel Expectation-Maximization Attacks
Block ciphers are protected against side-channel attacks by masking. On one hand, when the leakage model is unknown, second-order correlation attacks are typically used. On the other hand, when the leakage model can be profiled, template attacks are prescribed. But what if the profiled model does not exactly match that of the attacked device?
One solution consists in regressing on-the-fly the scaling parameters from the model. In this paper, we leverage an Expectation-Maximization (EM) algorithm to implement such an attack. The resulting unprofiled EM attack, termed U-EM, is shown to be both efficient (in terms of number of traces) and effective (computationally speaking). Based on synthetic and real traces, we introduce variants of our U-EM attack to optimize its performance, depending on trade-offs between model complexity and epistemic noise. We show that the approach is flexible, in that it can easily be adapted to refinements such as different points of interest and number of parameters in the leakage model
Formal Security Proofs via Doeblin Coefficients: Optimal Side-channel Factorization from Noisy Leakage to Random Probing
Masking is one of the most popular countermeasures to side-
channel attacks, because it can offer provable security. However, depend-
ing on the adversaryâs model, useful security guarantees can be hard
to provide. At first, masking has been shown secure against t-threshold
probing adversaries by Ishai et al. at Cryptoâ03. It has then been shown
secure in the more generic random probing model by Duc et al. at Euro-
cryptâ14. Prouff and Rivain have introduced the noisy leakage model to
capture more realistic leakage at Eurocryptâ13. Reduction from noisy
leakage to random probing has been introduced by Duc et al. at Euro-
cryptâ14, and security guarantees were improved for both models by
Prest et al. at Cryptoâ19, Duc et al. in Eurocryptâ15/J. Cryptolâ19,
and Masure and Standaert at Cryptoâ23. Unfortunately, as it turns out,
we found that previous proofs in either random probing or noisy leakage
models are flawed, and such flaws do not appear easy to fix.
In this work, we show that the Doeblin coefficient allows one to over-
come these flaws. In fact, it yields optimal reductions from noisy leakage
to random probing, thereby providing a correct and usable metric to
properly ground security proofs. This shows the inherent inevitable cost
of a reduction from the noisy leakages to the random probing model. We
show that it can also be used to derive direct formal security proofs using
the subsequence decomposition of Prouff and Rivain
Removing the Field Size Loss from Duc et al.\u27s Conjectured Bound for Masked Encodings
At Eurocrypt 2015, Duc et al. conjectured that the success rate of a side-channel attack targeting an intermediate computation encoded in a linear secret-sharing, a.k.a masking with shares, could be inferred by measuring the mutual information between the leakage and each share separately. This way, security bounds can be derived without having to mount the complete attack. So far, the best proven bounds for masked encodings were nearly tight with the conjecture, up to a constant factor overhead equal to the field size, which may still give loose security guarantees compared to actual attacks. In this paper, we improve upon the state-of-the-art bounds by removing the field size loss, in the cases of Boolean masking and arithmetic masking modulo a power of two. As an example, when masking in the AES field, our new bound outperforms the former ones by a factor . Moreover, we provide theoretical hints that similar results could hold for masking in other fields as well
Side-Channel Expectation-Maximization Attacks
International audienceBlock ciphers are protected against side-channel attacks by masking. On one hand, when the leakage model is unknown, second-order correlation attacks are typically used. On the other hand, when the leakage model can be profiled, template attacks are prescribed. But what if the profiled model does not exactly match that of the attacked device? One solution consists in regressing on-the-fly the scaling parameters from the model. In this paper, we leverage an Expectation-Maximization (EM) algorithm to implement such an attack. The resulting unprofiled EM attack, termed U-EM, is shown to be both efficient (in terms of number of traces) and effective (computationally speaking). Based on synthetic and real traces, we introduce variants of our U-EM attack to optimize its performance, depending on trade-offs between model complexity and epistemic noise. We show that the approach is flexible, in that it can easily be adapted to refinements such as different points of interest and number of parameters in the leakage model
La véritable (et méconnue) théorie de l'information de Shannon
International audienceClaude Shannon, who laid the foundations of the celebrated information theory in 1948, preferred the term âcommunication theoryâ. In a 1953 paper, he proposed a new approach to information and its lattice structure. Surprisingly, this remained relatively unknown. We briefly recall the features of this theory and the characteristics that could explain its poor impact; finally we consider possible interesting developments.Claude Shannon, qui a posĂ© les bases de la cĂ©lĂšbre thĂ©orie de lâinformation en 1948, prĂ©fĂ©rait parler de thĂ©orie de la communication. Dans un article de 1953, il a proposĂ© une nouvelle approche de lâinformation et de sa structure en treillis. Cela nâa Ă©tonnamment eu quâun trĂšs faible Ă©cho. Nous rappelons briĂšvement les traits principaux de cette thĂ©orie et les caractĂ©ristiques qui pourraient en expliquer lâoubli, et nous envisageons enfin les dĂ©veloppements intĂ©ressants quâelle pourrait susciter
Unprofiled expectation-maximization attack
International audienceBlock ciphers are often protected against side-channel attacks by masking. When traces are available for each key hypothesis, the attacker usually resorts to templates attacks with a profiling phase. Lemke-Rust & Paar suggested at CHES2007 a way to profile templates for Gaussian mixture models, with the use of the well-known Expectation-Maximization (EM) algorithm.In this work, we present a new attack, âunprofiled-EMâ (U-EM) that does not use the knowledge of the masks nor requires a profiling phase. This is done by âon-the-flyâ regression of the coefficients of a stochastic model using the EM algorithm. Compared to previous methods, it is easy to implement, computa- tionally tractable and efficient in terms of success rate or guessing entropy. We discuss several variations of U-EM and compare their performances on simula- tions and on real DPA contest traces. The best attack scenario depends on the trade-off between measurement noise and epistemic noise
Side-Channel Expectation-Maximization Attacks
Block ciphers are protected against side-channel attacks by masking. On one hand, when the leakage model is unknown, second-order correlation attacks are typically used. On the other hand, when the leakage model can be profiled, template attacks are prescribed. But what if the profiled model does not exactly match that of the attacked device?One solution consists in regressing on-the-fly the scaling parameters from the model. In this paper, we leverage an Expectation-Maximization (EM) algorithm to implement such an attack. The resulting unprofiled EM attack, termed U-EM, is shown to be both efficient (in terms of number of traces) and effective (computationally speaking). Based on synthetic and real traces, we introduce variants of our U-EM attack to optimize its performance, depending on trade-offs between model complexity and epistemic noise. We show that the approach is flexible, in that it can easily be adapted to refinements such as different points of interest and number of parameters in the leakage model
La véritable (et méconnue) théorie de l'information de Shannon
International audienceClaude Shannon, who laid the foundations of the celebrated information theory in 1948, preferred the term âcommunication theoryâ. In a 1953 paper, he proposed a new approach to information and its lattice structure. Surprisingly, this remained relatively unknown. We briefly recall the features of this theory and the characteristics that could explain its poor impact; finally we consider possible interesting developments.Claude Shannon, qui a posĂ© les bases de la cĂ©lĂšbre thĂ©orie de lâinformation en 1948, prĂ©fĂ©rait parler de thĂ©orie de la communication. Dans un article de 1953, il a proposĂ© une nouvelle approche de lâinformation et de sa structure en treillis. Cela nâa Ă©tonnamment eu quâun trĂšs faible Ă©cho. Nous rappelons briĂšvement les traits principaux de cette thĂ©orie et les caractĂ©ristiques qui pourraient en expliquer lâoubli, et nous envisageons enfin les dĂ©veloppements intĂ©ressants quâelle pourrait susciter
Be my guess: Guessing entropy vs. success rate for evaluating side-channel attacks of secure chips
International audienceIn a theoretical context of side-channel attacks, optimal bounds between success rate and guessing entropy are derived with a simple majorization (Schur-concavity) argument. They are further theoretically refined for different versions of the classical Hamming weight leakage model, in particular assuming apriori equiprobable secret keys and additive white Gaussian measurement noise. Closed-form expressions and numerical computation are given. A study of the impact of the choice of the substitution box with respect to side-channel resistance reveals that its nonlinearity tends to homogenize the expressivity of success rate and guessing entropy. The intriguing approximate relation GE = 1/SR is observed in the case of 8-bit bytes and low noise