In recent years key rank has become an important aspect of side-channel analysis, enabling an evaluation lab to analyse the security of a device after a side-channel attack. In particular, it enables the lab to do so when the enumeration effort would be beyond their computing power. Due to its importance there has been a host of work investigating key rank over the last few years. In this work we build upon the existing literature to make progress on understanding various properties of key rank. We begin by showing when two different  scoring methods  will provide the same rank. This has been implicitly used by various algorithms in the past but here it is shown for a large class of functions. We conclude by giving the computational complexity of key rank. This implies that it is unlikely for, considerably, better algorithms to exist

Daniel P.  Martin

Marco Martinoli

Cryptology ePrint Archive

A Note on Key RankDaniel P. Martin1 and Marco Martinoli21 School of Mathematics, University of Bristol, Bristol, BS8 1TW, UK,and the Heilbronn Institute for Mathematical Research, Bristol, UK.? ? ?dan.martin@bristol.ac.uk2 Department of Computer Science, University of Bristol, Merchant VenturersBuilding, Woodland Road, Bristol, UK.marco.martinoli@bristol.ac.uk†Abstract. In recent years key rank has become an important aspect ofside-channel analysis, enabling an evaluation lab to analyse the securityof a device after a side-channel attack. In particular, it enables the labto do so when the enumeration effort would be beyond their computingpower. Due to its importance there has been a host of work investigatingkey rank over the last few years.In this work we build upon the existing literature to make progress onunderstanding various properties of key rank. We begin by showing whentwo different “scoring methods” will provide the same rank. This hasbeen implicitly used by various algorithms in the past but here it is shownfor a large class of functions. We conclude by giving the computationalcomplexity of key rank. This implies that it is unlikely for, considerably,better algorithms to exist.Keywords: Side-channel Attacks, Key Rank, Scoring Methods1 IntroductionIn 2013 Veyrat-Charvillion et al. [11] give the first key rank algorithm, whichenabled evaluation labs to estimate the remaining security of a device, withouthaving to enumerate all of the keys. In the half decade that has followed there hasbeen a host of work producing alternate key rank algorithms providing differenttrade-offs between efficiency and accuracy [11,1,6,5,10,2,8].While the majority of work uses probabilities, other works assume scores of aspecific form arise from the side-channel distinguisher [10,2]. It has been statedin the literature that this makes research utilising scores not comparable withthose which utilise probabilities [4]. In this work we show that for the majorityscores required this is simply not the case.The work of Martin et al. [10] converts the probabilities from the side-channelattack into additive integers, where the smallest is the most likely. They argue? ? ? This research was carried out while D. P. Martin was a member of the Departmentof Computer Science, University of Bristol.† Funded by European Union’s Horizon 2020 research and innovation programmeMarie Sklodowska-Curie ITN ECRYPT-NET (Project Reference 643161).why this is possible. This mechanism is improved in a follow up work [9]. RecentlyDavid and Wool [4] show that if a function f is applied to the probabilities, suchthat the probabilities can only increase, then the rank applied to these new scoreswill upperbound the actual rank. Similar techniques were recently used [8] toshow the equivalence of the rank by Martin et al. [10] and that of Glowacz etal. [6].Every time an equivalence property between different types of scores hasbeen required, it has been shown specifically for the required example. Thismeans that some of these ideas have been repeated several times, across variouspapers. In this paper we give a wide range of functions which can be applied tothe scores whilst still preserving the rank. We also give a function that allowsmultiplicative scores to be converted to additive scores in a rank preservingmanner. We conclude by giving the computational complexity of key rank. Thisimplies we do not expect a more efficient key rank algorithm than the onesalready in the literature, without a significant breakthrough in computationalcomplexity.1.1 OutlineIn Section 2 we give any required notation and recap the definition of key rank.Section 3 gives a broad range of functions which can be applied to the outputprobabilities of a side-channel distinguisher while still keeping the rank invariant.In Section 4 we show the hardness of the key rank problem, showing that it isunlikely for a more efficient algorithm to exist.2 PreliminariesWe recall notions, definitions and facts from the literature which are useful tocontextualise our problem. These include basic notations from probability theoryas well as an informal discussion on what is generally understood to be the keyrank in the literature. We will conclude with its formal definition.2.1 Random VariablesWe denote vectors by lowercase boldface letters and we index them using sub-script notation. In this paper we make exclusive use of discrete random variablesdefined over finite spaces. We denote them by uppercase italic letters, and writeX ∼ D to say a random variable X follows the distribution D. We sometimes callthe latter prior distribution when we want to highlight the difference with thedistribution obtained by conditioning on some extra information T . We denotethe latter by DT . The probability of a random variable X assuming a certainvalue x is defined as and denoted byPr[X = x ] = D(x)2or just by Pr[x ] if X is clear from the context. If additional information T isavailable, then we writePr[X = x | T ] = DT (x)to express the probability conditioned on such information.2.2 Key RankEvery cryptographic primitive or protocol, once implemented, is vulnerable toimplementation-specific attacks. These range from simple bugs exposing the se-cret in plaintext, to sophisticated attacks which exploit side-channels to infersomething on the key being used. The latter scenario is the background andstarting point of our work: we assume a cryptographically relevant operation,i.e. using a secret an adversary wishes to learn, is implemented and exposed toside-channels. The latter can be generically thought of as carriers of informationon the secret key and we denote them by T . Every time we use the variable T ,then, we implicitly assume the presence of some sort of dependency on the secretkey.Let K be the space of all possible subkeys, m be the number of subkeys (thusimplying that the space of keys is Km) and n = |K| be the number of candidatesper subkey3. A side-channel attack against the implementation of a cipher hav-ing Km as key space is mounted and soft information are obtained. These canbe described as being m posterior probability distributions conditioned on theleakage in the side-channels T , one per subkey. We denote the random variablemodeling the ith position of a key k ∈ Km by Ki, and by DTi its posteriorprobability distribution. Such distribution can be thought of as being the ithmarginal of a distribution DT over the entire key space.Informally speaking, DTi might tell if there are values which are very unlikelyor very likely to be correct based on the side-channel information T . The idealcase from an adversarial perspective is when each DTi assigns the value 1 to thecorrect value in K and 0 to the others, meaning that the full secret key has beencompletely disclosed. We are now in a position to recap the definition of keyrank.Definition 1 (Key Rank). The key rank of a key k ∈ Km is defined as thenumber of keys with a probability greater than k. FormallyrankDT (k) = |{t ∈ Km : Pr[k | T ] < Pr[t | T ]}|=∣∣∣∣∣{t ∈ Km : Pr[m∧i=1(Ki = ki)∣∣∣∣∣ T]< Pr[m∧i=1(Ki = ti)∣∣∣∣∣ T]}∣∣∣∣∣ .3 Our work does not require all subkeys to be the same size. However, we do so toease explanation.3In this work, as with the majority of work in the key rank literature, weassume that the leakage on each of the subkeys is independent, i.e. thatPr[m∧i=1(Ki = ki)∣∣∣∣∣ T]=m∏i=1Pr[(Ki = ki) | T ] .While our definition does not need such assumption, it will be required in theanalysis that follows.Definition 1 is very formal in its use of posterior probabilities on single sub-keys to derive a rank for the full key. Often, practical reasons forbid a designerto adopt such a strict definition, and is easier and more useful to use an ap-proximation of probabilities called scores. We denote the score the ith subkey kiassumes on value j ∈ K by Si,j and the function returning the score of a full keyby S(k). They can be quite different from probabilities, in particular they can beadditive rather than multiplicative. We therefore give an alternative definitionof key rank for additive scores.Definition 2 (Additive Key Rank). The additive key rank of a key k ∈ Kmis defined as the number of keys with a score greater than k. Formallyrank+DT (k) = |{t ∈ Km : S(k) < S(t)}|=∣∣∣∣∣{t ∈ Km :m∑i=1Si,ki <m∑i=1Si,ti}∣∣∣∣∣ .For the remaining of this paper, we avoid conditioning on T whenever wewrite a probability, thus leaving it implicit. We do this for the sake of notationalconvenience.3 EquivalenceDespite the fact that the idea of equivalence of distinguishers is not novel [7], ourfirst contribution lies in formally defining under which circumstances the rankof a key remains unmodified even if the representation used to compute it doeschange. In other words, we define a class of functions that modify the underlyingprobabilities or scores without affecting the relative order of candidate keys, thuspreserving the notion of rank.Definition 3 (Rank Preserving). Let f be a function over the reals. Then fis called rank preserving if, for all k ∈ Kmrankf(DT ) (k) = rankDT (k)where f(DT ) represents applying the function f to every DTi (j). Equivalently, fis additive rank preserving if, for all k ∈ Kmrank+f(DT ) (k) = rank+DT (k) .4In this section we show the class of functions which can be applied to theprobabilities, without adjusting the rank of the key. We stress that this makesprobabilities and their function thereof comparable.Theorem 1. Functions in the class f(x) = a·xb for a, b ∈ R are rank preserving.Proof. For a key t to be in the set counted by rankf(DT ) (k), we have that:m∏i=1f(Pr[ki ]) <m∏i=1f(Pr[ti ])m∏i=1a · Pr[ki ]b <m∏i=1a · Pr[ti ]bamm∏i=1Pr[ki ]b< amm∏i=1Pr[ti ]bm∏i=1Pr[ki ]b<m∏i=1Pr[ti ]b(m∏i=1Pr[ki ])b<(m∏i=1Pr[ti ])bm∏i=1Pr[ki ] <m∏i=1Pr[ti ] .Thus the key t is also counted by rankDT (k). utA regularity result holds when scores are defined as the logarithm of prob-abilities. In particular, a connection between rank and additive rank exists, asproven in the following theorem.Theorem 2. Given f(x) = log x, for all k ∈ Km we have thatrankDT (k) = rank+f(DT ) (k) .5Proof. For a key t to be in the set counted by rank+f(DT ) (k), we have that:m∑i=1Si,ki <m∑i=1Si,tim∑i=1f(Pr[ki ]) <m∑i=1f(Pr[ti ])m∑i=1log Pr[ki ] <m∑i=1log Pr[ti ]2∑mi=1 log Pr[ki ] < 2∑mi=1 log Pr[ti ]m∏i=12log Pr[ki ] <m∏i=12log Pr[ti ]m∏i=1Pr[ki ] <m∏i=1Pr[ti] .Thus the key t is also counted by rankD(k). utThe above two theorems can be combined to give the following corollary foradditive rank.Corollary 1. Functions in the class f(x) = a + bx for a, b ∈ Z+ are additiverank preserving.There are two logical ways in which key rank can be defined. The first isas we have done above where the rank only counts keys with a strictly betterscore. The second is where keys with an equal score is also counted. We use theformer as it is the most commonly used in the literature and assumes a morepowerful adversary. However, the latter additionally leads to the following niceresult, which does not hold for the former.Theorem 3. Let f be a rank preserving function and let dxe be the ceiling func-tion, then:rankf(DT ) (k) ≤ rankdf(DT )e (k)rank+f(DT ) (k) ≤ rank+df(DT )e (k) .Proof. The first statement follows directly from Proposition 1 of David andWool [4]. The second statement follows from the first and monotonicity of thelogarithm function. utFinally, we note that any function ` applied to the final product of probabil-ities, `(∏mi=1 Pr[ki]), trivially preserves the rank providing that the function ismonotonically increasing.63.1 Functions of SubkeysAll classes of functions we have provided a proof for were applied to full keyranks. In certain scenarios, it might be interesting to also investigate functionsapplied to probabilities of subkeys.Definition 4 (Order Preserving). Let f be a function over the reals and letus write K = {j1, . . . jn}. Then f is called order preserving if for all i ≤ m itholds thatf(Pr[ki = j1 ]) < . . . < f(Pr[ki = jn ])⇔ Pr[ki = j1 ] < . . . < Pr[ki = jn ] .The above definition is particularly useful when the extend-and-prune [3]technique is applied, i.e. when positions are targeted sequentially and leakage onlater ones include a subset of guesses for previous ones. The size of the subsetis determined by a pruning strategy, which is deployed to discard (a.k.a. prune)particularly unlikely guesses.After the ith position has been targeted and a posterior distribution has beenobtained for that particular position (including information on all the previousones), an attacker has to decide how many to prune based on a pruning strategy.To the best of our knowledge, there is no comprehensive study comparing severalstrategies, and a subset of them involve making a decision based on the order ofthe probabilities Pr[ki = j ]. Thus, every function preserving the relative orderof posterior probabilities does not affect the pruning strategies. Depending onthe function f , strategies relying on the actual values of the probabilities, ratherthan just on their order, might be unaffected too.We investigate this matter no further because we consider it out of scopefor the current paper as preserving the order of probabilities for subkeys has noguarantee of preserving the rank: the latter crucially relies on values of proba-bilities of subkeys (or scores thereof), meaning that if these are changed despitethe order being preserved, the final rank will likely be different.Theorem 4. There exists a function f which is order preserving but which isnot rank preserving.Proof. When m = 1 the two definition perfectly coincide, hence we fix m = n =2. There are then two subkeys k1 and k2 which can assume two possible values.We denote them by j1 and j2. We summarise in the following table the posteriorprobabilities once an attack has taken place.k1 k2j1 0.4 0.2j2 0.6 0.8The correct key is k = (j1, j2), which has rank 2 since the key (j2, j2) has anhigher product of probabilities. We now define f(x) = x−0.7. It is trivially order7preserving because it simply applies a translational constant to each probability,hence leaving the order in each column unchanged. However, we now obtain thatk has rank 4 because all other keys have an higher product of scores. ut4 Hardness of Key RankIn this section we discuss the version of key rank where all the scores are positiveintegers which combine additively and the smaller the integer the more likelythe subkey. From Section 3, this is equivalent to the original definition of keyrank, utilising probabilities. We denote this as Z-rank+.Definition 5 (#P). The class of function problems of the form “compute f(x)”,where f is the number of accepting paths of an NP machine.Lemma 1. #Knapsack is #P-Complete.Theorem 5. The #multiple-choice knapsack problem is #P-Complete.Proof. This can be shown by reducing the #knapsack problem to the #multiple-choice knapsack problem.Given the set of items {xi}i=1, the reduction creates the set of sets {{xi, 0}}ni=1.The algorithm to solve #multiple-choice knapsack problem is then run on thisproblem instance. Since exactly one item can be added per set, the solution tothe #multiple-choice knapsack problem is trivially the solution to the #knap-sack problem as follows. For the ith set if xi was chosen, xi would chosen for theknapsack problem, while if 0 was chosen, this corresponds to not choosing xi.Therefore every possible solution to the multiple-choice version corresponds toa solution to the original version. utTheorem 6. Z-rank+ is #P-Complete.Proof. This can be shown by reducing the #multiple-choice knapsack problemto Z-rank+.The only difference between #multiple-choice knapsack problem and Z-rank+is that the former takes in a weight directly, while the latter takes in a key whichcan be seen as an index into the sets to choose a weight. Therefore we must embedthe desired weight W into the sets. To do this an extra set is added which containsW −∑i minjxi,j and m− 1 zeros (if each) set has m elements. The key is thenthe indices to to these minimum values plus the index to W −∑i minjxi,j .This is then passed to the Z-rank+ algorithm. The result is calculate by divingthe output by m−1. Any solution cannot contain W −∑i minjxi,j because thetotal minimum weight would be at least W so wouldn’t be counted. Any solutioninvolving a 0 in the last set has an equivalent solution involving any of the otherzeros in the final set. Thus the solution follows. ut8AcknowledgementsWe would like to thank Martijn Stam and Elisabeth Oswald for sharing thoughts,feedback and having insightful conversations that sparkled and deepened ourinterest in the topic.References1. Daniel J. Bernstein, Tanja Lange, and Christine van Vredendaal. Tighter, faster,simpler side-channel security evaluations beyond computing power. CryptologyePrint Archive, Report 2015/221, 2015. http://eprint.iacr.org/2015/221.2. Andrey Bogdanov, Ilya Kizhvatov, Kamran Manzoor, Elmar Tischhauser, andMarc Witteman. Fast and memory-efficient key recovery in side-channel attacks.Cryptology ePrint Archive, Report 2015/795, 2015. http://eprint.iacr.org/2015/795.3. Suresh Chari, Josyula R. Rao, and Pankaj Rohatgi. Template attacks. In Burton S.Kaliski Jr., Çetin Kaya Koç, and Christof Paar, editors, CHES 2002, volume 2523of LNCS, pages 13–28. Springer, Heidelberg, August 2003.4. Liron David and Avishai Wool. Prank: Fast analytical rank estimation viapareto distributions. Cryptology ePrint Archive, Report 2018/550, 2018. https://eprint.iacr.org/2018/550.5. Alexandre Duc, Sebastian Faust, and François-Xavier Standaert. Making maskingsecurity proofs concrete - or how to evaluate the security of any leaking device. InElisabeth Oswald and Marc Fischlin, editors, EUROCRYPT 2015, Part I, volume9056 of LNCS, pages 401–429. Springer, Heidelberg, April 2015.6. Cezary Glowacz, Vincent Grosso, Romain Poussier, Joachim Schüth, and François-Xavier Standaert. Simpler and more efficient rank estimation for side-channelsecurity assessment. In Gregor Leander, editor, FSE 2015, volume 9054 of LNCS,pages 117–129. Springer, Heidelberg, March 2015.7. Stefan Mangard, Elisabeth Oswald, and Franois-Xavier Standaert. One for all- all for one: Unifying standard differential power analysis attacks. InformationSecurity, IET, 5:100 – 110, 07 2011.8. Daniel P Martin, Luke Mather, and Elisabeth Oswald. Two sides of the same coin:counting and enumerating keys post side-channel attacks revisited. In Cryptogra-phers Track at the RSA Conference, pages 394–412. Springer, 2018.9. Daniel P Martin, Luke Mather, Elisabeth Oswald, and Martijn Stam. Character-isation and estimation of the key rank distribution in the context of side channelevaluations. In Asiacrypt 2016, volume 10031, pages 548–572. Springer, 2016.10. Daniel P. Martin, Jonathan F. O’Connell, Elisabeth Oswald, and Martijn Stam.Counting keys in parallel after a side channel attack. In Tetsu Iwata and Jung HeeCheon, editors, ASIACRYPT 2015, Part II, volume 9453 of LNCS, pages 313–337.Springer, Heidelberg, November / December 2015.11. Nicolas Veyrat-Charvillon, Benôıt Gérard, and François-Xavier Standaert. Securityevaluations beyond computing power. In Thomas Johansson and Phong Q. Nguyen,editors, EUROCRYPT 2013, volume 7881 of LNCS, pages 126–141. Springer, Hei-delberg, May 2013.9

A Note on Key Rank

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive