Showing papers by "Christof Paar published in 2003"

Cryptographic Hardware and Embedded Systems - CHES 2002

Abstract: We describe a new class of attacks on secure microcontrollers and smartcards. Illumination of a target transistor causes it to conduct, thereby inducing a transient fault. Such attacks are practical; they do not even require expensive laser equipment. We have carried them out using a flashgun bought second-hand from a camera store for $30 and with an $8 laser pointer. As an illustration of the power of this attack, we developed techniques to set or reset any individual bit of SRAM in a microcontroller. Unless suitable countermeasures are taken, optical probing may also be used to induce errors in cryptographic computations or protocols, and to disrupt the processor’s control flow. It thus provides a powerful extension of existing glitching and fault analysis techniques. This vulnerability may pose a big problem for the industry, similar to those resulting from probing attacks in the mid-1990s and power analysis attacks in the late 1990s. We have therefore developed a technology to block these attacks. We use self-timed dual-rail circuit design techniques whereby a logical 1 or 0 is not encoded by a high or low voltage on a single line, but by (HL) or (LH) on a pair of lines. The combination (HH) signals an alarm, which will typically reset the processor. Circuits can be designed so that singletransistor failures do not lead to security failure. This technology may also make power analysis attacks very much harder too.

Cryptographic Hardware and Embedded Systems - CHES 2003

Abstract: We introduce multi-channel attacks, i.e., side-channel attacks which utilize multiple side-channels such as power and EM simultaneously. We propose an adversarial model which combines a CMOS leakage model and the maximum-likelihood principle for performing and analyzing such attacks. This model is essential for deriving the optimal and very often counter-intuitive techniques for channel selection and data analysis. We show that using multiple channels is better for template attacks by experimentally showing a three-fold reduction in the error probability. Developing sound countermeasures against multi-channel attacks requires a rigorous leakage assessment methodology. Under suitable assumptions and approximations, our model also yields a practical assessment methodology for net information leakage from the power and all available EM channels in constrained devices such as chip-cards. Classical DPA/DEMA style attacks assume an adversary weaker than that of our model. For this adversary, we apply the maximum-likelihood principle to such design new and more efficient single and multiple-channel DPA/DEMA attacks.

A new class of collision attacks and its application to DES

Abstract: Until now in cryptography the term collision was mainly associated with the surjective mapping of different inputs to an equal output of a hash function Previous collision attacks were only able to detect collisions at the output of a particular function In this publication we introduce a new class of attacks which originates from Hans Dobbertin and is based on the fact that side channel analysis can be used to detect internal collisions We applied our attack against the widely used Data Encryption Standard (DES) We exploit the fact that internal collisions can be caused in three adjacent S-Boxes of DES [DDQ84] in order to gain information about the secret key-bits As result, we were able to exploit an internal collision with a minimum of 140 encryptions 1 yielding 102 key-bits Moreover, we successfully applied the attack to a smart card processor

A New Class of Collision Attacks and Its Application to DES

Abstract: Until now in cryptography the term collision was mainly associated with the surjective mapping of different inputs to an equal output of a hash function. Previous collision attacks were only able to detect collisions at the output of a particular function. In this publication we introduce a new class of attacks which originates from Hans Dobbertin and is based on the fact that side channel analysis can be used to detect internal collisions. We applied our attack against the widely used Data Encryption Standard (DES). We exploit the fact that internal collisions can be caused in three adjacent S-Boxes of DES [DDQ84] in order to gain information about the secret key-bits. As result, we were able to exploit an internal collision with a minimum of 140 encryptions yielding 10.2 key-bits. Moreover, we successfully applied the attack to a smart card processor.

Hyperelliptic Curve Cryptosystems: Closing the Performance Gap to Elliptic Curves

Abstract: For most of the time since they were proposed, it was widely believed that hyperelliptic curve cryptosystems (HECC) carry a substantial performance penalty compared to elliptic curve cryptosystems (ECC) and are, thus, not too attractive for practical applications. Only quite recently improvements have been made, mainly restricted to curves of genus 2. The work at hand advances the state-of-the-art considerably in several aspects. First, we generalize and improve the closed formulae for the group operation of genus 3 for HEC defined over fields of characteristic two. For certain curves we achieve over 50% complexity improvement compared to the best previously published results. Second, we introduce a new complexity metric for ECC and HECC defined over characteristic two fields which allow performance comparisons of practical relevance. It can be shown that the HECC performance is in the range of the performance of an ECC; for specific parameters HECC can even possess a lower complexity than an ECC at the same security level. Third, we describe the first implementation of a HEC cryptosystem on an embedded (ARM7) processor. Since HEC are particularly attractive for constrained environments, such a case study should be of relevance.

Efficient GF(p m ) arithmetic architectures for cryptographic applications

Abstract: Several public key cryptosystems (HFE, Quartz, Sflash, etc.) are based on the problem MQ of solving a system of multivariate quadratic equations over a finite field. At Asiacrypt 2002, Courtois and Pieprzyk show that the MQ problem is also relevant to the security of AES. At Eurocrypt 2000, Courtois, Klimov, Patarin and Shamir introduced the XL algorithm for solving MQ. They show that if the number of equations m is much larger than the number of variables n, such overdefined MQ systems can be easily solved. From their simplified and heuristic analysis it seemed that even when m = n, a variant of XL could still be subexponential. The exact complexity of the XL algorithm remained an open problem. Moreover, all their simulations has been done over GF(127) and with D < 127, with D being the parameter of the XL algorithm. At Asiacrypt 2002, an algorithm XSL, derived from XL, is introduced for the cryptanalysis of block ciphers [5]. Very little is known about the behaviour of XSL and we believe that one should study the XL algorithm itself first. In this paper we study the behaviour of XL for systems of quadratic equations over GF(2). We show that the possibility to use the equations of the field GF(2): xi2= xi that are also quadratic, makes that the XL algorithm works better. We also introduce two improved versions of XL, called XL' and XL2, with an improved final step of the algorithm (that also can be used in XSL). We present an explanation for the linear dependencies that appear in the XL algorithm, and derive a formula for the number of linearly independent equations in XL or XL2. Then we run various computer simulations and observe that this formula is always verified. Apparently we are able to predict exactly the behaviour of XL, XL' and XL2 for random systems of equations. Due to the entanglement of linear dependencies, the analysis of XL becomes increasingly difficult, and XL may be really exponential for m = n.

How Secure Are FPGAs in Cryptographic Applications

Abstract: The use of FPGAs for cryptographic applications is highly attractive for a variety of reasons but at the same time there are many open issues related to the general security of FPGAs. This contribution attempts to provide a state-of-the-art description of this topic. First, the advantages of reconfigurable hardware for cryptographic applications are listed. Second, potential security problems of FPGAs are described in detail, followed by a proposal of a some countermeasure. Third, a list of open research problems is provided. Even though there have been many contributions dealing with the algorithmic aspects of cryptographic schemes implemented on FPGAs, this contribution appears to be the first comprehensive treatment of system and security aspects.

Embedded end-to-end wireless security with ECDH key exchange

Abstract: Sensor networks offer tremendous benefits for the future as they have the potential to make life more convenient and safer. For instance, sensors can be used for climate control to reduce power consumption, for structures such as bridges to monitor the maintenance status, or for company badges to locate employees in order to increase productivity. However, the introduction of such ubiquitous computing to everyday life also raises privacy concerns. In this work the authors presented a public-key cryptography implementation for secure key exchange on low-end wireless devices using elliptic curves. The implementation is based on optimal extension fields (OEF) that are a special type of finite fields GF(p/sup m/). As for the platform, the authors chose a Chipcon CC1010 chip which is based on the 8051 architecture and that is especially suited for secure wireless applications as it has a built-in radio transceiver as well as a hardware DES engine. A secure end-to-end connection was established between the sensor and a base station in an acceptable time of 3 seconds without requiring cryptographic coprocessors.

Cryptography on FPGAs: State of the Art Implementations and Attacks

Abstract: In the last decade, it has become aparent that embedded systems are integral parts of our every day lives. The wireless nature of many embedded applications as well as their omnipresence has made the need for security and privacy preserving mechanisms particularly important. Thus, as FPGAs become integral parts of embedded systems, it is imperative to consider their security as a whole. This contribution provides a state-of-the-art description of security issues on FPGAs, both from the system and implementation perspectives. We discuss the advantages of reconfigurable hardware for cryptographic applications, show potential security problems of FPGAs, and provide a list of open research problems. Moreover, we summarize both public and symmetric-key algorithm implementations on FPGAs.

Cryptographic Hardware and Embedded Systems - CHES 2002: 4th International Workshop, Redwood Shores, CA, USA, August 13-15, 2002, Revised Papers

Abstract: Invited Talk.- CHES: Past, Present, and Future.- Attack Strategies.- Optical Fault Induction Attacks.- Template Attacks.- The EM Side-Channel(s).- Finite Field and Modular Arithmetic I.- Enhanced Montgomery Multiplication.- New Algorithm for Classical Modular Inverse.- Increasing the Bitlength of a Crypto-Coprocessor.- Elliptic Curve Cryptography I.- Enhancing Simple Power-Analysis Attacks on Elliptic Curve Cryptosystems.- Implementation of Elliptic Curve Cryptography with Built-In Counter Measures against Side Channel Attacks.- Secure Elliptic Curve Implementations: An Analysis of Resistance to Power-Attacks in a DSP Processor.- Address-Bit Differential Power Analysis of Cryptographic Schemes OK-ECDH and OK-ECDSA.- AES and AES Candidates.- 2Gbit/s Hardware Realizations of RIJNDAEL and SERPENT: A Comparative Analysis.- Efficient Software Implementation of AES on 32-Bit Platforms.- An Optimized S-Box Circuit Architecture for Low Power AES Design.- Simplified Adaptive Multiplicative Masking for AES.- Multiplicative Masking and Power Analysis of AES.- Tamper Resistance.- Keeping Secrets in Hardware: The Microsoft XboxTM Case Study.- RSA Implementation.- A DPA Attack against the Modular Reduction within a CRT Implementation of RSA.- Further Results and Considerations on Side Channel Attacks on RSA.- Fault Attacks on RSA with CRT: Concrete Results and Practical Countermeasures.- Finite Field and Modular Arithmetic II.- Some Security Aspects of the MIST Randomized Exponentiation Algorithm.- The Montgomery Powering Ladder.- DPA Countermeasures by Improving the Window Method.- Efficient Subgroup Exponentiation in Quadratic and Sixth Degree Extensions.- Elliptic Curve Cryptography II.- On the Efficient Generation of Elliptic Curves over Prime Fields.- An End-to-End Systems Approach to Elliptic Curve Cryptography.- A Low-Power Design for an Elliptic Curve Digital Signature Chip.- A Reconfigurable System on Chip Implementation for Elliptic Curve Cryptography over .- Genus Two Hyperelliptic Curve Coprocessor.- Random Number Generation.- True Random Number Generator Embedded in Reconfigurable Hardware.- Evaluation Criteria for True (Physical) Random Number Generators Used in Cryptographic Applications.- A Hardware Random Number Generator.- Invited Talk.- RFID Systems and Security and Privacy Implications.- New Primitives.- A New Class of Invertible Mappings.- Finite Field and Modular Arithmetic II.- Scalable and Unified Hardware to Compute Montgomery Inverse in GF(p) and GF(2n).- Dual-Field Arithmetic Unit for GF(p) and GF(2m).- Error Detection in Polynomial Basis Multipliers over Binary Extension Fields.- Hardware Implementation of Finite Fields of Characteristic Three.- Elliptic Curve Cryptography III.- Preventing Differential Analysis in GLV Elliptic Curve Scalar Multiplication.- Randomized Signed-Scalar Multiplication of ECC to Resist Power Attacks.- Fast Multi-scalar Multiplication Methods on Elliptic Curves with Precomputation Strategy Using Montgomery Trick.- Hardware for Cryptanalysis.- Experience Using a Low-Cost FPGA Design to Crack DES Keys.- A Time-Memory Tradeo. Using Distinguished Points: New Analysis & FPGA Results.

Instruction-level distributed processing for symmetric-key cryptography

Abstract: Efficient implementation of block ciphers is critical towards achieving both high security and high-speed processing. Numerous block ciphers have been proposed and implemented, using a wide and varied range of functional operations. As a result, it has become increasingly more difficult to develop a hardware architecture that allows the efficient and fast realization of a wide variety of block ciphers. In an effort to achieve such a hardware architecture, a study of a wide range of block ciphers was undertaken to develop an understanding of the functional requirements of each algorithm. This study led to the development of COBRA, a reconfigurable architecture for the efficient implementation of block ciphers. A detailed discussion of the top level architecture, interconnection scheme, and underlying elements of the architecture is provided. System configuration and on-the-fly reconfiguration is analyzed, and from this analysis it is demonstrated that the COBRA architecture satisfies the requirements for achieving efficient implementation of a wide range of block ciphers that meet the 622 Mbps ATM network encryption throughput requirement.

Low Cost Security: Explicit Formulae for Genus-4 Hyperelliptic Curves

Abstract: It is widely believed that genus four hyperelliptic curve cryptosystems (HECC) are not attractive for practical applications because of their complexity compared to systems based on lower genera, especially elliptic curves. Our contribution shows that for low cost security applications genus-4 hyperelliptic curves (HEC) can outperform genus-2 HEC and that we can achieve a performance similar to genus-3 HEC. Furthermore our implementation results show that a genus-4 HECC is an alternative cryptosystem to systems based on elliptic curves.

How Secure Are FPGAs in Cryptographic Applications? (Long Version) ?

Abstract: The use of FPGAs for cryptographic applications is highly attractive for a variety of reasons but at the same time there are many open issues related to the general security of FPGAs. This contribution attempts to provide a state-of-the-art description of this topic. First, the advantages of reconfigurable hardware for cryptographic applications are discussed from a systems perspective. Second, potential security prob- lems of FPGAs are described in detail, followed by a proposal of a some countermeasure. Third, a list of open research problems is provided. Even though there have been many contributions dealing with the algorithmic aspects of cryptographic schemes implemented on FPGAs, this contri- bution appears to be the first comprehensive treatment of system and security aspects.

How secure are FPGAs in cryptographic applications

Abstract: The use of FPGAs for cryptographic applications is highly attractive for a variety of reasons but at the same time there are many open issues related to the general security of FPGAs This contribution attempts to provide a state-of-the-art description of this topic First, the advantages of reconfigurable hardware for cryptographic applications are listed Second, potential security problems of FPGAs are described in detail, followed by a proposal of a some countermeasure Third, a list of open research problems is provided Even though there have been many contributions dealing with the algorithmic aspects of cryptographic schemes implemented on FPGAs, this contribution appears to be the first comprehensive treatment of system and security aspects

Cryptographic Hardware and Embedded Systems -- CHES 2003: 5th International Workshop, Cologne, Germany, September 8-10, 2003, Proceedings

Abstract: Invited Talk.- The Security Challenges of Ubiquitous Computing.- Side Channel Attack Methodology.- Multi-channel Attacks.- Hidden Markov Model Cryptanalysis.- Power-Analysis Attacks on an FPGA - First Experimental Results.- Hardware Factorization.- Hardware to Solve Sparse Systems of Linear Equations over GF(2).- Symmetric Ciphers: Side Channel Attacks and Countermeasures.- Cryptanalysis of DES Implemented on Computers with Cache.- A Differential Fault Attack Technique against SPN Structures, with Application to the AES and Khazad.- A New Algorithm for Switching from Arithmetic to Boolean Masking.- DeKaRT: A New Paradigm for Key-Dependent Reversible Circuits.- Secure Hardware Logic.- Parity-Based Concurrent Error Detection of Substitution-Permutation Network Block Ciphers.- Securing Encryption Algorithms against DPA at the Logic Level: Next Generation Smart Card Technology.- Security Evaluation of Asynchronous Circuits.- Random Number Generators.- Design and Implementation of a True Random Number Generator Based on Digital Circuit Artifacts.- True Random Number Generators Secure in a Changing Environment.- How to Predict the Output of a Hardware Random Number Generator.- Efficient Multiplication.- On Low Complexity Bit Parallel Polynomial Basis Multipliers.- Efficient Modular Reduction Algorithm in [x] and Its Application to "Left to Right" Modular Multiplication in [x].- Faster Double-Size Modular Multiplication from Euclidean Multipliers.- More on Efficient Arithmetic.- Efficient Exponentiation for a Class of Finite Fields GF(2 n ) Determined by Gauss Periods.- GCD-Free Algorithms for Computing Modular Inverses.- Attacks on Asymmetric Cryptosystems.- Attacking Unbalanced RSA-CRT Using SPA.- The Doubling Attack - Why Upwards Is Better than Downwards.- An Analysis of Goubin's Refined Power Analysis Attack.- A New Type of Timing Attack: Application to GPS.- Implementation of Symmetric Ciphers.- Unified Hardware Architecture for 128-Bit Block Ciphers AES and Camellia.- Very Compact FPGA Implementation of the AES Algorithm.- Efficient Implementation of Rijndael Encryption in Reconfigurable Hardware: Improvements and Design Tradeoffs.- Hyperelliptic Curve Cryptography.- Hyperelliptic Curve Cryptosystems: Closing the Performance Gap to Elliptic Curves.- Countermeasures against Differential Power Analysis for Hyperelliptic Curve Cryptosystems.- Countermeasures to Side Channel Leakage.- A Practical Countermeasure against Address-Bit Differential Power Analysis.- A More Flexible Countermeasure against Side Channel Attacks Using Window Method.- Security of Standards.- On the Security of PKCS #11.- Attacking RSA-Based Sessions in SSL/TLS.

Eingebettete Sicherheit und Kryptographie im Automobil: Eine Einführung

Abstract: Informationsund Kommunikationstechnik nimmt eine standig wachsende Rolle im Automobil ein. Der vorliegende Artikel soll das erste Mal einen Uberblick uber den wichtigen Themenkreis der IT-Sicherheit im Automobil geben. Es werden die jetzigen und zukunftigen Automobilfunktionen mit Sicherheitsbedarf diskutiert, eine Bedrohungsanalyse erstellt und Besonderheiten der eingebetteten Sicherheit im Automobilkontext erlautert. Anschliesend wird uber einige relevante Ergebnisse im Bereich von Kryptoverfahren in eingebetteten Umgebungen berichtet.

How Secure Are FPGAs in Cryptographic Applications

Abstract: The use of FPGAs for cryptographic applications is highly attractive for a variety of reasons but at the same time there are many open issues related to the general security of FPGAs. This contribution attempts to provide a state-of-the-art description of this topic. First, the advantages of reconfigurable hardware for cryptographic applications are listed. Second, potential security problems of FPGAs are described in detail, followed by a proposal of a some countermeasure. Third, a list of open research problems is provided. Even though there have been many contributions dealing with the algorithmic aspects of cryptographic schemes implemented on FPGAs, this contribution appears to be the first comprehensive treatment of system and security aspects.