National Institute of Standards and Technology における超伝導研究及び生活

Our contribution is twofold: first we describe a very compact hardware implementation of AES-128, which requires only 2400 GE. This is to the best of our knowledge the smallest implementation reported so far. Then we apply the threshold countermeasure by Nikova et al. to the AES S-box and yield an implementation of the AES improving the level of resistance against first-order side-channel attacks. Our experimental results on real-world power traces show that although our implementation provides additional security, it is still susceptible to some sophisticated attacks having enough number of measurements.

/pdf/pushing-the-limits-a-very-compact-and-a-threshold-y972zsgf3b.pdf

Pushing the limits: a very compact and a threshold implementation of AES

This book constitutes the refereed proceedings of the 30th Annual International Conference on the Theory and Applications of Cryptographic Techniques, EUROCRYPT 2011, held in Tallinn, Estonia, in May 2011. The 31 papers, presented together with 2 invited talks, were carefully reviewed and selected from 167 submissions. The papers are organized in topical sections on lattice-base cryptography, implementation and side channels, homomorphic cryptography, signature schemes, information-theoretic cryptography, symmetric key cryptography, attacks and algorithms, secure computation, composability, key dependent message security, and public key encryption.

Advances in cryptology : Eurocrypt 2011 : 30th annual international conference on the theory and applications of cryptographic techniques, Tallinn, Estonia, May 15-19, 2011 : proceedings

/pdf/sec-x-2-recommended-elliptic-curve-domain-parameters-54wojro6fg.pdf

SEC X.2: Recommended Elliptic Curve Domain Parameters

Evoked by the increasing need to integrate side-channel countermeasures into security-enabled commercial devices, evaluation labs are seeking a standard approach that enables a fast, reliable and robust evaluation of the side-channel vulnerability of the given products. To this end, standardization bodies such as NIST intend to establish a leakage assessment methodology fulfilling these demands. One of such proposals is the Welch’s t-test, which is being put forward by Cryptography Research Inc., and is able to relax the dependency between the evaluations and the device’s underlying architecture. In this work, we deeply study the theoretical background of the test’s different flavors, and present a roadmap which can be followed by the evaluation labs to efficiently and correctly conduct the tests. More precisely, we express a stable, robust and efficient way to perform the tests at higher orders. Further, we extend the test to multivariate settings, and provide details on how to efficiently and rapidly carry out such a multivariate higher-order test. Including a suggested methodology to collect the traces for these tests, we point out practical case studies where different types of t-tests can exhibit the leakage of supposedly secure designs.

/pdf/leakage-assessment-methodology-f0yjbgp6i4.pdf

Leakage Assessment Methodology

Side-channel based collision attacks are a mostly disregarded alternative to DPA for analyzing unprotected implementations. The advent of strong countermeasures, such as masking, has made further research in collision attacks seemingly in vain. In this work, we show that the principles of collision attacks can be adapted to efficiently break some masked hardware implementation of the AES which still have first-order leakage. The proposed attack breaks an AES implementation based on the corrected version of the masked S-box of Canright and Batina presented at ACNS 2008 which is supposed to be resistant against firstorder attacks. It requires only six times the number of traces necessary for breaking a comparable unprotected implementation. At the same time, the presented attack has minimal requirements on the abilities and knowledge of an adversary. The attack requires no detailed knowledge about the design, nor does it require a training phase.

/pdf/correlation-enhanced-power-analysis-collision-attack-5197mhf5as.pdf

Correlation-Enhanced Power Analysis Collision Attack.

Side-channel based collision attacks are a mostly disregarded alternative to DPA for analyzing unprotected implementations. The advent of strong countermeasures, such as masking, has made further research in collision attacks seemingly in vain. In this work, we show that the principles of collision attacks can be adapted to efficiently break some masked hardware implementation of the AES which still have first-order leakage. The proposed attack breaks an AES implementation based on the corrected version of the masked S-box of Canright and Batina presented at ACNS 2008. The attack requires only six times the number of traces necessary for breaking a comparable unprotected implementation. At the same time, the presented attack has minimal requirements on the abilities and knowledge of an adversary. The attack requires no detailed knowledge about the design, nor does it require a profiling phase.

/pdf/correlation-enhanced-power-analysis-collision-attack-1t2u6p0ie6.pdf

Correlation-enhanced power analysis collision attack

At CHES 2010 two powerful new attacks were presented, namely the Fault Sensitivity Analysis and the Correlation Collision Attack. This paper shows how these ideas can be combined to create even stronger attacks. Two solutions are presented; both extract leakage information by the fault sensitivity analysis method while each one applies a slightly different collision attack to deduce the secret information without the need of any hypothetical leakage model. Having a similar fault injection method, one attack utilizes the non-uniform distribution of faulty ciphertext bytes while the other one exploits the data-dependent timing characteristics of the target combination circuit. The results when attacking several AES ASIC cores of the SASEBO LSI chips in different process technologies are presented. Successfully breaking the cores protected against DPA attacks using either gate-level countermeasures or logic styles indicates the strength of the attacks.

/pdf/on-the-power-of-fault-sensitivity-analysis-and-collision-5fhl034cgl.pdf

On the power of fault sensitivity analysis and collision side-channel attacks in a combined setting

Several masking schemes to protect cryptographic implementations against side-channel attacks have been proposed. A few considered the glitches, and provided security proofs in presence of such inherent phenomena happening in logic circuits. One which is based on multi-party computation protocols and utilizes Shamir's secret sharing scheme was presented at CHES 2011. It aims at providing security for hardware implementations --- mainly of AES --- against those sophisticated side-channel attacks that also take glitches into account. One part of this article deals with the practical issues and relevance of the aforementioned masking scheme. Following the recommendations given in the extended version of the mentioned article, we first provide a guideline on how to implement the scheme for the simplest settings. Constructing an exemplary design of the scheme, we provide practical side-channel evaluations based on a Virtex-5 FPGA. Our results demonstrate that the implemented scheme is indeed secure against univariate power analysis attacks given a basic measurement setup. In the second part of this paper we show how using very simple changes in the measurement setup opens the possibility to exploit multivariate leakages while still performing a univariate attack. Using these techniques the scheme under evaluation can be defeated using only a moderate number of measurements. This is applicable not only to the scheme showcased here, but also to most other known masking schemes where the shares of sensitive values are processed in adjacent clock cycles.

/pdf/on-the-simplicity-of-converting-leakages-from-multivariate-2pxtndj7s4.pdf

On the simplicity of converting leakages from multivariate to univariate: case study of a glitch-resistant masking scheme

In this paper we present compact FPGA-based architectures for standardized elliptic curve cryptography over prime fields. Our approach differs from the many previous works due to the following design principles: First, we minimized storage by efficiently using block memories instead of registers, and second, we focused on elliptic curves based on standardized NIST primes. Furthermore, the presented MicroECC processors are optimized for two goals: a first architecture utilizes a 16-bit data path and a single 16-bit hardware multiplier and is optimized for minimal FPGA resource consumption. The second processor design employs a 32-bit data path and several hardware multipliers for improved throughput. Both implementations are not fixed to a single curve and support point multiplications for (but not limited to) both NIST curves P-256 and P-224. Tested on Xilinx and Micro semi FPGAs, our ECC-P256 processors provide a significantly better performance-per-slice ratio (i.e., a factor of 7.1 and 6.3 for the 16-bit and 32-bit architecture, respectively) compared to a comparable implementation, recently presented on ASAP 2010.

Oliver Mischke

Papers

Correlation-Enhanced Power Analysis Collision Attack.

Correlation-enhanced power analysis collision attack

On the power of fault sensitivity analysis and collision side-channel attacks in a combined setting

On the simplicity of converting leakages from multivariate to univariate: case study of a glitch-resistant masking scheme

MicroECC: A Lightweight Reconfigurable Elliptic Curve Crypto-processor