Algebraic Side-Channel Analysis in the Presence of Errors

Abstract

Abstract. Measurement errors make power analysis attacks difficult to mount when only a single power trace is available: the statistical methods that make DPA attacks so successful are not applicable since they require many (typically thousands) of traces. Recently it was suggested by [18] to use algebraic methods for the single-trace scenario, converting the key recovery problem into a Boolean satisfiability (SAT) problem, then using a SAT solver. However, this approach is extremely sensitive to noise (allowing an error rate of well under 1% at most), and the question of its practicality remained open. In this work we show how a single-trace side-channel analysis problem can be transformed into a pseudo-Boolean optimization (PBOPT) problem, which takes errors into consideration. The PBOPT instance can then be solved using a suitable optimization problem solver. The PBOPT syntax provides for a more expressive input specification which allows a very natural representation of measurement errors. Most importantly, we show that using our approach we are able to mount successful and efficient single-trace attacks even in the presence of realistic error rates of 10%-20%. We call our new attack methodology Tolerant Algebraic Side-Channel Analysis (TASCA). We show practical attacks on two real ciphers: Keeloq and AES.

An Optimal Key Enumeration Algorithm and Its Application to Side-Channel Attacks

“…In fact, the most noticeable exceptions attempting to better exploit computational power in physical attacks are based on advanced techniques, e.g. exploiting the detection of collisions [5,18,31,32], or taking advantage of algebraic cryptanalysis [6,23,27,28], of which the practical relevance remains an open question (because of stronger assumptions). But as again suggested by previous works in statistical cryptanalysis, optimal key ranking procedures would be a more direct approach in order to better trade data and time complexities in "standard" side-channel attacks.…”

A comprehensive study of multiple deductions-based algebraic trace driven cache attacks on AES

“…Since the traces are captured for entire encryptions, exploiting the cache events in the third and later rounds can improve the efficiency of TDCA. Combining TDCAs with algebraic techniques and conducting algebraic side-channel attacks (ASCA) [14,15,16,17] is a very promising way to improve TDCA. Previous ASCA mainly focused on power based Hamming weight leakage model [14,15,17] or Hamming distance leakage model [16].…”

“…Combining TDCAs with algebraic techniques and conducting algebraic side-channel attacks (ASCA) [14,15,16,17] is a very promising way to improve TDCA. Previous ASCA mainly focused on power based Hamming weight leakage model [14,15,17] or Hamming distance leakage model [16]. The original ASCA [14,15] can only work when the deduction on the targeted states is single and correct.…”

“…The original ASCA [14,15] can only work when the deduction on the targeted states is single and correct. The error tolerant ASCA in [16,17] can only work with limited deductions where the variance of the error is small and fixed. Previous ASCA cannot be directly and easily combined with TDCA because in practice, there are multiple deductions and the variance of the errors are large and uncertain.…”

“…As a result, attacks have to deal with the fact that the correct value is among multiple candidates obtained during the process, which are also referred to as multiple deductions. How to represent and utilize these multiple deductions is critical to improving the error tolerance and exploiting new leakage models for ASCAs [14,15,16,17]. They showed that MDASCA can utilize the leakages in the first three rounds of AES in TDCAs.…”