Analysis of a Code-Based Countermeasure Against Side-Channel and Fault Attacks

Abstract

The design of robust countermeasures against Side-Channel Analysis or Fault Attacks is always a challenging task. At WISTP'14, a single countermeasure designed to thwart in the same effort both kinds of attacks was presented. This countermeasure is based on coding theory and consists in a specific encoding of the manipulated data acting in the same time as a random masking and an error detector. In this paper, we prove that this countermeasure does not meet the ambitious objectives claimed by its authors. Indeed, we exhibit a bias in the distribution of the masked values that can be exploited to retrieve the sensitive data from the observed side-channel leakage. Going further, we show that this bias is inherent to the nature of the encoding and that randomizing the code itself can be useful to reduce the bias but cannot completely fix the scheme.

RS-Mask: Random Space Masking as an Integrated Countermeasure against Power and Fault Analysis

“…Although ODSM promised a generic countermeasure against SCA and fault analysis, studies of [49] demonstrated that ODSM fails to provide the assumed security. The major vulnerability of ODSM arises from the fact that the random mask added to sensitive variables is not perfectly uniform as opposed to Boolean masking, since the mask is chosen from the orthogonal space to the encoded sensitive variables.…”

“…As a result, the distribution of masked variables cannot be uniform. This property is exploited in [49] to deploy a first order DPA attack to recover the secret key of AES implemented with ODSM scheme. We will also prove that the non-uniform distribution of a mask makes the scheme vulnerable to fault analysis.…”