ARMISTICE: Microarchitectural Leakage Modeling for Masked Software Formal Verification

Abstract

Side channel attacks are powerful attacks for retrieving secret data by exploiting physical measurements such as power consumption or electromagnetic emissions. Masking is a popular countermeasure as it can be proven secure against an attacker model. In practice, software masked implementations suffer from a security reduction due to a mismatch between the considered leakage sources in the security proof and the real ones, which depend on the micro-architecture. We propose ARMISTICE, a framework for formally verifying the absence of leakage in first-order masked implementations taking into account modelled micro-architectural sources of leakage. As a proof of concept, we present the modelling of an Arm Cortex-M3 core from its RTL description and leakage test vectors, as well as the modelling of the memory of a STM32F1 board, exclusively using leakage test vectors. We show that, with these models, ARMISTICE pinpoints vulnerable instructions in real world masked implementations and helps the design of masked software implementations which are practically secure.

Prolead_sw

“…As Gigerl et al point out, due to occurring glitches probing the output of the combinatorial forwarding logic, i.e., the output of the multiplexer in Figure 3, could give adversaries access to its inputs and thus to multiple values within the pipeline. Furthermore, Grandmaison et al [dGHM22] report that such a forwarding mechanism also exists for ARM processors.…”