Clustering Algorithms for Non-profiled Single-Execution Attacks on Exponentiations

Abstract

Abstract. Most implementations of public key cryptography employ exponentiation algorithms. Side-channel attacks on secret exponents are typically bound to the leakage of single executions due to cryptographic protocols or side-channel countermeasures such as blinding. We propose for the first time, to use a well-established class of algorithms, i.e. unsupervised cluster classification algorithms such as the k-means algorithm to attack cryptographic exponentiations and recover secret exponents without any prior profiling, manual tuning or leakage models. Not requiring profiling is of significant advantage to attackers, as are well-established algorithms. The proposed non-profiled single-execution attack is able to exploit any available single-execution leakage and provides a straight-forward option to combine simultaneous measurements to increase the available leakage. We present empirical results from attacking an FPGA-based elliptic curve scalar multiplication using the kmeans clustering algorithm and successfully exploit location-based leakage from high-resolution electromagnetic field measurements to achieve a low remaining brute-force complexity of the secret exponent. A simulated multi-channel measurement even enables an error-free recovery of the exponent.

Single-Trace Side-Channel Attacks on Scalar Multiplications with Precomputations

“…Montgomery's ladder [41], Joye's regular algorithms [33], and other algorithms, where for-loops iterate only on non-static values, are not vulnerable because there is no static T that would be used in Ψ which is required by our attacks. However, other similar types of single-trace attacks have recently identified similar weaknesses also in such algorithms (e.g., [4,5,31]). …”

“…Clustering has been previously used in side-channel attacks on ECC by Heyszl et al in [31]. They used it for launching an attack without any profile about the device (a hardware implementation) by clustering repeating patterns in a power trace; i.e., they would cluster the entire trace of Ψ .…”

“…Another trend of attacks uses clustering algorithms to launch a single-trace attack on ECC. A clustering attack was shown to break an ECC hardware implementation without any profiling or leakage models by Heyszl et al [31]; Sprecht et al [49] later improved this attack. In addition to these, also local electromagnetic measurements have been shown to offer means to launch successful single-trace attacks, e.g., by Heyszl et al [32].…”

“…Such algorithms have been recently used for side-channel protected lightweight hardware implementations, e.g., in [47,48] as well as fast software, e.g., in [14]. In the light of new advanced single-trace attacks, there have been doubts about the security offered by these algorithms (see, e.g., [3,31,47]). …”

Attacking Randomized Exponentiations Using Unsupervised Learning

“…In [18], unsupervised learning has been presented to demonstrate the efficiency of localized EM attacks on exponentiations using a kmeans clustering algorithm to differentiate the attacked samples. Their attack is performed on an ECC [27] implementation over a binary field using Lopez-Dahab coordinates [26].…”