Correlation Power Analysis of Lightweight Block Ciphers: From Theory to Practice

Biryukov, Alex; Dinu, Daniel; Großschädl, Johann

doi:10.1007/978-3-319-39555-5_29

Cited by 22 publications

(32 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…can not be used in a feedback mode of operation such as CCM), the bitsliced implementations have a lower CPA leakage than implementations using lookup tables [4], but they are still vulnerable to DPA attacks [3].…”

Section: Resultsmentioning

confidence: 99%

“…Biryukov et al [4] introduced the correlation coefficient difference metric to analyze the leakage of different selection functions in the context of CPA. The correlation coefficient difference δ gives the difference between the correlation coefficient of the correct key and the correlation coefficient of the most likely key guess, where the most likely key is different from the correct key.…”

Section: Quantifying the Leakagementioning

confidence: 99%

“…The two selection functions are defined below: Table 2: Correlation coefficient difference δ between the correlation of the correct key and the correlation of the most likely key [4], for different Hamming weights of the correct key;δ and SEδ are the mean and the standard error for a 95% confidence interval, respectively. The leakages are acquired from an ARM Cortex-M3 processor.…”

Section: Quantifying the Leakagementioning

confidence: 99%

See 2 more Smart Citations

Side-Channel Attacks Meet Secure Network Protocols

Biryukov

Dinu

Corre

2017

Applied Cryptography and Network Security

Self Cite

View full text Add to dashboard Cite

Abstract. Side-channel attacks are powerful tools for breaking systems that implement cryptographic algorithms. The Advanced Encryption Standard (AES) is widely used to secure data, including the communication within various network protocols. Major cryptographic libraries such as OpenSSL or ARM mbed TLS include at least one implementation of the AES. In this paper, we show that most implementations of the AES present in popular open-source cryptographic libraries are vulnerable to side-channel attacks, even in a network protocol scenario when the attacker has limited control of the input. We present an algorithm for symbolic processing of the AES state for any input configuration where several input bytes are variable and known, while the rest are fixed and unknown as is the case in most secure network protocols. Then, we classify all possible inputs into 25 independent evaluation cases depending on the number of bytes controlled by attacker and the number of rounds that must be attacked to recover the master key. Finally, we describe an optimal algorithm that can be used to recover the master key using Correlation Power Analysis (CPA) attacks. Our experimental results raise awareness of the insecurity of unprotected implementations of the AES used in network protocol stacks.

show abstract

Section: Resultsmentioning

confidence: 99%

Section: Quantifying the Leakagementioning

confidence: 99%

Section: Quantifying the Leakagementioning

confidence: 99%

See 1 more Smart Citation

Side-Channel Attacks Meet Secure Network Protocols

Biryukov

Dinu

Corre

2017

Applied Cryptography and Network Security

Self Cite

View full text Add to dashboard Cite

show abstract

“…The number of general-purpose registers determines whether the entire cipher's state can be fitted into registers or whether a part of it has to be spilled to RAM. Memory operations are generally slower than register operations, consume more energy and increase the vulnerability of an implementation to side channel attacks [24]. Thus, the number of memory operations should be reduced as much as possible.…”

Section: Software Implementationmentioning

confidence: 99%

“…The absence of look-up tables reduces the memory requirements and provides, according to [24], some intrinsic resistance against power analysis attacks.…”

Section: Evaluation and Comparisonmentioning

confidence: 99%

Design Strategies for ARX with Provable Bounds: Sparx and LAX

Dinu

Perrin

Udovenko

et al. 2016

Lecture Notes in Computer Science

Self Cite

100

View full text Add to dashboard Cite

Abstract. We present, for the first time, a general strategy for designing ARX symmetric-key primitives with provable resistance against singletrail differential and linear cryptanalysis. The latter has been a long standing open problem in the area of ARX design. The wide trail design strategy (WTS), that is at the basis of many S-box based ciphers, including the AES, is not suitable for ARX designs due to the lack of S-boxes in the latter. In this paper we address the mentioned limitation by proposing the long trail design strategy (LTS) -a dual of the WTS that is applicable (but not limited) to ARX constructions. In contrast to the WTS, that prescribes the use of small and efficient S-boxes at the expense of heavy linear layers with strong mixing properties, the LTS advocates the use of large (ARX-based) S-Boxes together with sparse linear layers. With the help of the so-called Long Trail argument, a designer can bound the maximum differential and linear probabilities for any number of rounds of a cipher built according to the LTS. To illustrate the effectiveness of the new strategy, we propose Sparx -a family of ARX-based block ciphers designed according to the LTS. Sparx has 32-bit ARX-based S-boxes and has provable bounds against differential and linear cryptanalysis. In addition, Sparx is very efficient on a number of embedded platforms. Its optimized software implementation ranks in the top 6 of the most software-efficient ciphers along with Simon, Speck, Chaskey, LEA and RECTANGLE. As a second contribution we propose another strategy for designing ARX ciphers with provable properties, that is completely independent of the LTS. It is motivated by a challenge proposed earlier by Wallén and uses the differential properties of modular addition to minimize the maximum differential probability across multiple rounds of a cipher. A new primitive, called LAX, is designed following those principles. LAX partly solves the Wallén challenge.

show abstract

Assessing the Feasibility of Single Trace Power Analysis of Frodo

Bos

Friedberger

Martinoli

et al. 2019

Selected Areas in Cryptography – SAC 2018

View full text Add to dashboard Cite

Lattice-based schemes are among the most promising postquantum schemes, yet the effect of both parameter and implementation choices on their side-channel resilience is still poorly understood. Aysu et al. (HOST'18) recently investigated single-trace attacks against the core lattice operation, namely multiplication between a public matrix and a "small" secret vector, in the context of a hardware implementation. We complement this work by considering single-trace attacks against software implementations of "ring-less" LWE-based constructions. Specifically, we target Frodo, one of the submissions to the standardisation process of NIST, when implemented on an (emulated) ARM Cortex M0 processor. We confirm Aysu et al.'s observation that a standard divide-and-conquer attack is insufficient and instead we resort to a sequential, extend-and-prune approach. In contrast to Aysu et al. we find that, in our setting where the power model is far from being as clear as theirs, both profiling and less aggressive pruning are needed to obtain reasonable key recovery rates for SNRs of practical relevance. Our work drives home the message that parameter selection for LWE schemes is a double-edged sword: the schemes that are deemed most secure against (black-box) lattice attacks can provide the least security when considering side-channels. Finally, we suggest some easy countermeasures that thwart standard extend-and-prune attacks.

show abstract

Correlation Power Analysis of Lightweight Block Ciphers: From Theory to Practice

Cited by 22 publications

References 32 publications

Side-Channel Attacks Meet Secure Network Protocols

Side-Channel Attacks Meet Secure Network Protocols

Design Strategies for ARX with Provable Bounds: Sparx and LAX

Assessing the Feasibility of Single Trace Power Analysis of Frodo

Contact Info

Product

Resources

About