FENL: an ISE to mitigate analogue micro-architectural leakage

Gao, Si; Marshall, Ben; Page, Daniel; Pham, Thinh Hung

doi:10.46586/tches.v2020.i2.73-98

Cited by 10 publications

(8 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To avoid the aforementioned leakages, the contents of the interface_d_mem_data_in_reg register should be cleared (zeroized or randomized [GMPP20]) between consecutive iterations of the loops in both functions. A simple software approach, for example, is to insert dummy store operations at the end of each iteration, sending random data to this register.…”

Section: Resultsmentioning

confidence: 99%

SoC Root Canal!

Kiaei

Schaumont

2022

TCHES

View full text Add to dashboard Cite

Finding the root cause of power-based side-channel leakage becomes harder when multiple layers of design abstraction are involved. While side-channel leakage originates in processor hardware, the dangerous consequences may only become apparent in the cryptographic software that runs on the processor. This contribution presents RootCanal, a methodology to explain the origin of side-channel leakage in a software program in terms of the underlying micro-architecture and system architecture. We simulate the hardware power consumption at the gate level and perform a non-specific test to identify the logic gates that contribute most sidechannel leakage. Then, we back-annotate those findings to the related activities in the software. The resulting analysis can automatically point out non-trivial causes of side-channel leakages. To illustrate RootCanal’s capabilities, we discuss a collection of case studies.

show abstract

Section: Resultsmentioning

confidence: 99%

SoC Root Canal!

Kiaei

Schaumont

2022

TCHES

View full text Add to dashboard Cite

show abstract

“…For example, it was necessary to re-order instruction sequences such that given the masked representation of some x, i.e., x = (x 0 , x 1 ), a load of x 0 was not directly followed by a load of x 1 : doing so prevents accidental share combination, and thus Hamming distance leakage, in the memory interface. Where this was not possible, or not fully effective, we attempted to use fence-like instructions (see, e.g., [SSB + 19]) to load or store "dummy" random value to flush residual state; we note that a dedicated mechanism such as FENL [GMPP20] could serve the same purpose with potentially less overhead.…”

Section: Methodsmentioning

confidence: 99%

An Instruction Set Extension to Support Software-Based Masking

Gao

Großschädl

Marshall

et al. 2021

TCHES

Self Cite

View full text Add to dashboard Cite

In both hardware and software, masking can represent an effective means of hardening an implementation against side-channel attack vectors such as Differential Power Analysis (DPA). Focusing on software, however, the use of masking can present various challenges: specifically, it often 1) requires significant effort to translate any theoretical security properties into practice, and, even then, 2) imposes a significant overhead in terms of efficiency. To address both challenges, this paper explores the use of an Instruction Set Extension (ISE) to support masking in software-based implementations of a range of (symmetric) cryptographic kernels including AES: we design, implement, and evaluate such an ISE, using RISC-V as the base ISA. Our ISE-supported first-order masked implementation of AES, for example, is an order of magnitude more efficient than a software-only alternative with respect to both execution latency and memory footprint; this renders it comparable to an unmasked implementation using the same metrics, but also first-order secure.

show abstract

“…Similarly, Gao et al [26] have demonstrated an Instruction Set Extension (ISE) to RISC-V Instruction Set Architecture (ISA). The ISE guarantees that internal states that cause leakage are cleared acting as a barrier instruction when used in sensitive programs.…”

Section: Leakage Emulators and Automatic Countermeasuresmentioning

confidence: 98%

Rosita++: Automatic Higher-Order Leakage Elimination from Cryptographic Code

Shelton,

Chmielewski,

Samwel

et al. 2021

Preprint

View full text Add to dashboard Cite

Side-channel attacks are a major threat to the security of cryptographic implementations, particularly for small devices that are under the physical control of the adversary. While several strategies for protecting against side-channel attacks exist, these often fail in practice due to unintended interactions between values deep within the CPU. To detect and protect from side-channel attacks, several automated tools have recently been proposed; one of their common limitations is that they only support first-order leakage.In this work, we present Rosita++, the first automated tool for detecting and eliminating higher-order leakage from cryptographic implementations. Rosita++ proposes statistical and software-based tools to allow high-performance higher-order leakage detection. It then uses the code rewrite engine of Rosita (Shelton et al. NDSS 2021) to eliminate detected leakage. For the sake of practicality we evaluate Rosita++ against second and third order leakage, but our framework is not restricted to only these orders.We evaluate Rosita++ against second-order leakage with threeshare implementations of two ciphers, present and Xoodoo, and with the second-order Boolean-to-arithmetic masking, a core building block of masked implementations of many cryptographic primitives, including SHA-2, ChaCha and Blake. We show effective second-order leakage elimination at a performance cost of 36% for Xoodoo, 189% for present, and 29% for the Boolean-to-arithmetic masking. For third-order analysis, we evaluate Rosita++ against the third-order leakage using a four-share synthetic example that corresponds to typical four-share processing. Rosita++ correctly identified this leakage and applied code fixes.

show abstract

FENL: an ISE to mitigate analogue micro-architectural leakage

Cited by 10 publications

References 14 publications

SoC Root Canal!

SoC Root Canal!

An Instruction Set Extension to Support Software-Based Masking

Rosita++: Automatic Higher-Order Leakage Elimination from Cryptographic Code

Contact Info

Product

Resources

About