Improved Trace-Driven Cache-Collision Attacks against Embedded AES Implementations

Abstract

Abstract. In this paper we present two attacks that exploit cache events, which are visible in some side channel, to derive a secret key used in an implementation of AES. The first is an improvement of an adaptive chosen plaintext attack presented at ACISP 2006. The second is a new known plaintext attack that can recover a 128-bit key with approximately 30 measurements to reduce the number of key hypotheses to 2 30 . This is comparable to classical Differential Power Analysis; however, our attacks are able to overcome certain masking techniques. We also show how to deal with unreliable cache event detection in the real-life measurement scenario and present practical explorations on a 32-bit ARM microprocessor.

A comprehensive study of multiple deductions-based algebraic trace driven cache attacks on AES

“…Cache attacks demonstrated fall into three categories, depending on the channels used to collect the leakages. These channels are spy processes [1], timing information [2,3] and power/electromagnetic (EM) traces [4,5,6,7,8,9,10,11]. The focus of this paper is trace driven cache attack (TDCA), which exploits the power or electromagnetic traces.…”

“…The number of traces required in TDCAs is much less than in the conventional differential power attacks (DPAs) [12], correlation power attacks (CPAs) [13] or other types of cache attacks [1,2,3]. Considering AES for example, only 30 cache traces are required in TDCAs [9,10] instead of hundreds (or thousands) of power traces in DPAs, CPAs [13], hundreds of cache traces in access driven cache attacks [1], and millions of cache traces in timing driven cache attacks [2,3].…”

“…AES was targeted in many TDCAs [4,5,6,7,8,9,10,11]. Throughout this paper, AES refers to AES-128 by default.…”

“…Further research in TDCAs on AES splits into two directions. One is about exploiting new and real leakages in TDCAs, where cache traces were collected from real power consumptions in [8,9] and from EM in [10]. The other is improving the efficiency of TDCAs on different AES implementations.…”

“…In attacks on AES with large lookup tables (e.g., 1K bytes), TDCAs can exploit cache events in the first round [11], the first two rounds [4] or the last round [5,7]. For AES implemented with a compact table (256 bytes), TDCAs can exploit the cache events in the first round [6], or the first two rounds [8,9,10]. This paper is under the latter direction and tries to improve TDCA on AES.…”