Leakage-Resilient Symmetric Cryptography under Empirically Verifiable Assumptions

Abstract

Abstract. Leakage-resilient cryptography aims at formally proving the security of cryptographic implementations against large classes of side-channel adversaries. One important challenge for such an approach to be relevant is to adequately connect the formal models used in the proofs with the practice of side-channel attacks. It raises the fundamental problem of finding reasonable restrictions of the leakage functions that can be empirically verified by evaluation laboratories. In this paper, we first argue that the previous "bounded leakage" requirements used in leakage-resilient cryptography are hard to fulfill by hardware engineers. We then introduce a new, more realistic and empirically verifiable assumption of simulatable leakage, under which security proofs in the standard model can be obtained. We finally illustrate our claims by analyzing the physical security of an efficient pseudorandom generator (for which security could only be proven under a random oracle based assumption so far). These positive results come at the cost of (algorithm-level) specialization, as our new assumption is specifically defined for block ciphers. Nevertheless, since block ciphers are the main building block of many leakage-resilient cryptographic primitives, our results also open the way towards more realistic constructions and proofs for other pseudorandom objects.

Implementation of a leakage-resilient ElGamal key encapsulation mechanism

“…In this model only actual computations are supposed to leak sensitive information. This captures the usual situation in side-channel attacks, where leakage data only depend on the current state of the target device and some independent randomness [32]. The internal data of the device are divided into two parts, an active and a passive part, the active part being the input data used in the current computation.…”

“…Several contemporary works [4,27,32] have put forward ways to redefine the above models and bring them closer to practice, for symmetric cryptography primitives. This comes at the cost of algorithmic-level specialization, providing models that are indeed more realistic, but which apply to a more restrained class of primitives (i.e., pseudorandom generators, block ciphers).…”

“…This kind of requirement that may look reasonable for a theoretician used to study cryptographic primitives in the so-called black-box model might seem completely unrealistic to the practitioner. As an example, let us recall the figure gathered in [32], where it is pointed out that the leaking of a block cipher recently reported in [24], consisted of 200,000 traces leading to more than 1.5 Gb of data storage.…”

Unifying Leakage Models: From Probing Attacks to Noisy Leakage.

“…Prominent sources of such physical leakages include the running time of an implementation [17], its power consumption [18] or electromagnetic radiation emitting from it [27]. A large body of recent applied and theoretical research attempts to incorporate the information an adversary obtains from the leakage into the security analysis and develops countermeasures to defeat common side-channel attacks [4,14,21,1,9,32,31]. While there is still a large gap between what theoretical models can achieve and what side-channel information is measured in practice, some recent important works propose models that better go align with the perspective of cryptographic engineering [30,25,31].…”

Simulatable Leakage: Analysis, Pitfalls, and New Constructions

“…At Crypto'13, Standaert et al [19] proposed a new notion for leakage resilience involving simulators. The intuition behind their proposal is that if an adversary cannot tell the difference between real leakage and simulated leakage (from a simulator that does not know the secret key), then clearly the leakage does not reveal any information about the secret key.…”