Multi-target DPA Attacks: Pushing DPA Beyond the Limits of a Desktop Computer

Abstract

Abstract. Following the pioneering CRYPTO '99 paper by Kocher et al. differential power analysis (DPA) was initially geared around lowcost computations performed using standard desktop equipment with minimal reliance on device-specific assumptions. In subsequent years, the scope was broadened by, e.g., making explicit use of (approximate) power models. An important practical incentive of so-doing is to reduce the data complexity of attacks, usually at the cost of increased computational complexity. It is this trade-off which we seek to explore in this paper. We draw together emerging ideas from several strands of the literaturehigh performance computing, post-side-channel global key enumeration, and effective combination of separate information sources-by way of advancing (non-profiled) 'standard DPA' towards a more realistic threat model in which trace acquisitions are scarce but adversaries are well resourced. Using our specially designed computing platform (including our parallel and scalable DPA implementation, which allows us to work efficiently with as many as 2 32 key hypotheses), we demonstrate some dramatic improvements that are possible for 'standard DPA' when combining DPA outcomes for several intermediate targets. Unlike most previous 'information combining' attempts, we are able to evidence the fact that the improvements apply even when the exact trace locations of the relevant information (i.e. the 'interesting points') are not known a priori but must be searched simultaneously with the correct subkey.

Correlation Power Analysis of Lightweight Block Ciphers: From Theory to Practice

“…Fantomas. Our attack against the implementation of Fantomas is a multi-target attack [26] because a normal attack failed to recover two bits of each attacked subkey. The multi-target attack enabled us to reveal the four key-bytes using 165 traces with 100% success rate.…”

Uncertain? No, It’s Very Certain!

“…With the increase number of power traces, the correct key will reach the first position. Martin et al constructed an extremely efficient algorithm that accurately computing the rank of a (known) key in the list of all keys [8]. This approach is tweaked and can be also utilised to enumerate the most likely keys in a parallel fashion.…”

“…They don't consider the relationship between the repetitions and guessing entropy. So, very different from [8], we make use of the information leaking from the guessing entropy to recover the key rather than only a kind of evaluation in this paper. Our scheme significantly improves the efficiency of CPA.…”

Computational aspects of correlation power analysis

“…This is illustrated by recent work, e.g. [1,22] investigates the usage of graphics processing units to accelerate the computation while [20] explores the sophisticated usage of high-performance computing in this setting. Although many hardware designers and power analysis experts report whether the implementations of their techniques withstand (higher order) correlation attacks, it is often not reported how much time was required to mount such attacks.…”