Principles on the Security of AES against First and Second-Order Differential Power Analysis

Abstract

The Advanced Encryption Standard (AES) is a 128-bit block cipher that is currently being widely used in smartcards. Differential Power Analysis (DPA) is a powerful technique used to attack a cryptographic implementation in a resource-limited application environment like smartcards. Despite the extensive research on DPA of AES, it seems none has explicitly addressed the fundamental issue: How many rounds of the beginning and end parts of an AES implementation should be protected in order to resist practical DPA attacks, namely first and second-order DPA attacks? Implementation designers may think that it is sufficient to protect the first and last one (or one and a half) rounds of AES, leaving the inner rounds unprotected or protected by simple countermeasures. In this paper, we show that power leakage of some intermediate values from the more inner rounds of AES can be exploited to conduct first and/or second-order DPA attacks by employing techniques such as fixing certain plaintext/ciphertext bytes. We give five general principles on DPA vulnerability of unprotected AES implementations, and then give several general principles on DPA vulnerability of protected AES implementations. These principles specify which positions of AES are vulnerable to first and second-order DPA. To justify the principles, we attack two recently proposed AES implementations that use two kinds of countermeasures to achieve a high resistance against power analysis, and demonstrate that they are even vulnerable to DPA. Finally, we conclude that at least the first two and a half rounds and the last three rounds should be secured for an AES implementation to be resistant against first and second-order DPA in practice.

Diffusional Side-Channel Leakage From Unrolled Lightweight Block Ciphers: A Case Study of Power Analysis on PRINCE

“…R RC [1] p c R RC [2] R RC [3] R RC [4] R RC [5] R RC [6] R RC [7] R RC [8] R RC [9] R RC [10] S M S -1 -1 -1 -1 -1 -1 1 2 3 4 5 6 7 8 9 Against DES software, previous attacks, such as those in [14], [15], and [16], have overcome some masking methods by fixing the inputs in a particular manner. Against an AES software implementation in which the inner rounds were not protected, Lu et al [17] demonstrated a first-and second-order differential power analysis (DPA) attack that exploits some inner round intermediate values by fixing certain parts of the inputs. Reparaz et al [18] demonstrated a chosen-input DPA attack in the third round of a DES software implementation.…”

Leakage Mapping

“…Although most of the published attacks against block cipher implementations are focused on the predictable [Standaert et al 2004] intermediate results in the outer rounds based on known plain-or cipher-text, recent results highlight the importance of considering leakages in the middle rounds as well. Work on techniques such as algebraic side-channel attacks (e.g., and ) and chosen message attacks [Lu et al 2010] has demonstrated the ability to directly target intermediate results in middle rounds of a cipher-in some cases even without any knowledge of the plain-or cipher-text.…”

Security and Privacy Challenges in Cyber-Physical Systems

“…The computation of modular exponentiation proceeds from the random starting point towards the MSB using the right-to-left binary exponentiation algorithm, returns to the starting point and then moves towards the LSB using the left-to-right binary exponentiation algorithm [29]. The authors in [30] presented a randomized window-scanning RSA scheme resistant to power analysis attacks, specifically to the CPA that uses different inputs to the same algorithm and analyze the power consumption traces. Even if the attacker was able to recover the bits, it will be difficult to put those key bits in the correct order.…”