Scalable Key Rank Estimation (and Key Enumeration) Algorithm for Large Keys

Grosso, Vincent

doi:10.1007/978-3-030-15462-2_6

Cited by 21 publications

(32 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This issue is addressed by a recent work [VCGS13], with an algorithm to estimate the upper and lower bounds for the rank of the correct full-key. More efficient ranking algorithms have been further developed [GGP + 15, BLvV15, MOOS15, DW17,Gro18]. As these ranking algorithms require access to a data set (e.g., with q measurement traces) to find the correct full-key rank over the set, the empirical GE estimation needs to average the ranks on N such independent data sets.…”

Section: Introductionmentioning

confidence: 99%

A Fast and Accurate Guessing Entropy Estimation Algorithm for Full-key Recovery

Zhang

Ding

Fei

2020

TCHES

View full text Add to dashboard Cite

Guessing entropy (GE) is a widely adopted metric that measures the average computational cost needed for a successful side-channel analysis (SCA). However, with current estimation methods where the evaluator has to average the correct key rank over many independent side-channel leakage measurement sets, full-key GE estimation is impractical due to its prohibitive computing requirement. A recent estimation method based on posterior probabilities, although scalable, is not accurate.We propose a new guessing entropy estimation algorithm (GEEA) based on theoretical distributions of the ranking score vectors. By discovering the relationship of GE with pairwise success rates and utilizing it, GEEA uses a sum of many univariate Gaussian probabilities instead of multi-variate Gaussian probabilities, significantly improving the computation efficiency.We show that GEEA is more accurate and efficient than all current GE estimations. To the best of our knowledge, it is the only practical full-key GE evaluation on given experimental data sets which the evaluator has access to. Moreover, it can accurately predict the GE for larger sizes than the experimental data sets, providing comprehensive security evaluation.

show abstract

Section: Introductionmentioning

confidence: 99%

A Fast and Accurate Guessing Entropy Estimation Algorithm for Full-key Recovery

Zhang

Ding

Fei

2020

TCHES

View full text Add to dashboard Cite

show abstract

“…Due to computational limitations, existing key rank estimation algorithms estimate the key rank with some bounded error [Gro19]. As detailed in [Gro19], the histogram of the log probabilities corresponding to key guesses for a key byte is convolved with the histograms of the log probabilities corresponding to key guesses for each and every key byte to find the rank of the correct key with some bounded error. Hence, KR is typically reported as a tight range with an upper bound and a lower bound.…”

Section: Key Rankmentioning

confidence: 99%

VITI: A Tiny Self-Calibrating Sensor for Power-Variation Measurement in FPGAs

Udugama

Jayasinghe

Saadat

et al. 2021

TCHES

View full text Add to dashboard Cite

On-chip sensors, built using reconfigurable logic resources in field programmable gate arrays (FPGAs), have been shown to sense variations in signalpropagation delay, supply voltage and power consumption. These sensors have been successfully used to deploy security attacks called Remote Power Analysis (RPA) Attacks on FPGAs. The sensors proposed thus far consume significant logic resources and some of them could be used to deploy power viruses. In this paper, a sensor (named VITI) occupying a far smaller footprint than existing sensors is presented. VITI is a self-calibrating on-chip sensor design, constructed using adjustable delay elements, flip-flops and LUT elements instead of combinational loops, bulky carry chains or latches. Self-calibration enables VITI the autonomous adaptation to differing situations (such as increased power consumption, temperature changes or placement of the sensor in faraway locations from the circuit under attack). The efficacy of VITI for power consumption measurement was evaluated using Remote Power Analysis (RPA) attacks and results demonstrate recovery of a full 128-bit Advanced Encryption Standard (AES) key with only 20,000 power traces. Experiments demonstrate that VITI consumes 1/4th and 1/16th of the area compared to state-of-the-art sensors such as time to digital converters and ring oscillators for similar effectiveness.

show abstract

“…The question then becomes can we design efficient algorithms that traverse the lists of chunk candidates to combine chunk candidates c i , obtaining complete key candidates c having high total scores obtained by summation? This question has been previously addressed in the side-channel analysis literature, with a variety of different algorithms being possible to solve this problem and the related problem known as key rank estimation [12][13][14][15][16][17][18][19][20][21][22][23][24][25][26].…”

Section: P(r)mentioning

confidence: 99%

“…Broadly speaking, optimal key enumeration algorithms [18,28] tend to consume more memory and to be less efficient while generating high-scoring key candidates, whereas nonoptimal key enumeration algorithms [12][13][14][15][16][17]26,29] are expected to run faster and to consume less memory. Table 1 shows a preliminary taxonomy of the key enumeration algorithms to be reviewed in this section.…”

Section: Key Enumeration Algorithmsmentioning

confidence: 99%

“…A recent paper by Grosso [26] introduced a variant of the previous algorithm. Basically, the author of [26] makes a small adaptation of Algorithm 14 to take into account the tree-like structure used by their rank estimation algorithm. Also, the author claims this variant has an advantage over the previous one when the memory needed to store histograms is too large.…”

Section: Variantmentioning

confidence: 99%

See 1 more Smart Citation

A Comprehensive Study of the Key Enumeration Problem

Villanueva-Polanco

2019

Entropy

View full text Add to dashboard Cite

In this paper, we will study the key enumeration problem, which is connected to the key recovery problem posed in the cold boot attack setting. In this setting, an attacker with physical access to a computer may obtain noisy data of a cryptographic secret key of a cryptographic scheme from main memory via this data remanence attack. Therefore, the attacker would need a key-recovery algorithm to reconstruct the secret key from its noisy version. We will first describe this attack setting and then pose the problem of key recovery in a general way and establish a connection between the key recovery problem and the key enumeration problem. The latter problem has already been studied in the side-channel attack literature, where, for example, the attacker might procure scoring information for each byte of an Advanced Encryption Standard (AES) key from a side-channel attack and then want to efficiently enumerate and test a large number of complete 16-byte candidates until the correct key is found. After establishing such a connection between the key recovery problem and the key enumeration problem, we will present a comprehensive review of the most outstanding key enumeration algorithms to tackle the latter problem, for example, an optimal key enumeration algorithm (OKEA) and several nonoptimal key enumeration algorithms. Also, we will propose variants to some of them and make a comparison of them, highlighting their strengths and weaknesses.

show abstract

Scalable Key Rank Estimation (and Key Enumeration) Algorithm for Large Keys

Cited by 21 publications

References 15 publications

A Fast and Accurate Guessing Entropy Estimation Algorithm for Full-key Recovery

A Fast and Accurate Guessing Entropy Estimation Algorithm for Full-key Recovery

VITI: A Tiny Self-Calibrating Sensor for Power-Variation Measurement in FPGAs

A Comprehensive Study of the Key Enumeration Problem

Contact Info

Product

Resources

About