Strengthening Sequential Side-Channel Attacks Through Change Detection

Abstract

The sequential structure of some side-channel attacks makes them subject to error propagation, i.e. when an error occurs during the recovery of some part of a secret key, all the following guesses might as well be chosen randomly. We propose a methodology that strengthens sequential attacks by automatically identifying and correcting errors. The core ingredient of our methodology is a change-detection test that monitors the distribution of the distinguisher values used to reconstruct the secret key. Our methodology includes an error-correction procedure that can cope both with false positives of the change-detection test, and inaccuracies of the estimated location of the wrong key guess. The proposed methodology is general and can be included in several attacks. As meaningful examples, we conduct two different side-channel attacks against RSA-2048: an horizontal power-analysis attack based on correlation and a vertical timing attack. Our experiments show that, in all the considered cases, strengthened attacks outperforms their original counterparts and alternative solutions that are based on thresholds. In particular, strengthened attacks achieve high success rates even when the side-channel measurements are noisy or limited in number, without prohibitively increasing the computing time.

Change Detection in Multivariate Datastreams Controlling False Alarms

“…In terms of false alarm rate, QT-EWMA and SPLL-CPM approach the target values computed by (9), while QT and SPLL have fewer and more false alarms, respectively, as a consequence of their empirical ARL 0 , and this happens in all the considered monitoring scenarios. The false alarms of Scan-B, instead, exhibit a completely different behavior which also depends on the data distribution, due to the fact that its thresholds do not yield a constant false alarm probability.…”

“…The target ARL0 ∈ {500, 1000, 2000, 5000} is maintained when the line is close to the dotted diagonal. (b,d) show the detection delay against the percentage of false alarms achieved on the same datasets, which should approach the dotted false alarm rates by(9).…”

“…where the probability P is computed under φ 0 . This fact has relevant practical implications: since false alarms are controlled by (9), any substantial increase in their occurrence might indicate a drift in the data-generating process, which requires to update the change-detection algorithm. Other strategies based on asymptotic approximations cannot guarantee (9), as shown in our experiments.…”

“…In this experiment, we consider datastreams of length L = 6 • ARL 0 to have a detection in each datastream. Since, by construction, the detection time t * of our method under φ 0 is a Geometric random variable with parameter α = 1/ARL 0 , (9) indicates that the probability of having a false alarm before L is P(t * ≤ L) ≈ 0.9975. Detection delay.…”

“…Detecting changes in datastreams is a frequently encountered problem in industrial [13] and traffic monitoring [12], security [31], cryptographic attacks [9], and finance [29], to name a few examples. Change detection is also relevant in machine learning, where changes are also known as concept drifts, and classifiers have to be adapted as the data-generating process changes [10].…”