Towards fresh re-keying with leakage-resilient PRFs: cipher design principles and analysis

Abstract

Abstract. Leakage-resilient cryptography aims at developing new algorithms for which physical security against side-channel attacks can be formally analyzed. Following the work of Dziembowski and Pietrzak at FOCS 2008, several symmetric cryptographic primitives have been investigated in this setting. Most of them can be instantiated with a block cipher as underlying component. Such an approach naturally raises the question whether certain block ciphers are better suited for this purpose. In order to answer this question, we consider a leakage-resilient rekeying function, and evaluate its security at different abstraction levels. That is, we study possible attacks exploiting specific features of the algorithmic description, hardware architecture and physical implementation of this construction. These evaluations lead to two main outcomes. First, we complement previous works on leakage-resilient cryptography and further specify the conditions under which they actually provide physical security. Second, we take advantage of our analysis to extract new design principles for block ciphers to be used in leakage-resilient primitives. While our investigations focus on side-channel attacks in the first place, we hope these new design principles will trigger the interest of symmetric cryptographers to design new block ciphers combining good properties for secure implementations and security against black box (mathematical) cryptanalysis.

On the Security of Fresh Re-keying to Counteract Side-Channel and Fault Attacks

“…A simple, but unsatisfactory solution to prevent this kind of attacks is to increase the master key, session key and nonce sizes to twice the security level each. More promising approaches focus on the properties of g, in particular the hardness to invert g(·, r) to deduce the key k, as in the scheme by Belaid et al [4]. Our results show that designing secure, efficient re-keying functions remains a challenging task, and that frequent re-keying opens up problems of its own that are not yet fully understood.…”

“…This is clearly not compatible with resource-constrained application scenarios. The alternative is to fix the construction by using a function g that is hard to invert, as for instance the one suggested in [4]. It should be hard to recover the master key k from the knowledge of one or a few session keys k * and corresponding nonces r. However, this raises the question how such a cryptographically strong function can be constructed without in turn being very costly to protect against side-channel attacks.…”

“…In fact, several articles [1,4,7] treat the question of how to construct a key derivation function that can be implemented efficiently and that at the same time provides a high level of protection against differential attacks. Finding such a function is a central research question in the field of side-channel attacks and countermeasures.…”

Key Updating for Leakage Resiliency With Application to AES Modes of Operation

“…Focusing on the role of key-updating in leakage resilient cryptographic schemes, high-diffusion was proposed as the only mathematical condition required for secure key-updating [8], [15]. Here, we show that this condition is not sufficient with a counter example, and propose new conditions.…”

MEAS: memory encryption and authentication secure against side-channel attacks

“…In more detail, it is widely accepted that very small data complexities, i.e., q = 1 and q = 2, have sufficiently small side-channel leakage and do not allow for successful key recovery from DPA attacks [7,46,53,56].…”