Why Cryptography Should Not Rely on Physical Attack Complexity

Abstract

Ich versichere an Eides statt, dass ich diese Dissertation selbständig verfasst und nur die angegebenen Quellen und Hilfsmittel verwendet habe. Datum Für meine Eltern AbstractEver since the first side channel attacks and fault attacks on cryptographic devices were introduced in the mid-nineties, new possibilities of physical attacks have been consistently explored. The risk that these attacks pose is reduced by reacting to known attacks and by developing and implementing countermeasures against them. For physical attacks whose theory is known but which have not been conducted yet, however, the situation is different. Attacks whose physical realization is assumed to be very complex are taken less seriously. The trust that these attacks will not be realized due to their physical complexity means that no countermeasures are developed at all. This leads to unprotected devices once the assessment of the complexity turns out to be wrong.This thesis presents two practical physical attacks whose theory is known for several years. Since neither attack has previously been successfully implemented in practice, however, they were not considered a serious threat. Their physical attack complexity has been overestimated and the implied security threat has been underestimated. First, we introduce the photonic side channel, which offers not only temporal resolution, but also the highest possible spatial resolution. Due to the high cost of its first realization, it has not been taken seriously. We show both simple and differential photonic side channel analyses. Then, we present a fault attack against pairing-based cryptography. Due to the need for at least two independent precise faults in a single pairing computation, it has also not been taken seriously. We show how attackers can reveal the secret key of symmetric as well as asymmetric cryptographic algorithms based on these physical attacks. We present countermeasures on the software and the hardware level, which help to prevent these attacks in the future.Based on these two presented attacks, this thesis shows that the assessment of physical attack complexity is error-prone. Hence, cryptography should not rely on it. Cryptographic technologies have to be protected against all physical attacks, have they already been realized or not. The development of countermeasures does not require the successful execution of an attack but can already be carried out as soon as the principle of a side channel or a fault attack is understood.

Enhancing Side Channel Attack-Resistance of the STTL Combining Multi-Vt Transistors with Capacitance and Current Paths Counterbalancing

“…The symmetric algorithms exposed in this section were implemented, aiming to deliver some level of mathematical safety. However, both symmetric and asymmetric algorithms are known to be vulnerable to SCA even with high numerical robustness (i.e., higher bit-width encryption) [27].…”

SoK: An Analysis of Protocol Design: Avoiding Traps for Implementation and Deployment

“…We call this the "good enough" approach to security. Others, especially the field of cryptography [102], follow the approach of "perfect security". Perfect security refers to using every possible mean to achieve security.…”

Descrambling of Embedded SRAM Using a Laser Probe

“…Some microcontrollers even allow the execution of a program from the SRAM in order to fasten execution or minimize power consumption. In the context involving the manipulation of sensitive data such as encryption [1], this area becomes a target of choice for attackers.…”