AI helps you reading Science

AI generates interpretation videos

AI extracts and analyses the key points of the paper to generate videos automatically


pub
Go Generating

AI Traceability

AI parses the academic lineage of this thesis


Master Reading Tree
Generate MRT

AI Insight

AI extracts a summary of this paper


Weibo:
While implementations of cryptographic algorithms in pervasive devices seriously face area and power constraints, their resistance against physical attacks has to be taken into account

Pushing the limits: a very compact and a threshold implementation of AES

EUROCRYPT, (2011): 69-88

Cited by: 348|Views155
EI

Abstract

Our contribution is twofold: first we describe a very compact hardware implementation of AES-128, which requires only 2400 GE. This is to the best of our knowledge the smallest implementation reported so far. Then we apply the threshold countermeasure by Nikova et al. to the AES S-box and yield an implementation of the AES improving the l...More

Code:

Data:

0
Introduction
  • The mass deployment of pervasive devices promises many benefits such as lower logistic costs, higher process granularity, optimized supply-chains, or location based services among others.
  • An aggravating factor is that pervasive devices are usually not deployed in a controlled but rather in a hostile environment, i.e., an adversary has physical access to or control over the devices
  • This adds the whole field of physical attacks to the potential attack scenarios.
  • E.g., [12] have stressed that such physical attacks are an extremely practical and powerful tool for recovering the secrets of unprotected cryptographic devices
  • These attacks exploit the information leaking through physical side channels and involved in sensitive computations to reveal the key materials.
  • Correlation power analysis (CPA) [6], which is a general form of DPA, got more attention since it is able to efficiently reveal the secrets by comparing the measurements to the estimations obtained by means of a theoretical power model which fits to the characteristics of the target implementation
Highlights
  • The mass deployment of pervasive devices promises many benefits such as lower logistic costs, higher process granularity, optimized supply-chains, or location based services among others
  • We investigate side-channel countermeasures for this lightweight Advanced Encryption Standard implementation
  • Correlation power analysis (CPA) [6], which is a general form of DPA, got more attention since it is able to efficiently reveal the secrets by comparing the measurements to the estimations obtained by means of a theoretical power model which fits to the characteristics of the target implementation
  • As expected and observed in [20], correlation power analysis attacks which use a HW model predicting the S-box input or output are not able to recover the secrets of hardware implementations
  • What should directly lead to a successful attack is a correlation power analysis using HD model which predicts bit flips on a part of the state register when S-box outputs are overwritten to each other
  • While implementations of cryptographic algorithms in pervasive devices seriously face area and power constraints, their resistance against physical attacks has to be taken into account
Methods
  • The authors used Mentor Graphics ModelSimXE 6.4b and Synopsys DesignCompiler version A-2007.12-SP1 for functional simulation and synthesis of the designs to the Virtual Silicon (VST) standard cell library UMCL18G212T3 [33], which is based on the UMC L180 0.18μm 1P6M logic process with a typical voltage of 1.8 V.
  • The authors used Synopsys Power Compiler version A-2007.12-SP1 to estimate the power consumption of the ASIC implementations.
  • In a typical application scenario the cryptographic core would be part of an integrated ASIC, for the power measurements on SASEBO the authors embedded the cryptographic core in a framework that handles the communication between the two FPGAs
Results
  • In addition to the performance and area consumption features of the threshold implementation, the authors have implemented the whole AES encryption design on an FPGA-based platform and analyzed the actual power consumption traces to practically investigate its resistance to first-order DPA attacks.
  • Two consecutive key bytes, i.e., 216 hypotheses, should be guessed
  • The results of such an attack, which shows the amount of information leakage related to register updates, is depicted by Fig. 4(a).
  • A mutual information analysis attack using the same distinguisher, i.e., HD of the register updates, is efficiently capable of recovering the secret
  • The results of this attack are shown in Fig. 5(a) and Fig. 5(b).
  • It is noteworthy to mention that those four clock cycles in which the secret leaks clearly in both Fig. 4 and Fig. 5 are when the intermediate results of the target S-box computation are consecutively stored in the pipeline registers of the shared S-box
Conclusion
  • While implementations of cryptographic algorithms in pervasive devices seriously face area and power constraints, their resistance against physical attacks has to be taken into account.
  • Most side-channel countermeasures introduce power and area overheads which are proportional to the values of the unprotected implementation.
  • This fact prohibits the implementation of a wide range of proposed countermeasures and limits possible cipher candidates for ubiquitous computing applications.
  • In this article the authors have applied a recently proposed secret sharing-based masking scheme to the AES S-box in order to improve the first-order resistance.
  • To separate the glitches of different parts of the circuit the authors have designed the S-box in five pipeline stages by adding four sets of intermediate registers and applying a remasking scheme on some selected registers
Tables
  • Table1: Breakdown of the post-synthesis implementation results for both architectures of a serialized AES-128 encryption-only core
Download tables as Excel
Funding
  • The authors were supported in part by the Singapore National Research Foundation under Research Grant NRF-CRP2-2007-03
Reference
  • Side-channel attack standard evaluation board (sasebo), Further information are http://www.rcis.aist.go.jp/special/SASEBO/index-en.html
    Findings
  • Agrawal, D., Rao, J.R., Rohatgi, P.: Multi-channel Attacks. In: Walter, C.D., Koç, Ç.K., Paar, C. (eds.) CHES 2003. LNCS, vol. 2779, pp. 2–16. Springer, Heidelberg (2003)
    Google ScholarLocate open access versionFindings
  • Blakley, G.R.: Safeguarding Cryptographic Keys. In: National Computer Conference, pp. 313–317 (1979)
    Google ScholarLocate open access versionFindings
  • Blömer, J., Guajardo, J., Krummel, V.: Provably Secure Masking of AES. In: Handschuh, H., Hasan, M.A. (eds.) SAC 2004. LNCS, vol. 3357, pp. 69–83. Springer, Heidelberg (2004)
    Google ScholarLocate open access versionFindings
  • Bogdanov, A., Leander, G., Knudsen, L., Paar, C., Poschmann, A., Robshaw, M., Seurin, Y., Vikkelsoe, C.: PRESENT: An Ultra-Lightweight Block Cipher. In: Paillier, P., Verbauwhede, I. (eds.) CHES 2007. LNCS, vol. 4727, pp. 450–466. Springer, Heidelberg (2007)
    Google ScholarLocate open access versionFindings
  • Brier, E., Clavier, C., Olivier, F.: Correlation Power Analysis with a Leakage Model. In: Joye, M., Quisquater, J.-J. (eds.) CHES 2004. LNCS, vol. 3156, pp. 16–29. Springer, Heidelberg (2004)
    Google ScholarLocate open access versionFindings
  • De Cannière, C., Dunkelman, O., Knežević, M.: KATAN and KTANTAN — A Family of Small and Efficient Hardware-Oriented Block Ciphers. In: Clavier, C., Gaj, K. (eds.) CHES 2009. LNCS, vol. 5747, pp. 272–288. Springer, Heidelberg (2009)
    Google ScholarLocate open access versionFindings
  • Canright, D.: A Very Compact S-Box for AES. In: Rao, J.R., Sunar, B. (eds.) CHES 2005. LNCS, vol. 3659, pp. 441–455. Springer, Heidelberg (2005)
    Google ScholarLocate open access versionFindings
  • Canright, D., Batina, L.: A Very Compact “Perfectly Masked” S-Box for AES. In: Bellovin, S.M., Gennaro, R., Keromytis, A.D., Yung, M. (eds.) ACNS 2008. LNCS, vol. 5037, pp. 446–459. Springer, Heidelberg (2008), the corrected version is available at Cryptology ePrint Archive, Report 2009/011 http://eprint.iacr.org/2009/011
    Locate open access versionFindings
  • Chari, S., Jutla, C.S., Rao, J.R., Rohatgi, P.: Towards Sound Approaches to Counteract Power-Analysis Attacks. In: Wiener, M. (ed.) CRYPTO 1999. LNCS, vol. 1666, pp. 398–412. Springer, Heidelberg (1999)
    Google ScholarLocate open access versionFindings
  • Coron, J.-S., Prouff, E., Rivain, M.: Side Channel Cryptanalysis of a Higher Order Masking Scheme. In: Paillier, P., Verbauwhede, I. (eds.) CHES 2007. LNCS, vol. 4727, pp. 28–44.
    Google ScholarLocate open access versionFindings
  • Eisenbarth, T., Kasper, T., Moradi, A., Paar, C., Salmasizadeh, M., Shalmani, M.T.M.: On the Power of Power Analysis in the Real World: A Complete Break of the KeeLoq Code Hopping Scheme. In: Wagner, D. (ed.) CRYPTO 2008. LNCS, vol. 5157, pp. 203–220. Springer, Heidelberg (2008)
    Google ScholarFindings
  • Feldhofer, M., Wolkerstorfer, J., Rijmen, V.: AES Implementation on a Grain of Sand. IEE Proceedings of Information Security 152(1), 13–20 (2005)
    Google ScholarLocate open access versionFindings
  • Gierlichs, B., Batina, L., Tuyls, P., Preneel, B.: Mutual Information Analysis. In: Oswald, E., Rohatgi, P. (eds.) CHES 2008. LNCS, vol. 5154, pp. 426–442. Springer, Heidelberg (2008)
    Google ScholarFindings
  • Hämäläinen, P., Alho, T., Hännikäinen, M., Hämäläinen, T.D.: Design and Implementation of Low-Area and Low-Power AES Encryption Hardware Core. In: DSD, pp. 577–583 (2006)
    Google ScholarFindings
  • Herbst, C., Oswald, E., Mangard, S.: An AES Smart Card Implementation Resistant to Power Analysis Attacks. In: Zhou, J., Yung, M., Bao, F. (eds.) ACNS 2006. LNCS, vol. 3989, pp. 239–252. Springer, Heidelberg (2006)
    Google ScholarLocate open access versionFindings
  • Daemen, G.J., Peeters, M., Rijmen, V.: The Noekeon Block Cipher. In: First Open NESSIE Workshop (2000)
    Google ScholarFindings
  • Kocher, P.C., Jaffe, J., Jun, B.: Differential Power Analysis. In: Wiener, M. (ed.) CRYPTO 1999. LNCS, vol. 1666, pp. 388–397. Springer, Heidelberg (1999)
    Google ScholarLocate open access versionFindings
  • Mangard, S., Oswald, E., Popp, T.: Power Analysis Attacks: Revealing the Secrets of Smart Cards. Springer, Heidelberg (2007)
    Google ScholarFindings
  • Mangard, S., Pramstaller, N., Oswald, E.: Successfully Attacking Masked AES Hardware Implementations. In: Rao, J.R., Sunar, B. (eds.) CHES 2005. LNCS, vol. 3659, pp. 157–171. Springer, Heidelberg (2005)
    Google ScholarLocate open access versionFindings
  • Moradi, A., Mischke, O., Eisenbarth, T.: Correlation-Enhanced Power Analysis Collision Attack. In: Mangard, S., Standaert, F.-X. (eds.) CHES 2010. LNCS, vol. 6225, pp. 125–139. Springer, Heidelberg (2010)
    Google ScholarLocate open access versionFindings
  • National Institute of Standards and Technology (NIST). Announcing the Advanced Encryption Standard (AES). Federal Information Processing Standards Publication 197 (November 2001)
    Google ScholarLocate open access versionFindings
  • Nikova, S., Rechberger, C., Rijmen, V.: Threshold Implementations Against SideChannel Attacks and Glitches. In: Ning, P., Qing, S., Li, N. (eds.) ICICS 2006. LNCS, vol. 4307, pp. 529–545. Springer, Heidelberg (2006)
    Google ScholarLocate open access versionFindings
  • Nikova, S., Rijmen, V., Schläffer, M.: Secure Hardware Implementation of Nonlinear Functions in the Presence of Glitches. In: Lee, P.J., Cheon, J.H. (eds.) ICISC 2008. LNCS, vol. 5461, pp. 218–234.
    Google ScholarLocate open access versionFindings
  • Nikova, S., Rijmen, V., Schläffer, M.: Secure Hardware Implementation of Nonlinear Functions in the Presence of Glitches. Journal of Cryptology (2010) (in press), doi:10.1007/s00145-010-9085-7
    Locate open access versionFindings
  • Oswald, E., Mangard, S., Pramstaller, N., Rijmen, V.: A Side-Channel Analysis Resistant Description of the AES S-Box. In: Gilbert, H., Handschuh, H. (eds.) FSE 2005. LNCS, vol. 3557, pp. 413–423. Springer, Heidelberg (2005)
    Google ScholarLocate open access versionFindings
  • Popp, T., Mangard, S.: Masked Dual-Rail Pre-charge Logic: DPA-Resistance Without Routing Constraints. In: Rao, J.R., Sunar, B. (eds.) CHES 2005. LNCS, vol. 3659, pp. 172–186. Springer, Heidelberg (2005)
    Google ScholarLocate open access versionFindings
  • Poschmann, A., Moradi, A., Khoo, K., Lim, C.-W., Wang, H., Ling, S.: Side-Channel Resistant Crypto for less than 2,300 GE. Journal of Cryptology (2010) (in press), doi: 10.1007/s00145-010-9086-6
    Locate open access versionFindings
  • Rijmen, V., Daemen, J.: The Design of Rijndael: AES. The Advanced Encryption Standard, 1st edn. Springer, Heidelberg (2002)
    Google ScholarFindings
  • Rolfes, C., Poschmann, A., Leander, G., Paar, C.: Ultra-Lightweight Implementations for Smart Devices – Security for 1000 Gate Equivalents. In: Grimaud, G., Standaert, F.-X. (eds.) CARDIS 2008. LNCS, vol. 5189, pp. 89–103.
    Google ScholarLocate open access versionFindings
  • Shamir, A.: How to Share a Secret. Communications of the ACM 22(11), 612–613 (1979)
    Google ScholarLocate open access versionFindings
  • Standaert, F.-X., Veyrat-Charvillon, N., Oswald, E., Gierlichs, B., Medwed, M., Kasper, M., Mangard, S.: The World is Not Enough: Another Look on SecondOrder DPA. In: Abe, M. (ed.) ASIACRYPT 2010. LNCS, vol. 6477, pp. 112–129. Springer, Heidelberg (2010)
    Google ScholarLocate open access versionFindings
  • Virtual Silicon Inc. 0.18 μm VIP Standard Cell Library Tape Out Ready, Part Number: UMCL18G212T3, Process: UMC Logic 0.18 μm Generic II Technology: 0.18μm (July 2004)
    Google ScholarLocate open access versionFindings
  • Waddle, J., Wagner, D.: Towards Efficient Second-Order Power Analysis. In: Joye, M., Quisquater, J.-J. (eds.) CHES 2004. LNCS, vol. 3156, pp. 1–15. Springer, Heidelberg (2004)
    Google ScholarLocate open access versionFindings
  • Xilinx: Virtex-II Pro and Virtex-II ProX Platform FPGAs: Complete Data Sheet (November 2007), http://www.xilinx.com/support/documentation/data_sheets/ds083.pdf
    Findings
Your rating :
0

 

Tags
Comments
数据免责声明
页面数据均来自互联网公开来源、合作出版商和通过AI技术自动分析结果,我们不对页面数据的有效性、准确性、正确性、可靠性、完整性和及时性做出任何承诺和保证。若有疑问,可以通过电子邮件方式联系我们:report@aminer.cn
小科