Overview of the 2008-2009 ‘DPA contest’€¦ · Oﬃcial Declaration of the 2008–2009 DPA...

DPA Contest: What is it?Summary of the Worldwide Involvement

Best AttacksOfficial Declaration of the 2008–2009 DPA contest Winner

Overview of the 2008-2009 ‘DPA contest’

Sylvain GUILLEY, Laurent SAUVAGE, Florent FLAMENT,Maxime NASSAR, Nidhal SELMANE, Jean-Luc DANGER,

Tarik GRABA, Yves MATHIEU & Renaud PACALET.< [email protected]>

Institut TELECOM / TELECOM-ParisTechCNRS – LTCI (UMR 5141)

SECURE

CHES’09, September 7th, 2009,Lausanne, Switzerland.

Sylvain GUILLEY < [email protected] > Overview of the ‘DPA Contest’SECURE

1/24

http://www.DPAcontest.org/


http://www.institut-telecom.fr/

http://www.telecom-paristech.fr/

http://www.cnrs.fr/

http://www.ltci.enst.fr/



http://www.cnrs.fr/

http://www.secure-ic.com/




http://www.cnrs.fr/

http://www.cnrs.fr/



Presentation Outline

1 DPA Contest: What is it?

2 Summary of the Worldwide InvolvementWeb AudienceParticipation Statistics

3 Best Attacks

4 Official Declaration of the 2008–2009 DPA contest Winner


2/24






http://www.cnrs.fr/

http://www.cnrs.fr/






3 Best Attacks



3/24






http://www.cnrs.fr/

http://www.cnrs.fr/



What is this http://www.DPAcontest.org/?

It is a key recover attack contest

80k+ side-channel measurements (traces) are freelyavailable worldwide from a PostGreSQL database.

They have been measured on a real circuit, but are somehowideal, hence suitable for academic studies:

Clock signal is stable.Traces synchronization is perfect.Power curves concern the DES crypto-processor alone.Measurement bandwidth is 5 GHz, and sampling rate is20 Gsample/s.Vertical resolution is 12.0 effective bits.


4/24






http://www.cnrs.fr/

http://www.cnrs.fr/

RAM64(for AES)

4×

ROM2k

AES

CPU

DES2

(for DES)

DES1

RAM2563×

(for CPU)

SDES

RAM32k

Purpose Characterization and attack on the symmetric encryptionalgorithms DES (fips46-3) and AES (fips197)

Programmation C language, configuration via an RS232 or a USB port

Chip’s size 4.0 mm2, 2.0 million transistors

Power domains 5: pads (3.3 V), core + DES1 + DES2 + SDES (1.2 V)

Technology STMicroelectronics 130 nanometer low-leakage (high Vt)with 6 layers of metal process, founded at Crolles, FRANCE

Fabrication CMP run S12C5 1 (13/01/2005) with the help of ST/AST

More information online: http://cmp.imag.fr/aboutus/gallery/details.php?id_circ=63&y=2005.

http://cmp.imag.fr/aboutus/gallery/details.php?id_circ=63&y=2005



Motivation + Ethics

Advantages

Makes it possible for a laboratory w/o measurementfacilities to experiment security evaluation algorithms.

Allows a fair comparison of known attacks and tricks.

Stimulates the research for better power attacks.

Ethics

Such a contest on a commercial product would endanger allits users.

Thus only a public research group can safely share measuresfrom an home-made academic circuit.

Open source = danger?No = possibility to improve on top of others’ ideas!


6/24





http://www.cnrs.fr/

http://www.cnrs.fr/



Example with the reference code

Demonstration of the contest simplicity:

> svn co https://svn.comelec.enst.fr/dpacontest/

> cd code/reference/

> python main.py

# Table: secmatv1_2006_04_0809

# Stability threshold: 100

# Iteration threshold: 1800

#

# Columns: Iteration Stability Subkey0 ... Subkey7

1

2

3

...


7/24





http://www.cnrs.fr/

http://www.cnrs.fr/



Reference Attack: Difference-of-Means [P. Kocher, 1998]

-20

0

20

40

60

80

-8 0 8 16

Voltage [m

V]

Time [clock periods]

Average power trace

-0.5

0

0.5

1

1.5

2

2.5

3

-8 0 8 16V

oltage [m

V]

Time [clock periods]

Covariance result (zoomed)


8/24





http://www.cnrs.fr/

http://www.cnrs.fr/



Rules

A valid attack shall:

Recover the correct key with a stability of additional 100traces usage.

Consist in source code, committed into an SVN repository.

The hall of fame is based on:

An eligibility that is verifiable on a peer-review basis.

Objective: use as few traces as possible.

The date of the commit, which must belong to:[Aug 12th 2008, Aug 30th 2009].


9/24





http://www.cnrs.fr/

http://www.cnrs.fr/



Web AudienceParticipation Statistics




3 Best Attacks



10/24






http://www.cnrs.fr/

http://www.cnrs.fr/




Two Kinds of Involvements

Internet

SVN(code)

SQL(curves)

Download Contribute&

Observers: download the tracesand/or the attack source code.

Key figure: 4,355 visits.

Players: upload attack source code.

Key figure: 44 submissions.


11/24





http://www.cnrs.fr/

http://www.cnrs.fr/

DPA Contest Popularity Indicators

DPA Contest Map: 45 countries / territories

Riscure

GERMANY

Karlsruhe U.

NETHERLANDS

Toshiba

Tohoku U.

Mitsubishi

SOUTH KOREA

TELECOM ParisTech

LIRMM

3iL, Limoges U.

JAPAN

Korea U., CIST

FRANCE

BELGIUM

KUL




Hall of Fame Split in Four Categories

1 Order-independent: the attacks have been carried out onvarious significant sets of traces, ordered in a random way.

2 Chosen plaintext order: where the traces order is computedby an algorithm that is explicited in the attack source code.

3 Fixed order: that models an attack at known albeit notchosen plaintext or ciphertext. The order is either

that of the database without the SORT BY clause, orthat of the ZIP archive, orlexicographical (corresponding to acquisition order).

4 Custom order: left at the discretion of the attacker . . . ofcourse, an explanation of the sorting strategy is preferred.


14/24





http://www.cnrs.fr/

http://www.cnrs.fr/




Events for each category

0

500

1000

1500

2000

2500

Au

g 1

2th

08

Se

p 1

st

08

Oct

1st

08

No

v 1

st

08

De

c 1

st

08

Ja

n 1

st

09

Fe

b 1

st

09

Ma

r 1

st

09

Ap

r 1

st

09

Ma

y 1

st

09

Ju

n 1

st

09

Ju

l 1

st

09

Au

g 1

st

09

Se

p 1

st

09

0

20

40

60

80

100

120

140

160

180

200

220

240

260

Nu

mb

er

of

tra

ce

s t

o b

rea

k D

ES

SV

N r

evis

ion

fo

r th

e s

ub

mis

sio

n

SVN revision for the submission# traces to break DES (category 1)# traces to break DES (category 3)# traces to break DES (category 4)


15/24





http://www.cnrs.fr/

http://www.cnrs.fr/




Category # Attacks Best attack

#1 17 141.42 traces, by Christophe Clavierof 3iL & U. of Limoges, FRANCE.

#2 0 No submission /.

#3 17 120 traces, by Daisuke Suzuki & Mi-noru Saeki of Mitsubishi, JAPAN.

#4 10 107 traces, by Hideo Shimizu ofToshiba, JAPAN.

Total 44 −→ winner chosen as the best sub-

mission in category #1.


16/24





http://www.cnrs.fr/

http://www.cnrs.fr/






3 Best Attacks



17/24






http://www.cnrs.fr/

http://www.cnrs.fr/



Campaign Characteristics

Unprotected and little noisy traces.

Excellent linear and temporally localized leakage.

Hence:

The dominant strategy has been model-based attacks:

Differential Power Analysis orCorrelation Power Analysis,


18/24





http://www.cnrs.fr/

http://www.cnrs.fr/



Overview of the State-of-the-Art Advance [1/4]

New attacks are based on one or more of these techniques:

Pre-filtering the traces (window filters, or cropping):

Victor LOMNE from LIRMM was the first to attack the lastround and to select a good temporal window

Choice of which round to attack:

Daisuke SUZUKI from Mitsubishi dual round attack byBS-CPA

Number of key bits attacked simultaneously:

Eloi SANFELIX from Riscure attacked two sboxessimultaneously


19/24





http://www.cnrs.fr/

http://www.cnrs.fr/





Number of unknown bits making up the selection function:

Most attacks were multi-bit, and Daisuke SUZUKI proposedan improved power modelAntonio SOBREIRA from Universitat Karlsruhe performed aclassical CPA considering the left side of the message register

Statistical test to distinguish the correct guess fromerroneous ones:

Benedikt GIERLICHS from KUL implemented a t-test;Yongdae KIM from Tohoku University tested Pearson, Kendalland Spearman correlations


20/24





http://www.cnrs.fr/

http://www.cnrs.fr/





Taking advantage of the knowledge of the already brokensboxes to improve the correlation of hard to break sboxes:

Hideo SHIMIZU from Toshiba coined the Built-in determinedSub-key Correlation Power Analysis (BS-CPA), described inhttp://eprint.iacr.org/2009/161.

Cooperation between hypotheses:

Renaud PACALET from TELECOM ParisTech finds the bestkey candidates by optimization algorithm based on the theoryintroduced by Xiaofei Huang


21/24


http://eprint.iacr.org/2009/161




http://www.cnrs.fr/

http://www.cnrs.fr/





On-line model estimation:

Christophe CLAVIER estimated on-line a multi-variate linearmodel

Stochastic model attack:

contributed by Yongdae KIM from Tohoku university

Multi-DPA:

Jung HAE-IL from Korea University combined multi-bit DPAof Thomas MESSERGES and Regis BEVAN

Combined attacks:

e.g. BS-CPA on 2-sboxes by Laurent SAUVAGE, fromTELECOM ParisTech


22/24





http://www.cnrs.fr/

http://www.cnrs.fr/






3 Best Attacks



23/24






http://www.cnrs.fr/

http://www.cnrs.fr/



2008–2009 Winner Congratulations!

Winner identity

Name Prof. Christophe CLAVIERAffiliation #1 Institut d’Ingenierie Informatique de Limoges

(3iL), 42 rue Sainte Anne, 87 000 Limoges.Affiliation #2 Universite de Limoges – Laboratoire XLIM,

83 rue d’Isle, 87 000 Limoges, FRANCE.

Winning attack

Attack algorithm Maximum likelihood method with a bi-variate known model

Number of traces 141.42 traces as an average success rate,estimated with 100 attacks

SVN tag Revision 197, 2009 August 18th


24/24


http://www.3iL.fr/

http://www.unilim.fr/




http://www.cnrs.fr/

http://www.cnrs.fr/

Overview of the 2008-2009 ‘DPA contest’€¦ · Oﬃcial Declaration of the 2008–2009 DPA...

Documents

Transcript of Overview of the 2008-2009 ‘DPA contest’€¦ · Oﬃcial Declaration of the 2008–2009 DPA...