Breaking Masked Implementations with Many Shares on 32-bit Software Platforms

Abstract

We explore the concrete side-channel security provided by state-of-theart higher-order masked software implementations of the AES and the (candidate to the NIST Lightweight Cryptography competition) Clyde, in ARM Cortex-M0 and M3 devices. Rather than looking for possibly reduced security orders (as frequently considered in the literature), we directly target these implementations by assuming their maximum security order and aim at reducing their noise level thanks to multivariate, horizontal and analytical attacks. Our investigations point out that the Cortex-M0 device has so limited physical noise that masking is close to ineffective. The Cortex-M3 shows a better trend but still requires a large number of shares to provide strong security guarantees. Practically, we first exhibit a full 128-bit key recovery in less than 10 traces for a 6-share masked AES implementation running on the Cortex-M0 requiring 232 enumeration power. A similar attack performed against the Cortex-M3 with 5 shares require 1,000 measurements with 244 enumeration power. We then show the positive impact of lightweight block ciphers with limited number of AND gates for side-channel security, and compare our attacks against a masked Clyde with the best reported attacks of the CHES 2020 CTF. We complement these experiments with a careful information theoretic analysis, which allows interpreting our results. We also discuss our conclusions under the umbrella of “backwards security evaluations” recently put forwards by Azouaoui et al. We finally extrapolate the evolution of the proposed attack complexities in the presence of additional countermeasures using the local random probing model proposed at CHES 2020.

Breaking Masked Implementations of the Clyde-Cipher by Means of Side-Channel Analysis

“…competition for each target; in general, the results we obtained were similar to those reported in the evaluation ("Hall of Fame") of the competition [5], for which according to the organizers five attack runs were performed. However, similar to [6], and different from the rules used in [5], we decided to evaluate our attack against the median key rank at a given number of traces; [5] used the average key rank. Since the key rank distribution has a very heavy tail, the average of the key rank of n attack runs will generally be higher than the median of the key rank achieved in the same attack runs.…”

“…While especially the last figure is subject to much uncertainty, the numbers given by [5] do have the advantage that they were generated data that we never had access to. We do not know the corresponding numbers for the solution proposed in [6].…”

“…Table 3: Number of traces that are needed to achieve a median key rank lower than 2 32 , comparison of our solution and [6].…”

Fully-Digital Randomization Based Side-Channel Security—Toward Ultra-Low Cost-per-Security

“…If higher security levels are required, and e.g., if masking is evaluated to be used simultaneously, such a factor can quadratically reduce area/energy cost of the entire system as the masking order (d) can be linearly reduced with the SNR decrease. Another important aspect is that in low-noise scenarios some underlying noise-embedding mechanism is anyway a must for masked designs as demonstrated in [11], pinpointing the importance of the proposed mechanism. Therefore, the proposed design support our objective of demonstrating a fully-digital randomization based SCA security mechanism which provides a state-of-the-art cost-per-security in the class of EDA supported and security-modelled solutions.…”

“…An important added value for embedding circuitry randomization mechanism, such as the ones promoted in this manuscript, is that in many cases the inherent level of noise required to comply with masking's statistical security bounds is insufficient. For example, we can consider the evaluation in [11] showing insufficient software implementations security levels which impedes fulfilling masking full potential. This implies that some underlying noise-embedding mechanism is a must for even standard edge/IoT devices which manifest a rather low noise-level.…”