ChipWhisperer: An Open-Source Platform for Hardware Embedded Security Research

O’Flynn, Colin; Chen, Zhizhang

doi:10.1007/978-3-319-10175-0_17

Cited by 172 publications

(82 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…For this reason we will choose to split our comparisons according to four contexts depending on the final goal pursued by the attacker: The testing adversary. Our testing adversary attacks an 8-bit AVR microprocessor Atmega328P and acquires power-consumption traces via the ChipWhisperer platform [19]. 7 The target device stores a secret 128-bit key and performs the first steps of an AES: the loading of 16 bytes of the plaintext, the AddRoundKey step and the AES Sbox.…”

Section: Resultsmentioning

confidence: 99%

Enhancing Dimensionality Reduction Methods for Side-Channel Attacks

Cagli¹,

Dumas²,

Prouff³

2016

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Advanced Side-Channel Analyses make use of dimensionality reduction techniques to reduce both the memory and timing complexity of the attacks. The most popular methods to effectuate such a reduction are the Principal Component Analysis (PCA) and the Linear Discriminant Analysis (LDA). They indeed lead to remarkable efficiency gains but their use in side-channel context also raised some issues. The PCA provides a set of vectors (the principal components) onto which project the data. The open question is which of these principal components are the most suitable for side-channel attacks. The LDA has been valorized for its theoretical leaning toward the class-distinguishability, but discouraged for its constraining greed of data. In this paper we present an in-depth study of these two methods, and, to automatize and to ameliorate the principal components selection, we propose a new technique named cumulative Explained Local Variance (ELV) selection. Moreover we present some extensions of the LDA, available in less constrained situations than the classical version. We equip our study with a comprehensive comparison of the existing and new methods in real cases. It allows us to verify the soundness of the ELV selection, and the effectiveness of the methods proposed to extend the use of the LDA to side-channel contexts where the existing approaches are inapplicable.

show abstract

Section: Resultsmentioning

confidence: 99%

Enhancing Dimensionality Reduction Methods for Side-Channel Attacks

Cagli¹,

Dumas²,

Prouff³

2016

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Synchronous sampling has already been demonstrated to be a useful tool in reducing the data complexity when working with side-channel analysis measurements [10,12,13]. It is know that compression of the power traces can be performed post-capture to reduce them to points of interest.…”

Section: Discussionmentioning

confidence: 99%

“…For asynchronous sampling a PicoScope 6403D oscilloscope is used, and for synchronous sampling the ChipWhisperer is used. Full details of the capture hardware and software are available in [13] and at the ChipWhisperer wiki 1 . See Fig.…”

Section: Experimental Platformmentioning

confidence: 99%

“…24 The VCC glitch inserted into the AtMega48A device for this test is derived from a source clock. The glitch width and offset are a function of that source clock, see [13] for details.…”

Section: Fault Injection and Target Codementioning

confidence: 99%

“…The implementation of the SAD comes from the ChipWhisperer system [13]. In this implementation 128 input samples, T, are continuously compared to a 128 point reference waveform, R, using (7).…”

Section: Sum Of Absolute Difference Triggermentioning

confidence: 99%

See 2 more Smart Citations

Synchronous sampling and clock recovery of internal oscillators for side channel analysis and fault injection

O’Flynn

Chen

2014

J Cryptogr Eng

Self Cite

View full text Add to dashboard Cite

Measuring power consumption for side channel analysis typically uses an oscilloscope, which measures the data relative to an internal sample clock. By synchronizing the sampling clock to the clock of the target device, the sample rate requirements are considerably relaxed; the attack will succeed with a much lower sample rate.This work characterizes the performance of a synchronous sampling system attacking a modern microcontroller running a software AES implementation. This attack is characterized under four conditions: with a stable crystal-oscillator based clock, with a clock that is randomly varied between 3.9 MHz-13 MHz, with an internal oscillator that is randomly varied between 7.2 MHz-8.1 MHz, and with an internal oscillator that has slight random variation due to natural 'drift' in the oscillator.Traces captured with the synchronous sampling technique can be processed with a standard Differential Power Analysis (DPA) style attack in all four cases, whereas when an oscilloscope is used only the stable oscillator setup is successful. This work also develops the hardware to recover the internal clock of a device which does not have an externally available clock. It is possible to implement this scheme in software only, allowing it to work with existing oscilloscope-based test environments.Performing the recovery in hardware allows the use of fault injection with excellent temporal stability relative to a sensitive event. This is demonstrated with a power glitch inserted into a microcontroller, where the glitch is triggered based on a signature in the measured power consumption.

show abstract

Side‐channel analysis of the modular inversion step in the RSA key generation algorithm

Aldaya

Márquez

Sarmiento

et al. 2016

Circuit Theory & Apps

View full text Add to dashboard Cite

This paper studies the security of the RSA key generation algorithm with regard to side-channel analysis and presents a novel approach that targets the simple power analysis (SPA) vulnerabilities that may exist in an implementation of the binary extended Euclidean algorithm (BEEA). The SPA vulnerabilities described, together with the properties of the values processed by the BEEA in the context of RSA key generation, represent a serious threat for an implementation of this algorithm. It is shown that an adversary can disclose the private key employing only one power trace with a success rate of 100 %an improvement on the 25% success rate achieved by the best side-channel analysis carried out on this algorithm. Two very different BEEA implementations are analyzed, showing how the algorithm's SPA leakages could be exploited. Also, two countermeasures are discussed that could be used to reduce those SPA leakages and prevent the recovery of the RSA private key.One of the algorithms that have been targeted using this kind of side-channel analysis is the RSA key generation procedure, an algorithm commonly used in electronic devices (i.e., hardware security modules) [2] dedicated to the generation and storage of cryptographic keys.Side-channel leakages that may exist during the RSA key generation procedure have been analyzed in several published works, most of which have focused their attention on the algorithms employed to generate the secret prime numbers needed to construct an RSA key. In [3], the Joye and Pallier method proposed in [4] was analyzed to recover some bits of the secret primes, and the Coppersmith method was used to calculate the remaining ones, with an overall success rate of 0.1% [5]. In [6] and [7], the authors analyzed the leakages that could exist in different methods for checking the divisibility of a prime candidate by a prime sieve. Independent of the specific random prime number generation algorithms analyzed in these works and their intrinsic implementation details, the best success rate achieved was 25% [7].This work presents a new side-channel analysis of the RSA key generation procedure. Instead of targeting a prime generation algorithm as in previous works, the proposed side-channel analysis, based on SPA leakages, focuses on the modular inversion operation required to generate an RSA private key. In this context, the RSA key generation procedure imposes the requirement that only one power consumption trace can be used to extract the private key.There are different approaches for computing modular inverses. Among the most popular methods are those based on the extended Euclidean algorithm [8]. In order to avoid the divisions involved in this algorithm, a binary variant of it, called binary extended Euclidean algorithm (BEEA), is often preferred because it replaces multi-precision divisions with right shift operations [9]. This change results in software implementations with very good performance [10], and it is also very suitable for hardware realizations, as the required shift operations ...

show abstract

ChipWhisperer: An Open-Source Platform for Hardware Embedded Security Research

Cited by 172 publications

References 9 publications

Enhancing Dimensionality Reduction Methods for Side-Channel Attacks

Enhancing Dimensionality Reduction Methods for Side-Channel Attacks

Synchronous sampling and clock recovery of internal oscillators for side channel analysis and fault injection

Side‐channel analysis of the modular inversion step in the RSA key generation algorithm

Contact Info

Product

Resources

About