From Improved Leakage Detection to the Detection of Points of Interests in Leakage Traces

Fast Software Encryption

2016

Abstract. Masking is a popular countermeasure to thwart side-channel attacks on embedded systems. Many proposed masking schemes, even carrying "security proofs", are eventually broken because they are flawed by design. The security validation process is nowadays a lengthy, tedious and manual process. In this paper, we report on a method to verify the soundness of a masking scheme before implementing it on a device. We show that by instrumenting a high-level implementation of the masking scheme and by applying leakage detection techniques, a system designer can quickly assess at design time whether the masking scheme is flawed or not, and to what extent. Our method requires not more than working high-level source code and is based on simulation. Thus, our method can be used already in the very early stages of design. We validate our approach by spotting in an automated fashion first-, second-and thirdorder flaws in recently published state-of-the-art schemes in a matter of seconds with limited computational resources. We also present a new second-order flaw on a table recomputation scheme, and show that the approach is useful when designing a hardware masked implementation.

Section: Leakage Detectionsupporting

confidence: 84%

Detecting Flawed Masking Schemes with Leakage Detection Tests

Fast Software Encryption

2016

“…The two classes are defined as this: one class corresponds to a fix seed value; the other class is defined as a random seed value (fix-vs-random test). This choice, in contrast to a fix-vs-fix test, is expected to capture a broad set of leakages [DS16].…”

Section: Methodsmentioning

confidence: 99%

Constant-Time Discrete Gaussian Sampling

Karmakar

Roy

et al. 2018

IEEE Trans. Comput.

Abstract. Sampling from a discrete Gaussian distribution is an indispensable part of lattice-based cryptography. Several recent works have shown that the timing leakage from a non-constant-time implementation of the discrete Gaussian sampling algorithm could be exploited to recover the secret. In this paper, we propose a constant-time implementation of the Knuth-Yao random walk algorithm for performing constanttime discrete Gaussian sampling. Since the random walk is dictated by a set of input random bits, we can express the generated sample as a function of the input random bits. Hence, our constant-time implementation expresses the unique mapping of the input random-bits to the output sample-bits as a Boolean expression of the random-bits. We use bit-slicing to generate multiple samples in batches and thus increase the throughput of our constant-time sampling manifold. Our experiments on an Intel R i7-Broadwell processor show that our method can be as much as 2.4 times faster than the constant-time implementation of cumulative distribution table based sampling and consumes exponentially less memory than the Knuth-Yao algorithm with shuffling for a similar level of security.

“…Thus, we do not have to place assumptions on how the implementation may leak, or which subcomponent may cause the timing leakage. There are other tests such as fix-vs-fix that may be less generic but more efficient, as Durvaux and Standaert note [DS16]. e) How many measurements to take?…”

Section: Discussionmentioning

confidence: 99%

Dude, is my code constant time?

Design, Automation &Amp; Test in Europe Conference &Amp; Exhibition (DATE), 2017

Balasch

Verbauwhede

2017

Abstract-This paper introduces dudect: a tool to assess whether a piece of code runs in constant time or not on a given platform. We base our approach on leakage detection techniques, resulting in a very compact, easy to use and easy to maintain tool. Our methodology fits in around 300 lines of C and runs on the target platform. The approach is substantially different from previous solutions. Contrary to others, our solution requires no modeling of hardware behavior. Our solution can be used in black-box testing, yet benefits from implementation details if available. We show the effectiveness of our approach by detecting several variable-time cryptographic implementations. We place a prototype implementation of dudect in the public domain.