Investigating Profiled Side-Channel Attacks Against the DES Key Schedule

Abstract

Recent publications describe profiled single trace side-channel attacks (SCAs) against the DES key-schedule of a “commercially available security controller”. They report a significant reduction of the average remaining entropy of cryptographic keys after the attack, with surprisingly large, key-dependent variations of attack results, and individual cases with remaining key entropies as low as a few bits. Unfortunately, they leave important questions unanswered: Are the reported wide distributions of results plausible - can this be explained? Are the results device-specific or more generally applicable to other devices? What is the actual impact on the security of 3-key triple DES? We systematically answer those and several other questions by analyzing two commercial security controllers and a general purpose microcontroller. We observe a significant overall reduction and, importantly, also observe a large key-dependent variation in single DES key security levels, i.e. 49.4 bit mean and 0.9 % of keys < 40 bit (first investigated security controller; other results similar). We also observe a small fraction of keys with exceptionally low security levels that can be called weak keys. It is unclear, whether a device’s side-channel security should be assessed based on such rare weak key outliers. We generalize results to other leakage models by attacking the hardware DES accelerator of a general purpose microcontroller exhibiting a different leakage model. A highly simplified leakage simulation also confirms the wide distribution and shows that security levels are predictable to some extent. Through extensive investigations we find that the actual weakness of keys mainly stems from the specific switching noise they cause. Based on our investigations we expect that widely distributed results and weak outliers should be expected for all profiled attacks against (insufficiently protected) key-schedules, regardless of the algorithm and specific implementation. Finally, we describe a sound approach to estimate actual 3-key triple-DES security levels from empirical single DES results and find that the impact on the security of 3-key triple-DES is limited, i.e. 96.1 bit mean and 0.24 % of key-triples < 80 bit for the same security controller.

Improving recent side-channel attacks against the DES key schedule

“…The authors of [7] provided us with their measurement data. The provided data set consists of a profiling set and an attack set.…”

“…We consider variations of the leakage models identified in previous works [7,8,[14][15][16][17]. The models assume that the keydependent leakage originates from updates (c i+1 , d i+1 ) ← (c i , d i ) of the Cand D-registers and/or updates k i+1 ← k i of the round-key register for i ∈ [15].…”

“…As a natural approach one might try to find the values of the Cand D-register separately. In the publication [7], for instance, the authors discuss a template attack on even smaller parts of the Cand D-registers. Here we want to clarify that this reduces the amount of mutual information significantly.…”

“…Publications by Wagner et al [8,[14][15][16][17] attempt side-channel attacks against the key schedule of the Data Encryption Standard (DES), which are further investigated in [7]. They conduct template attacks against several microcontrollers and demonstrate that the entropy of the 56-bit DES keys can be reduced to 48 bits on average in their experimental setting.…”

“…We apply our attack to side-channel measurements provided by the authors of [7]. The measurements are obtained from an implementation without countermeasures.…”