Localized Electromagnetic Analysis of Cryptographic Implementations

Heyszl, Johann; Mangard, Stefan; Heinz, Benedikt; Stumpf, Frederic; Sigl, Georg

doi:10.1007/978-3-642-27954-6_15

Cited by 74 publications

(48 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…When different registers are used depending on the processed sensitive values, "the assignment of concerned registers to physical locations should be repeatedly randomized [...] during execution" [93]. This is similar to the proposed parallelization countermeasure.…”

Section: Effective Countermeasuresmentioning

confidence: 97%

“…In 2012, location-dependent electromagnetic leakage was successfully exploited in an attack on an elliptic curve scalar multiplication implementation on a Field Programmable Gate Array (FPGA) using a near-field EM probe [93]. The authors scanned the die surface and collected EM traces at every point.…”

Section: Electromagnetic Analysismentioning

confidence: 99%

“…This is not addressed by countermeasures against timing and power attacks, since these do not exploit location-dependent differences. Thus, it was proposed to exploit this leakage in side channel attacks which do exploit location-dependent differences [93]. The authors present a successful attack against an elliptic curve scalar multiplication algorithm and reveal a secret 163-bit scalar by analyzing the location-dependent leakage.…”

Section: Binary Exponentiation and Multiplication Algorithmsmentioning

confidence: 99%

See 2 more Smart Citations

Why Cryptography Should Not Rely on Physical Attack Complexity

Krämer

2015

T-Labs Series in Telecommunication Services

View full text Add to dashboard Cite

Ich versichere an Eides statt, dass ich diese Dissertation selbständig verfasst und nur die angegebenen Quellen und Hilfsmittel verwendet habe. Datum Für meine Eltern AbstractEver since the first side channel attacks and fault attacks on cryptographic devices were introduced in the mid-nineties, new possibilities of physical attacks have been consistently explored. The risk that these attacks pose is reduced by reacting to known attacks and by developing and implementing countermeasures against them. For physical attacks whose theory is known but which have not been conducted yet, however, the situation is different. Attacks whose physical realization is assumed to be very complex are taken less seriously. The trust that these attacks will not be realized due to their physical complexity means that no countermeasures are developed at all. This leads to unprotected devices once the assessment of the complexity turns out to be wrong.This thesis presents two practical physical attacks whose theory is known for several years. Since neither attack has previously been successfully implemented in practice, however, they were not considered a serious threat. Their physical attack complexity has been overestimated and the implied security threat has been underestimated. First, we introduce the photonic side channel, which offers not only temporal resolution, but also the highest possible spatial resolution. Due to the high cost of its first realization, it has not been taken seriously. We show both simple and differential photonic side channel analyses. Then, we present a fault attack against pairing-based cryptography. Due to the need for at least two independent precise faults in a single pairing computation, it has also not been taken seriously. We show how attackers can reveal the secret key of symmetric as well as asymmetric cryptographic algorithms based on these physical attacks. We present countermeasures on the software and the hardware level, which help to prevent these attacks in the future.Based on these two presented attacks, this thesis shows that the assessment of physical attack complexity is error-prone. Hence, cryptography should not rely on it. Cryptographic technologies have to be protected against all physical attacks, have they already been realized or not. The development of countermeasures does not require the successful execution of an attack but can already be carried out as soon as the principle of a side channel or a fault attack is understood.

show abstract

Section: Effective Countermeasuresmentioning

confidence: 97%

Section: Electromagnetic Analysismentioning

confidence: 99%

Section: Binary Exponentiation and Multiplication Algorithmsmentioning

confidence: 99%

See 1 more Smart Citation

Why Cryptography Should Not Rely on Physical Attack Complexity

Krämer

2015

T-Labs Series in Telecommunication Services

View full text Add to dashboard Cite

show abstract

“…Another template attack on ECC is presented in [21]. This attack exploits register location-based leakage using a high-resolution inductive EM probe; therefore, the attack is considerably expensive to execute.…”

Section: Introductionmentioning

confidence: 99%

Online template attacks

Batina

Chmielewski²,

Papachristodoulou

et al. 2017

J Cryptogr Eng

View full text Add to dashboard Cite

Template attacks are a special kind of sidechannel attacks that work in two stages. In a first stage, the attacker builds up a database of template traces collected from a device which is identical to the attacked device, but under the attacker's control. In the second stage, traces from the target device are compared to the template traces to recover the secret key. In the context of attacking elliptic curve scalar multiplication with template attacks, one can interleave template generation and template matching and reduce the amount of template traces. This paper enhances the power of this technique by defining and applying the concept of online template attacks, a general attack technique with minimal assumptions for an attacker, who has very very limited control over the template device. We show that online template attacks need only one power consumption trace of a scalar multiplication on the target device; they are thus suitable not only against ECDSA and static elliptic curve Diffie-Hellman (ECDH), but also against elliptic curve scalar multiplication in ephemeral ECDH. In addition, online template attacks need only one template trace per scalar bit and they can be applied to a broad variety of scalar multiplication algorithms. To demonstrate the power of online template attacks, we recover scalar bits of a scalar multiplication using the double-and-add-always algorithm on a twisted Edwards curve running on a smartcard with an ATmega163 CPU.

show abstract

“…A clustering attack was shown to break an ECC hardware implementation without any profiling or leakage models by Heyszl et al [31]; Sprecht et al [49] later improved this attack. In addition to these, also local electromagnetic measurements have been shown to offer means to launch successful single-trace attacks, e.g., by Heyszl et al [32].…”

Section: Introductionmentioning

confidence: 99%

Single-Trace Side-Channel Attacks on Scalar Multiplications with Precomputations

Järvinen

Balasch

2017

Smart Card Research and Advanced Applications

View full text Add to dashboard Cite

Abstract. Single-trace side-channel attacks are a serious threat to elliptic curve cryptography in practice because they can break also cryptosystems where scalars are nonces (e.g., ECDSA). Previously it was believed that single-trace attacks can be avoided by using scalar multiplication algorithms with regular patterns of operations but recently we have learned that they can be broken with correlation tests to decide whether different operations share common operands. In this work, we extend these attacks to scalar multiplication algorithms with precomputations. We show that many algorithms are vulnerable to our attack which correlates measurements with precomputed values. We also show that successful attacks are possible even without knowledge of precomputed values by using clustering instead of correlations. We provide extensive evidence for the feasibility of the attacks with simulations and experiments with an 8-bit AVR. Finally, we discuss the effectiveness of certain countermeasures against our attacks.

show abstract

Localized Electromagnetic Analysis of Cryptographic Implementations

Cited by 74 publications

References 18 publications

Why Cryptography Should Not Rely on Physical Attack Complexity

Why Cryptography Should Not Rely on Physical Attack Complexity

Online template attacks

Single-Trace Side-Channel Attacks on Scalar Multiplications with Precomputations

Contact Info

Product

Resources

About