Multiple-Differential Side-Channel Collision Attacks on AES

Abstract

Abstract. In this paper, two efficient multiple-differential methods to detect collisions in the presence of strong noise are proposed -binary and ternary voting. After collisions have been detected, the cryptographic key can be recovered from these collisions using such recent cryptanalytic techniques as linear [1] and algebraic [2] collision attacks. We refer to this combination of the collision detection methods and cryptanalytic techniques as multiple-differential collision attacks (MDCA).When applied to AES, MDCA using binary voting without profiling requires about 2.7 to 13.2 times less traces than the Hamming-weight based CPA for the same implementation. MDCA on AES using ternary voting with profiling and linear key recovery clearly outperforms CPA by requiring only about 6 online measurements for the range of noise amplitudes where CPA requires from 163 to 6912 measurements. These attacks do not need the S-box to be known. Moreover, neither key nor plaintexts have to be known to the attacker in the profiling stage.

Detecting Hidden Leakages

“…2 before 50 µs are related to the initial masking of plaintext bytes before the key addition. Correlation-Collision Attack In order to perform a correlation-collision attack which aims at recovering the linear difference between the targeted key bytes (see AES linear collision attack [7]) the mean traces, e.g., m i 0 and m i 2 , should be first aligned based on the time instances of leaking parts discovered by the variance check approach restated above. Suppose that m i 2 indicate the mean traces m i 2 which are aligned to the mean traces m i 0 , i.e., by shifting each mean trace m i 2 9.524 µs (4762 sample points) to the left (see Fig.…”

“…The mask values are chosen in such a way that the leakage caused by the masked variable X ⊕ S 1 depends on X only at degree 4. It is explained in [4] that such security can be reached if the masks are distributed as the 16 codewords of the [8,4,4] linear code, extension with one parity bit of the [7,4,3] Hamming code.…”

On the Power of Fault Sensitivity Analysis and Collision Side-Channel Attacks in a Combined Setting

“…Its major advantage compared to classical power analysis attacks is that it neither relies on a hypothetical power model nor requires a profiling phase. Enhancing linear collision attacks [6] by the methods of correlation-based DPAs, it is able to overcome side-channel countermeasures as long as a minimal first order leakage remains.…”

“…The main idea of the attack is to check the similarity between two faulty ciphertext distributions, e.g., of two ciphertext bytes, each of which corresponds to a masked S-box followed by a fixed key addition, i.e., in the last round of the AES encryption. According to the linear collision in AES [6], the difference between key bytes equals to the difference between the corresponding fault-free ciphertext bytes when such a collision occurs.…”

Differential Cluster Analysis

“…The work of [21] and in particular recent works on collision attacks [3,4,5,6,7] veer away from long sequences of instructions [22,15], e.g. collisions that persist for an entire round, and target short-scale intermediate results.…”