On the Security of Balanced Encoding Countermeasures

Abstract

Most cryptographic devices should inevitably have a resistance against the threat of side channel attacks. For this, masking and hiding schemes have been proposed since 1999. The security validation of these countermeasures is an ongoing reserach topic, as a wider range of new and existing attack techniques are tested against these countermeasures. This paper examines the side channel security of the balanced encoding countermeasure, whose aim is to process the secret key-related data under a constant Hamming weight and/or Hamming distance leakage. Unlike previous works, we assume that the leakage model coefficients conform to a normal distribution, producing a model with closer fidelity to real-world implementations. We perform analysis on the balanced encoded PRINCE block cipher with simulated leakage model and also an implementation on an AVR board. We consider both standard correlation power analysis (CPA) and bit-wise CPA. We confirm the resistance of the countermeasure against standard CPA, however, we find with a bit-wise CPA that we can reveal the key with only a few thousands traces.

Power-Balancing Software Implementation to Mitigate Side-Channel Attacks without Using Look-Up Tables

“…In 2011, Hoogvorst et al first tried to bring dual-rail-based schemes of hardware into software [7]. Han [12,13]. The most recent balancing countermeasure based on a Han-like encoding rule is the method proposed by Pour et al [19].…”

“…In DPL styles, a logic bit a is represented by a 2-bit pair (a, a), where a is the complement bit of a. Hoogvorst et al was the first to attempt to create DPL styles of hardware into software [7]. Since then, several studies, such as constant XOR and look-up table-based (LUT-based) operations, have applied these schemes to symmetric ciphers [10][11][12][13][14][15][16][17][18]. Here, constant operators, such as constant XOR, are modified into operations that always hold the same HW/HD in internal process by using only assembly language.…”

Security of Constant Weight Countermeasures

“…In this section, we review the simulated leakage model from [22]. To obtain a more realistic model, the polynomial form is chosen as the simulated leakage model.…”

“…Unlike many previous models, the value of the coefficients in the leakage model is likely to follow a normal distribution. The model in [22] proves useful when a countermeasure, such as a constant weight, is evaluated. The leakage model is as follows.…”

The other side of the coin: Analyzing software encoding schemes against fault injection attacks

“…Similarly, balanced encoding [6] provided good resistance against standard CPA. Recently, it was shown that if the attacker chooses to perform a bit-wise CPA on balanced encoding, the security gain is drastically reduced [7]. Nevertheless, both implementations show some amount of side-channel resistance.…”