Retrofitting Leakage Resilient Authenticated Encryption to Microcontrollers

Abstract

The security of Internet of Things (IoT) devices relies on fundamental concepts such as cryptographically protected firmware updates. In this context attackers usually have physical access to a device and therefore side-channel attacks have to be considered. This makes the protection of required cryptographic keys and implementations challenging, especially for commercial off-the-shelf (COTS) microcontrollers that typically have no hardware countermeasures. In this work, we demonstrate how unprotected hardware AES engines of COTS microcontrollers can be efficiently protected against side-channel attacks by constructing a leakage resilient pseudo random function (LR-PRF). Using this side-channel protected building block, we implement a leakage resilient authenticated encryption with associated data (AEAD) scheme that enables secured firmware updates. We use concepts from leakage resilience to retrofit side-channel protection on unprotected hardware AES engines by means of software-only modifications. The LR-PRF construction leverages frequent key changes and low data complexity together with key dependent noise from parallel hardware to protect against side-channel attacks. Contrary to most other protection mechanisms such as time-based hiding, no additional true randomness is required. Our concept relies on parallel S-boxes in the AES hardware implementation, a feature that is fortunately present in many microcontrollers as a measure to increase performance. In a case study, we implement the protected AEAD scheme for two popular ARM Cortex-M microcontrollers with differing parallelism. We evaluate the protection capabilities in realistic IoT attack scenarios, where non-invasive EM probes or power consumption measurements are employed by the attacker. We show that the concept provides the side-channel hardening that is required for the long-term security of IoT devices.

Efficient Regression-Based Linear Discriminant Analysis for Side-Channel Security Evaluations

“…The PI of a leakage model is a side-channel metric that characterizes the amount of information that can be extracted about a target variable X from leakage traces using a given model [RSV + 11]. It is related to the success rate of an adversary that uses this model [DFS19, dCGRP19, MDP20], and it is a lower bound for the Mutual Information (MI) between the leakage and the target variable [BHM + 19, MCHS22], which characterizes the worst-case security of an implementation and therefore makes an interesting tool for side-channel security evaluations [SMY09]. Concretely, and given a model f[l|x] and a set of leakage traces L , the PI can be estimated as:…”

Leakage-Resilient Revocable Certificateless Encryption with an Outsourced Revocation Authority

“…However, the efficiency of Hazay et al's scheme is not good so that Abdalla et al (2013) improved their scheme to propose an efficient leakage-resilient symmetric encryption scheme using the AES block cipher without constructing a leakage resilient block cipher. Recently, for enhancing the efficiency, several leakage-resilient authenticated symmetric encryption schemes based on hardware AES coprocessors (Unterstein et al, 2020;Bronchain et al, 2021) have been proposed.…”

Leakage Resilient Value Comparison with Application to Message Authentication

“…Thus, the protection of primitives against potent and skillful attackers that can perform simple power analysis or template attacks is still crucial [37]. Nevertheless, leakage resilient schemes have been implemented on micro-controllers and practical evaluation shows that protection against sidechannel attacks can be efficiently achieved in practice against a set of realistic adversaries [56].…”