Side-Channel Countermeasures’ Dissection and the Limits of Closed Source Security Evaluations

Abstract

We take advantage of a recently published open source implementation of the AES protected with a mix of countermeasures against side-channel attacks to discuss both the challenges in protecting COTS devices against such attacks and the limitations of closed source security evaluations. The target implementation has been proposed by the French ANSSI (Agence Nationale de la Sécurité des Systèmes d’Information) to stimulate research on the design and evaluation of side-channel secure implementations. It combines additive and multiplicative secret sharings into an affine masking scheme that is additionally mixed with a shuffled execution. Its preliminary leakage assessment did not detect data dependencies with up to 100,000 measurements. We first exhibit the gap between such a preliminary leakage assessment and advanced attacks by demonstrating how a countermeasures’ dissection exploiting a mix of dimensionality reduction, multivariate information extraction and key enumeration can recover the full key with less than 2,000 measurements. We then discuss the relevance of open source evaluations to analyze such implementations efficiently, by pointing out that certain steps of the attack are hard to automate without implementation knowledge (even with machine learning tools), while performing them manually is straightforward. Our findings are not due to design flaws but from the general difficulty to prevent side-channel attacks in COTS devices with limited noise. We anticipate that high security on such devices requires significantly more shares.

How to fool a black box machine learning based side-channel security evaluation

“…Our view is that countermeasures should provide security independent of the attack / evaluation strategy, and that a single (e.g., machine learning / deep learning) tool is unlikely to provide strong theoretical guarantees, especially in a black box context. So this study has to be seen as complementary to discussions which show that there are realistic implementations for which black box security evaluations can be much less efficient than informed ones [5]. We show that there are (less realistic) implementations where black box security evaluations cannot succeed at all.…”

“…Both are derived from the open-source DOM protected AES instantiated with two shares. 5 The protected one is fed with fresh randomness generated from an AES-based PRG. The unprotected one is strictly the same except that it is fed with a constant as randomness.…”

Breaking Masked Implementations with Many Shares on 32-bit Software Platforms

“…• We show that despite the fact that bitslice masking provides better opportunity for secure implementation than the table-based solutions considered in [BKPT,BS20], it remains hard to reach high security levels in the investigated low-end devices.…”

“…Somewhat surprisingly, the amount of public research in this direction is quite limited. Examples include multivariate attacks against masked tables' re-computation algorithms [TWO13,BGNT18] and their recent application to an open-source affine masked implementation proposed by the French ANSSI [BKPT,BS20]. These investigations put forward that implementing masking securely in a software device with limited noise is a challenging task, and suggest bitslice implementations as one of the natural directions to reach higher security levels.…”

Improved Leakage-Resistant Authenticated Encryption based on Hardware AES Coprocessors

“…The first limitation of [USS + 20] relates to its motivation of enabling secure firmware updates by leveraging hardware coprocessors rather than countermeasures like masking. While this appears as a strong motivation given the challenge of implementing masking securely on low-end devices [BS20], we observe that the main security property that is required for this purpose is ciphertext integrity with leakage in decryption. As discussed in [BPPS17], this property can be reached with two calls to a strongly protected block cipher and letting most of the other parts of the implementation leak in an unbounded manner.…”