Symbolic Analysis of Higher-Order Side Channel Countermeasures

Abstract

In this paper, we deal with the problem of efficiently assessing the higher order vulnerability of a hardware cryptographic circuit. Our main concern is to provide methods that allow a circuit designer to detect early in the design cycle if the implementation of a Boolean-additive masking countermeasure does not hold up to the required protection order. To achieve this goal, we promote the search for vulnerabilities from a statistical problem to a purely symbolical one and then provide a method for reasoning about this new symbolical interpretation. Eventually we show, with a synthetic example, how the proposed conceptual tool can be used for exploring the vulnerability space of a cryptographic primitive

SCInfer: Refinement-Based Verification of Software Countermeasures Against Side-Channel Attacks

“…In terms of accuracy, numerous unknowns occurred in the experimental results of [47] and two obviously perfect masking cases were not proved in [6]. Finally, although higher-order masking were addressed by prior techniques [13], they were limited to linear operations, whereas our method can handle both first-order and higher-order masking with non-linear operations.…”

“…We first introduce our distribution types, which are inspired by prior work in [6,13,47], together with some auxiliary data structures; then, we present our inference rules.…”

“…Although some verification tools have been developed for this application [6,7,10,13,14,20,26,27,47], they are either fast but inaccurate (e.g., type-inference techniques) or accurate but slow (e.g., model-counting techniques). For example, Bayrak et al [10] developed a leak detector that checks if a computation result is logically dependent of the secret and, at the same time, logically independent of any random variable.…”

“…The aforementioned gap, in terms of both accuracy and scalability, has not been bridged by more recent approaches [6,13,47]. For example, Barthe et al [6] proposed some inference rules to prove masking countermeasures based on the observation that certain operators (e.g., XOR) are invertible: in the absence of such operators, purely algebraic laws can be used to normalize expressions of computation results to apply the rules of invertible functions.…”

“…Ouahma et al [47] introduced a linear-time algorithm based on finer-grained syntactical inference rules. A similar idea was explored by Bisi et al [13] for analyzing higher-order masking: like in [6,47], however, the method is not complete, and does not consider non-linear operators which are common in cryptographic software.…”