Project topics and materials
Get Complete Project Material File(s) Now! »
Advanced Encryption Standard (AES)
In Secret-key cryptography, the Advanced Encryption Standard (AES) [105], also known as Rijndael, is a famous block-cipher too, which is designed by Joan Daemen and Vincent Rijmen. AES is a U.S. encryption standard that is developed essentially to be an alternative to the Data Encryption Standard DES. AES processes data using blocks of 128 bits length, and a variable secret key length (128, 192 or 256 bits). Hence, as specied by the standard, three dierent block-ciphers can be used: AES-128, AES- 192, AES-256. From the structural point of view, AES operates on a 4×4 matrix of bytes, usually referred to as the state. Each round of AES is composed of four stages:
• Sub-byte The Sub-byte modies each byte in the state using an 8-bit substitution box, often called Sbox. From the mathematical view point, Sub-byte function is a non linear operation.
• Shift-Rows The Shift-Rows rotates the bytes in each row of the state.
• Mix-Columns The Mix-Columns is a linear transformation that operates on the column of the state. Note that this transformation is omitted for the last round.
• AddRoundKey The AddRoundKey mixes the state with a sub-key. The subkey is basically generated from the initial key (or the input key) using what we call key generator module.
Public-Key Cryptography
Public-key cryptography is also called asymmetric cryptography as it does not use the same key for the two processes: encryption and decryption. Consequently, such cryptography is not concerned about the key distribution issue as it is the case for symmetric encryption. Indeed, in Public-key cryptography, two separated and dependent keys are involved: the public key and the private key. More precisely, the public key is used 6for encryption; and alternatively the private key is used for decryption. For technical details about Public-key Cryptography, we refer the reader to [37; 125].
Embedded Cryptography & Vulnerabilities
An embedded device is an electronic system that is mainly designed for fast, robust and specic purposes. When designing an embedded system, both hardware and software competencies are usually met together. Therefore, embedded systems designers must have a thorough knowledge of both the advantages and limitations of the system’s architecture. Consequently, designing for an embedded device is dierent from designing a personal computer (PC).
Nowadays, embedded systems are omnipresent in our daily life (telecommunication systems, consumer electronics, etc:). But more importantly, the majority of recent technologies involving embedded systems, such as mobiles phones and smart cards, require a certain level of security to work properly. The physical security has always been an open question and usually treated as an integral part of embedded system design. Indeed, any violation of embedded systems security could lead to the loss of sensitive and personal information. This would be more critical if we were simply dealing with military and defense market that have always been ruled by high reliable embedded systems, often called Systems on Chips (SoC) such as ASICs and FPGAs. Attacks on embedded systems involving security functionalities are growing at rapid pace; and can be basically categorised into passive and active attacks, as it is well described by Stefan Mangard et al. in their book [86].
• Passive attacks which exploit the physical properties leaked from the system during a cryptographic process, in order to reveal the sensitive information. Physical properties can be for instance power/electromagnetic consumption and timing execution.
• Active attacks which are based on the manipulation of the secure embedded system (inputs, access, etc:). Such manipulation (or tampering with the system) aims at making the behaviour of the system abnormal, which can be exploited to retrieve the sensitive information.
In the literature [86], a second classication of attacks deals with the several interfaces (logical / physical) of embedded systems that are exploited by the attack. Depending on the way of accessing these interfaces, attacks can be classied into in- vasive, semi-invasive and non-invasive attacks.
• Invasive attacks They are very strong attacks that target secure embedded systems. For such attacks, the sensitive information is retrieved at all costs. Basically, an invasive attack usually includes the decapsulation of the system and the probing (altering) of signals. Besides, such attacks require, in general, sophisticated (expensive) materials.
• Semi-invasive attacks They also involve the decapsulation of the system. Nonetheless, the system surface is not altered at the opposite of invasive attacks.
• Non-invasive attacks They do not tamper with the system, in the sense that they target only the accessible parts of the system. Such attacks pose a serious threat to embedded systems as they are low cost and easy to mount (relatively to an experienced attacker). In the literature, we can distinguish active non-invasive attacks often called Fault Attacks (but without de-packaging the system), and passive non-invasive attacks often called Side-Channel At- tacks, that principally exploit unintentional physical leakages (timing information, power consumption, etc:).
Table of contents :
Abstract
Contents
List of Figures
List of Tables
Resume de la these en Francais.
0.1 Chapitre 1: Introduction et Plan de la these
0.2 Chapitre 2: Attaques par canaux caches (SCA)
0.2.1 Contribution 1: Optimalite de la CPA
0.2.2 Contribution 2: Combinaison des distingueurs
0.2.3 Contribution 3: Le Correceteur de rang (RC)
0.2.4 Contribution 4: L’attaque multivarivariee FPCA
0.2.5 Contribution 5: Attaque en ondelettes
0.3 Chapitre 3: Pre-traitement des traces SCA
0.3.1 Techniques de ltrage de traces
0.3.1.1 Filtrage base sur la theorie de Kalman
0.3.1.2 Filtrage de Kalman combine a l’algorithme Esperance- Maximisation EM
0.3.1.3 Filtrage base sur le principe de la cage de Faraday
0.3.2 Resynchronisation de traces: algorithme RM
0.4 Chapitre 4: Outils et methodes d’evaluation
0.5 Chapitre 5: Conclusion
1 Introduction to Modern Cryptography
1.1 Introduction
1.2 Secret-Key Cryptography
1.2.1 Symmetric Ciphers
1.2.1.1 Stream Ciphers
1.2.1.2 Block-Ciphers
1.2.2 Standard Secret-Key Systems
1.2.2.1 Data Encryption Standard (DES)
1.2.2.2 Advanced Encryption Standard (AES)
1.3 Public-Key Cryptography
1.4 Embedded Cryptography & Vulnerabilities
1.5 Side-Channel Analysis: General Background
1.5.1 SCA Classications
1.5.2 SCA Algorithms: Typical Description
1.5.2.1 Basic Algorithm
1.5.2.2 Template Attack Algorithm
1.5.2.3 Stochastic Model Attack Algorithm
1.5.3 SCA Countermeasures
1.5.4 SCA Metrics
1.5.4.1 Attack’s Eciency Metrics
1.5.4.2 Leakage Quantication Metrics
2 Side-Channel Attacks
2.1 Our Contributions
2.2 On the Optimality of Correlation Power Analysis
2.2.1 Introduction
2.2.2 Notations & Denitions
2.2.3 The Optimality From the Historical View Point
2.2.4 The Optimality From the Estimation Theory View Point
2.2.4.1 The Approximation Problem
2.2.4.2 Optimal Linear MMSE Estimation & Connection with
2.2.5 Case Study
2.2.6 Conclusion
2.3 Combined Side-Channel Distinguishers
2.3.1 Introduction
2.3.2 Combination of Distinguishers
2.3.2.1 Gini Correlation: A mixture of Pearson and Spearman Coecients
2.3.2.2 Practical Computation of Gini Correlation & Properties
2.3.2.3 Pearson-Spearman Combination: An Empirical Approach
2.3.2.4 Experimental Results & Discussion
2.3.3 Conclusion
2.4 Secret Key Rank Correction
2.4.1 Introduction: Background Knowledge
2.4.1.1 Rank-based SCAs
2.4.1.2 Notations
2.4.1.3 Key Rank Behaviours
2.4.2 Rank Corrector: Principle
2.4.2.1 Application Field
2.4.2.2 Basic Principle
2.4.2.3 RC Parameters & Evaluation
2.4.2.4 Algorithm Description
2.4.2.5 Case Study
2.4.2.6 Optimization
2.4.3 Experiments & Results
2.4.4 Conclusion
2.5 First Principal Components Analysis for Secret Key Re- covery
2.5.1 Introduction
2.5.2 Principal Component Analysis: Background Knowledge
2.5.3 FPCA: Attack Process
2.5.3.1 Preliminary Preparation Phase
2.5.3.2 References computation
2.5.3.3 FPCA distinguisher
2.5.4 FPCA on DES Implementations
2.5.4.1 FPCA on Unprotected DES
2.5.4.2 FPCA on Masked DES
2.5.5 Conclusion
2.6 Wavelets Transform based Side-Channel Attacks
2.6.1 Introduction
2.6.2 An Understanding of the Multiresolution Analysis
2.6.2.1 Fourier Transform Overview
2.6.2.2 Short Fourier Transform (STFT) Overview
2.6.2.3 Wavelet Transform
2.6.2.4 Continuous Wavelet Transform (CWT)
2.6.2.5 Discrete Wavelet Transform (DWT)
2.6.3 Wavelets for Secret Key Recovery
2.6.3.1 Wavelets based CPA
2.6.3.2 Wavelets based Template attacks
2.6.3.3 Wavelets vs FFT based Template Attacks
2.6.4 Conclusion
3 Side-Channel Signal Processing
3.1 Introduction & Contributions
3.1.1 The Noise Problem
3.1.1.1 Our contributions
3.1.2 The De-synchronization Problem
3.1.2.1 Our contribution
3.2 Side-Channel Filtering & Patterns Detection
3.2.1 Kalman Noise Filtering
3.2.1.1 Kalman Filter Model
3.2.1.2 Experiments & Results
3.2.1.3 Conclusion
3.2.2 Kalman Combined Expectation Maximization Algorithm
3.2.2.1 An Overview of Kalman Smoother
3.2.2.2 Updating Kalman Parameters with EM Algorithm
3.2.2.3 Experiments & Results
3.2.2.4 Conclusion
3.2.3 Wavelets: A Multiresolution Time-Frequency Analysis
3.2.3.1 Wavelets for Cryptographic Patterns Detection
3.2.3.2 Wavelets Combined Mutual Information for Side-Channel Traces Filtering
3.2.3.3 Conclusion
3.2.4 Electromagnetic Shielding
3.2.4.1 Electromagnetic Signals: General Background
3.2.4.2 Electromagnetic Shielding Overview
3.2.4.3 Experiments & Results
3.2.4.4 Conclusion
3.3 Side-Channel Signals Re-synchronization
3.3.1 Related Work
3.3.2 Eect of Traces Misalignment on SCA
3.3.3 Re-synchronization by Statistical Moments
3.3.4 Statistical Moments Based Jame’s Method Principle
3.3.4.1 Adequacy for Side-Channel Analysis
3.3.4.2 Resynchronization by Moments (RM): Proposed Algorithm
3.3.4.3 Link With POC
3.3.5 Experiments, Results & Discussion
3.3.5.1 Evaluation Metrics
3.3.5.2 Experiments & Results
3.3.5.3 Discussion
3.3.6 Conclusion
4 Side-Channel Security Evaluation & Methodologies
4.1 Introduction & Contributions
4.2 Certication Schemes & Standards: the Example of Com- mon Criteria
4.3 Towards a Common Framework for Security Evaluation
4.3.1 Characterization Phase
4.3.1.1 SCA Constraints
4.3.1.2 On the Choice of the Most Appropriate Analysis
4.3.2 Acquisition Phase
4.3.2.1 A Practical Example
4.3.2.2 Combination of Measurements
4.3.3 Pre-processing Phase
4.3.4 Simulation Phase
4.3.5 Analysis & Decision Phase
4.3.5.1 Cautions on the Use of SCA Metrics
4.3.5.2 Key-Time Success Rate Metric (KTSR)
4.3.6 Methodological Scheme for the Evaluation
4.4 Conclusion
5 Conclusions & Perspectives
A Publications & Activities
B Appendix
B.1 Adding noise decreases the quality of
B.2 Expectation-Maximization components calculation
B.2.1 Component
B.2.2 Component
B.2.3 Component
B.3 Binomial Formulas
B.4 Procedure to Obtain the KTSR 2D plot (such as the one of Fig. 4.10) . 190
B.4.1 Identication of the correct and bad samples
B.4.2 Compute an attack statistics matrix for k and t
B.4.3 Draw the graphs
C Glossary
C.1 Acronyms
C.2 Notations
References
