scholarly journals One Bit is All It Takes: A Devastating Timing Attack on BLISS’s Non-Constant Time Sign Flips

2020 ◽  
Vol 15 (1) ◽  
pp. 131-142
Author(s):  
Mehdi Tibouchi ◽  
Alexandre Wallet
Keyword(s):  
Likelihood Estimation ◽  
Constant Time ◽  
Side Channel ◽  
Key Recovery ◽  
Signature Generation ◽  
Fisher Information Metric ◽  
Timing Attack ◽  
Information Metric ◽  
Key Recovery Attack ◽  
Cache Attacks

AbstractAs one of the most efficient lattice-based signature schemes, and one of the only ones to have seen deployment beyond an academic setting (e.g., as part of the VPN software suite strongSwan), BLISS has attracted a significant amount of attention in terms of its implementation security, and side-channel vulnerabilities of several parts of its signing algorithm have been identified in previous works. In this paper, we present an even simpler timing attack against it. The bimodal Gaussian distribution that BLISS is named after is achieved using a random sign flip during signature generation, and neither the original implementation of BLISS nor strongSwan ensure that this sign flip is carried out in constant time. It is therefore possible to recover the corresponding sign through side-channel leakage (using, e.g., cache attacks or branch tracing). We show that obtaining this single bit of leakage (for a moderate number of signatures) is in fact sufficient for a full key recovery attack. The recovery is carried out using a maximum likelihood estimation on the space of parameters, which can be seen as a statistical manifold. The analysis of the attack thus reduces to the computation of the Fisher information metric.

scholarly journals Novel Key Recovery Attack on Secure ECDSA Implementation by Exploiting Collisions between Unknown Entries

2021 ◽  
pp. 1-26
Author(s):  
Sunghyun Jin ◽  
Sangyub Lee ◽  
Sung Min Cho ◽  
HeeSeok Kim ◽  
Seokhie Hong
Keyword(s):  
Power Consumption ◽  
Digital Signatures ◽  
Scalar Multiplication ◽  
Side Channel ◽  
Validation Process ◽  
Key Recovery ◽  
Private Key ◽  
Signature Generation ◽  
Fixed Base ◽  
Key Recovery Attack

In this paper, we propose a novel key recovery attack against secure ECDSA signature generation employing regular table-based scalar multiplication. Our attack exploits novel leakage, denoted by collision information, which can be constructed by iteratively determining whether two entries loaded from the table are the same or not through side-channel collision analysis. Without knowing the actual value of the table entries, an adversary can recover the private key of ECDSA by finding the condition for which several nonces are linearly dependent by exploiting only the collision information. We show that this condition can be satisfied practically with a reasonable number of digital signatures and corresponding traces. Furthermore, we also show that all entries in the pre-computation table can be recovered using the recovered private key and a sufficient number of digital signatures based on the collision information. As case studies, we find that fixed-base comb and T_SM scalar multiplication are vulnerable to our attack. Finally, we verify that our attack is a real threat by conducting an experiment with power consumption traces acquired during T_SM scalar multiplication operations on an ARM Cortex-M based microcontroller. We also provide the details for validation process.

scholarly journals Cryptanalysis of Round-Reduced Fantomas, Robin and iSCREAM

Cryptography ◽  
2019 ◽  
Vol 3 (1) ◽  
pp. 4 ◽  
Author(s):  
Ashutosh Dwivedi ◽  
Shalini Dhar ◽  
Gautam Srivastava ◽  
Rajani Singh
Keyword(s):  
Side Channel ◽  
Linear Cryptanalysis ◽  
Key Recovery ◽  
Side Channel Analysis ◽  
Linear Characteristic ◽  
Random Behavior ◽  
Channel Analysis ◽  
Key Recovery Attack

In this work, we focus on LS-design ciphers Fantomas, Robin, and iSCREAM. LS-designs are a family of bitslice ciphers aimed at efficient masked implementations against side-channel analysis. We have analyzed Fantomas and Robin with a technique that previously has not been applied to both algorithms or linear cryptanalysis. The idea behind linear cryptanalysis is to build a linear characteristic that describes the relation between plaintext and ciphertext bits. Such a relationship should hold with probability 0.5 (bias is zero) for a secure cipher. Therefore, we try to find a linear characteristic between plaintext and ciphertext where bias is not equal to zero. This non-random behavior of cipher could be converted to some key-recovery attack. For Fantomas and Robin, we find 5 and 7-round linear characteristics. Using these characteristics, we attack both the ciphers with reduced rounds and recover the key for the same number of rounds. We also apply linear cryptanalysis to the famous CAESAR candidate iSCREAM and the closely related LS-design Robin. For iScream, we apply linear cryptanalysis to the round-reduced cipher and find a 7-round best linear characteristics. Based on those linear characteristics we extend the path in the related-key scenario for a higher number of rounds.

scholarly journals Security against Timing Analysis Attack

2015 ◽  
Vol 5 (4) ◽  
pp. 759
Author(s):  
Deevi Radha Rani ◽  
S Venkateswarlu
Keyword(s):  
Experimental Test ◽  
Timing Analysis ◽  
Critical Issue ◽  
Side Channel ◽  
Hamming Weight ◽  
Test Bed ◽  
Side Channel Attack ◽  
Key Recovery ◽  
Recovery Method ◽  
Timing Attack

Timing attack is the type of side-channel attack involves the time taken to complete critical operations. Securing crypto processor from timing attack is critical issue. This paper implements the Bernstein’s Timing Attack and timing attack based on hamming weight. The countermeasures of Bernstein’s Timing attack are implemented in our experimental test bed and their performance is compared.  This paper also proposes the key recovery method based on timing attack using hamming weight of the key.

scholarly journals Cache-Timing Attacks on RSA Key Generation

2019 ◽  
pp. 213-242 ◽  
Author(s):  
Alejandro Cabrera Aldaya ◽  
Cesar Pereida García ◽  
Luis Manuel Alvarez Tapia ◽  
Billy Bob Brumley
Keyword(s):  
Constant Time ◽  
Key Generation ◽  
Limited Information ◽  
Key Recovery ◽  
Lattice Problem ◽  
Timing Attack ◽  
Problem Instances ◽  
Single Trace ◽  
Bulk Processing ◽  
Trace Cache

During the last decade, constant-time cryptographic software has quickly transitioned from an academic construct to a concrete security requirement for real-world libraries. Most of OpenSSL’s constant-time code paths are driven by cryptosystem implementations enabling a dedicated flag at runtime. This process is perilous, with several examples emerging in the past few years of the flag either not being set or software defects directly mishandling the flag. In this work, we propose a methodology to analyze security-critical software for side-channel insecure code path traversal. Applying our methodology to OpenSSL, we identify three new code paths during RSA key generation that potentially leak critical algorithm state. Exploiting one of these leaks, we design, implement, and mount a single trace cache-timing attack on the GCD computation step. We overcome several hurdles in the process, including but not limited to: (1) granularity issues due to word-size operands to the GCD function; (2) bulk processing of desynchronized trace data; (3) non-trivial error rate during information extraction; and (4) limited high-confidence information on the modulus factors. Formulating lattice problem instances after obtaining and processing this limited information, our attack achieves roughly a 27% success rate for key recovery using the empirical data from 10K trials.

scholarly journals Cryptanalysis of Loiss Stream Cipher-Revisited

2014 ◽  
Vol 2014 ◽  
pp. 1-7
Author(s):  
Lin Ding ◽  
Chenhui Jin ◽  
Jie Guan ◽  
Qiuyan Wang
Keyword(s):  
Time Complexity ◽  
Stream Cipher ◽  
Linear Equations ◽  
Data Complexity ◽  
Secret Key ◽  
Key Recovery ◽  
Systems Of Linear Equations ◽  
Key Recovery Attack ◽  
Better Than

Loiss is a novel byte-oriented stream cipher proposed in 2011. In this paper, based on solving systems of linear equations, we propose an improved Guess and Determine attack on Loiss with a time complexity of 2231and a data complexity of 268, which reduces the time complexity of the Guess and Determine attack proposed by the designers by a factor of 216. Furthermore, a related key chosenIVattack on a scaled-down version of Loiss is presented. The attack recovers the 128-bit secret key of the scaled-down Loiss with a time complexity of 280, requiring 264chosenIVs. The related key attack is minimal in the sense that it only requires one related key. The result shows that our key recovery attack on the scaled-down Loiss is much better than an exhaustive key search in the related key setting.

Sign in / Sign up

Export Citation Format

Share Document