Revealing the Weakness of Addition Chain Based Masked SBox Implementations

2021 ◽  
pp. 326-350
Author(s):  
Jingdian Ming ◽  
Huizhong Li ◽  
Yongbin Zhou ◽  
Wei Cheng ◽  
Zehua Qiao
Keyword(s):  
Higher Order ◽  
Side Channel ◽  
Noise Levels ◽  
Channel Resistance ◽  
Addition Chain

Addition chain is a well-known approach for implementing higher-order masked SBoxes. However, this approach induces more computations of intermediate monomials over F2n, which in turn leak more information related to the sensitive variables and may decrease its side-channel resistance consequently. In this paper, we introduce a new notion named polygon degree to measure the resistance of monomial computations. With the help of this notion, we select several typical addition chain implementations with the strongest or the weakest resistance. In practical experiments based on an ARM Cortex-M4 architecture, we collect power and electromagnetic traces in consideration of different noise levels. The results show that the resistance of the weakest masked SBox implementation is close to that of an unprotected implementation, while the strongest one can also be broken with fewer than 1,500 traces due to extra leakages. Moreover, we study the resistance of addition chain implementations against profiled attacks. We find that some monomials with smaller output size leak more information than the SBox output. The work by Duc et al. at JOC 2019 showed that for a balanced function, the smaller the output size is, the less information is leaked. Thus, our attacks demonstrate that this property of balanced functions does not apply to unbalanced functions.

scholarly journals Symbolic Analysis of Higher-Order Side Channel Countermeasures

2017 ◽  
Vol 66 (6) ◽  
pp. 1099-1105 ◽  
Author(s):  
Elia Bisi ◽  
Filippo Melzani ◽  
Vittorio Zaccaria
Keyword(s):  
Symbolic Analysis ◽  
Higher Order ◽  
Side Channel

scholarly journals The Multi-round Process Matrix

Quantum ◽  
2021 ◽  
Vol 5 ◽  
pp. 384
Author(s):  
Timothée Hoffreumon ◽  
Ognyan Oreshkov
Keyword(s):  
Information Exchange ◽  
Higher Order ◽  
Side Channel ◽  
Order Process ◽  
Causal Order ◽  
Quantum Operations ◽  
First Case ◽  
The One

We develop an extension of the process matrix (PM) framework for correlations between quantum operations with no causal order that allows multiple rounds of information exchange for each party compatibly with the assumption of well-defined causal order of events locally. We characterise the higher-order process describing such correlations, which we name the multi-round process matrix (MPM), and formulate a notion of causal nonseparability for it that extends the one for standard PMs. We show that in the multi-round case there are novel manifestations of causal nonseparability that are not captured by a naive application of the standard PM formalism: we exhibit an instance of an operator that is both a valid PM and a valid MPM, but is causally separable in the first case and can violate causal inequalities in the second case due to the possibility of using a side channel.

scholarly journals Higher-Order Lookup Table Masking in Essentially Constant Memory

2021 ◽  
pp. 546-586
Author(s):  
Annapurna Valiveti ◽  
Srinivas Vivek
Keyword(s):  
Higher Order ◽  
Lookup Table ◽  
Side Channel ◽  
Pseudorandom Number Generator ◽  
Side Channel Attacks ◽  
Online Computation ◽  
Original Scheme ◽  
Memory Complexity ◽  
Resource Constrained Devices ◽  
Constrained Devices

Masking using randomised lookup tables is a popular countermeasure for side-channel attacks, particularly at small masking orders. An advantage of this class of countermeasures for masking S-boxes compared to ISW-based masking is that it supports pre-processing and thus significantly reducing the amount of computation to be done after the unmasked inputs are available. Indeed, the “online” computation can be as fast as just a table lookup. But the size of the randomised lookup table increases linearly with the masking order, and hence the RAM memory required to store pre-processed tables becomes infeasible for higher masking orders. Hence demonstrating the feasibility of full pre-processing of higher-order lookup table-based masking schemes on resource-constrained devices has remained an open problem. In this work, we solve the above problem by implementing a higher-order lookup table-based scheme using an amount of RAM memory that is essentially independent of the masking order. More concretely, we reduce the amount of RAM memory needed for the table-based scheme of Coron et al. (TCHES 2018) approximately by a factor equal to the number of shares. Our technique is based upon the use of pseudorandom number generator (PRG) to minimise the randomness complexity of ISW-based masking schemes proposed by Ishai et al. (ICALP 2013) and Coron et al. (Eurocrypt 2020). Hence we show that for lookup table-based masking schemes, the use of a PRG not only reduces the randomness complexity (now logarithmic in the size of the S-box) but also the memory complexity, and without any significant increase in the overall running time. We have implemented in software the higher-order table-based masking scheme of Coron et al. (TCHES 2018) at tenth order with full pre-processing of a single execution of all the AES S-boxes on a ARM Cortex-M4 device that has 256 KB RAM memory. Our technique requires only 41.2 KB of RAM memory, whereas the original scheme would have needed 440 KB. Moreover, our 8-bit implementation results demonstrate that the online execution time of our variant is about 1.5 times faster compared to the 8-bit bitsliced masked implementation of AES-128.

scholarly journals Transparency order versus confusion coefficient: a case study of NIST lightweight cryptography S-Boxes

Cybersecurity ◽  
2021 ◽  
Vol 4 (1) ◽  
Author(s):  
Huizhong Li ◽  
Guang Yang ◽  
Jingdian Ming ◽  
Yongbin Zhou ◽  
Chengbin Jin
Keyword(s):  
The Other ◽  
Side Channel ◽  
Side Channel Attacks ◽  
Lightweight Cryptography ◽  
Security Assurance ◽  
Channel Resistance ◽  
Cryptographic Algorithms ◽  
Transparency Order ◽  
Comprehensive Study

AbstractSide-channel resistance is nowadays widely accepted as a crucial factor in deciding the security assurance level of cryptographic implementations. In most cases, non-linear components (e.g. S-Boxes) of cryptographic algorithms will be chosen as primary targets of side-channel attacks (SCAs). In order to measure side-channel resistance of S-Boxes, three theoretical metrics are proposed and they are reVisited transparency order (VTO), confusion coefficients variance (CCV), and minimum confusion coefficient (MCC), respectively. However, the practical effectiveness of these metrics remains still unclear. Taking the 4-bit and 8-bit S-Boxes used in NIST Lightweight Cryptography candidates as concrete examples, this paper takes a comprehensive study of the applicability of these metrics. First of all, we empirically investigate the relations among three metrics for targeted S-boxes, and find that CCV is almost linearly correlated with VTO, while MCC is inconsistent with the other two. Furthermore, in order to verify which metric is more effective in which scenarios, we perform simulated and practical experiments on nine 4-bit S-Boxes under the non-profiled attacks and profiled attacks, respectively. The experiments show that for quantifying side-channel resistance of S-Boxes under non-profiled attacks, VTO and CCV are more reliable while MCC fails. We also obtain an interesting observation that none of these three metrics is suitable for measuring the resistance of S-Boxes against profiled SCAs. Finally, we try to verify whether these metrics can be applied to compare the resistance of S-Boxes with different sizes. Unfortunately, all of them are invalid in this scenario.

Sign in / Sign up

Export Citation Format

Share Document