. The National Institute of Standards and Technology (NIST) started a competition for lightweight cryptography candidates for authenticated encryption. Elephant is one of the ten finalists. Many physical attacks exist on the different traditional cryptographic algorithms. New standard are a new targets for this domain. In this paper, an improvement of the first theoretical blind side channel attack against the authenticated encryption algorithm Elephant is presented. More precisely, we are targeting the LFSR-based counter used internally. LFSRs are classic functions used in symmetric cryptography. In the case of Elephant, retrieving the initial state of the LFSR is equivalent to recovering the encryption key. This paper is an extension of a previous version. So an optimization of our previous theoretical attack is given. In the previous version, in only half of the cases, the attack succeeds in less than two days. In this extended paper, with optimization, the attack succeeds in three quarters of the cases.

Side-channel based instruction disassembly (SCBD) is a family of side-channel attacks that aims at recovering the code executed by a device from physical measurements. Over past decades researches proved that instruction-level disassembly is feasible on simple microcontrollers. Simultaneously, the computing power and architectural complexity of processors are increasing, even in constrained devices. Performing side-channel attacks on mid or high-end devices is inherently harder because of complex concurrent activities and an important amount of noise. While broad behavior identification, such as cryptographic primitives, has been proved possible, the feasibility of precise SCBD remains an open question on a complex System-on-Chip (SoC). In this work, we address some of the technical challenges involved in performing SCBD on SoCs. We propose an experimental setup and measurement methodology that enables reliable characterization of instruction level electromagnetic (EM) leakages. After investigating broad-functional unit activity leakages, we study the feasibility of three instruction-level code reconstruction granularities: functional unit recognition, opcode recognition and bit-level recovery. Under a controlled experimental environment, our results show that broad functional unit activity recognition is achievable as well as opcode-level SCBD. Finally, we show promising results regarding bit-level SCBD exploiting the prefetching stages of the CPU.

Elephant is a finalist to the NIST lightweight cryptography competition. In this paper, the first theoretical blind side channel attack against the authenticated encryption algorithm Elephant is presented. More precisely, we are targetting the LFSR-based counter used internally. LFSRs are classic functions used in symmetric cryptography. In the case of Elephant, retrieving the initial state of the LFSR is equivalent to retrieving the encryption key. The paper ends by the study of different ways to tweak the design of Elephant to mitigate our attack.

Side-channel based instruction disassembly (SCBD) is a family of side-channel attacks that aims at recovering the code executed by a device from physical measurements. Over past decades researches have proved that instruction-level disassembly is feasible on simple controllers. Simultaneously, the computing power and architectural complexity of processors are increasing, even in constrained devices. Performing side-channel attacks on mid or high-end devices is inherently harder because of complex concurrent activities and an important amount of noise. While broad pattern identification, such as cryptographic primitives, has been proved possible, the feasibility of precise SCBD remains an open question on a complex System-on-Chip (SoC). In this work, we address some of the technical challenges involved in performing SCBD on SoCs. We propose an experimental setup and measurement methodology that enables reliable characterization of instruction-level electromagnetic (EM) leakages. We study the feasibility of three code reconstruction granularities: functional unit recognition, opcode recognition and full instruction recovery. Under a controlled experimental environment, our results show that functional unit recognition is achievable (100% classification accuracy) as well as opcode recognition (with evidence of leakage). In our setup, full instruction recovery (i.e., bit-level encoding) turned out to be more challenging. We show that the classification accuracy on instruction bits is better than random guesses and can be improved by combining multiple EM probe positions, but it is not high enough to foresee an attack in a real environment.

In 1973, Neil Sloane published a very short paper introducing an intriguing problem: Pick a decimal integer $n$ and multiply all its digits by each other. Repeat the process until a single digit $\Delta(n)$ is obtained. $\Delta(n)$ is called the \textsl{multiplicative digital root of $n$} or \textsl{the target of $n$}. The number of steps $\Xi(n)$ needed to reach $\Delta(n)$, called the multiplicative persistence of $n$ or \textsl{the height of $n$} is conjectured to always be at most $11$. Like many other very simple to state number-theoretic conjectures, the multiplicative persistence mystery resisted numerous explanation attempts. This paper proves that the conjecture holds for all odd target values: Namely that if $\Delta(n)\in\{1,3,7,9\}$, then $\Xi(n) \leq 1$ and that if $\Delta(n)=5$, then $\Xi(n) \leq 5$. Naturally, we overview the difficulties currently preventing us from extending the approach to (nonzero) even targets.

1Trusted Objects Europarc de Pichaury, Bât. B8, 1330 rue Guillibert de la Lauzière, 13290 AIX-EN-PROVENCE France, email: a.adomnicai@trusted-objects.com 2Université de Limoges 123 avenue Albert Thomas, 87060 LIMOGES Cedex France, email: thierry.berger, christophe.clavier, leo.reynaud@xlim.fr 3Airbus CyberSecurity ZA Clef Saint-Pierre, 1 Bd Jean Moulin, CS 40001, MetaPole, 78996 ELANCOURT Cedex France, email: julien.francq, kevin.legouguec@airbus.com 4Université de Lorraine, CNRS, Inria, LORIA Campus Scientifique BP 239, 54506 VANDOEUVRE-LES-NANCY France, email: paul.huynh, virginie.lallemand, marine.minier@loria.fr 5DGA Maîtrise de l’information BP 7, 35998 RENNES CEDEX 9 France, email: gael.thomas.87@gmail.com

Previous blind side-channel analysis have been proposed to recover a block cipher secret key while neither the plaintext nor the ciphertext is available to the attacker. A recent improvement has been proposed that deals with several first-order Boolean masking schemes. Unfortunately the proposed attacks only work if at least two intermediate states that involve a same key byte are protected by a same mask. In this paper we describe a quadrivariate analysis which involves a pair of key bytes and allows to threaten improved Boolean masked implementations where all masks on inputs of AddRoundKey, SubBytes and MixColumns (respectively $$r_m$$ , $$r_x$$ and $$r_y$$ ) related to a same key byte are independant. Our attack comes in two flavors: in a first variant the attacker learns Hamming distances between pairs of expanded key bytes of his choice while in the other variant he learns whether two pairs of extended key bytes share the same unknown Hamming distance. We provide an analysis and simulation results which demonstrate that the ciphering key can be recovered in both settings.

Side-channel techniques have been progressing over the last few years, leading to the creation of a variety of statistical tools, aiming at extracting secrets handled in cryptographic algorithms. Noticeably, the vast majority of side-channel techniques requires to get the traces aligned together prior to applying statistics. This prerequisite turns out to be challenging in the practical realization of attacks as implementations tend to include hardware or software countermeasures to increase this difficulty. This is typically achieved by adding random jitters or random executions with fake operations. In this paper, we introduce the new side-channel technique scatter, whose potential is to tackle alignment issues. By construction, scatter brings an additional dimension and opens the door to a large set of potential new attack techniques. The effectiveness of scatter has been proven on both simulated traces and real world secure products. In summary scatter is a new side-channel technique offering a valuable alternative when the trace alignment represents an issue. Furthermore, scatter represents a suitable option for low-cost attacks, as the requirements in terms of equipment and expertise are significantly reduced.

Classical side-channel analysis include statistical attacks which require the knowledge of either the plaintext or the ciphertext to predict some internal value to be correlated to the observed leakages. In this paper we revisit a blind (i.e. leakage-only) attack from Linge et al. that exploits joint distributions of leakages. We show – both by simulations and concrete experiments on a real device – that the maximum likelihood (ML) approach is more efficient than Linge’s distance-based comparison of distributions, and demonstrate that this method can be easily adapted to deal with implementations protected by first-order Boolean masking. We give example applications of different variants of this approach, and propose countermeasures that could prevent them. Interestingly, we also observe that, when the inputs are known, the ML criterion is more efficient than correlation power analysis.

This paper describes the method adopted by the winning attack proposal to the first edition of the DPA contest. Two original ideas allowed to efficiently recover the secret key of a hardware implementation of the DES function. The first one was to consider full 56-bit guesses on the whole key (instead of only 6, 8, or even 12 or 16 bits that are usually used) to optimally exploit the side-channel leakage. We used a maximum likelihood based distinguisher fitted to the hardware characteristics of the leakage (32-bit register Hamming distance model). The second original idea was to design a smart sampling of the key space in order to find the correct key without requiring to exhaust a substantial proportion of the $$2^{56}$$ keys. We adopted a hill climbing heuristic approach using a likelihood based objective function, combined with a clever candidate update function that takes into account the main specificities of the DES key schedule.

In this paper we study a parity check based countermeasure proposed by Chen et al. that thwarts their attack by detecting byte fault injection during the AES key schedule process. We provide a generalization of their approach that allows to derive parity equations for every AES sizes not given by the authors. We analyze why Chen et al. countermeasure does not properly works. Doing so we are able to extend the coverage of the fault detection to the full expanded key. Finally we suggest optimizations that reduce memory and computation costs, and propose an adaptation to a more general fault model.

Side-channel analyses constitute a major threat for embedded devices, because they allow an attacker to recover secret keys without the device being aware of the sensitive information theft. They have been proved to be efficient in practice on many deployed cryptosystems. Even during the standardization process for the AES, many scientists have raised the attention on the potential vulnerabilities against implementation-level attacks Chari et al. (A Cautionary Note Regarding Evaluation of AES Candidates on Smart-cards, 133–147, 1999). The evaluation of devices against side-channel attacks is now common practice, especially in ITSEFs. This procedure has even been formalized recently Standaert et al. (EUROCRYPT LNCS 5479:443–461, 2009). The framework suggests to estimate the leakage via an information theoretic metric, and the performance of real attacks thanks to either the success rates or the guessing entropy metrics. The DPA contests are a series of international challenges that allow researchers to improve existing side-channel attacks or develop new ones and compare their effectiveness on several reference sets of power consumption traces using a common methodology. In this article, we focus on the second edition of this contest, which targeted a FPGA-based implementation of AES. This article has been written jointly with several of the participants who describe their tactics used in their attacks and their improvements beyond the state of the art. In particular, this feedback puts to the fore some considerations seldom described in the scientific literature, yet relevant to increase the convergence rate of attacks. These considerations concern in particular the correction of acquisition defects such as the drifting side-channel leakage, the identification of the most leaking samples, the order in which subkeys are attacked, how to exploit subkeys that are revealed easily to help retrieve subkeys that leak less, and non-linear leakage models.