Provable Security at Implementation-level 011011001010010010100110010111100101101010001010100100101100101000101001010101010100011010010101010010001010010111100111101001101001001010101000101010101001010101010100101001010101010100101001110010010010001010000010101100001001010001001111010010101001010010101011100101000001011101001011011001010010010100110010111100101101010001010100100101100101000101001010101010100011001001010010100100010100100101000101010101001010101010100101001010101010100101001110010010010001010000010101100001001010001001111010010101001010010010101010001010100001011100101001010101010100101001010101010100110010010110010100010100101010000101110110000110110011010001101100101001001010011001011110010110101000101010010010110010100010100101010101010001101001010101001000101001011110011110100110100100101010100010101010100101010101010010100101010101010010100111001001001000101000001010110000100101000100111101001010100101001010101110010100000101110100101101100101001001010011001011110010110101000101010010010110010100010100101010101010001100100101001010010001010010010100010101010100101010101010010100101010101010010100111001001001000101000001010110000100101000100111101001010100101001001010101000101010000101110010100101010101010010100101010101010011001001011001010001010010101000010111011000011011001101000110110010100100101001100101111001011010100010101001001011001010001010010101010101000110100101010100100010100101111001111010011010010010101010001010101010010101010101001010010101010101001010011100100100100010100000101011000010010100010011110100101010010100101010111001010000010111010010110110010100100101001100101111001011010100010101001001011001010001010010101010101000110010010100101001000101001001010001010101010010101010101001010010101010101001010011100100100100010100000101011000010010100010011110100101010010100100101010100010101000010111001010010101010101001010010101010101001100100101100101000101001010100001011101100001101100110100011011001010010010100110010111100101101010001010100100101100101000101001010101010100011010010101010010001010010111100111101001101001001010101000101010101001010101010100101001010101010100101001110010010010001010000010101100001001010001001111010010101001010010101011100101000001011101001011011001010010010100110010111100101101010001010100100101100101000101001010101010100011001001010010100100010100100101000101010101001010101010100101001010101010100101001110010010010001010000010101100001001010001001111010010101001010010010101010001010100001011100101001010101010100101001010101010100110010010110010100010100101010000101110110000110110011010011011001010010010100110010111100101101010001010100100101100101000101001010101010100011010010101010010001010010111100111101001101001001010101000101010101001010101010100101001010101010100101001110010010010001010000010101100001001010001001111010010101001010010101011100101000001011101001011011001010010010100110010111100101101010001010100100101100101000101001010101010100011001001010010100100010100100101000101010101001010101010100101001010101010100101001110010010010001010000010101100001001010001001111010010101001010010010101010001010100001011100101001010101010100101001010101010100110010010110010100010100101010000101110110000110110011010001101100101001001010011001011110010110101000101010010010110010100010100101010101010001101001010101001000101001011110011110100110100100101010100010101010100101010101010010100101010101010010100111001001001000101000001010110000100101000100111101001010100101001010101110010100000101110100101101100101001001010011001011110010110101000101010010010110010100010100101010101010001100100101001010010001010010010100010101010100101010101010010100101010101010010100111001001001000101000001010110000100101000100111101001010100101001001010101000101010000101110010100101010101010010100101010101010011001001011001010001010010101000010111011000011011001101001101100101001001010011001011110010110101000101010010010110010100010100101010101010001101001010101001000101001011110011110100110100100101010100010101010100101010101010010100101010101010010100111001001001000101000001010110000100101000100111101001010100101001010101110010100000101110100101101100101001001010011001011110010110101000101010010010110010100010100101010101010001100100101001010010001010010010100010101010100101010101010010100101010101010010100111001001001000101000001010110000100101000100111101001010100101001001010101000101010000101110010100101010101010010100101010101010011001001011001010001010010101000010111011000011011001101000110110010100100101001100101111001011010100010101001001011001010001010010101010101000110100101010100100010100101111001111010011010010010101010001010101010010101010101001010010101010101001010011100100100100010100000101011000010010100010011110100101010010100101010111001010000010111010010110110010100100101001100101111001011010100010101001001011001010001010010101010101000110010010100101001000101001001010001010101010010101010101001010010101010101001010011100100100100010100000101011000010010100010011110100101010010100100101010100010101000010111001010010101010101001010010101010101001100100101100101000101001010100001011101100001101100110100110110010100100101001100101111001010100101111001111010011010010010101010001010101010010101010101001010010101010101001010011100100100100010100000101011000010010100010011110100101010010100000010111010010110110010101010010101010101001100100101100101000101001010100001011101100001101100110100011011001010010010100110010111100101101010001010 010100101111001111010011010010010101010001010101010010101010101001010010101010101001010011100100100100010100000101011000010010100010011110100101010010100000010111010010110110010101010010101010101001100100101100101000101001010100001011101100001101100110100011011001010010010100110010111100101101010001010 Provable Security at Implementation-level Sebastian Faust sfaust@esat.kuleuven.be Provable Security Provable security has nowadays become the standard way of designing cryptographic protocols. The idea is to first develop an adversarial model, defining the security of the protocol, and then to rigorously prove that no such adversary can exist. Traditional provable security treats cryptographic algorithms as black boxes: an adversary may have access to inputs and outputs, but the computation within the box stays secret. The Challenge The black box model does not match reality if there are more powerful attacks on the algorithm's implementation. An important example in this context are side-channel attacks. The goal of this project is to develop theoretical models that allow for provable security guarantees on the implementation-level. Cipher message ciphertext Adversarial Model The adversarial model specifies the abilities of the adversary. It has been shown that some limitation of the adversaries’ power is necessary. One of the main challenges of this project is to develop reasonable restrictions such that practical attacks are still taken into account. State of the Art Micali & Reyzin presented a generic model, in which each step of the computation is associated with a leakage function. They show how to build more complex schemes out of physically secure primitives under a set of axioms specifying the physical world. Reality Model A different approach was taken by Ishai et. al. They analyze boolean circuits and study their security against probing and tampering adversaries. Recent Research The M&R model is not suitable for the analysis of cryptographic schemes because for each construction a new tailored assumption needs to be introduced. While the model of Ishai et. al studies invasive adversaries, in practice non-invasive opponents are a bigger threat. Thus, we analyze circuit transformations in the power-analysis model. Remarkably, the constructions from Ishai et. al fail to provide security. Future Research Further restrictions to the MR04 model (e.g. constant or bounded leakage functions) Continue analysis in the power analysis model. Study instruction set as used in smart cards and search for program transformations.