Side-Channel Attacks on Smart Cards

Timing Analysis Cryptosystems take different amount of time to process different inputs. Performance optimisations in software Branching/condiational statements Caching in RAM Variable length instructions (multiply,divide) Timing measurements taken with various input data can be used to deduce internal workings.

Input: M, N, d = (d n-1 d n-2...d 1 d 0 ) 2 Output: S = M d mod N S = 1 for j = n do S = S 2 mod N if (d j == 1) then S = S*M mod N return S Timing Analysis Example: Repeated Square and multiply of modular exponentiation

Timing Analysis Counter-measure Input: M, N, d = (d n-1 d n-2...d 1 d 0 ) 2 Output: S = M d mod N S = 1 for j = n do S = S 2 mod N T = S*M mod N if (d j == 1) then S = T return S

Timing Analysis Counter measures: Implementing constant timing for all operations Add noise to the execution time. Prevent an attacker from learning the inputs to a vulnerable operation. Previous example: S = M d mod N (Can sign multiple M’s to deduce d) M’ = R e. M mod N=> S’ = M’ mod N (M’ is hidden from attacker) R -1 S’ = R -1 R ed M d = R -1 RM d = M d mod N = S

Computational Fault Analysis Induce faults on computation by: power supply clock frequency and duty cycle, working temparature UV lights microwaves ion beam

Computational Fault Analysis Fault induced in CRT used to speed up RSA signature S = M d mod N S p = M dp mod pand S q = M dq mod q dp = d mod (p-1), dq = d mod (q-1) S = u p S p + u q S q mod N 2 signatures on same message, 1 good, 1 faulty can be used to factor N when exactly one of S p or S q is faulty. S’ q = M dq mod q. Signature S’ will be invalid. p = gcd(N,M- S’ e )

Computational Fault Analysis Coutermeasure: Results could be verified before exposed. Randomization by padding messages.

Power Analysis Simple Power Analysis (SPA) Information about the operation is deduced directly from tracing the global consumption power of the chip Eg. DES key rotation Eg. RSA exponentiation Differential Power Analysis (DPA) Statistical analysis on power consumption over several executions of the same algorithm with different inputs Idea: The average traces on power consumption reduces noise and reveals otherwise obscured small biases.

Conclusion Smart cards crypto is constrained by the physical limitation of the microprocessor. Implementation needs to take into account of possible attacks. Counter measures taken for attacks need to take into account the efficiency of the implementation in practice.