1. Provable Security at Implementation-level
Provable Security at Implementation-level
Sebastian Faust
Provable Security
Provable security has nowadays become the standard way of designing cryptographic protocols. The idea is to first develop an adversarial model, defining the security of the protocol, and then to rigorously prove that no such adversary can exist. Traditional provable security treats cryptographic algorithms as black boxes: an adversary may have access to inputs and outputs, but the computation within the box stays secret.
The Challenge
The black box model does not match reality if there are more powerful attacks on the algorithm's implementation. An important example in this context are side-channel attacks. The goal of this project is to develop theoretical models that allow for provable security guarantees on the implementation-level.
Cipher
message
ciphertext
Adversarial Model
The adversarial model specifies the abilities of the adversary. It has been shown that some limitation of the adversaries’ power is necessary. One of the main challenges of this project is to develop reasonable restrictions such that practical attacks are still taken into account.
State of the Art
Micali & Reyzin presented a generic model, in which each step of the computation is associated with a leakage function. They show how to build more complex schemes out of physically secure primitives under a set of axioms specifying the physical world.
Reality
Model
A different approach was taken by Ishai et. al. They analyze boolean circuits and study their security against probing and tampering adversaries.
Recent Research
The M&R model is not suitable for the analysis of cryptographic schemes because for each construction a new tailored assumption needs to be introduced.
While the model of Ishai et. al studies invasive adversaries, in practice non-invasive opponents are a bigger threat. Thus, we analyze circuit transformations in the power-analysis model. Remarkably, the constructions from Ishai et. al fail to provide security.
Future Research
Further restrictions to the MR04 model (e.g. constant or bounded leakage functions)
Continue analysis in the power analysis model.
Study instruction set as used in smart cards and search for program transformations.