Skip to main content
SpringerLink
Log in

Security Evaluation Against Side-Channel Analysis at Compilation Time

  • Conference paper
  • First Online:
Book cover Algebra, Codes and Cryptology (A2C 2019)

Part of the book series: Communications in Computer and Information Science ((CCIS,volume 1133))

Included in the following conference series:

Abstract

Masking countermeasure is implemented to thwart side-channel attacks. The maturity of high-order masking schemes has reached the level where the concepts are sound and proven. For instance, Rivain and Prouff proposed a full-fledged AES at CHES 2010. Some non-trivial fixes regarding refresh functions were needed though. Now, industry is adopting such solutions, and for the sake of both quality and certification requirements, masked cryptographic code shall be checked for correctness using the same model as that of the theoretical protection rationale (for instance the probing leakage model).

Seminal work has been initiated by Barthe et al. at EUROCRYPT 2015 for automated verification at higher orders on concrete implementations.

In this paper, we build on this work to actually perform verification from within a compiler, so as to enable timely feedback to the developer. Precisely, our methodology enables to provide the actual security order of the code at the intermediate representation (IR) level, thereby identifying possible flaws (owing either to source code errors or to compiler optimizations). Second, our methodology allows for an exploitability analysis of the analysed IR code. In this respect, we formally handle all the symbolic expressions in the static single assignment (SSA) representation to build the optimal distinguisher function. This enables to evaluate the most powerful attack, which is not only function of the masking order d, but also on the number of leaking samples and of the expressions (e.g., linear vs non-linear leakages).

This scheme allows to evaluate the correctness of a masked cryptographic code, and also its actual security in terms of number of traces in a given deployment context.

N. Bruneau—Work done while at Secure-IC S.A.S.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    In this paper, we use the same letter d for the number of shares necessary to recover information on sensitive variables (designer’s perspective) and the smallest attack order (evaluator’s perspective). Actually, those values match in practice, assuming that the implementation is not flawed.

  2. 2.

    At infinite order, the expansion of Eq. (3) is not considered, rather the original expression of Eq. (1) is used.

  3. 3.

    The LLVM IR is lowered to machine instructions, and some optimizations can still be performed on this representation. In particular, some memory accesses can be gathered, some peephole optimizations may remove some useless computations, selection of some instructions may disrupt the intended control flow, instruction scheduling may reorder computations and register allocation can introduce flaws.

  4. 4.

    This is the way all Secure-IC pre-silicon tools, namely Virtualyzr\(^{\textregistered }\) and Catalyzr\(^{\textregistered }\), work.

  5. 5.

    Battistello et al. [4] also notice that great multiplicity helps attacks, albeit in the different context of low-noise implementations (e.g., software running on top of a CPU). Anyway, such results highlight well that high dimensionality significantly favors the attackers, and that this aspect is often overlooked when simply analysing the security of a masking scheme only in terms of its degree (i.e., number of shares).

References

  1. Balasch, Josep, Gierlichs, Benedikt, Reparaz, Oscar, Verbauwhede, Ingrid: DPA, bitslicing and masking at 1 GHz. In: Güneysu, Tim, Handschuh, Helena (eds.) CHES 2015. LNCS, vol. 9293, pp. 599–619. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-48324-4_30

    Chapter  Google Scholar 

  2. Barthe, G., Belaïd, S., Dupressoir, F., Fouque, P.-A., Grégoire, B., Strub, P.-Y.: Verified proofs of higher-order masking. In: Oswald, E., Fischlin, M. (eds.) EUROCRYPT 2015. LNCS, vol. 9056, pp. 457–485. Springer, Heidelberg (2015). https://doi.org/10.1007/978-3-662-46800-5_18

    Chapter  Google Scholar 

  3. Barthe, G., Dupressoir, F., Faust, S., Grégoire, B., Standaert, F.-X., Strub, P.-Y.: Parallel implementations of masking schemes and the bounded moment leakage model. In: Coron, J.-S., Nielsen, J.B. (eds.) EUROCRYPT 2017. LNCS, vol. 10210, pp. 535–566. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-56620-7_19

    Chapter  Google Scholar 

  4. Battistello, A., Coron, J.-S., Prouff, E., Zeitoun, R.: Horizontal side-channel attacks and countermeasures on the ISW masking scheme. In: Gierlichs, B., Poschmann, A.Y. (eds.) CHES 2016. LNCS, vol. 9813, pp. 23–39. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-53140-2_2

    Chapter  MATH  Google Scholar 

  5. Bayrak, A.G., Regazzoni, F., Novo, D., Brisk, P., Standaert, F.-X., Ienne, P.: Automatic application of power analysis countermeasures. IEEE Trans. Comput. 64(2), 329–341 (2015)

    Article  MathSciNet  Google Scholar 

  6. Bayrak, A.G., Regazzoni, F., Novo, D., Ienne, P.: Sleuth: automated verification of software power analysis countermeasures. In: Bertoni, G., Coron, J.-S. (eds.) CHES 2013. LNCS, vol. 8086, pp. 293–310. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-40349-1_17

    Chapter  Google Scholar 

  7. Belgarric, P., et al.: Time-frequency analysis for second-order attacks. In: Francillon, A., Rohatgi, P. (eds.) CARDIS 2013. LNCS, vol. 8419, pp. 108–122. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-08302-5_8

    Chapter  Google Scholar 

  8. El Ouahma, I.B., Meunier, Q., Heydemann, K., Encrenaz, E.: Side-channel robustness analysis of masked assembly codes using a symbolic approach. J. Cryptographic Eng. 1–12 (2019). https://doi.org/10.1007/s13389-019-00205-7.

    Article  Google Scholar 

  9. Bhasin, S., Danger, J.-L., Guilley, S., Najm, Z.: A low-entropy first-degree secure provable masking scheme for resource-constrained devices. In: Proceedings of the Workshop on Embedded Systems Security, WESS 2013, Montreal, Quebec, Canada, 29 September–4 October 2013, pp. 7:1–7:10. ACM (2013)

    Google Scholar 

  10. Billet, O., Gilbert, H., Ech-Chatbi, C.: Cryptanalysis of a white box AES implementation. In: Selected Areas in Cryptography, pp. 227–240 (2004)

    Chapter  Google Scholar 

  11. Blömer, J., Guajardo, J., Krummel, V.: Provably secure masking of AES. In: Handschuh, H., Hasan, M.A. (eds.) SAC 2004. LNCS, vol. 3357, pp. 69–83. Springer, Heidelberg (2004). https://doi.org/10.1007/978-3-540-30564-4_5

    Chapter  Google Scholar 

  12. Bogdanov, A., et al.: PRESENT: an ultra-lightweight block cipher. In: Paillier, P., Verbauwhede, I. (eds.) CHES 2007. LNCS, vol. 4727, pp. 450–466. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-74735-2_31

    Chapter  Google Scholar 

  13. Bruneau, N., Danger, J.-L., Guilley, S., Heuser, A., Teglia, Y.: Boosting higher-order correlation attacks by dimensionality reduction. In: Chakraborty, R.S., Matyas, V., Schaumont, P. (eds.) SPACE 2014. LNCS, vol. 8804, pp. 183–200. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-12060-7_13

    Chapter  Google Scholar 

  14. Bruneau, N., Guilley, S., Heuser, A., Rioul, O.: Masks will fall off. In: Sarkar, P., Iwata, T. (eds.) ASIACRYPT 2014. LNCS, vol. 8874, pp. 344–365. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-662-45608-8_19

    Chapter  Google Scholar 

  15. Bruneau, N., Guilley, S., Heuser, A., Rioul, O., Standaert, F.-X., Teglia, Y.: Taylor expansion of maximum likelihood attacks for masked and shuffled implementations. In: Cheon, J.H., Takagi, T. (eds.) ASIACRYPT 2016. LNCS, vol. 10031, pp. 573–601. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-53887-6_21

    Chapter  Google Scholar 

  16. Bruneau, N., Guilley, S., Najm, Z., Teglia, Y.: Multivariate high-order attacks of shuffled tables recomputation. J. Cryptol. 31(2), 351–393 (2018)

    Article  MathSciNet  Google Scholar 

  17. Carré, S., Facon, A., Guilley, S., Takarabt, S., Schaub, A., Souissi, Y.: Cache-timing attack detection and prevention. In: Polian, I., Stöttinger, M. (eds.) COSADE 2019. LNCS, vol. 11421, pp. 13–21. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-16350-1_2

    Chapter  Google Scholar 

  18. Coron, J.-S., Prouff, E., Rivain, M.: Side channel cryptanalysis of a higher order masking scheme. In: Paillier, P., Verbauwhede, I. (eds.) CHES 2007. LNCS, vol. 4727, pp. 28–44. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-74735-2_3

    Chapter  Google Scholar 

  19. Danger, J.-L., et al.: On the performance and security of multiplication in GF(2\({}^{\text{ N }}\)). Cryptography 2(3), 25 (2018)

    Article  Google Scholar 

  20. Eldib, H., Wang, C., Schaumont, P.: Formal verification of software countermeasures against side-channel attacks. ACM Trans. Softw. Eng. Methodol. 24(2), 11:1–11:24 (2014)

    Article  Google Scholar 

  21. ETSI/TC CYBER. Security techniques for protecting software in a white box model. ETSI TR 103 642 V1.1.1, October 2018

    Google Scholar 

  22. Ishai, Y., Sahai, A., Wagner, D.: Private circuits: securing hardware against probing attacks. In: Boneh, D. (ed.) CRYPTO 2003. LNCS, vol. 2729, pp. 463–481. Springer, Heidelberg (2003). https://doi.org/10.1007/978-3-540-45146-4_27

    Chapter  Google Scholar 

  23. ISO/IEC JTC 1/SC 27/WG 3. ISO/IEC CD 20085–1:2017 (E). Information technology - Security techniques – Test tool requirements and test tool calibration methods for use in testing non-invasive attack mitigation techniques in cryptographic modules – Part 1: Test tools and techniques, 25 January 2017

    Google Scholar 

  24. Nassar, M., Souissi, Y., Guilley, S., Danger, J.-L.: RSM: a small and fast countermeasure for AES, secure against first- and second-order zero-offset SCAs. In: DATE, pp. 1173–1178. IEEE Computer Society, Dresden, Germany, 12–16 March 2012. (TRACK A: “Application Design”, TOPIC A5: “Secure Systems”)

    Google Scholar 

  25. Oren, Y., Weisse, O., Wool, A.: A new framework for constraint-based probabilistic template side channel attacks. In: Batina, L., Robshaw, M. (eds.) CHES 2014. LNCS, vol. 8731, pp. 17–34. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-662-44709-3_2

    Chapter  Google Scholar 

  26. Rauzy, P., Guilley, S., Najm, Z.: Formally proved security of assembly code against power analysis - a case study on balanced logic. J. Cryptogr. Eng. 6(3), 201–216 (2016)

    Article  Google Scholar 

  27. Rivain, M., Prouff, E.: Provably secure higher-order masking of AES. In: Mangard, S., Standaert, F.-X. (eds.) CHES 2010. LNCS, vol. 6225, pp. 413–427. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-15031-9_28

    Chapter  Google Scholar 

  28. Roy, D.B., Bhasin, S., Guilley, S., Danger, J.-L., Mukhopadhyay, D.: From theory to practice of private circuit: a cautionary note. In: 33rd IEEE International Conference on Computer Design, ICCD 2015, New York City, NY, USA, 18–21 October 2015, pp. 296–303. IEEE Computer Society (2015)

    Google Scholar 

  29. Schramm, K., Paar, C.: Higher order masking of the AES. In: Pointcheval, D. (ed.) CT-RSA 2006. LNCS, vol. 3860, pp. 208–225. Springer, Heidelberg (2006). https://doi.org/10.1007/11605805_14

    Chapter  Google Scholar 

  30. Tunstall, M., Whitnall, C., Oswald, E.: Masking tables—an underestimated security risk. In: Moriai, S. (ed.) FSE 2013. LNCS, vol. 8424, pp. 425–444. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-662-43933-3_22

    Chapter  Google Scholar 

  31. University of Sydney (Australia). Magma Computational Algebra System. http://magma.maths.usyd.edu.au/magma/. Accessed 22 Aug 2014

  32. Veyrat-Charvillon, N., Gérard, B., Standaert, F.-X.: Soft analytical side-channel attacks. In: Sarkar, P., Iwata, T. (eds.) ASIACRYPT 2014. LNCS, vol. 8873, pp. 282–296. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-662-45611-8_15

    Chapter  Google Scholar 

Download references

Acknowledgments

This work has been partly financed via TeamPlay, a project from European Union’s Horizon20202 research and innovation program, under grand agreement N\(^\circ \) 779882 (https://teamplay-h2020.eu/).

Author information

Authors and Affiliations

  1. Secure-IC S.A.S, 35510, Cesson-Sévigné, France

    Nicolas Bruneau, Jean-Luc Danger, Adrien Facon & Sylvain Guilley

  2. STMicroelectronics, 13790, Rousset, France

    Nicolas Bruneau

  3. Direction Générale de l’Armement, 35170, Bruz, France

    Charles Christen

  4. Télécom-Paris, Institut Polytechnique de Paris, 91400, Saclay, France

    Jean-Luc Danger & Sylvain Guilley

  5. Département d’informatique de l’ENS, CNRS, PSL University, 75005, Paris, France

    Adrien Facon & Sylvain Guilley

Authors
  1. Nicolas Bruneau
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Charles Christen
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Jean-Luc Danger
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Adrien Facon
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Sylvain Guilley
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Sylvain Guilley .

Editor information

Editors and Affiliations

  1. Cheikh Anta Diop University, Dakar, Senegal

    Cheikh Thiecoumba Gueye

  2. Florida Atlantic University, Boca Raton, FL, USA

    Edoardo Persichetti

  3. Jean Monnet University, Saint-Etienne, France

    Pierre-Louis Cayrel

  4. Technical University of Darmstadt, Darmstadt, Germany

    Johannes Buchmann

Appendices

A Example of Input Codes For Analysis

1.1 A.1 Codes Which can be Analyzed in Our Framework

Two examples of codes which can be analyzed are provided here-after in Listing 1.1. The selection between the two codes is achieved by defining macro to either cube or present at line 117.

figure d
figure e
figure f

1.2 A.2 Code Which Cannot be Analyzed

In this section, we present one example of code which cannot be analyzed (automatically) since simplifications as per Barthe [2] do not apply. Indeed, the masks are not used as in ISW [22]:

  • in ISW: masks are added (XORed) and subsequently subtracted (XORed), whereas

  • in Alg. 1.2: the masks are involved in computation as selection variable in a choice.

The listing 1.2 presents both a straightforward multiplexor and a multiplexor protected at first-order.

figure g

B Multi-variate Attack at Degrees Two and Three

Fig. 4.
figure 4

Comparison of success rate for classical bi-variate attack and our multi-variate attack at degrees two and three

Full size image

Rights and permissions

Reprints and permissions

Copyright information

© 2019 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Bruneau, N., Christen, C., Danger, JL., Facon, A., Guilley, S. (2019). Security Evaluation Against Side-Channel Analysis at Compilation Time. In: Gueye, C., Persichetti, E., Cayrel, PL., Buchmann, J. (eds) Algebra, Codes and Cryptology. A2C 2019. Communications in Computer and Information Science, vol 1133. Springer, Cham. https://doi.org/10.1007/978-3-030-36237-9_8

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-36237-9_8

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-36236-2

  • Online ISBN: 978-3-030-36237-9

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation