Introduction to side channel attacks and non invasive attacks
Introduction to side channel attacks and non invasive attacks Introduction to side channel attacks and non invasive attacks
FIPS Physical security workshop, Hawaii 2005 Introduction to side channel attacks and non invasive attacks TNO ITSEF Jan Blonk TNO ITSEF www.itsef.com Blonk@ itsef.com
- Page 2 and 3: TNO ITSEF “IT Security Evaluation
- Page 4 and 5: Sm art Card security evaluations TN
- Page 6 and 7: Sm art cards Side channel attacks S
- Page 8 and 9: Pow er consum ption trace 5-10000 c
- Page 10 and 11: Timing dependent on data bits Simpl
- Page 12 and 13: DPA counterm easures Protection aga
- Page 14 and 15: Electro-magnetic fields Principles
- Page 16 and 17: DPA and DEM A counterm easures Prot
- Page 18 and 19: Coils for EM A side channel attacks
- Page 20 and 21: Voltage glitch attack Select target
- Page 22 and 23: Light attack Added value: Can targe
FIPS Physical security workshop, Hawaii 2005<br />
<strong>Introduction</strong> <strong>to</strong> <strong>side</strong> <strong>channel</strong><br />
<strong>attacks</strong> <strong>and</strong> <strong>non</strong> <strong>invasive</strong><br />
<strong>attacks</strong><br />
TNO ITSEF<br />
Jan Blonk<br />
TNO ITSEF<br />
www.itsef.com<br />
Blonk@ itsef.com
TNO ITSEF<br />
“IT Security Evaluation Facility”<br />
TNO is an independent R&D com pany in the Netherl<strong>and</strong>s<br />
TNO ITSEF is ow ned by TNO<br />
TNO ITSEF provides services for:<br />
-security evaluations<br />
-developer support services<br />
strict procedures for maintaining client secrecy of sensitive<br />
inform ation<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 2
Chip security evaluations<br />
TNO ITSEF perform s chip evaluations according <strong>to</strong><br />
different schem es (VISA, MasterCard, CC)<br />
Test<br />
report<br />
MasterCard<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 3
Sm art Card security evaluations<br />
TNO ITSEF perform s form al <strong>and</strong> inform al evaluations on<br />
sm art cards with Global Platform or proprietary OSs<br />
according <strong>to</strong> different schem es (VRIR, CAST, CC, other)<br />
MasterCard<br />
Test<br />
report<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 4
Term inal security evaluations<br />
TNO ITSEF perform s form al <strong>and</strong> inform al security<br />
evaluations on paym ent term inals according <strong>to</strong><br />
different schem es (PCI/PED, CC, other)<br />
Test<br />
report<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 5
Sm art cards<br />
Side <strong>channel</strong> <strong>attacks</strong><br />
SPA/DPA<br />
EM A/DEM A<br />
Perturbation<br />
Light flashes<br />
Voltage glitches<br />
Excess conditions<br />
Frequency<br />
Voltage<br />
tem perature<br />
reset<br />
light<br />
(radiation)<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 6
mA<br />
Pow er analysis<br />
Pow er leakage<br />
Instruction<br />
fetch<br />
Instruction<br />
processing<br />
usec<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 7
Pow er consum ption trace<br />
5-10000 clock cycles (instructions)<br />
Characteristic structures becom e visible<br />
DES<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 8
Pow er consum ption dependent on data<br />
bits<br />
Simple pow er analysis:<br />
Recognise differences in pow er consum ption for “0”<strong>and</strong><br />
“1” databits<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 9
Timing dependent on data bits<br />
Simple Pow er Analysis<br />
Exam ple of timing attack on RSA<br />
1 0 0 0 1 1 1<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 10
Principles of DPA<br />
Large am ount of traces:<br />
Assum e pow er consum ption relates <strong>to</strong> ham m ing weight of data<br />
Subtract traces with high <strong>and</strong> low ham m ing weight<br />
Resulting trace show s ham m ing weight <strong>and</strong> data manipulation<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 11
DPA counterm easures<br />
Protection against DPA is a com bination of:<br />
Hardware<br />
signal reduction<br />
adding am plitude noise<br />
adding timing noise<br />
Dedicated com ponents<br />
Softw are<br />
Time constant program m ing<br />
Adding r<strong>and</strong>om delays or alternating paths<br />
blinding of interm ediate values with r<strong>and</strong>om values<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 12
Set up for pow er analysis<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 13
Electro-magnetic fields<br />
Principles of EM A<br />
electric<br />
field<br />
conduc<strong>to</strong>r<br />
magnetic<br />
field<br />
current i<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 14
EM signals<br />
Sam e inform ation content as pow er signals<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 15
DPA <strong>and</strong> DEM A counterm easures<br />
Protection against DPA <strong>and</strong> DEM A is a com bination of:<br />
Hardware<br />
signal reduction<br />
adding am plitude noise<br />
adding timing noise<br />
Dedicated com ponents<br />
Softw are<br />
Time constant program m ing<br />
Adding r<strong>and</strong>om delays or alternating paths<br />
blinding of interm ediate values with r<strong>and</strong>om values<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 16
Added EM value<br />
Aid for reverse engineering: locate functional blocks<br />
Multi-<strong>channel</strong> Analysis:<br />
Clock extraction for re-alignm ent of pow er traces<br />
Pick-up coil<br />
E-M signal derived clock<br />
raw power<br />
signal traces<br />
process<br />
Also applicable for term inals, phones, PDA’s<br />
Clock<br />
integration<br />
DPA<br />
traces<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 17
Coils for EM A<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 18
Non <strong>invasive</strong> <strong>attacks</strong> (perturbation)<br />
Voltage Glitching:<br />
Very short glitches on the supply voltage<br />
Can change the value of read data<br />
Threshold of<br />
read value<br />
Data value<br />
A power dip at the<br />
moment of reading a<br />
memory cell<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 19
Voltage glitch attack<br />
Select target<br />
Changing calculations:<br />
2A + 2B = 200<br />
2A + 0B = 100<br />
=> A= 50<br />
Determ ine timepoint<br />
Adm inister glitch<br />
Changing program flow :<br />
Result = Verify(PIN)<br />
IF result> 0<br />
THEN Authorize()<br />
END<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 20
Exam ple of voltage glitch set up<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 21
Light attack<br />
Added value:<br />
Can target sm aller features<br />
in the chip<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 22
Exam ple of light attack set up<br />
<strong>side</strong> <strong>channel</strong> <strong>attacks</strong> <strong>and</strong> perturbation <strong>attacks</strong> FIPS conference 23