DPA Countermeasures

Patent license agreement

Rambus has signed a patent license agreement with Gemalto that covers the use of our patented security technologies – including Differential Power Analysis (DPA) countermeasures, which protect devices against DPA and other related side-channel attacks (SCA).

Much like safecracking, electronic side-channel attacks eschew a brute force approach to extracting keys and other secret information from a device or system. SCA conducted against electronic devices and systems are non-intrusive, relatively simple and inexpensive to execute.

Differential Power Analysis

Differential Power Analysis (DPA) is a form of side-channel attack that monitors variations in the electrical power consumption or electro-magnetic emissions of a target device. The basic method involves partitioning a set of traces into subsets, then subsequently computing the difference of the averages of these subsets. A trace refers to a set of power consumption measurements taken while the device is performing cryptographic operations. Given enough traces, extremely minute correlations can be isolated — no matter how much noise is present in the measurements.

An example of the traces collected during a cryptographic operation is shown below in Figure 1.

The top trace shows the DPA results showing the average power trace for an AES-128 operation running on an FPGA. The DPA process was used to find the bytes of the last round key used in the AES operation. The middle trace is a differential trace for a DPA test carried out with an incorrect guess of the first byte of the last round key and the bottom trace shows the corresponding differential trace for the correct key byte guess.

A typical DPA attack comprises 6 primary stages: communicating with a target device; recording power traces while the target device performs cryptographic operations; signal processing to remove errors and reduce noise; prediction and selection function generation to prepare and define for analysis; as well as computing the averages of input trace subsets and evaluating DPA test results to determine the most probable key guesses.

Additional DPA variants include reverse engineering unknown S-boxes and algorithms, correlation power analysis (CPA), probability distribution analysis, high-order DPA and template attacks.

DPA countermeasures

Specific DPA countermeasure techniques include decreasing the signal-to-noise ratio of the power side channel by reducing leakage (signal) or increasing noise, for example, by making the amount of power consumed less contingent upon data values and/or operation (balancing); introducing amplitude and temporal noise; incorporating randomness with blinding and masking by randomly altering the representation of secret parameters and implementing protocol-level countermeasures by continually refreshing and updating cryptographic protocols used by a device.

Because all physical electronic systems routinely leak information, an effective layer of side-channel countermeasures should be implemented via hardware (DPA resistant cores), software (DPA resistant libraries) or both. It should be noted that stand-alone noise introduction is incapable of sufficiently masking side-channel emissions. Indeed, DPA conducted against a device can effectively bypass stand-alone noise countermeasures, ultimately allowing the signal to be isolated. After layered countermeasures have been implemented, systems should be carefully evaluated with a Test Vector Leakage Assessment (TVLA) platform such as the Rambus DPA Workstation (DPAWS) to confirm the cessation of sensitive side-channel leakage.

Interested in learning more about Rambus’ DPA countermeasures? You can check out our product page here and download our eBook on the subject below.

Exploiting the magnetic field with Odini

Researchers at Israel’s Ben Gurion University (BGU) have demonstrated how attackers can successfully bypass Faraday cages to monitor low-frequency magnetic radiation emitted by air-gapped electronic devices.

“While Faraday rooms may successfully block electromagnetic signals which emanate from computers, low-frequency magnetic radiation disseminates through the air, penetrating metal shields within the rooms,” explains Dr. Mordechai Guri, the director of the Cybersecurity Research Center at BGU.

“That’s why a compass still works inside of a Faraday room. Attackers can use this covert magnetic channel to intercept sensitive data from virtually any desktop PCs, servers, laptops, embedded systems and other devices.”

More specifically, Guri’s Odini method (named after escape artist Harry Houdini), exploits the magnetic field generated by a CPU to circumvent even the most securely equipped room. Put simply, Odini is specially coded malware designed to control the low frequency magnetic fields emitted from an infected computer by regulating the load of the CPU cores. This means arbitrary data can be modulated and transmitted on top of the magnetic emission – and received by a magnetic receiver (bug) placed nearby.

It should be noted that the malicious code does not require special privileges (e.g., root) and can successfully operate from within isolated virtual machines (VMs).

Magneto malware taps covert channels

In a separate attack, Guri and his team utilized malware keystrokes and passwords on an air-gapped computer to transfer data to a nearby smartphone via its magnetic sensor.

“We implement a malware that controls the magnetic fields emanating from the computer by regulating workloads on the CPU cores,” Guri and his research team explained in a recently publish abstract.

“Sensitive data such as encryption keys, passwords, or keylogging data is encoded and transmitted over the magnetic signals, [while] a smartphone located near the computer receives the covert signals with its magnetic sensor.”

The abstract also noted that the proposed covert channel works from a user-level process without requiring special privileges – and can successfully operate from within an isolated virtual machine (VM). Moreover, attackers can intercept the leaked data even when a smartphone is sealed in a Faraday bag or set to airplane mode.

Extracting stolen data

As Wired’s Andy Greenberg reports, Guri’s work aims to demonstrate that once a device is infected, attackers aren’t going to necessarily wait to establish a traditional connection before they exfiltrate stolen data.

“Instead, they can use more insidious means to leak information to nearby computers—often to malware on a nearby smartphone, or another infected computer on the other side of the air gap,” he writes.

According to Guri, challenging the concept of air-gapped devices involves thinking creatively about how computer components can be surreptitiously transformed into clandestine communication devices.

“It goes way beyond typical computer science: electrical engineering, physics, thermodynamics, acoustic science, optics,” he tells Wired. “It requires thinking ‘out of the box,’ literally.”

During the early days of safecracking, rudimentary rotary locks were compromised by feel or sound to determine the correct combination. Following in this tradition, cyber criminals and other malicious actors are now exploiting side-channel attacks (SCA) to compromise cryptographic systems.

To be sure, all physical electronic systems routinely leak information about the internal process of computing via fluctuating levels of power consumption and electro-magnetic emissions. Much like traditional safecracking, electronic side-channel attacks eschew a brute force approach to extracting keys and other secret information from a device or system.

SCA conducted against electronic devices and systems are non-intrusive, relatively simple and inexpensive to execute. Side-channel attacks comprise a wide range of techniques including Differential Power Analysis (DPA), Simple Power Analysis (SPA), Simple Electromagnetic Analysis (SEMA), Differential Electromagnetic Analysis (DEMA), Correlation Power Analysis (CPA) and Correlation Electromagnetic Analysis (CEMA).

Because all physical electronic systems routinely leak information, an effective layer of side-channel countermeasures should be implemented via hardware (DPA resistant cores), software (DPA resistant software libraries) or both. Countermeasures – including leakage reduction, noise introduction, obfuscation and the incorporation of randomness – are critical to ensuring the protection of sensitive keys and data. It should be noted that stand-alone noise introduction is incapable of sufficiently masking side-channel emissions.

Indeed, DPA conducted against a device can effectively bypass stand-alone noise countermeasures, ultimately allowing the signal to be isolated. After layered countermeasures have been implemented, systems should be carefully evaluated with a Test Vector Leakage Assessment (TVLA) platform such as the Rambus DPA Workstation (DPAWS) to confirm the cessation of sensitive side-channel leakage.

More specifically, DPAWS measures a range of side-channel attacks across a wide spectrum of devices and platforms including smart phones, tablets, POS terminals, CPUs, TVs, set-top boxes, FPGAs, smart cards and NFC tech. DPAWS provides users with a highly-intuitive UI paired with enhanced data visualization that creates an integrated, project-centric analytic environment specifically designed to optimize the efficiency of side-channel analysis.

Both flexible and scalable, DPAWS supports multiple side-channel sensors, device protocols and form factors, with out-of-the-box support for SASEBO and additional third-party hardware. DPAWS also easily integrates with a wide range of industry tools including Matlab, Python and other scripting languages. Moreover, the Rambus DPA Workstation supports full cipher coverage (AES, RSA, ECC, DES and SHA), large dataset handling, as well as high-speed collection and analysis of billions of traces. Source code is also available to facilitate increased flexibility.

Interested in learning more about protecting electronic systems from side-channel attacks? You can download our eBook on the subject below.

Michael Mehlberg, a senior director of business development at Rambus’ security division, recently wrote an article for Intelligent Aerospace about the importance of protecting military equipment – including avionics and electronics – from tampering, reverse engineering and cryptanalysis.

“While cyber-warfare has become increasingly sophisticated in recent years, side-channel attacks conducted against sensitive electronic gear are relatively simple to execute and can be performed with less than $5,000 of standard lab equipment,” he explained.

SPA illustration. Image Credit: Rambus Security Division (via “Introduction to Differential Power Analysis”)

“Such attacks include Simple Power Analysis (SPA) and Differential Power Analysis (DPA). These noninvasive techniques analyze power consumption while a device is performing routine operations with secret keys and algorithms.”

While no single countermeasure can effectively secure a system against all threats, Mehlberg says a layered approach that includes resistance against SPA and DPA attacks should be integrated into critical electronic systems.

“Military equipment and platforms may have evolved significantly since Soviet scientists reverse-engineered the Sidewinder missile in 1958 and North Korean soldiers boarded the Pueblo in 1968,” he continued. “Nevertheless, the threat of total mission compromise remains a clear and present danger, especially in close proximity to hostile territory. Indeed, equipment deployed at forward operating bases (FOBs) is particularly vulnerable.”

USS Pueblo. Image Credit: U.S. Navy Naval History and Heritage Command (via Wikipedia)

To be sure, although FOBs are routinely supported by Main Operating Bases, adverse conditions may act to temporarily delay resupply and reinforcements. Smaller Cooperative Security Locations (CSLs) – aka “lily pads” – face similar logistical difficulties as well. In addition, CSL personnel may be instructed to follow strict security protocols that effectively limit both incoming and outgoing communications. Therefore, says Mehlberg, it is critical for warfighters to be equipped with secure electronic equipment before they are deployed to FOBs and CSLs.

“As is the case with many deployed electronic systems, developers and systems integrators must take care to protect important equipment against unauthorized access in the event of a battlefield loss,” he elaborated. “Electronic communications equipment is of particular interest to those who may wish to intercept battlefield transmissions and should be specifically secured against unauthorized access of any kind.”

Forward Operating Base Logar, Afghanistan. Image Credit: U.S. Army (via Wikipedia) 

More specifically, portable electronics, communications gear and “leave-behind” equipment are the most vulnerable to exploitation and could potentially allow hostile forces to eavesdrop on military communications and forge command-and-control messages. Therefore, equipment that employs cryptography to protect the sensitive transmission of data should be capable of resisting various forms of side-channel attacks, including DPA and SPA.

“These powerful, non-invasive attacks can be exploited by hostile elements to allow the unauthorized extraction of secret cryptographic keys, potentially revealing classified data. In fact, most tamper-resistant devices and cryptographic algorithms are susceptible to such attacks if they do not include countermeasures. Perhaps not surprisingly, general-purpose silicon – such as FPGAs and ASICs – receive more attacker attention because they are easier to acquire,” he added.

Interested in learning more about protecting military equipment from side-channel attacks? The full text of “Protecting military electronics, avionics from side-channel attacks,” is available on Intelligent Aerospace here. You can also check out our DPA countermeasures product page here.

Rambus security researchers have successfully conducted a side-channel assisted cryptanalysis attack against QcBits, a code-based public key algorithm based on a problem thought to be resistant to quantum computer attacks. QcBits – pronounced “quick-bits” – is a variant of the McEliece public-key cryptosystem based on quasi-cyclic (QC) moderate density parity check (MDPC) codes.

According to Rambus Security technical director Mark E. Marson, the attack only required researchers to observe a relatively small number of decryptions – approximately 200 power traces for the analyzed implementation. Moreover, less than 1% of each trace needed to be analyzed. As Marson told Rambus Press, the side-channel attack comprised two steps. The first, a Differential Power Analysis (DPA) attack, targeted the syndrome computation of the decryption operation.

“The operation used half of the private key. During this step, we recovered some information about that half of the key,” Marson explained. “Because of the way in which the implementation leaks, there was some ambiguity as to the exact location of the nonzero elements of the key.”

The second step was based on a linear algebra computation which exploited the sparseness of the private key and succeeded with high probability.

“We repeated this operation – varying the equations slightly each time – until the computation succeeded,” Marson elaborated. “This allowed us to recover the entire secret key.”

In a detailed paper that was presented at CHES 2017, the Rambus security team proposed a simple masking technique to help defend against future side-channel attacks targeting QcBits during the syndrome calculation process. Essentially, since QC-MDPC codes are linear, the XOR of two codewords is another codeword. In addition, all codewords are in the nullspace of the parity check matrix. As such, the corrupted codeword can be masked by XORing it with a random codeword – before passing it to the syndrome computation.

Importantly, the above-mentioned technique does not alter the outcome of the syndrome calculation, although it does effectively mask the DPA leak exploited by researchers. It should also be noted that this countermeasure is only effective during the syndrome calculation. Additional side-channel countermeasures are required to protect the private key during other calculations such as the bit flipping algorithm.

“Many proposals for post-quantum cryptography are based on noisy linear systems: lattices, learning with errors or error-correcting codes. In terms of side-channel resilience, these systems have an important difference from systems based on number-theoretic problems,” Marson added. “Leaking a few bits of a number-theoretic system may open up a new avenue of attack, but it usually doesn’t directly contribute to solving the underlying hard problem. For noisy linear systems, leaking a few bits of the secret is likely to directly erode the difficulty of the underlying hard problem. As such, designers may wish to consider the risks of side-channel analysis when evaluating post-quantum cryptographic algorithms.”

As we’ve previously discussed on Rambus Press, all cryptographic systems routinely leak information about the internal process of computing. In practical terms, this means attackers can exploit various techniques to extract the key and other secret information from a target device. This vector is known as side-channel attacks, which are commonly referred to as SCA.

Put simply, side-channel attacks monitor power consumption and electro-magnetic emissions while a device is performing cryptographic operations. Side-channel attacks conducted against electronic devices and systems are relatively simple and inexpensive to execute. This means attackers can exploit various side-channel techniques to gather data and extract secret cryptographic keys. As all physical electronic systems leak information, effective side-channel countermeasures should be implemented at the design stage to ensure protection of sensitive keys and data.

Interested in learning more about how Rambus security researchers cracked a post-quantum ‘QcBits’ cipher with side-channel power analysis? The full text of “A Side-Channel Assisted Cryptanalytic Attack Against QcBits,” written by Melissa Rossi, Mike Hamburg, Michael Hutter and Mark E. Marson is available for download here.

Be sure to stay tuned for more news about Rambus Security and our post-quantum cryptography projects, such as the quantum-resistant public-key cryptographic algorithms that we are preparing to submit to the National Institute of Standards and Technology (NIST).

In a recently published paper, security researchers built a miniature system capable of covertly recovering encryption keys using side-channel analysis. Fox-IT’s Craig Ramsay and Jasper Lohuis collaborated with Riscure to perform this analysis against two realistic AES-256 implementations. Specifically, the attacks were conducted using an improved antenna and signal processing equipment that cost less than €200 and fit into a jacket pocket. Moreover, the entire operation spanned five minutes at a distance of one meter, dropping down to a quick 50 seconds for 30 cm.

“Some things are just inherent to electronic products. TEMPEST leakage is one of them. This holds true for any appliance — whether programmed in JavaScript, C, or even a custom hardware design. Everything is eventually run on hardware (a.k.a. electronics),” Ramsay and Lohuis explained. “So, running an algorithm will produce some fluctuating magnetic field. There is often nothing preventing us from measuring this EM radiation from close by, or even covertly from a distance. In fact, this is a technique which is relied upon in all wireless communication. All FM radio, WiFi, and GSM communications work by deliberately exploiting this. TEMPEST attacks measure this field from a distance and extract useful information from it.”

For the attack executed at 30 cm, Fox-IT targeted the ARM Cortex-M3 core powering the SmartFusion2 SoC. Security researchers used a small magnetic loop antenna, an external amplifier and bandpass filters, as well as a €20 USB RTL-SDR USB dongle for data recording. (The researchers also worked with SR-7100 and USRP B200 data recorders). Preprocessing, first extracted one large recording from the radio, then detected where each encryption block started and split the recording up into single encryption blocks. Subsequent analysis was performed by correlating between key byte guesses and the recorded traces to retrieve the secret key.

“[On the] SmartFusion2 target, the leakage seems to largely originate from the AHB bus connecting the Cortex-M3 to the on-chip memories. We can correlate on the addresses of the T table lookups to attack the key,” Ramsay and Lohuis explained. “We count the number of bits which transition between two sequential addresses on the bus (i.e. Hamming distance). This suggests that the bus logic briefly short-circuits when transitioning.”

Image Credit: Fox-IT

The plot above shows the correlation traces for all 256 guesses of a key byte using the Fox-IT address line model. As the image illustrates, the correct byte does indeed provide the highest spike, meaning the key (byte by byte) can be recovered using only measurements and the input data.

To perform the TEMPEST attack at a distance, security researchers switched to a more directional PCB log-periodic antenna that targeted a Pynq board.

“The software is still the same, we still attack the bus between ARM core and memory, but we can clock the memory at 400 MHz,” Ramsay and Lohuis continued. “We find switching to the new board surprising easy. Although the memory clock is ≈3 times faster (or effectively ≈6 as we now use DDR), we can still attack the Pynq board with the bandwidth supported by the RTL-SDR.”

For the next stage of the TEMPEST side-channel attack project, the researchers built a shielded chamber to reduce the effect of external signals using two boxes wrapped with emergency blankets – later moving their equipment to an anechoic chamber at OSPL, an environment essentially free of external signals and most reflections of internal signals.

“We use a discone antenna (also seen below) to measure omnidirectionally with a very wide frequency range,” Ramsay and Lohuis concluded. “Even with our <€200 (excluding antenna) recording setup we are able to successfully attack the Pynq board from 1 m distance. This is possible with 5 minutes of recording time which captures ≈2.4 million traces. This result shows that, under ideal conditions, attacks from 1 m are definitely possible.”

It should be noted that Rambus’ security division originally discovered and published side-channel analysis in the 1990s and has also demonstrated side-channel attacks in recent years.  EM side-channel work by Rambus’ security division include analysis of mobile phones and analysis of a complex system-on-chip.