DPA Countermeasures

During the early days of safecracking, rudimentary rotary locks were compromised by feel or sound to determine the correct combination. Following in this tradition, cyber criminals and other malicious actors are now exploiting side-channel attacks (SCA) to compromise cryptographic systems.

To be sure, all physical electronic systems routinely leak information about the internal process of computing via fluctuating levels of power consumption and electro-magnetic emissions. Much like traditional safecracking, electronic side-channel attacks eschew a brute force approach to extracting keys and other secret information from a device or system.

SCA conducted against electronic devices and systems are non-intrusive, relatively simple and inexpensive to execute. Side-channel attacks comprise a wide range of techniques including Differential Power Analysis (DPA), Simple Power Analysis (SPA), Simple Electromagnetic Analysis (SEMA), Differential Electromagnetic Analysis (DEMA), Correlation Power Analysis (CPA) and Correlation Electromagnetic Analysis (CEMA).

Because all physical electronic systems routinely leak information, an effective layer of side-channel countermeasures should be implemented via hardware (DPA resistant cores), software (DPA resistant software libraries) or both. Countermeasures – including leakage reduction, noise introduction, obfuscation and the incorporation of randomness – are critical to ensuring the protection of sensitive keys and data. It should be noted that stand-alone noise introduction is incapable of sufficiently masking side-channel emissions.

Indeed, DPA conducted against a device can effectively bypass stand-alone noise countermeasures, ultimately allowing the signal to be isolated. After layered countermeasures have been implemented, systems should be carefully evaluated with a Test Vector Leakage Assessment (TVLA) platform such as the Rambus DPA Workstation (DPAWS) to confirm the cessation of sensitive side-channel leakage.

More specifically, DPAWS measures a range of side-channel attacks across a wide spectrum of devices and platforms including smart phones, tablets, POS terminals, CPUs, TVs, set-top boxes, FPGAs, smart cards and NFC tech. DPAWS provides users with a highly-intuitive UI paired with enhanced data visualization that creates an integrated, project-centric analytic environment specifically designed to optimize the efficiency of side-channel analysis.

Both flexible and scalable, DPAWS supports multiple side-channel sensors, device protocols and form factors, with out-of-the-box support for SASEBO and additional third-party hardware. DPAWS also easily integrates with a wide range of industry tools including Matlab, Python and other scripting languages. Moreover, the Rambus DPA Workstation supports full cipher coverage (AES, RSA, ECC, DES and SHA), large dataset handling, as well as high-speed collection and analysis of billions of traces. Source code is also available to facilitate increased flexibility.

Interested in learning more about protecting electronic systems from side-channel attacks? You can download our eBook on the subject below.

Michael Mehlberg, a senior director of business development at Rambus’ security division, recently wrote an article for Intelligent Aerospace about the importance of protecting military equipment – including avionics and electronics – from tampering, reverse engineering and cryptanalysis.

“While cyber-warfare has become increasingly sophisticated in recent years, side-channel attacks conducted against sensitive electronic gear are relatively simple to execute and can be performed with less than $5,000 of standard lab equipment,” he explained.

SPA illustration. Image Credit: Rambus Security Division (via “Introduction to Differential Power Analysis”)

“Such attacks include Simple Power Analysis (SPA) and Differential Power Analysis (DPA). These noninvasive techniques analyze power consumption while a device is performing routine operations with secret keys and algorithms.”

While no single countermeasure can effectively secure a system against all threats, Mehlberg says a layered approach that includes resistance against SPA and DPA attacks should be integrated into critical electronic systems.

“Military equipment and platforms may have evolved significantly since Soviet scientists reverse-engineered the Sidewinder missile in 1958 and North Korean soldiers boarded the Pueblo in 1968,” he continued. “Nevertheless, the threat of total mission compromise remains a clear and present danger, especially in close proximity to hostile territory. Indeed, equipment deployed at forward operating bases (FOBs) is particularly vulnerable.”

USS Pueblo. Image Credit: U.S. Navy Naval History and Heritage Command (via Wikipedia)

To be sure, although FOBs are routinely supported by Main Operating Bases, adverse conditions may act to temporarily delay resupply and reinforcements. Smaller Cooperative Security Locations (CSLs) – aka “lily pads” – face similar logistical difficulties as well. In addition, CSL personnel may be instructed to follow strict security protocols that effectively limit both incoming and outgoing communications. Therefore, says Mehlberg, it is critical for warfighters to be equipped with secure electronic equipment before they are deployed to FOBs and CSLs.

“As is the case with many deployed electronic systems, developers and systems integrators must take care to protect important equipment against unauthorized access in the event of a battlefield loss,” he elaborated. “Electronic communications equipment is of particular interest to those who may wish to intercept battlefield transmissions and should be specifically secured against unauthorized access of any kind.”

Forward Operating Base Logar, Afghanistan. Image Credit: U.S. Army (via Wikipedia) 

More specifically, portable electronics, communications gear and “leave-behind” equipment are the most vulnerable to exploitation and could potentially allow hostile forces to eavesdrop on military communications and forge command-and-control messages. Therefore, equipment that employs cryptography to protect the sensitive transmission of data should be capable of resisting various forms of side-channel attacks, including DPA and SPA.

“These powerful, non-invasive attacks can be exploited by hostile elements to allow the unauthorized extraction of secret cryptographic keys, potentially revealing classified data. In fact, most tamper-resistant devices and cryptographic algorithms are susceptible to such attacks if they do not include countermeasures. Perhaps not surprisingly, general-purpose silicon – such as FPGAs and ASICs – receive more attacker attention because they are easier to acquire,” he added.

Interested in learning more about protecting military equipment from side-channel attacks? The full text of “Protecting military electronics, avionics from side-channel attacks,” is available on Intelligent Aerospace here. You can also check out our DPA countermeasures product page here.

Rambus security researchers have successfully conducted a side-channel assisted cryptanalysis attack against QcBits, a code-based public key algorithm based on a problem thought to be resistant to quantum computer attacks. QcBits – pronounced “quick-bits” – is a variant of the McEliece public-key cryptosystem based on quasi-cyclic (QC) moderate density parity check (MDPC) codes.

According to Rambus Security technical director Mark E. Marson, the attack only required researchers to observe a relatively small number of decryptions – approximately 200 power traces for the analyzed implementation. Moreover, less than 1% of each trace needed to be analyzed. As Marson told Rambus Press, the side-channel attack comprised two steps. The first, a Differential Power Analysis (DPA) attack, targeted the syndrome computation of the decryption operation.

“The operation used half of the private key. During this step, we recovered some information about that half of the key,” Marson explained. “Because of the way in which the implementation leaks, there was some ambiguity as to the exact location of the nonzero elements of the key.”

The second step was based on a linear algebra computation which exploited the sparseness of the private key and succeeded with high probability.

“We repeated this operation – varying the equations slightly each time – until the computation succeeded,” Marson elaborated. “This allowed us to recover the entire secret key.”

In a detailed paper that was presented at CHES 2017, the Rambus security team proposed a simple masking technique to help defend against future side-channel attacks targeting QcBits during the syndrome calculation process. Essentially, since QC-MDPC codes are linear, the XOR of two codewords is another codeword. In addition, all codewords are in the nullspace of the parity check matrix. As such, the corrupted codeword can be masked by XORing it with a random codeword – before passing it to the syndrome computation.

Importantly, the above-mentioned technique does not alter the outcome of the syndrome calculation, although it does effectively mask the DPA leak exploited by researchers. It should also be noted that this countermeasure is only effective during the syndrome calculation. Additional side-channel countermeasures are required to protect the private key during other calculations such as the bit flipping algorithm.

“Many proposals for post-quantum cryptography are based on noisy linear systems: lattices, learning with errors or error-correcting codes. In terms of side-channel resilience, these systems have an important difference from systems based on number-theoretic problems,” Marson added. “Leaking a few bits of a number-theoretic system may open up a new avenue of attack, but it usually doesn’t directly contribute to solving the underlying hard problem. For noisy linear systems, leaking a few bits of the secret is likely to directly erode the difficulty of the underlying hard problem. As such, designers may wish to consider the risks of side-channel analysis when evaluating post-quantum cryptographic algorithms.”

As we’ve previously discussed on Rambus Press, all cryptographic systems routinely leak information about the internal process of computing. In practical terms, this means attackers can exploit various techniques to extract the key and other secret information from a target device. This vector is known as side-channel attacks, which are commonly referred to as SCA.

Put simply, side-channel attacks monitor power consumption and electro-magnetic emissions while a device is performing cryptographic operations. Side-channel attacks conducted against electronic devices and systems are relatively simple and inexpensive to execute. This means attackers can exploit various side-channel techniques to gather data and extract secret cryptographic keys. As all physical electronic systems leak information, effective side-channel countermeasures should be implemented at the design stage to ensure protection of sensitive keys and data.

Interested in learning more about how Rambus security researchers cracked a post-quantum ‘QcBits’ cipher with side-channel power analysis? The full text of “A Side-Channel Assisted Cryptanalytic Attack Against QcBits,” written by Melissa Rossi, Mike Hamburg, Michael Hutter and Mark E. Marson is available for download here.

Be sure to stay tuned for more news about Rambus Security and our post-quantum cryptography projects, such as the quantum-resistant public-key cryptographic algorithms that we are preparing to submit to the National Institute of Standards and Technology (NIST).

In a recently published paper, security researchers built a miniature system capable of covertly recovering encryption keys using side-channel analysis. Fox-IT’s Craig Ramsay and Jasper Lohuis collaborated with Riscure to perform this analysis against two realistic AES-256 implementations. Specifically, the attacks were conducted using an improved antenna and signal processing equipment that cost less than €200 and fit into a jacket pocket. Moreover, the entire operation spanned five minutes at a distance of one meter, dropping down to a quick 50 seconds for 30 cm.

“Some things are just inherent to electronic products. TEMPEST leakage is one of them. This holds true for any appliance — whether programmed in JavaScript, C, or even a custom hardware design. Everything is eventually run on hardware (a.k.a. electronics),” Ramsay and Lohuis explained. “So, running an algorithm will produce some fluctuating magnetic field. There is often nothing preventing us from measuring this EM radiation from close by, or even covertly from a distance. In fact, this is a technique which is relied upon in all wireless communication. All FM radio, WiFi, and GSM communications work by deliberately exploiting this. TEMPEST attacks measure this field from a distance and extract useful information from it.”

For the attack executed at 30 cm, Fox-IT targeted the ARM Cortex-M3 core powering the SmartFusion2 SoC. Security researchers used a small magnetic loop antenna, an external amplifier and bandpass filters, as well as a €20 USB RTL-SDR USB dongle for data recording. (The researchers also worked with SR-7100 and USRP B200 data recorders). Preprocessing, first extracted one large recording from the radio, then detected where each encryption block started and split the recording up into single encryption blocks. Subsequent analysis was performed by correlating between key byte guesses and the recorded traces to retrieve the secret key.

“[On the] SmartFusion2 target, the leakage seems to largely originate from the AHB bus connecting the Cortex-M3 to the on-chip memories. We can correlate on the addresses of the T table lookups to attack the key,” Ramsay and Lohuis explained. “We count the number of bits which transition between two sequential addresses on the bus (i.e. Hamming distance). This suggests that the bus logic briefly short-circuits when transitioning.”

Image Credit: Fox-IT

The plot above shows the correlation traces for all 256 guesses of a key byte using the Fox-IT address line model. As the image illustrates, the correct byte does indeed provide the highest spike, meaning the key (byte by byte) can be recovered using only measurements and the input data.

To perform the TEMPEST attack at a distance, security researchers switched to a more directional PCB log-periodic antenna that targeted a Pynq board.

“The software is still the same, we still attack the bus between ARM core and memory, but we can clock the memory at 400 MHz,” Ramsay and Lohuis continued. “We find switching to the new board surprising easy. Although the memory clock is ≈3 times faster (or effectively ≈6 as we now use DDR), we can still attack the Pynq board with the bandwidth supported by the RTL-SDR.”

For the next stage of the TEMPEST side-channel attack project, the researchers built a shielded chamber to reduce the effect of external signals using two boxes wrapped with emergency blankets – later moving their equipment to an anechoic chamber at OSPL, an environment essentially free of external signals and most reflections of internal signals.

“We use a discone antenna (also seen below) to measure omnidirectionally with a very wide frequency range,” Ramsay and Lohuis concluded. “Even with our <€200 (excluding antenna) recording setup we are able to successfully attack the Pynq board from 1 m distance. This is possible with 5 minutes of recording time which captures ≈2.4 million traces. This result shows that, under ideal conditions, attacks from 1 m are definitely possible.”

It should be noted that Rambus’ security division originally discovered and published side-channel analysis in the 1990s and has also demonstrated side-channel attacks in recent years.  EM side-channel work by Rambus’ security division include analysis of mobile phones and analysis of a complex system-on-chip.

Semiconductor Engineering’s Ann Steffora Mutschler has written an in-depth article that explores the issue of transient power at 10/7nm. According to Mutschler, transient power adds yet another level of complexity for design teams already wrestling with power issues caused by leakage, a variety of power management techniques to control dynamic power and leakage current.

“At each new node there is less headroom for engineering teams to address these problems, and more likelihood that what they do in one area will affect another,” she explained.

“Threshold voltages already are pushing the limit, design margins are shrinking, and a push toward greater heterogeneity means more devices with their own power requirements are being crammed into these designs. Transient power is one more factor to deal with, and it adds to the collective problems of power and signal integrity.”

Mutschler also noted that concerns about security further complicate matters at 10/7nm, with side-channel attacks presenting a danger to chip designers. Preventing this type of breach, says Mutschler, requires an understanding of transient power – skill sets that normally don’t go together.

“Designers need to analyze the transient power waveform for a variety of usage scenarios to make sure that their chip will not be susceptible to side-channel attacks,” Andy Ladd, president and CEO of Baum, told Semiconductor Engineering. “In all of these cases, fast and accurate transient power analysis is key to optimizing and validating the design.”

As we’ve previously discussed on Rambus Press, side-channel attacks monitor power consumption and electro-magnetic emissions while a device is performing cryptographic operations. Side-channel attacks conducted against electronic devices and systems are relatively simple and inexpensive to execute. This means attackers can exploit various side-channel techniques to gather data and extract secret cryptographic keys.

In addition to implementing side-channel countermeasures, it is recommended that system and device designers evaluate resistance to side-channel attacks – including SPA, DPA, HO-DPA and EMA – before a product is brought to market. Platforms such as the DPA Workstation (DPAWS) measure a variety of side-channel attacks across a wide number of devices and platforms including smart phones, tablets, POS terminals, CPUs, TVs, set-top boxes, FPGAs, smart cards and NFC tech.

DPAWS provides users with a highly-intuitive UI paired with enhanced data visualization that creates an integrated, project-centric analytic environment specifically designed to optimize the efficiency of side-channel analysis. Both flexible and scalable, DPAWS easily integrates with a wide range of industry tools such as Matlab, as well as Python and other scripting languages. The DPA Workstation also supports full cipher coverage (AES, RSA, ECC, DES and SHA), large dataset handling, as well as high-speed collection and analysis of billions of traces.

Interested in learning more about side-channel attacks? You can check out our eBook on the subject below.

hbspt.cta.load(418219, ’92dae1e8-d934-4cb9-bfd5-72a97f34cb5d’, {});

Rambus has joined Microsemi Corporation’s System-on-Chip (SoC) Partner Program. This means Microsemi field programmable gate array (FPGA) customers can now select advanced security solutions developed by Rambus to protect against side-channel attacks for highly-sensitive markets, including aerospace and avionics.

The Partner Program agreement includes all differential power analysis (DPA) solutions developed by Rambus – including its DPA Resistant cryptographic cores and DPA Resistant software libraries. As part of Microsemi’s SoC Partner Program, Rambus will join other independent providers in providing FPGA design services and embedded software/hardware products supporting Microsemi devices. The program provides engineers with access to additional design resources, expertise and products from Microsemi’s network to enable faster time to market.

According to Eric Spanneut, vice president of the Rambus Security Division, Microsemi and Rambus have collaborated on security technology for several years. In addition, Microsemi was an early licensee of Rambus’ security offerings.

“Customers now have an option to add our proven security solutions into Microsemi FPGAs to mitigate the threat of DPA—a significant vulnerability in chip security facing multiple end markets, including mission-critical applications found in government and military settings,” he explained. “We are excited to team with Microsemi to deliver the right products, tools and services to keep customer products secure.”

Bruce Weyer, vice president and business unit manager at Microsemi, expressed similar sentiments.

“With the threat of side-channel attacks and other cybersecurity threats on the rise, our relationship with Rambus allows customers to inherently protect their valuable design intellectual property (IP), sensitive data and embedded systems, and ensures the rigorous security requirements of our defense, communications and industrial customers are being met,” he stated. “We look forward to an ongoing collaboration with Rambus so we can jointly deliver proven security solutions to our customers.”

As we’ve previously discussed on Rambus Press, Differential Power Analysis is a form of side-channel attack that monitors variations in the electrical power consumption or electro-magnetic emissions of a target device. The basic method involves partitioning a set of traces into subsets, then subsequently computing the difference of the averages of these subsets. Given enough traces, extremely minute correlations can be isolated—no matter how much noise is present in the measurements.

Image Credit: Rambus Security Division (via “Introduction to Differential Power Analysis”)

A typical DPA attack comprises 6 primary stages: communicating with a target device; recording power traces while the target device performs cryptographic operations; signal processing to remove errors and reduce noise; prediction and selection function generation to prepare and define for analysis; as well as computing the averages of input trace subsets and evaluating DPA test results to determine the most probable key guesses. Additional DPA variants include reverse engineering unknown S-boxes and algorithms, correlation power analysis (CPA), probability distribution analysis, high-order DPA and template attacks.

Specific DPA countermeasure techniques include decreasing the signal-to-noise ratio of the power side channel by reducing leakage (signal) or increasing noise, for example, by making the amount of power consumed less contingent upon data values and/or operation (balancing); introducing amplitude and temporal noise; incorporating randomness with blinding and masking by randomly altering the representation of secret parameters and implementing protocol-level countermeasures by continually refreshing and updating cryptographic protocols used by a device.

It should be noted that Rambus has licensed a range of DPA countermeasures to a number of prominent corporations such as Boeing, NVIDIA, Idaho Scientific, The Athena Group, Thales E-Security, NAGRA and Winbond.

Interested in learning more? You can check out our DPA countermeasures product page here.