Active and Passive Side-Channel

Key Recovery Attacks on Ascon

Keyvan Ramezanpour 1,2

Abubakr Abdulgadir 3

William Diehl 1

Jens-Peter Kaps 3

Paul Ampadu 2

1 Signatures Analysis Laboratory (SAL), Virginia Tech, Blacksburg, VA 24060

2 Multifunction Integrated Circuits and Systems Group (MICS), Virginia Tech, Blacksburg, VA 24060

3 Cryptographic Engineering Research Group (CERG), George Mason University, Fairfax, VA 22033

October 19-21, 2020

NIST Lightweight Cryptography Workshop 2020

Outline

Introduction to side-channel analysis (SCA)

Attack setup for active and passive SCA

Key recovery attacks on Ascon

Active SCA with Voltage Glitch on FPGA

Passive SCA with power measurements on FPGA

Results

Conclusions

2

Introduction

3

Security in Internet-of-Things (IoT)

Authenticated ciphers are trending for lightweight applications;

Confidentiality, data integrity and authentication with single algorithm.

Possible lower overhead of security protocol implementation in hardware/software.

NIST LWC Competition:

Assessing security of candidates for lightweight cryptography (LWC) and Hash functions, and

Robustness of the implementations (and ease of inclusion of countermeasures) against side-

channel analysis (SCA).

Ascon authenticated cipher:

The first choice of CAESAR committee for lightweight use case (Feb. 2019).

Selected as a candidate for the second round of NIST LWC Competition.

We demonstrate vulnerability of Ascon to both active and passive SCA attacks.

4

Side-Channel Analysis (SCA)

Physical Implementation of cryptographic algorithms leak secret

information

Side-channel analysis (SCA) exploits runtime signatures to infer secret

information.

Two categories of SCA analysis:

1. Passive SCA: measure signals and correlate with secret;

Power Analysis (PA) and electromagnetic (EM) Analysis;

Power consumption of device is correlated with processed (secret) data.

2. Active SCA: induce a stimulus and observe data-dependent behavior;

Fault Injection Analysis (FIA): inject fault during execution with known properties;

• Only correct key guess exhibits expected fault properties.

5

Key Recovery with SCA

6

S1 f1(S1, K) S2 f2(S2, K) Snfn-1(Sn-1, K) fn(Sn, K) C. . .

X: Intermediate Variable (subset of Sn)Si: State at each roundK: Secret Key

Input &Initial conditions Output

Passive SCA:

Power Analysis (PA)

7

Algorithmic-level vulnerability:

A subset of key K is sufficient to calculate intermediate variable X from input or output.

Implementation-level vulnerability:

Power consumption during execution correlated with data.

X

Leakage

model

The computation results correlated with observations.

Attack location

Calculate X using:

1. Inverse fn

2. Subset of secret key K

S1 f1(S1, K) S2 f2(S2, K) Snfn-1(Sn-1, K) fn(Sn, K) C. . .

X: Intermediate Variable (subset of Sn)Si: State at each roundK: Secret Key

Input &Initial conditions Output

Active SCA:

Fault Injection Analysis (FIA)

8

X

Leakage

model

Calculate X using:

1. Inverse fn

2. Subset of secret key K

Fault

injection

Intermediate variable X

Algorithmic-level vulnerability:

A subset of key K is sufficient to calculate intermediate variable X from input or output.

Implementation-level vulnerability:

Data distribution under fault injection is different from max-entropy distribution.

Intermediate variable X

Ascon Authenticated Cipher

9

Diffusion (matrix notation):

a r

ou

nd

s o

f

per

mu

tati

on

x 0x 1

x 2x 3

x 4r

c

0*||k

b r

ou

nd

s o

f

per

mu

tati

on

A1

b r

ou

nd

s o

f

per

mu

tati

on

As

. . .

. . . c

r

c

0*||1

P1

r

C1

b r

ou

nd

s o

f

per

mu

tati

on

. . .

. . .

Pt-1 Ct-1

r

c

b r

ou

nd

s o

f

per

mu

tati

on

Pt Ct

r

c

k||0*

c

a r

ou

nd

s o

f

per

mu

tati

on

r

k

T

64

64

64

64

64

320

IV||k||N

x 0x 1

x 2x 3

x 4

Initialization Associated Data Plaintext Finalization

{A1, , As}: Blocks of associated data

{P1, , Pt}: Blocks of plaintext

{C1, , Ct}: Blocks of ciphertextk: 128-bit secret key

IV: Initial Vector N: Nonce T: 128-bit tag

SCA Attack Setup

10

SCA Attack on Ascon

a r

ou

nd

s of

per

mu

tati

on

x 0x 1

x 2x 3

x 4

r

c

0*||kb

rou

nd

s of

per

mu

tati

on

A1

b r

ou

nd

s of

per

mu

tati

on

As

. . .

. . . c

r

c

0*||1

P1

r

C1

b r

ou

nd

s of

per

mu

tati

on

. . .

. . .

Pt-1 Ct-1

r

c

b r

ou

nd

s of

per

mu

tati

on

Pt Ct

r

c

k||0*

c

a r

ou

nd

s of

per

mu

tati

on

r

K

T

64

64

64

64

64

320IV||K||N

x 0x 1

x 2x 3

x 4

Initialization Associated Data Plaintext Finalization

Fault AttackPower Attack

11

Vulnerability to fault attack (active SCA):

Addition of secret key at the end of Finalization for authentication tag generation.

Vulnerability to power attack (passive SCA):

Initialization of cipher state with secret key at the beginning of Initialization Stage.

Attack Setup

12

FOBOS: Flexible Open-source workBench fOr Side-channel analysis.

Target board (under attack):

Artix-7 FPGA executing Ascon.

Control board:

Data, configuration and synchronization.

Power attack:

PicoScope 5000 measuring power

consumption of target FPGA chip.

Fault attack:

Single-pole double-thru (SPDT) analog

switch for switching VDD of target FPGA

chip.

Fault Attack on Ascon (Active SCA)

13

Statistical Ineffective

Fault Analysis (SIFA)

Intermediate Variable

Intermediate variable X

with fault injection

w/o fault injection

Inspect distribution of

(correct) data under

fault injection

• Inject fault at last round of finalization.

• Collect multiple outputs (tags) for random inputs.

• Requires only correct outputs. (successful even if countermeasures suppress faulty values.)

• For every key guess:1. Calculate the output of Sbox pairs under

attack.2. Find the distribution of calculated data.3. Calculate the SEI* of data distribution.

• Key guess with highest SEI is the correct key.

*SEI: Square Euclidean Imbalance

K. Ramezanpour, P. Ampadu, and W. Diehl, "A Statistical Fault Analysis Methodology for the Ascon Authenticated Cipher," HOST 2019.

K. Ramezanpour, P. Ampadu, and W. Diehl, "FIMA: Fault Intensity Map Analysis," COSADE’19. Springer, Cham, 2019.

SIFA Attack on Ascon

with Voltage Glitch

. . .

0 1 63

SBox

Diffload Input layer load output layer

64 cycles 6 cycles64 cycles

134 cycles

1 round

AppRegion of Fault Effect in Finalization Round 1

Glitch Period:

5 Cycles @ 10 MHz Attack on S-box 0

Operating voltage: ~ 0.75 V

Glitch voltage: ~ 0.51 V

15

Set operation conditions at high frequency/low voltage corner.

Our setup: Artix-7 FPGA executing Ascon with VDD=0.75V @ 10 MHz without errors.

Reducing VDD to 0.51V (with SPDT switch) results in desired fault effect.

Power Attack on Ascon (Passive SCA)

16

Power Attack on Ascon

17

Cipher state initialized with initial vector (IV), secret key and nonce.

Nonce values are known in the proposed power attack.

Bit-sliced implementation of S-box with one S-box operation at every clock cycle

(lightweight implementation).K. Ramezanpour, P. Ampadu, and W. Diehl, "SCAUL: Power Side-Channel Analysis with Unsupervised Learning," arXiv preprint

arXiv:2001.05951 (2020).

Clustering-based PA Techniques

18

Available information:

A set of power traces with the corresponding input data (nonce values in Ascon).

A leakage model describing the relationship between power traces and intermediate variable.

Intermediate variable can be calculated from the input data and a subset of secret key.

Clustering-based PA Techniques

19

For every key candidate:

1. Calculate intermediate variable corresponding to all power traces.

2. Calculate the value of the leakage model using the intermediate variables.

3. Cluster power traces in which similar power traces exhibit similar leakage values.

4. Calculate the difference between a statistics (e.g. mean in 1st order SCA) of power traces in clusters.

5. The inter-cluster difference of the statistics is the measure for ranking key candidates.

Side-Channel Analysis with

Reinforcement Learning (SCARL)

Measurements

(auto-encoder features)

policy

actor

...

Clu

ster

1C

lust

er 2

...

environment

?

20

State: inter-cluster difference

Reward:

Max

difference

Even

assignment

Leakage model (generic):

Estimated leakage for every key

candidate:

Low-order leakage:

𝑙𝑗

K. Ramezanpour, P. Ampadu, and W. Diehl, "SCARL: Side-Channel Analysis

with Reinforcement Learning on the Ascon Authenticated Cipher," arXiv

preprint arXiv:2006.03995 (2020).

Results

21

Results of Voltage Glitch on Ascon

22

Intermediate Value: 2 least significant bits at output of S-box under attack.

Bias of intermediate values with fault locations at S-boxes 3 & 4:

S-box 2

S-box 3

S-box

SE

I

# encryptions = 20 K

Voltage glitch

Intermediate

Variable

Key Recovery with Voltage Glitch

23

# Correct Tags

# Encryptions

Incorrect Keys

Correct Key

# en

cryp

tio

ns:

12

,00

0#

corr

ect

tag

s: 2

80

Correct key identified

SE

I

Classical PA Attacks on Ascon

24

Differential power analysis (DPA) and correlation power analysis (CPA) with two different

leakage models:

Hamming weight (Hw) and most significant bit (MSB) of intermediate variable (S-box output)

correlated with power traces.

Both techniques fail to detect the correct key with 40K traces.

SCARL Attack on Ascon

25

0 50 100 150

Power Features

0

0.005

0.01

0.015

0.02

Inte

r-cl

ust

er D

iffe

ren

ce

0

0.1

0.2

0.3

0.4

0.5

Inte

r-cl

ust

er D

iffe

ren

ce

Correct Key

Incorrect KeyRL Inter-cluster Diff

(a) Inter-cluster difference

0.5 1 1.5 2 2.5 3

Number of encryptions 104

0

0.01

0.02

0.03

0.04

0.05

0.06

Ra

nk

# e

ncr

yp

tion

s =

24K

Correct key

(b) Rank vs. data size

SCARL attack based on deep learning able to recover the secret key with 24K traces.

Conclusions

Protection of cryptographic hardware implementations is critical for security.

Algorithmic properties and implementation vulnerability of ciphers are exploited in

side-channel analysis to recover the Ascon secret key.

Addition of secret key for tag generation exploited in fault injection attack.

Initialization of the cipher state with secret key exploited in power attack.

Voltage glitch on FPGA implementation of Ascon induces significant bias into the S-

box outputs which is exploited in a fault attack.

Reinforcement learning technique more efficient than DPA or CPA.

26

Thank you!

27