information security – theory vs. realitytromer/istvr1516-files/lecture6-pc... · 2020. 2....
TRANSCRIPT
![Page 1: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/1.jpg)
1
Information Security – Theory vs. Reality
0368-4474, Winter 2015-2016
Lecture 6:Physical Side Channel Attacks on PCs
Guest lecturer:Lev Pachmanov
![Page 2: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/2.jpg)
2
Side channel attacks
electromagnetic acoustic
probing
opticalpower
CPUarchitecture
chassis potential
![Page 3: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/3.jpg)
3
Traditional side channel attacks methodology
1. Grab/borrow/steal device2. Find key-dependent instruction3. Record emanations using
high-bandwidth equipment(> clock rate , PC: >2GHz)
4. Obtain traces5. Signal and cryptanalytic analysis 6. Recover key
for i=1…2048sqr(…)if key[i]=1
mul(…)
Hard for PCs
![Page 4: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/4.jpg)
4
1. Grab/borrow/steal device2. Find key-dependent instruction3. Record emanations using
high-bandwidth equipment(> clock rate , PC: >2GHz)
4. Obtain traces5. Signal and cryptanalytic analysis 6. Recover key
Traditional side channel attacks methodology
Hard for PCs
![Page 5: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/5.jpg)
5
1. Grab/borrow/steal device2. Find key-dependent instruction3. Record emanations using
high-bandwidth equipment(> clock rate , PC: >2GHz)
4. Obtain traces5. Signal and cryptanalytic analysis 6. Recover key
Traditional side channel attacks methodology
Hard for PCs
Not handed out
vs.
Measuring a 2GHz PC requires expansive and bulky equipment (compared to a 100 MHz smart card)
vs.
100,000$
1,000$
Complex electronicsrunning complicated software (in parallel)
vs.
![Page 6: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/6.jpg)
6
• Channels for attacking PCs– Ground potential (chassis and others)– Power– Electromagnetic– Acoustic
• Exploited via low-bandwidth cryptanalytic attacks– Adaptive attack (50 kHz bandwidth) [Genkin Shamir Tromer ‘14]
– Non-adaptive attacks (1.5 MHz bandwidth)[Genkin Pipman Tromer ‘14] [Genkin Pachmanov Pipman Tromer ‘15]
• Common cryptographic software– GnuPG 1.4.13-1.4.16 (CVE 2013-4576, 2014-3591, 2014-5270)
– RSA and ElGamal, various implementations– Worked with GnuPG developers
to mitigate the attacks
• Applicable to various laptop models
Our results
![Page 7: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/7.jpg)
7
Chassis-potential channel
![Page 8: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/8.jpg)
8
Ground-potential analysis• Attenuating EMI emanations
“Unwanted currents or electromagnetic fields? Dump them to the circuit ground!”(Bypass capacitors, RF shields, …)
• Device is grounded, but its “ground” potential fluctuates relative to the mains earth ground.
Computationaffects currents and EM fieldsdumped to device groundconnected to conductive chassis
Key = 101011…
![Page 9: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/9.jpg)
9
Connecting to the chassis
![Page 10: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/10.jpg)
10
Demo: distinguishing instructions
Key = 101011…
![Page 11: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/11.jpg)
11
Distinguishing various CPU operationsfrequency (2-2.3 MHz)
time
(10
sec)
![Page 12: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/12.jpg)
12
Low-bandwidth leakage of RSA
![Page 13: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/13.jpg)
13
Definitions (RSA)
Key setup
• sk: random primes 𝑝𝑝, 𝑞𝑞,
private exponent 𝑑𝑑
• pk: 𝑛𝑛 = 𝑝𝑝𝑞𝑞, public
exponent 𝑒𝑒
Encryption𝑐𝑐 = 𝑚𝑚𝑒𝑒 mod 𝑛𝑛
Decryption
𝑚𝑚 = 𝑐𝑐𝑑𝑑 mod 𝑛𝑛
A quicker way used by most implementations
𝑚𝑚𝑝𝑝 = 𝑐𝑐𝑑𝑑𝑝𝑝 mod 𝑝𝑝𝑚𝑚𝑞𝑞 = 𝑐𝑐𝑑𝑑𝑞𝑞 mod 𝑞𝑞
Obtain 𝑚𝑚 using Chinese Remainder Theorem
![Page 14: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/14.jpg)
14
mod 𝑝𝑝
mod 𝑞𝑞
GnuPG RSA key distinguishability
frequency (1.9-2.4 MHz)
time
(0.8
sec
)
Can distinguish between:1. Decryptions and other operations2. Two exponentiations (mod 𝑝𝑝, mod 𝑞𝑞)3. Different keys 4. Different primes
![Page 15: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/15.jpg)
15
Key extraction
![Page 16: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/16.jpg)
16
GnuPG modular exponentiationmodular_exponentiation(c,d,p){m=1for i=n to 1 dom = m2 mod pt = m*c mod p //always multif d[i]==1 thenm=t
return m
}
m = 𝑐𝑐𝑑𝑑𝑛𝑛⋯𝑑𝑑𝑖𝑖+1 𝑚𝑚𝑚𝑚𝑑𝑑 𝑝𝑝
m = 𝑐𝑐𝑑𝑑𝑛𝑛⋯𝑑𝑑𝑖𝑖+10 𝑚𝑚𝑚𝑚𝑑𝑑 𝑝𝑝
𝑡𝑡 = 𝑐𝑐𝑑𝑑𝑛𝑛⋯𝑑𝑑𝑖𝑖+11 𝑚𝑚𝑚𝑚𝑑𝑑 𝑝𝑝
m = 𝑐𝑐𝑑𝑑𝑛𝑛⋯𝑑𝑑𝑖𝑖 𝑚𝑚𝑚𝑚𝑑𝑑 𝑝𝑝
Q: Why always compute 𝑡𝑡 ← 𝑚𝑚 ⋅ 𝑐𝑐 then conditionally copy?A: This is a side channel countermeasure meant to protect 𝑑𝑑
no key dependent operation to measure
![Page 17: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/17.jpg)
17
GnuPG modular exponentiationmodular_exponentiation(c,d,p){m=1for i=n to 1 dom = m2 mod pt = m*c mod p //always multif d[i]==1 thenm=t
return m
}
𝑚𝑚 depends on both 𝑑𝑑[𝑖𝑖] and 𝑐𝑐
𝑚𝑚 is squard in next iteration of the main loop
craft 𝑐𝑐 to affect the squaring in the next loop iteration, based on 𝑑𝑑[𝑖𝑖]
measure changes inside squaring operation and
obtain 𝑑𝑑[𝑖𝑖]
2GHz CPU speed vs. 1.5MHz measurements
can only see drastic changes inside squaring operation
Idea: leakage self-amplificationabuse algorithm’s own code to amplify its own leakage!1. Craft suitable cipher-text to affect the inner-most loop 2. Small differences in repeated inner-most loops cause a
big overall difference in code behavior
![Page 18: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/18.jpg)
18
Non-adaptive key extraction (similar to [Yen, Lien, Moon and Ha 05])
modular_exponentiation(c,d,p){m=1for i=n to 1 dom = m2 mod pt = m*c mod p //always multif d[i]==1 thenm=t
return m
}
karatsuba_sqr( m ){…basic_sqr( x )…
}
basic_sqr( x ){…
}
if( x[j]==0)y = 0else y = x[j]*x
If 𝒅𝒅 𝒊𝒊 == 𝟏𝟏 then 𝑚𝑚 ≡ −1 (mod 𝑝𝑝)so bits of 𝒎𝒎 are “random”.
If 𝒅𝒅 𝒊𝒊 == 𝟎𝟎 then 𝑚𝑚 ≡ 1 (mod 𝑝𝑝)so bits of 𝒎𝒎 have many zeros.
0/$
𝑐𝑐 ≡ −1 (mod 𝑝𝑝)
𝑚𝑚 ≡ 1 (mod 𝑝𝑝)
𝑡𝑡 ≡ −1 (mod 𝑝𝑝)
x7
Many zeros orrandom looking,based on 𝑑𝑑[𝑖𝑖]
x27
±1𝑚𝑚 ≡ ±1
𝑚𝑚 ≡ 1
𝑚𝑚 ≡ −1
repeated 189 times per bit of 𝑑𝑑
~0.2ms of measurement per bit of 𝑑𝑑
![Page 19: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/19.jpg)
19
Non-adaptive ciphertext choice 𝑐𝑐 ≡ −1 mod 𝑝𝑝(similar to [YLMH05]):− RSA: 𝑐𝑐 = 𝑁𝑁 − 1− ElGamal: 𝑐𝑐 = 𝑝𝑝 − 1
Overall attack performance: Algorithm Attack type # ciphertexts Time BW Cipher RefSqr-and-always-mlt
Non-adaptivechosen ciphertext
1 3 sec 2 MHz ElGamal,RSA
[GPT14]
A chosen ciphertext attack
![Page 20: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/20.jpg)
20
Non-adaptive ciphertext choice 𝑐𝑐 ≡ −1 mod 𝑝𝑝(similar to [YLMH05]):− RSA: 𝑐𝑐 = 𝑁𝑁 − 1− ElGamal: 𝑐𝑐 = 𝑝𝑝 − 1
Overall attack performance: Algorithm Attack type # ciphertexts Time BW Cipher RefSqr-and-always-mlt
Non-adaptivechosen ciphertext
1 3 sec 2 MHz ElGamal,RSA
[GPT14]
Sliding / fixed window
Non-adaptivechosen ciphertext
2𝑤𝑤−1 (usually 8 or 16)
30 sec 2 MHz ElGamal,RSA
[GPPT15]
A chosen ciphertext attack
![Page 21: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/21.jpg)
21
Non-adaptive ciphertext choice 𝑐𝑐 ≡ −1 mod 𝑝𝑝(similar to [YLMH05]):− RSA: 𝑐𝑐 = 𝑁𝑁 − 1− ElGamal: 𝑐𝑐 = 𝑝𝑝 − 1
Overall attack performance: Algorithm Attack type # ciphertexts Time BW Cipher RefSqr-and-always-mlt
Non-adaptivechosen ciphertext
1 3 sec 2 MHz ElGamal,RSA
[GPT14]
Sliding / fixed window
Non-adaptivechosen ciphertext
2𝑤𝑤−1 (usually 8 or 16)
30 sec 2 MHz ElGamal,RSA
[GPPT15]
Sqr-and-always-mlt
Adaptivechosen ciphertext
𝐾𝐾𝑒𝑒𝐾𝐾 𝑠𝑠𝑖𝑖𝑠𝑠𝑒𝑒4
1 hour 50 kHz RSA [GST14]
A chosen ciphertext attack
![Page 22: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/22.jpg)
22
Non-adaptive ciphertext choice 𝑐𝑐 ≡ −1 mod 𝑝𝑝(similar to [YLMH05]):− RSA: 𝑐𝑐 = 𝑁𝑁 − 1− ElGamal: 𝑐𝑐 = 𝑝𝑝 − 1
Overall attack performance: Algorithm Attack type # ciphertexts Time BW Cipher RefSqr-and-always-mlt
Non-adaptivechosen ciphertext
1 3 sec 2 MHz ElGamal,RSA
[GPT14]
Sliding / fixed window
Non-adaptivechosen ciphertext
2𝑤𝑤−1 (usually 8 or 16)
30 sec 2 MHz ElGamal,RSA
[GPPT15]
Sqr-and-always-mlt
Adaptivechosen ciphertext
𝐾𝐾𝑒𝑒𝐾𝐾 𝑠𝑠𝑖𝑖𝑠𝑠𝑒𝑒4
1 hour 50 kHz RSA [GST14]
A chosen ciphertext attack
Ciphertext injectionSend chosen ciphertexts via email (PGP/MIME).Decrypted by email client (e.g., Enigmail)automatically.
![Page 23: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/23.jpg)
23
Empirical results:ground-potential attacks
![Page 24: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/24.jpg)
24
Demo: RSA key extraction
from chassis potential
![Page 25: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/25.jpg)
25
Reading the secret key (non-adaptive attack)
carrier
FM-modulated keydue to squaring of a random-looking /
mostly zero limb value of 𝑚𝑚
Key = 101011…
![Page 26: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/26.jpg)
26
Reading the secret key (non-adaptive attack)• Acquire trace• Filter around carrier (1.7 MHz)• FM demodulation• Read out bits (“simple ground analysis”)
interrupt
![Page 27: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/27.jpg)
27
RSA and ElGamal key extraction in a few seconds usinghuman touch (non-adaptive attack)
Key = 101011…
![Page 28: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/28.jpg)
28
Ground-potential analysis• Attenuating EMI emanations
“Unwanted currents or electromagnetic fields? Dump them to the circuit ground!”(Bypass capacitors, RF shields, …)
• Device is grounded, but its “ground” potential fluctuates relative to the mains earth ground.
Computationaffects currents and EM fieldsdumped to device groundconnected to conductive chassis
![Page 29: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/29.jpg)
29
Ground-potential analysis• Attenuating EMI emanations
“Unwanted currents or electromagnetic fields? Dump them to the circuit ground!”(Bypass capacitors, RF shields, …)
• Device is grounded, but its “ground” potential fluctuates relative to the mains earth ground.
Computationaffects currents and EM fieldsdumped to device groundconnected to conductive chassisconnected to shielded cables
Key = 101011…
Even when no data, or port is turned off.
![Page 30: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/30.jpg)
30
RSA and ElGamal key extraction in a few seconds usingthe far end of 10 meter network cable
works even if a firewall is present, or port is turned off
key=101011…
![Page 31: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/31.jpg)
31
Empirical results:electromagnetic attacks
![Page 32: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/32.jpg)
32
Electromagnetic key extraction• Currents inside the target create electromagnetic waves.• Can be detected using an electromagnetic probe
(e.g., a loop of cable).
target attacker
![Page 33: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/33.jpg)
33
Portable Instrument for Trace Acquisition
Cost to build: ~300$
![Page 34: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/34.jpg)
34
Key extraction via commodity radio receiver
![Page 35: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/35.jpg)
35
Acoustic cryptanalysis
![Page 36: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/36.jpg)
36
Acoustic emanations from PCs
• Noisy electrical components in the voltage regulator
• Commonly known as “coil-whine’’ but also originates from capacitors
Bzzzzzz
![Page 37: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/37.jpg)
37
Experimental setup (example)
target
microphoneamplifier
attacker
digitizer
![Page 38: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/38.jpg)
38
Adaptive key extraction
Severe attenuation of high frequency signals.• Effective bandwidth of 50 kHZ• Cannot observe a single squaring
Make the entire decryption depend on a single attacked bit • Extreme version of self-amplification• Extract the prime 𝑞𝑞 bit-by-bit (adaptive chosen ciphertext)• Total #measurements:
2048 decryptions for RSA-4096 (~1 hour)
![Page 39: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/39.jpg)
39
An adaptive chosen-ciphertext attack
�0 𝑖𝑖𝑖𝑖 𝑐𝑐 > 𝑞𝑞1 𝑖𝑖𝑖𝑖 𝑐𝑐 ≤ 𝑞𝑞
𝑐𝑐 = . . . . . . 111 … 1
𝑞𝑞 = 1? ? ? ? ? ? ? …
1111...1
1000…01
𝑞𝑞 = 11? ? ? ? ? ? …
0
𝑞𝑞 = 110? ? ? ? ? …
𝑐𝑐 = 10111111…
𝑐𝑐 = 11011111…
Bit-distinguisher oracle
𝑞𝑞 = 11011010 …
![Page 40: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/40.jpg)
40
An adaptive chosen-ciphertext attack
�0 𝑖𝑖𝑖𝑖 𝑐𝑐 > 𝑞𝑞1 𝑖𝑖𝑖𝑖 𝑐𝑐 ≤ 𝑞𝑞
𝑐𝑐 = . . . . . . 111 … 1Total #measurements:
𝐾𝐾𝑒𝑒𝐾𝐾 𝑠𝑠𝑖𝑖𝑠𝑠𝑒𝑒2 ⋅ 2
⋅ 2
Overall: 2048 decryptions for RSA-4096 (~1 hour)
Just qCoppersmith
lattice reduction:half the bits suffice
Error correction
Bit distinguisher oracle
![Page 41: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/41.jpg)
41
GnuPG RSA decryption - 𝑚𝑚𝑞𝑞 = 𝑐𝑐𝑑𝑑𝑞𝑞 𝑚𝑚𝑚𝑚𝑑𝑑 𝑞𝑞
modular_exponentiation(c,d,q){…karatsuba_mult(m,c)…
}
karatsuba_mult(m,c){…basic_mult(x,y)…
}
basic_mult(x,y){…
}
if (y[j]==0)return 0else return y[j]*x
x7
craft c such that𝑞𝑞𝑖𝑖 = 1 → 𝐾𝐾[𝑗𝑗] = 0𝑞𝑞𝑖𝑖 = 0 → 𝐾𝐾 𝑗𝑗 ≠ 0
(for most 𝑗𝑗’s)
x19 x2048
Grand total:272384 times
~0.5 sec of measurements
![Page 42: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/42.jpg)
42
Extracting 𝑞𝑞𝑖𝑖 (simplified)
𝑐𝑐𝑖𝑖 = 𝑞𝑞2048 ⋯𝑞𝑞𝑖𝑖+101⋯1
If 𝒒𝒒𝒊𝒊 = 𝟏𝟏 then 𝑐𝑐𝑖𝑖 < 𝑞𝑞, thus 𝑐𝑐 = 𝑐𝑐𝑖𝑖. That is, 𝒄𝒄 has special structure.
If 𝒒𝒒𝒊𝒊 = 𝟎𝟎 then 2q > 𝑐𝑐𝑖𝑖 > 𝑞𝑞, thus 𝑐𝑐 = 𝑐𝑐𝑖𝑖 − 𝑞𝑞.That is, 𝒄𝒄 is random looking.and we now multiply by 𝑐𝑐causing the bit-dependent leakage.
![Page 43: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/43.jpg)
43
Extracting 𝑞𝑞𝑖𝑖
𝑐𝑐𝑖𝑖 = 𝑞𝑞2048 ⋯𝑞𝑞𝑖𝑖+101⋯ 1 + 𝑛𝑛
If 𝒒𝒒𝒊𝒊 = 𝟏𝟏 then 𝑐𝑐𝑖𝑖 − 𝑛𝑛 < 𝑞𝑞, thus 𝑐𝑐 = 𝑐𝑐𝑖𝑖 − 𝑛𝑛. That is, 𝒄𝒄 has special structure.If 𝒒𝒒𝒊𝒊 = 𝟎𝟎 then2q > 𝑐𝑐𝑖𝑖 − 𝑛𝑛 > 𝑞𝑞, thus 𝑐𝑐= 𝑐𝑐𝑖𝑖 − 𝑞𝑞 − 𝑛𝑛.That is, 𝒄𝒄 is random looking.and we now multiply by 𝑐𝑐causing the bit-dependent leakage.
![Page 44: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/44.jpg)
44
Extracting 𝑞𝑞𝑖𝑖 (problem)
Single multiplication is way too fast for us to measure
Multiplication is repeated 2048 times (0.5 sec of data)
![Page 45: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/45.jpg)
45
Empirical results:acoustic attacks
![Page 46: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/46.jpg)
46
Distinguishing a key bit by a spectral signature
frequency
time
frequency
time
mod q
mod p
mod q
mod p
![Page 47: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/47.jpg)
47
Demo: key extraction
![Page 48: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/48.jpg)
48
Acoustic: results
RSA 4096-bit key extraction from1 meter away using a microphone
![Page 49: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/49.jpg)
49
Acoustic: results
RSA 4096-bit key extraction from10 meters away using a parabolic microphone
![Page 50: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/50.jpg)
50
Acoustic: results
RSA 4096-bit key extraction from30cm away using a smartphone
![Page 51: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/51.jpg)
51
Countermeasures
![Page 52: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/52.jpg)
52
Common suggestions1. Shielding
– EM (Faraday cages), grounddifficult and expensive
– Acoustic? Vents!
2. Add analog noise (expensive, correlations remain)
3. Parallel software load (inadequate, may help attacker)
Attacks rely on decryption of chosen ciphertexts.Solution: ciphertext randomization use equivalent but random-looking ciphertexts• Negligible slowdown for RSA• x2 slowdown for ElGamal
Countermeasures
![Page 53: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/53.jpg)
53
Given a ciphertext 𝑐𝑐:1. Generate a random number 𝑟𝑟 and compute 𝑟𝑟𝑒𝑒
2. Decrypt 𝑟𝑟𝑒𝑒 ⋅ 𝑐𝑐 and obtain 𝑚𝑚𝑚3. Output 𝑚𝑚′ ⋅ 𝑟𝑟−1
Works since 𝑒𝑒𝑑𝑑 = 1 𝑚𝑚𝑚𝑚𝑑𝑑 𝜑𝜑(𝑛𝑛) thus:𝑟𝑟𝑒𝑒 ⋅ 𝑐𝑐 𝑑𝑑 ⋅ 𝑟𝑟−1 𝑚𝑚𝑚𝑚𝑑𝑑 𝑛𝑛 = 𝑟𝑟𝑒𝑒𝑑𝑑 ⋅ 𝑟𝑟−1 ⋅ 𝑐𝑐𝑑𝑑 𝑚𝑚𝑚𝑚𝑑𝑑 𝑛𝑛
= 𝑟𝑟 ⋅ 𝑟𝑟−1 ⋅ 𝑐𝑐𝑑𝑑 𝑚𝑚𝑚𝑚𝑑𝑑 𝑛𝑛= 𝑐𝑐𝑑𝑑 𝑚𝑚𝑚𝑚𝑑𝑑 𝑛𝑛= 𝑚𝑚
Effective countermeasure:ciphertext randomization (added in GnuPG 1.4.16)
![Page 54: Information Security – Theory vs. Realitytromer/istvr1516-files/lecture6-PC... · 2020. 2. 27. · 1 Information Security – Theory vs. Reality 0368-4474, Winter 2015-2016 Lecture](https://reader035.vdocuments.us/reader035/viewer/2022071002/5fbec7e79ef0840b9476537f/html5/thumbnails/54.jpg)
54
tau.ac.il/~tromer/acoustic CRYPTO’14 CVE 2013-4576
tau.ac.il/~tromer/handsoff CHES’14 CVE-2014-5270
tau.ac.il/~tromer/radioexp CHES’15 CVE-2014-3591