| Summary: | Side-Channel Analysis plays an important role in cryptology, as
it represents an important class of attacks against cryptographic
implementations, especially in the context of embedded systems
such as hand-held mobile devices, smart cards, RFID tags, etc.
These types of attacks bypass any intrinsic mathematical security
of the cryptographic algorithm or protocol by exploiting observable
side-effects of the execution of the cryptographic operation that
may exhibit some relationship with the internal (secret) parameters
in the device. Two of the main types of side-channel attacks are
timing attacks or timing analysis, where the relationship between
the execution time and secret parameters is exploited; and power
analysis, which exploits the relationship between power consumption
and the operations being executed by a processor as well as the
data that these operations work with. For power analysis, two
main types have been proposed: simple power analysis (SPA) which
relies on direct observation on a single measurement, and
differential power analysis (DPA), which uses multiple
measurements combined with statistical processing to extract
information from the small variations in power consumption
correlated to the data.
In this thesis, we propose several countermeasures to these
types of attacks, with the main themes being timing analysis
and SPA. In addition to these themes, one of our contributions
expands upon the ideas behind SPA to present a constructive
use of these techniques in the context of embedded systems
debugging.
In our first contribution, we present a countermeasure against
timing attacks where an optimized form of idle-wait is proposed
with the goal of making the observable decryption time constant
for most operations while maintaining the overhead to a minimum.
We show that not only we reduce the overhead in terms of execution
speed, but also the computational cost of the countermeasure,
which represents a considerable advantage in the context of
devices relying on battery power, where reduced computations
translates into lower power consumption and thus increased
battery life. This is indeed one of the important themes for
all of the contributions related to countermeasures to side-
channel attacks.
Our second and third contributions focus on power analysis;
specifically, SPA. We address the issue of straightforward
implementations of binary exponentiation algorithms (or scalar
multiplication, in the context of elliptic curve cryptography)
making a cryptographic system vulnerable to SPA. Solutions
previously proposed introduce a considerable performance
penalty. We propose a new method, namely Square-and-Buffered-
Multiplications (SABM), that implements an SPA-resistant binary
exponentiation exhibiting optimal execution time at the cost of
a small amount of storage --- O(\sqrt(\ell)), where \ell is the
bit length of the exponent. The technique is optimal in the
sense that it adds SPA-resistance to an underlying binary
exponentiation algorithm while introducing zero computational
overhead.
We then present several new SPA-resistant algorithms that result
from a novel way of combining the SABM method with an alternative
binary exponentiation algorithm where the exponent is split in
two halves for simultaneous processing, showing that by combining
the two techniques, we can make use of signed-digit representations
of the exponent to further improve performance while maintaining
SPA-resistance. We also discuss the possibility of our method
being implemented in a way that a certain level of resistance
against DPA may be obtained.
In a related contribution, we extend these ideas used in SPA and
propose a technique to non-intrusively monitor a device and trace
program execution, with the intended application of assisting in
the difficult task of debugging embedded systems at deployment
or production stage, when standard debugging tools or auxiliary
components to facilitate debugging are no longer enabled in the
device. One of the important highlights of this contribution is
the fact that the system works on a standard PC, capturing the
power traces through the recording input of the sound card.
|
|---|
