Attaque par canal auxiliaire

Dans le domaine de la sécurité informatique, une attaque par canal auxiliaire ( ou SCA) est une attaque informatique qui, sans remettre en cause la robustesse théorique des méthodes et procédures de sécurité, recherche et exploite des failles dans leur implémentation, logicielle ou matérielle. En effet, une sécurité « mathématique » ne garantit pas forcément une sécurité lors de l'utilisation en « pratique ». Types d'attaques Une attaque est considérée comme utile dès lors qu'elle présente des performances supérieures à une attaque par force brute. Les attaques par canal auxiliaire sont nombreuses et variées et portent sur différents paramètres. On en distingue deux grandes catégories. Attaques invasives Les attaques invasives nécessitent une interaction avec le matériel (potentiellement destructive). ; Attaque par sondage : Cette attaque consiste à placer une sonde directement dans le circuit à étudier, afin d'observer son comportement (généralement utilisée

À propos de ce résultat

Cette page est générée automatiquement et peut contenir des informations qui ne sont pas correctes, complètes, à jour ou pertinentes par rapport à votre recherche. Il en va de même pour toutes les autres pages de ce site. Veillez à vérifier les informations auprès des sources officielles de l'EPFL.

Publications associées (61)

Publications associées

Chargement

Personnes associées (8)

Personnes associées

Chargement

Unités associées (5)

Unités associées

Chargement

Concepts associés (19)

Concepts associés

Chargement

Cours associés (9)

Cours associés

Chargement

Séances de cours associées (18)

Séances de cours associées

Chargement

Side-channel attacks on SIKE

Natacha Yolande Emmanuel Marie Linard de Guertechin

This thesis presents, firstly, an introduction to the current state of the art in isogeny-based cryptography, and secondly, a side-channel differential power analysis of SIKE—an isogeny-based key exchange algorithm—in semi-static mode. These attacks have been realized on an ARM implementation of SIKEp434 in the pqm4 library which is itself based on the reference implementation of the SIKE submission to the NIST post-quantum standardization process. We have analyzed the power consumption of an STM32F3 board which features an ARM Cortex-M4 microcontroller through Pearson’s correlation in the Hamming Weight model. We investigated an information leak of the 3-points Ladder involved in the decapsulation mechanism of SIKEp434. As this function was used to compute P + [m]Q where m is Bob’s private key and P, Q are two public points on a known elliptic curve, we showed that we can recover every bit of Bob’s private key by exploiting the power consumption as a bit distinguisher through a correlation with the result of an ADDS assembly instruction. A proof of leakage of the ADDS instruction of ARM has been demonstrated in this thesis. Ideas for countermeasures to prevent this attack are discussed.

2020

Chargement

F-BLEAU: Fast Black-box Leakage Estimation

Giovanni Cherubin

We consider the problem of measuring how much a system reveals about its secret inputs. We work in the black-box setting: we assume no prior knowledge of the system's internals, and we run the system for choices of secrets and measure its leakage from the respective outputs. Our goal is to estimate the Bayes risk, from which one can derive some of the most popular leakage measures (e.g., min-entropy leakage). The state-of-the-art method for estimating these leakage measures is the frequentist paradigm, which approximates the system's internals by looking at the frequencies of its inputs and outputs. Unfortunately, this does not scale for systems with large output spaces, where it would require too many input-output examples. Consequently, it also cannot be applied to systems with continuous outputs (e.g., time side channels, network traffic). In this paper, we exploit an analogy between Machine Learning (ML) and black-box leakage estimation to show that the Bayes risk of a system can be estimated by using a class of ML methods: the universally consistent learning rules; these rules can exploit patterns in the input-output examples to improve the estimates' convergence, while retaining formal optimality guarantees. We focus on a set of them, the nearest neighbor rules; we show that they significantly reduce the number of black-box queries required for a precise estimation whenever nearby outputs tend to be produced by the same secret; furthermore, some of them can tackle systems with continuous outputs. We illustrate the applicability of these techniques on both synthetic and real-world data, and we compare them with the state-of-the-art tool, leakiEst, which is based on the frequentist approach.

IEEE2019

Chargement

Hardware Attacks against Hash-based Cryptographic Algorithms

Aymeric Genet

This thesis surveys the current state of the art of hash-based cryptography with a view to finding vulnerabilities related to side-channel attacks and fault attacks. For side-channel investigation, we analyzed the power consumption of an Arduino Due microcontroller running a custom ARM implementation of SPHINCS-256---the most advanced digital signature scheme based on hash functions. Simple power analysis (SPA) was applied on a single trace to obtain a first insight into the implementation, and then on multiple traces to identify an initial data dependence of the power consumption on the hash functions involved in the instance. Based on this result, differential power analysis (DPA), with difference of means, V-test, and Pearson correlation, was applied to further investigate the leakage relating to BLAKE-256, as this function is used within SPHINCS-256 several times with the same secret key but applied on different known addresses. Concerning fault attacks, using instances of one-time signature (OTS) or few-times signatures (FTS) to sign a same message has been shown to theoretically make many schemes, such as LD-OTS, W-OTS, and HORS, existentially forgeable with non-invasive attacks. These vulnerabilities are fatal for the Merkle signature schemes which implement the tree chaining method (CMSS). When the schemes provide n/2 = 128 bits of quantum security, a universal forgery can be created with around q = 20 different faulty signatures. This thesis demonstrates a practical application of fault attacks to create this universal forgery using voltage glitching on the previously mentioned ARM implementation of SPHINCS-256. An invasive attack performing key recovery against W-OTS by forcing bits of two quantities to be zero is also described. Countermeasures to thwart all the described attacks are discussed.

2017

Chargement

Cryptographie

thumb|La machine de Lorenz utilisée par les nazis durant la Seconde Guerre mondiale pour chiffrer les communications militaires de haut niveau entre Berlin et les quartiers-généraux des différentes ar

Chiffrement

thumb|Table de chiffrement de la guerre franco–prussienne de 1870, évoquant une série de mots classés par ordre alphabétique. Archives nationales de France. Le chiffrement (ou parfois cryptage) est u

Chiffrement RSA

COM-402: Information security and privacy

This course provides an overview of information security and privacy topics. It introduces students to the knowledge and tools they will need to deal with the security/privacy challenges they are likely to encounter in today's Big Data world. The tools are illustrated with relevant applications.

COM-501: Advanced cryptography

This course reviews some failure cases in public-key cryptography. It introduces some cryptanalysis techniques. It also presents fundamentals in cryptography such as interactive proofs. Finally, it presents some techniques to validate the security of cryptographic primitives.

COM-401: Cryptography and security

This course introduces the basics of cryptography. We review several types of cryptographic primitives, when it is safe to use them and how to select the appropriate security parameters. We detail how they work and sketch how they can be implemented.