Ali Galip Bayrak | EPFL Graph Search

À propos de ce résultat

Cette page est générée automatiquement et peut contenir des informations qui ne sont pas correctes, complètes, à jour ou pertinentes par rapport à votre recherche. Il en va de même pour toutes les autres pages de ce site. Veillez à vérifier les informations auprès des sources officielles de l'EPFL.

Automatic Application of Power Analysis Countermeasures

Ali Galip Bayrak, Philip Brisk, Paolo Ienne, David Novo Bruna, Francesco Regazzoni

We introduce a compiler that automatically inserts software countermeasures to protect cryptographic algorithms against power-based side-channel attacks. The compiler first estimates which instruction instances leak the most information through side-channels. This information is obtained either by dynamic analysis, evaluating an information theoretic metric over the power traces acquired during the execution of the input program, or by static analysis. As information leakage implies a loss of security, the compiler then identifies (groups of) instruction instances to protect with a software countermeasure such as random precharging or Boolean masking. As software protection incurs significant overhead in terms of cryptosystem runtime and memory usage, the compiler protects the minimum number of instruction instances to achieve a desired level of security. The compiler is evaluated on two block ciphers, AES and Clefia; our experiments demonstrate that the compiler can automatically identify and protect the most important instruction instances. To date, these software countermeasures have been inserted manually by security experts, who are not necessarily the main cryptosystem developers. Our compiler offers significant productivity gains for cryptosystem developers who wish to protect their implementations from side-channel attacks.

Institute of Electrical and Electronics Engineers2015

Automated Side-Channel Vulnerability Discovery and Hardening

Ali Galip Bayrak

In traditional cryptography, an attacker tries to infer a mathematical relationship between the inputs and outputs of a cryptosystem to recover secret information. With the advances in the theoretical basis of the cryptographic algorithms, this task became harder and attackers started to seek different approaches. A family of attacks known as side-channel attacks have focused on using information leaked through the underlying device when the cryptographic algorithm is running. For instance, a power analysis attack can exploit the relationship between the inputs of a cryptosystem and the underlying device’s power consumption while performing cryptographic operations on these inputs. Such attacks have shown to be so successful and efficient in practice that prudent designers now insert countermeasures against these attacks to their hardware and software systems. However, the insertion process is challenging to a non-expert in cryptography due to several factors including unnatural structure of the countermeasures (e.g., obfuscating the implementation), use of non-standard elements in the design (e.g., using non-CMOS logic styles), conflict with standard design parameters and the optimization processes of design tools (e.g., adding dummy operations, which are normally eliminated by the design tools to increase performance), etc. To facilitate a reliably-secure design process, this thesis proposes automated methodologies which analyze a given hardware or software cryptosystem and insert appropriate side-channel countermeasures. We first propose one type of hardware countermeasure and show how it can easily be integrated into the standard electronic design automation flow to protect high-level hardware implementations. The countermeasure is based on adding random jitter to the clocks of sequential circuit elements, and incurs a modest area and energy overhead. Next, we propose a hardware extension unit, an instruction shuffler, to existing processors. The unit is very lightweight and does not require any architectural changes, and hence can be used with any processor, increasing the side-channel resistance of the overall system. We then present a compiler, which can easily be combined with the off-the-shelf compilers, to automatically apply countermeasures on given software implementations. We show that the compiler can produce protected implementations that are as efficient as their manually optimized counterparts, eliminating the need for designer expertise and time. Finally, we present an automated security verification methodology, which checks certain properties to detect potential vulnerabilities in a (manually or automatically) protected implementation. Our experiments show that we can successfully detect common security problems in a flawed implementation of a countermeasure within a reasonable amount of time.

EPFL2014

An Architecture-Independent Instruction Shuffler to Protect against Side-Channel Attacks

Ali Galip Bayrak, Paolo Ienne, Nikola Velickovic

Embedded cryptographic systems, such as smart cards, require secure implementations that are robust to a variety of low-level attacks. Side-Channel Attacks (SCA) exploit the information such as power consumption, electromagnetic radiation and acoustic leaking through the device to uncover the secret information. Attackers can mount successful attacks with very modest resources in a short time period. Therefore, many methods have been proposed to increase the security against SCA. Randomizing the execution order of the instructions that are independent, i.e., random shuffling, is one of the most popular among them. Implementing instruction shuffling in software is either implementation specific or has a significant performance or code size overhead. To overcome these problems, we propose in this work a generic custom hardware unit to implement random instruction shuffling as an extension to existing processors. The unit operates between the CPU and the instruction cache (or memory, if no cache exists), without any modification to these components. Both true and pseudo random number generators are used to dynamically and locally provide the shuffling sequence. The unit is mainly designed for in-order processors, since the embedded devices subject to these kind of attacks use simple in-order processors. More advanced processors (e.g., superscalar, VLIW or EPIC processors) are already more resistant to these attacks because of their built-in ILP and wide word size. Our experiments on two different soft in-order processor cores, i.e., OpenRISC and MicroBlaze, implemented on FPGA show that the proposed unit could increase the security drastically with very modest resource overhead. With around 2% area, 1.5% power and no performance overhead, the shuffler increases the effort to mount a successful power analysis attack on AES software implementation over 360 times.

2012