Differential Side Channel Analysis Attacks on FPGAImplementations of ARIA

ETRI Journal

关键词: countermeasure;    side channel attacks;    FPGA;    ARIA;    DEMA;    DPA;   

Others  :  1185706
DOI  :  10.4218/etrij.08.0107.0167

【 摘 要 】

In this paper, we first investigate the side channel analysis attack resistance of various FPGA hardware implementations of the ARIA block cipher. The analysis is performed on an FPGA test board dedicated to side channel attacks. Our results show that an unprotected implementation of ARIA allows one to recover the secret key with a low number of power or electromagnetic measurements. We also present a masking countermeasure and analyze its second-order side channel resistance by using various suitable preprocessing functions. Our experimental results clearly confirm that second-order differential side channel analysis attacks also remain a practical threat for masked hardware implementations of ARIA.

   

【 参考文献 】

• [1]P. Kocher, J. Jaffe, and B. Jun, "Differential Power Analysis,"Proc. CRYPTO, LNCS 1666, 1999, pp. 388-397.
• [2]S.B. Ors, E. Oswald, and B. Preneel, "Power-Analysis Attacks on an FPGA: First Experimental Results,"Proc. CHES, LNCS 2779, 2003, pp. 35-50.
• [3]S.B. Ors, F. Gurkaynak, E. Oswald, and B. Preneel, "Power-Analysis Attack on an ASIC AES Implementation,"Proc. ITCC, vol. 2, 2004, pp. 546-552.
• [4]F. Standaert, S. Ors, and B. Preneel, "Power Analysis of an FPGA Implementation of Rijndael: Is Pipelining a DPA Countermeasure?"Proc. CHES, LNCS 3156, 2004, pp. 30-44.
• [5]F.X. Standaert, F. Mace, and J.J. Quisquater, "Updates on the Security of FPGAs against Power Analysis Attacks,"Proc. CHES, LNCS 3985, 2006, pp. 335-346.
• [6]D. Kwon, J. Kim, S. Park, S. Sung, Y. Sohn, J. Song, Y. Yeom, E. Yoon, S. Lee, J. Lee, S. Chee, D. Han, and J. Hong, "New Block Cipher: ARIA,"Proc. ICISC’03, LNCS 2971, 2004, pp. 432-445.
• [7]J. Ha, C. Kim, S. Moon, I. Park, and H. Yoo, "Differential Power Analysis on Block Cipher ARIA,"Proc. HPCC, LNCS 3726, 2005, pp. 541-548.
• [8]H. Yoo, C. Herbst, S. Mangard, E. Oswald, and S. Moon, "Investigations of Power Analysis Attacks and Countermeasures for ARIA,"Proc. WISA’06, LNCS 4298, 2007.
• [9]K. Gandolfi, C. Mourtel, and F. Olivier, "Electromagnetic Analysis: Concrete Results,"Proc. CHES, LNCS 2162, 2001, pp. 251-261.
• [10]A. Satoh, S. Morioka, K. Takano, and S. Munetoh, "A Compact Rijndael Hardware Architecture with S-Box Optimization,"Proc. ASIACRYPT, LNCS 2248, 2001, pp. 239-254.
• [11]A. Satoh and S. Morioka, "Unified Hardware Architecture for 128-bit Block Cipher AES and Camellia,"Proc. CHES, LNCS 2779, 2003, pp. 304-318.
• [12]S. Yang, J. Park, and Y. You, "The Smallest ARIA Module with 16-Bit Architecture,"Proc. ICISC, LNCS 4296, 2006, pp. 107-117.
• [13]E. Brier, C. Clavier, and F. Olivier, "Correlation Power Analysis with a Leakage Model,"Proc. CHES, LNCS 3156, 2004, pp. 16-29.
• [14]D. Agrawal, B. Archambeault, J.R. Rao, and P. Rohatgi, "The EM Side-Channel(s),"Proc. CHES, LNCS 2523, 2002, pp. 29-45.
• [15]D. Agrowal, B. Archambeault, S. Chari, P. Rohatgi, and J. Rao, "Advances in Side-Channel Cryptanalysis, Electromagnetic Analysis and Template Attacks,"Cryptobytes, vol. 6, no. 1, 2003, pp. 20-32.
• [16]C.H. Gebotys, S. Ho, and C.C. Tiu, "EM Analysis of Rijndael and ECC on a Wireless Java-Based PDA,"Proc. CHES, LNCS 3659, 2005, pp. 250-264.
• [17]LANGER EMV-Technik, http://www.langer-emv.de/en/produ kte/prod_rf2.htm/.
• [18]S. Mangard, "Hardware Countermeasures against DPA: A Statistical Analysis of Their Effectiveness,"Proc. CT-RSA, LNCS 2964, 2004, pp. 222-235.
• [19]S. Mangard, T. Popp, and B.M. Gammel, "Side-Channel Leakage of Masked CMOS Gates,"Proc. CT-RSA, LNCS 3376, 2005, pp. 351-365.
• [20]S. Mangard, N. Pramstaller, and E. Oswald, "Successfully Attacking Masked AES Hardware Implementations,"Proc. CHES, LNCS 3659, 2005, pp. 157-171.
• [21]W. Fischer and B.M. Gammel, "Masking at Gate Level in the Presence of Glitches,"Proc. CHES, LNCS 3659, 2005, pp. 187-200.
• [22]S. Mangard and K. Schramm "Pinpointing the Side-Channel Leakage of Masked AES Hardware Implementations,"Proc. CHES, LNCS 4249, 2006, pp. 76-90.
• [23]T. Messerges, "Using Second-Order Power Analysis to Attack DPA Resistant Software,"Proc. CHES’00, LNCS 1965, 2004, pp. 238-251.
• [24]J. Waddle and D. Wagner, "Towards Efficient Second-Order Power Analysis,"Proc. CHES, LNCS 3156, 2004, pp. 1-15.
• [25]F. Standaert, E. Peeters, and J. Quisquater, "On the Masking Countermeasure and Higher-Order Power Analysis Attacks,"Proc. ITCC, vol. 1, 2005, pp. 562-567.
• [26]M. Joye, P. Paillier, and B. Schoenmakers, "On Second-Order Differential Power Analysis,"Proc. CHES, LNCS 3659, 2005, pp. 293-308.
• [27]E. Peeters, F. Standaert, N. Donckers, and J. Quisquater, "Improved Higher Order Side-Channel Attacks with FPGA Experiments,"Proc. CHES, LNCS 3659, 2005, pp. 309-323.
• [28]E. Oswald, S. Mangard, C. Herbst, and S. Tillich, "Practical Second-Order DPA Attacks for Masked Smart Card Implementations of Block Ciphers,"Proc. CT-RSA, LNCS 3860, 2006, pp. 192-207.
• [29]S. Mangard, E. Oswald, and T. Popp, Power Analysis Attacks: Revealing the Secrets of Smartcards, Springer-Verlag, 2007.