Breaking Masked Implementations with ManyShares on 32-bit Software Platformsor or When the Security Order Does Not Matter
(2021) IACR Transactions on Cryptographic Hardware and Embedded Systems — Vol. 2021, n° 3, p. 202-234 (2021)
Files
BreakingMaskedImplemenattionswithManyShareson2-bitSoftwarePlatformsorWhentheSecurityOrderDoesNotMatter.pdf
Open Access - Adobe PDF
- 1.32 MB
Details
- Authors
Bronchain, Olivier 
- Abstract
- We explore the concrete side-channel security provided by state-of-the-art higher-order masked software implementations of the AES and the (candidateto the NIST Lightweight Cryptography competition) Clyde, in ARM Cortex-M0and M3 devices. Rather than looking for possibly reduced security orders (asfrequently considered in the literature), we directly target these implementations byassuming their maximum security order and aim at reducing their noise level thanksto multivariate, horizontal and analytical attacks. Our investigations point out thatthe Cortex-M0 device has so limited physical noise that masking is close to ineffective.The Cortex-M3 shows a better trend but still requires a large number of shares toprovide strong security guarantees. Practically, we first exhibit a full 128-bit keyrecovery in less than 10 traces for a 6-share masked AES implementation running onthe Cortex-M0 requiring232enumeration power. A similar attack performed againstthe Cortex-M3 with 5 shares require 1,000 measurements with244enumeration power.We then show the positive impact of lightweight block ciphers with limited numberof AND gates for side-channel security, and compare our attacks against a maskedClyde with the best reported attacks of the CHES 2020 CTF. We complement theseexperiments with a careful information theoretic analysis, which allows interpretingour results. We also discuss our conclusions under the umbrella of “backwardssecurity evaluations” recently put forwards by Azouaoui et al. We finally extrapolatethe evolution of the proposed attack complexities in the presence of additionalcountermeasures using the local random probing model proposed at CHES 2020.
- Affiliations
Citations
Bronchain, O., & Standaert, F.-X. (2021). Breaking Masked Implementations with ManyShares on 32-bit Software Platformsor or When the Security Order Does Not Matter. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2021(3), 202-234. https://doi.org/10.46586/tches.v2021.i3.202-234 (Original work published 2021)