Side channel attack
Encyclopedia
In cryptography
, a side channel attack is any attack based on information gained from the physical implementation
of a cryptosystem
, rather than brute force
or theoretical weaknesses in the algorithm
s (compare cryptanalysis
). For example, timing information, power consumption, electromagnetic
leaks or even sound can provide an extra source of information which can be exploited to break the system. Some side-channel attacks require technical knowledge of the internal operation of the system on which the cryptography is implemented, although others such as differential power analysis are effective as black-box attacks. The most powerful side channel attacks are based on statistical methods pioneered by Paul Kocher
.
Attempts to break a cryptosystem by deceiving or coercing people with legitimate access are not typically called side-channel attacks: see social engineering and rubber-hose cryptanalysis
. For attacks on computer systems themselves (which are often used to perform cryptography and thus contain cryptographic keys or plaintext
s), see computer security
. The rise of Web applications and software-as-a-service has also raised the possibility of side-channel attacks on these programs, even when transmissions between a Web browser and server are encrypted, according to Microsoft and Indiana University researchers.
In all cases, the underlying principle is that physical effects caused by the operation of a cryptosystem (on the side) can provide useful extra information about secrets in the system, for example, the cryptographic key, partial state information, full or partial plaintext
s and so forth. The term cryptophthora (secret degradation) is sometimes used to express the degradation of secret key material resulting from side channel leakage.
, or memory, on the hardware running the cryptosystem or algorithm. Simply by observing variations in how long it takes to perform cryptographic operations, it can be possible to determine the entire secret key. Such attacks involve statistical analysis of timing measurements, and have been demonstrated across networks.
A power analysis attack can provide even more detailed information by observing the power consumption of a hardware device such as CPU or cryptographic circuit. These attacks are roughly categorized into simple power analysis (SPA) and differential power analysis (DPA).
Fluctuations in current also generate radio waves
, enabling attacks that analyze measurements of electromagnetic emanations. These attacks typically involve similar statistical techniques as power analysis attacks.
Non-cryptographic historical analogues to modern side channel attacks are known. A recently declassified NSA document reveals that as far back as 1943, an engineer with Bell telephone observed decipherable spikes on an oscilloscope associated with the decrypted output of a certain encrypting teletype. According to former MI5
officer Peter Wright
, the British Security Service analysed emissions from French cipher equipment in the 1960s. In the 1980s, Soviet
eavesdroppers were suspected to plant bugs inside IBM Selectric typewriters to monitor the electrical noise generated as the type ball rotated and pitched to strike the paper; the characteristics of those signals could determine which key was pressed.
Power consumption of devices causes heating, which is offset by cooling effects. Temperature changes create thermally induced mechanical stress. That stress appears can create low level acoustic
(i.e. noise) emissions from operating CPUs (about 10 kHz in some cases). Recent research by Shamir
et al. has suggested that information about the operation of cryptosystems and algorithms can be obtained in this way as well. This is an acoustic attack
; if the surface of the CPU chip, or in some cases the CPU package, can be observed, infrared
images can also provide information about the code being executed on the CPU, known as a thermal imaging attack.
Another countermeasure is to jam the emitted channel with noise. For instance, a random delay can be added to deter timing attacks, although adversaries can compensate for these delays by averaging multiple measurements together (or, more generally, using more measurements in the analysis). As the amount of noise in the side channel increases, the adversary needs to collect more measurements.
In the case of timing attacks against targets whose computation times are quantized into discrete clock cycle counts, an effective countermeasure against is to design the software so that it is isochronous—so it runs in an exactly constant amount of time, independent of secret values. This makes timing attacks impossible. Such countermeasures can be difficult to implement in practice, since even individual instructions can have variable timing on some CPUs.
One partial countermeasure against simple power attacks, but not differential power analysis attacks, is to design the software so that it is "PC-secure" in the "program counter security model". In a PC-secure program, the execution path does not depend on secret values—in other words, all conditional branches depend only on public information.
(This is a more restrictive condition than isochronous code, but a less restrictive condition than branch-free code.)
Even though multiply operations draw more power than NOP
on practically all CPUs, using a constant execution path prevents such operation-dependent power differences—differences in power from choosing one branch over another—from leaking any secret information.
On architectures where the instruction execution time is not data-dependent, a PC-secure program is also immune to timing attacks.
Another way in which code can be non-isochronous is that modern CPUs have a memory cache: accessing infrequently-used information incurs a large timing penalty, revealing some information about the frequency of use of memory blocks. Cryptographic code designed to resist cache attacks attempts to use memory in only a predictable fashion (such as accessing only the input, outputs and program data, and doing so according to a fixed pattern). For example data-dependent look-up tables must be avoided because the cache could reveal which part of the look-up table was accessed.
Other partial countermeasures attempt to reduce the amount of information leaked from data-dependent power differences.
Some operations use power that is correlated to the number of 1 bits in a secret value.
Using a constant-weight code
(such as using Fredkin gate
s or dual-rail encoding) can reduce the leakage of information about the Hamming weight
of the secret value, although exploitable correlations will likely to remain unless the balancing is exactly perfect. This "balanced design" can be approximated in software by manipulating both the data and its complement together.
Several "secure CPUs" have been built as asynchronous CPUs; they have no global timing reference. While these CPUs were intended to make timing and power attacks more difficult, subsequent research found that timing variations in asynchronous circuits are harder to remove.
Cryptography
Cryptography is the practice and study of techniques for secure communication in the presence of third parties...
, a side channel attack is any attack based on information gained from the physical implementation
Implementation
Implementation is the realization of an application, or execution of a plan, idea, model, design, specification, standard, algorithm, or policy.-Computer Science:...
of a cryptosystem
Cryptosystem
There are two different meanings of the word cryptosystem. One is used by the cryptographic community, while the other is the meaning understood by the public.- General meaning :...
, rather than brute force
Brute force attack
In cryptography, a brute-force attack, or exhaustive key search, is a strategy that can, in theory, be used against any encrypted data. Such an attack might be utilized when it is not possible to take advantage of other weaknesses in an encryption system that would make the task easier...
or theoretical weaknesses in the algorithm
Algorithm
In mathematics and computer science, an algorithm is an effective method expressed as a finite list of well-defined instructions for calculating a function. Algorithms are used for calculation, data processing, and automated reasoning...
s (compare cryptanalysis
Cryptanalysis
Cryptanalysis is the study of methods for obtaining the meaning of encrypted information, without access to the secret information that is normally required to do so. Typically, this involves knowing how the system works and finding a secret key...
). For example, timing information, power consumption, electromagnetic
Electromagnetic radiation
Electromagnetic radiation is a form of energy that exhibits wave-like behavior as it travels through space...
leaks or even sound can provide an extra source of information which can be exploited to break the system. Some side-channel attacks require technical knowledge of the internal operation of the system on which the cryptography is implemented, although others such as differential power analysis are effective as black-box attacks. The most powerful side channel attacks are based on statistical methods pioneered by Paul Kocher
Paul Kocher
Paul Carl Kocher is an American cryptographer and cryptography consultant, currently the president and chief scientist of Cryptography Research, Inc....
.
Attempts to break a cryptosystem by deceiving or coercing people with legitimate access are not typically called side-channel attacks: see social engineering and rubber-hose cryptanalysis
Rubber-hose cryptanalysis
In cryptography, rubber-hose cryptanalysis is the extraction of cryptographic secrets from a person by coercion or torture, in contrast to a mathematical or technical cryptanalytic attack....
. For attacks on computer systems themselves (which are often used to perform cryptography and thus contain cryptographic keys or plaintext
Plaintext
In cryptography, plaintext is information a sender wishes to transmit to a receiver. Cleartext is often used as a synonym. Before the computer era, plaintext most commonly meant message text in the language of the communicating parties....
s), see computer security
Computer security
Computer security is a branch of computer technology known as information security as applied to computers and networks. The objective of computer security includes protection of information and property from theft, corruption, or natural disaster, while allowing the information and property to...
. The rise of Web applications and software-as-a-service has also raised the possibility of side-channel attacks on these programs, even when transmissions between a Web browser and server are encrypted, according to Microsoft and Indiana University researchers.
General
General classes of side channel attack include:- Timing attackTiming attackIn cryptography, a timing attack is a side channel attack in which the attacker attempts to compromise a cryptosystem by analyzing the time taken to execute cryptographic algorithms...
— attacks based on measuring how much time various computations take to perform. - Power monitoring attackPower analysisIn cryptography, power analysis is a form of side channel attack in which the attacker studies the power consumption of a cryptographic hardware device...
— attacks which make use of varying power consumption by the hardware during computation. - Electromagnetic attacks — attacks based on leaked electromagnetic radiation which can directly provide plaintexts and other information. Such measurements can be used to infer cryptographic keys using techniques equivalent to those in power analysis, or can be used in non-cryptographic attacks, e.g. TEMPESTTEMPESTTEMPEST is a codename referring to investigations and studies of compromising emission . Compromising emanations are defined as unintentional intelligence-bearing signals which, if intercepted and analyzed, may disclose the information transmitted, received, handled, or otherwise processed by any...
(aka van Eck phreakingVan Eck phreakingVan Eck phreaking is the process of eavesdropping on the contents of a CRT- or LC-Display by detecting its electromagnetic emissions. It is named after Dutch computer researcher Wim van Eck, who in 1985 published the first paper on it, including proof of concept.Phreaking is the process of...
or radiation monitoring) attacks. - Acoustic cryptanalysisAcoustic cryptanalysisAcoustic cryptanalysis is a side channel attack which exploits sounds emitted by computers or machines. Modern acoustic cryptanalysis mostly focuses on sounds emitted by computer keyboards and internal computer components, but historically it has also been applied to impact printers and...
— attacks which exploit sound produced during a computation (rather like power analysis). - Differential fault analysisDifferential fault analysisDifferential fault analysis is a type of side channel attack in the field of cryptography, specifically cryptanalysis. The principle is to induce faults—unexpected environmental conditions—into cryptographic implementations, to reveal their internal states....
, in which secrets are discovered by introducing faults in a computation.
In all cases, the underlying principle is that physical effects caused by the operation of a cryptosystem (on the side) can provide useful extra information about secrets in the system, for example, the cryptographic key, partial state information, full or partial plaintext
Plaintext
In cryptography, plaintext is information a sender wishes to transmit to a receiver. Cleartext is often used as a synonym. Before the computer era, plaintext most commonly meant message text in the language of the communicating parties....
s and so forth. The term cryptophthora (secret degradation) is sometimes used to express the degradation of secret key material resulting from side channel leakage.
Examples
A timing attack watches data movement into and out of the CPUCentral processing unit
The central processing unit is the portion of a computer system that carries out the instructions of a computer program, to perform the basic arithmetical, logical, and input/output operations of the system. The CPU plays a role somewhat analogous to the brain in the computer. The term has been in...
, or memory, on the hardware running the cryptosystem or algorithm. Simply by observing variations in how long it takes to perform cryptographic operations, it can be possible to determine the entire secret key. Such attacks involve statistical analysis of timing measurements, and have been demonstrated across networks.
A power analysis attack can provide even more detailed information by observing the power consumption of a hardware device such as CPU or cryptographic circuit. These attacks are roughly categorized into simple power analysis (SPA) and differential power analysis (DPA).
Fluctuations in current also generate radio waves
Electromagnetic radiation
Electromagnetic radiation is a form of energy that exhibits wave-like behavior as it travels through space...
, enabling attacks that analyze measurements of electromagnetic emanations. These attacks typically involve similar statistical techniques as power analysis attacks.
Non-cryptographic historical analogues to modern side channel attacks are known. A recently declassified NSA document reveals that as far back as 1943, an engineer with Bell telephone observed decipherable spikes on an oscilloscope associated with the decrypted output of a certain encrypting teletype. According to former MI5
MI5
The Security Service, commonly known as MI5 , is the United Kingdom's internal counter-intelligence and security agency and is part of its core intelligence machinery alongside the Secret Intelligence Service focused on foreign threats, Government Communications Headquarters and the Defence...
officer Peter Wright
Peter Wright
Peter Maurice Wright was an English scientist and former MI5 counterintelligence officer, noted for writing the controversial book Spycatcher, which became an international bestseller with sales of over two million copies...
, the British Security Service analysed emissions from French cipher equipment in the 1960s. In the 1980s, Soviet
KGB
The KGB was the commonly used acronym for the . It was the national security agency of the Soviet Union from 1954 until 1991, and was the premier internal security, intelligence, and secret police organization during that time.The State Security Agency of the Republic of Belarus currently uses the...
eavesdroppers were suspected to plant bugs inside IBM Selectric typewriters to monitor the electrical noise generated as the type ball rotated and pitched to strike the paper; the characteristics of those signals could determine which key was pressed.
Power consumption of devices causes heating, which is offset by cooling effects. Temperature changes create thermally induced mechanical stress. That stress appears can create low level acoustic
Acoustics
Acoustics is the interdisciplinary science that deals with the study of all mechanical waves in gases, liquids, and solids including vibration, sound, ultrasound and infrasound. A scientist who works in the field of acoustics is an acoustician while someone working in the field of acoustics...
(i.e. noise) emissions from operating CPUs (about 10 kHz in some cases). Recent research by Shamir
Adi Shamir
Adi Shamir is an Israeli cryptographer. He is a co-inventor of the RSA algorithm , a co-inventor of the Feige–Fiat–Shamir identification scheme , one of the inventors of differential cryptanalysis and has made numerous contributions to the fields of cryptography and computer...
et al. has suggested that information about the operation of cryptosystems and algorithms can be obtained in this way as well. This is an acoustic attack
Acoustic cryptanalysis
Acoustic cryptanalysis is a side channel attack which exploits sounds emitted by computers or machines. Modern acoustic cryptanalysis mostly focuses on sounds emitted by computer keyboards and internal computer components, but historically it has also been applied to impact printers and...
; if the surface of the CPU chip, or in some cases the CPU package, can be observed, infrared
Infrared
Infrared light is electromagnetic radiation with a wavelength longer than that of visible light, measured from the nominal edge of visible red light at 0.74 micrometres , and extending conventionally to 300 µm...
images can also provide information about the code being executed on the CPU, known as a thermal imaging attack.
Countermeasures
Because side channel attacks rely on emitted information (like electromagnetic radiation or sound) or on relationship information (as in timing and power attacks), one method of countering such attacks is to reduce the release of such information or access to those relationships. Displays are now commercially available which have been specially shielded to lessen electromagnetic emissions reducing susceptibility to TEMPEST attacks. Power line conditioning and filtering can help deter power monitoring attacks, although such measures must be used cautiously since even very small correlations can remain and compromise security. Physical enclosures can reduce the risk of surreptitious installation of microphones (to counter acoustic attacks) and other micro-monitoring devices (against CPU power draw or thermal imaging attacks).Another countermeasure is to jam the emitted channel with noise. For instance, a random delay can be added to deter timing attacks, although adversaries can compensate for these delays by averaging multiple measurements together (or, more generally, using more measurements in the analysis). As the amount of noise in the side channel increases, the adversary needs to collect more measurements.
In the case of timing attacks against targets whose computation times are quantized into discrete clock cycle counts, an effective countermeasure against is to design the software so that it is isochronous—so it runs in an exactly constant amount of time, independent of secret values. This makes timing attacks impossible. Such countermeasures can be difficult to implement in practice, since even individual instructions can have variable timing on some CPUs.
One partial countermeasure against simple power attacks, but not differential power analysis attacks, is to design the software so that it is "PC-secure" in the "program counter security model". In a PC-secure program, the execution path does not depend on secret values—in other words, all conditional branches depend only on public information.
(This is a more restrictive condition than isochronous code, but a less restrictive condition than branch-free code.)
Even though multiply operations draw more power than NOP
NOP
In computer science, NOP or NOOP is an assembly language instruction, sequence of programming language statements, or computer protocol command that effectively does nothing at all....
on practically all CPUs, using a constant execution path prevents such operation-dependent power differences—differences in power from choosing one branch over another—from leaking any secret information.
On architectures where the instruction execution time is not data-dependent, a PC-secure program is also immune to timing attacks.
Another way in which code can be non-isochronous is that modern CPUs have a memory cache: accessing infrequently-used information incurs a large timing penalty, revealing some information about the frequency of use of memory blocks. Cryptographic code designed to resist cache attacks attempts to use memory in only a predictable fashion (such as accessing only the input, outputs and program data, and doing so according to a fixed pattern). For example data-dependent look-up tables must be avoided because the cache could reveal which part of the look-up table was accessed.
Other partial countermeasures attempt to reduce the amount of information leaked from data-dependent power differences.
Some operations use power that is correlated to the number of 1 bits in a secret value.
Using a constant-weight code
Constant-weight code
In coding theory, a constant-weight code, also called an m of n code, is an error detection and correction code where all codewords share the same Hamming weight. The theory is closely connected to that of designs...
(such as using Fredkin gate
Fredkin gate
The Fredkin gate is a computational circuit suitable for reversible computing, invented by Ed Fredkin. It is universal, which means that any logical or arithmetic operation can be constructed entirely of Fredkin gates...
s or dual-rail encoding) can reduce the leakage of information about the Hamming weight
Hamming weight
The Hamming weight of a string is the number of symbols that are different from the zero-symbol of the alphabet used. It is thus equivalent to the Hamming distance from the all-zero string of the same length. For the most typical case, a string of bits, this is the number of 1's in the string...
of the secret value, although exploitable correlations will likely to remain unless the balancing is exactly perfect. This "balanced design" can be approximated in software by manipulating both the data and its complement together.
Several "secure CPUs" have been built as asynchronous CPUs; they have no global timing reference. While these CPUs were intended to make timing and power attacks more difficult, subsequent research found that timing variations in asynchronous circuits are harder to remove.
See also
- Differential power analysis
- Brute-force attack
- Computer surveillanceComputer surveillanceComputer surveillance is the act of performing surveillance of computer activity, and of data stored on a hard drive or being transferred over the Internet....
- Covert channelCovert channelIn computer security, a covert channel is a type of computer security attack that creates a capability to transfer information objects between processes that are not supposed to be allowed to communicate by the computer security policy...
Additional reading
- http://www.cryptography.com/public/pdf/DPA.pdf, Differential Power Analysis, P. Kocher, J. Jaffe, B. Jun, appeared in CRYPTO '99.
- http://www.cryptography.com/public/pdf/TimingAttacks.pdf, Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems, P. Kocher.
- Cryptography.com, Introduction to Differential Power Analysis and Related attacks, 1998, P Kocher, J Jaffe, B Jun.
- Nist.gov, a cautionary Note Regarding Evaluation of AES Candidates on Smart Cards, 1999, S Chari, C Jutla, J R Rao, P Rohatgi
- DES and Differential Power Analysis, L Goubin and J Patarin, in Proceedings of CHES'99, Lecture Notes in Computer Science Nr 1717, Springer-Verlag
- Sidechannelattacks.com, listing of side channel attack related publications and patents
- COSADE Workshop International Workshop on Constructive Side-Channel Analysis and Secure Design