Wide Collisions in Practice Xin Ye, Thomas Eisenbarth Florida Atlantic University, USA 10 th ACNS Singapore

Overview Side Channel Collision Attacks Wide Collisions for AES Improving Recognition Rates Attack Results

Embedded Systems Specific purpose device with computing capabilities Constrained resources Many require security

Side Channel Attacks … leaks additional information via side channel! e.g. power consumption / EM emanation Leakage plaintext ciphertext

Collisions in AES Collision: Querying same S-box value twice Collision Attack: Exploiting collision detections to recover secret key y1y1 y 4 = y 1 plaintext Add_Key Sub_Bytes S-box 1S-box 4

Collision Detection Collisions are highly frequent: – First round:.41 collisions – One encryption:>40 collisions Detecting collisions is hard: – One encryption: comparisons – Probability of a collision: <0.4% – False positive rate of 1%: >120 faulty detections  Should minimize false positives

Wide Collisions (I)  Two AES encryptions with chosen inputs  Same plaintexts except for diagonals!  AddRoundKey, SubBytes -> same difference

Wide Collisions (II) ShiftRows aligns differences MixColumns can result in equal bytes Collision

Wide Collisions (III)  2 nd ShiftRows results in equal columns  Full column collides until next ShiftRows!  5 predictable S-Box collisions between 2 encryptions! Full Column Collision

Collision Detection Direct Comparison of two power traces Ideally only compared in leaking regions (5 s-Boxes and full MixColumns colliding)  Point selection necessary: – Knowledge of implementation or profiling needed S-box4 S-boxes (in round 3) + S-box in round 2 + Mix Columns

Key Recovery Phase 1 st byte after 1 st MixColumns: 4 collisions reduce key candidates from 2 32 to 1 candidate per diagonal. Full key recovery: 16 distinct collisions.  Avoid false positives

Outlier Method Procedure: Find overall Mean Trace Locate Outlier Region Locate Neighboring Pairs Mean Trace Individual Trace Outlier Region

Outlier Method: Details Two parameters: Size of outlier region Admitted distance between neighboring points Both influence Number of detected collisions Rate of false positives Tradeoff depends on implementation

Results Leaking PointsDetected CollisionsCorrect Detections 1 (R = 0.9, d max = 0.3) % 4 (R = 0.9, d max = 0.3)4671.1% 8 (R = 0.9, d max = 0.3)8893.7%  Wide Collisions stronger, but knowledge of implementation or profiling needed  Blind Templates (+ PCA) are great for device profiling Unprotected SW implementation, 8-bit Smart Card Results on 3000 power traces:

Optimized Collision Detection Targeting Wide Collisions – Strong leakage, easier to detect – Requires chosen inputs Using Outlier Detection method: – Reduces overall detection of collisions – Minimizes false positives

Conclusion Wide collisions yield feasible power based collision attack Outlier Method is a helpful tool for decreasing false positive detections

Thank you very much for your attention!