Sandrine AGAGLIATE, FTFC Power Consumption Analysis and Cryptography S. Agagliate Canal+Technologies P. Guillot Canal+Technologies O. Orcières Thalès Communications

Sandrine AGAGLIATE, FTFC The Problem A secret is hidden into a chip  Ex: Digital Signature… How to find the secret? Which protection against these attacks?

Sandrine AGAGLIATE, FTFC Side Channel Attacks Use leak of information  Power consumption  Electromagnetic radiation  Fault provocation  Computation time

Sandrine AGAGLIATE, FTFC Chip consumption

Sandrine AGAGLIATE, FTFC x Known bit XOR XOR gate consumption

Sandrine AGAGLIATE, FTFC Methods SPA = Simple Power Analysis DPA = Differential Power Analysis …

Sandrine AGAGLIATE, FTFC Counter measures Hardware  Timer  Bus encryption  … Software  Algorithms Constant timing Random Execution

Sandrine AGAGLIATE, FTFC Elliptic Curve Cryptosystems For digital signature Use the computation of Q=k.P k=private key P=data Advantages  small key, small signature size  high security P1 P2 P3=P1+P2

Sandrine AGAGLIATE, FTFC Random Execution Variables blinding  private key k  base point P Randomization of computation algorithm

Sandrine AGAGLIATE, FTFC Ternary techniques: optimisation k i  { -1, 0, 1 } 1111 = = = Q := 0 for i:=max down to 0 Q:=2Q if k i =1 then Q:=Q+P if k i =-1 then Q:=Q-P Result Q=k.P

Sandrine AGAGLIATE, FTFC Binary transducer  ternary 1 : : 0 0 : : : :

Sandrine AGAGLIATE, FTFC Sub-optimal alternate automaton 1 : : 0 0 : : : -1

Sandrine AGAGLIATE, FTFC : : 0 0 : 0 1 / p 0 / q 0 : : 0 –1 / r 1 : : 1 -1 / 1 - p 0 : -1 / 1 - q Randomized automaton 1 : -11 / 1 -r

Sandrine AGAGLIATE, FTFC Performances 2,2%2,1%Gain / previous work without DPA countermeasures 10,6%10,7%Loss / first automaton Key size

Sandrine AGAGLIATE, FTFC Conclusion Power Analysis can reveal secrets Solution: to interfere with power consumption  Ex: random execution Cost : computation speed, memory…