1. Sandrine AGAGLIATE, FTFC 2003 1 Power Consumption Analysis and Cryptography S. Agagliate Canal+Technologies P. Guillot Canal+Technologies O. Orcières Thalès Communications

2. Sandrine AGAGLIATE, FTFC 20032 The Problem A secret is hidden into a chip  Ex: Digital Signature… How to find the secret? Which protection against these attacks?

3. Sandrine AGAGLIATE, FTFC 20033 Side Channel Attacks Use leak of information  Power consumption  Electromagnetic radiation  Fault provocation  Computation time

4. Sandrine AGAGLIATE, FTFC 20034 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 Chip consumption

5. Sandrine AGAGLIATE, FTFC 20035 + x Known bit XOR XOR gate consumption

6. Sandrine AGAGLIATE, FTFC 20036 Methods SPA = Simple Power Analysis DPA = Differential Power Analysis …

7. Sandrine AGAGLIATE, FTFC 20037 Counter measures Hardware  Timer  Bus encryption  … Software  Algorithms Constant timing Random Execution

8. Sandrine AGAGLIATE, FTFC 20038 Elliptic Curve Cryptosystems For digital signature Use the computation of Q=k.P k=private key P=data Advantages  small key, small signature size  high security P1 P2 P3=P1+P2

9. Sandrine AGAGLIATE, FTFC 20039 Random Execution Variables blinding  private key k  base point P Randomization of computation algorithm

10. Sandrine AGAGLIATE, FTFC 200310 Ternary techniques: optimisation k i  { -1, 0, 1 } 1111 = 1000-1 -11 = 0-1 111101111 = 1000-1000-1 Q := 0 for i:=max down to 0 Q:=2Q if k i =1 then Q:=Q+P if k i =-1 then Q:=Q-P Result Q=k.P

11. Sandrine AGAGLIATE, FTFC 200311 Binary transducer  ternary 1 : 1 0 0 3 1 2 0 1 0 : 0 0 : 0 1 0 0 : -1 0 1 1 : 0 -1 1 : 0 -1 0 0

12. Sandrine AGAGLIATE, FTFC 200312 Sub-optimal alternate automaton 1 : 1 0 01 2 0 1 0 : 0 0 : 0 1 1 1 : 0 0 0 : -1

13. Sandrine AGAGLIATE, FTFC 200313 1 : 1 0 0 3 1 2 0 1 0 : 0 0 : 0 1 / p 0 / q 0 : -1 0 1 1 : 0 –1 / r 1 : 0 -1 0 0 0 : 1 -1 / 1 - p 0 : -1 / 1 - q Randomized automaton 1 : -11 / 1 -r

14. Sandrine AGAGLIATE, FTFC 200314 Performances 2,2%2,1%Gain / previous work without DPA countermeasures 10,6%10,7%Loss / first automaton 300 160Key size

15. Sandrine AGAGLIATE, FTFC 200315 Conclusion Power Analysis can reveal secrets Solution: to interfere with power consumption  Ex: random execution Cost : computation speed, memory…