1. 1 Information Security – Theory vs. Reality 0368-4474-01, Winter 2012-2013 Lecture 13: Cryptographic leakage resilience (cont.) Eran Tromer Slides credit: Yuval Ishai, Manoj Prabhakaran

2. 2 PrimitiveAttacksGuaranteesFunction ality Communi cation Assumpti ons Leakag e TamperingCorrectne ss SecrecyFunction class Output form FHEANYnoneyesYESCircuitsEncryptedMinimalComputati onal ANYno Arguments (CS proofs / PCD / SNARG) ANY YESnoRAM, distributed PlaintextMinimalExotic computati onal / oracle MPCANY YES ANYPlaintextHeavy interaction Mild computati onal Garbled circuits ANYnoneyesYESCircuitsPlaintextPreproces sing + minimal Mild computati onal ANYno Leakage resilience VariesnoneyesYESVariesPlaintextMinimalVaries Tamper resilience Varies PlaintextMinimalVaries ObfuscationANY YES PlaintextMinimal0=1 TPMSecure hardware

3. Leakage resilience s x y=y(s,x) s’ x y=y(s,x) Same I/O functionality Keeps secret even in the presence of side-channel attacks: leakage and tampering 3

4. INPUT OUTPUT CIRCUIT MEMORY Model Circuits runs for many cycles In each cycle: –Adversary chooses input –Adversary chooses an admissible attack Leakage and/or tampering from a specified class –Adversary observes output + leakage –Memory state is updated 4

5. INPUT OUTPUT CIRCUIT MEMORY Circuit transformers T=(T C,T s ), on inputs k,t, maps C to C’ and s 0 to s 0 ’. T s must be randomized –Otherwise initial state s 0 is revealed by probing C’ can be either randomized or (better yet) deterministic. Functionally equivalent: C[s 0 ]  C’[s 0 ’] C INPUT OUTPUT CIRCUIT MEMORY T C’ s0s0 s0’s0’ 5

6. 6 s xY Any boolean circuit Circuit transformation Transformed circuit admissible leakage YX black-box indistinguishable Security [Ishai Sahai Wagner ’03]

7. INPUT OUTPUT CIRCUIT MEMORY Security definition T protects privacy:  circuit C  efficient Sim  admissible Adv  initial state s 0 : Sim Adv,C[s0]  view of Adv attacking C’[s 0 ’] (Even in case of tampering, only privacy is required) C INPUT OUTPUT CIRCUIT MEMORY T C’ s0s0 s0’s0’ 7

8. INPUT OUTPUT CIRCUIT MEMORY Relation to obfuscation C’[s 0 ’] should act like a “virtual black-box” for C[s 0 ]. –Even in the presence of side-channel attacks Negative results for obfuscation [BGI+01,GK05] restrict classes of attacks that can be tolerated –Can’t probe all wires in a single cycle –Can’t leak an arbitrary predicate of the state [BGI+01,GK05,DP06] –Can’t freely “edit” gates and wires C INPUT OUTPUT CIRCUIT MEMORY T C’ s0s0 s0’s0’ 8

9. Simple/practical schemes I Sum-of-wires leakage –Dual-Rail Logic Sum-of-wire-transitions leakage –Dual-Rail Precharge Logic Protecting s Practical complications: –Capacitance imbalance –Glitches –Cell internals 9

10. Simple/practical schemes II Single-wire leakage –Bit masking Single-”value” leakage –RSA blinding t-wire leakage –Secret sharing… 10

11. t-wire leakage [ISW03] Secrets additively shared into m=2t+1 shares Given shares of a=a 1  …  a m and b=b 1  …  b m : –Compute shares of NOT(a) : apply NOT to a 1 –Compute shares c i of a AND b : Let z i,j, i<j, be random independent bits Let z j,i =(z i,j  a i b j )  a j b i (i<j) Let c i =a i b i   j  i z i,j Re-randomize s’ at every iteration Randomness gates eliminated by a random-number generator s0’s0’ 11

12. 12 s XY Any boolean circuit Circuit transformation Transformed circuit t-wire probing YX black-box indistinguishable [ISW03]

13. 13 Our goal Allow stronger leakage.

14. 14 Leakage classes Locality assumptions –Single wire, t wires –Separate sub-circuits –Leak-free processor (Oblivious RAM [GO95]) –Leak-free memory (“only computation leaks information” [MR04]: leakage from CPU state and memory accessed at that program step) “Simple leakgage” –Sums and Hamming weights –Low-complexity global functions Specific functionality (mainly crypto)