Cardis When Clocks Fail: On Critical Paths and Clock Faults. Michel Agoyan Bruno Robisson Assia Tria. David Naccache Ecole Normale Supérieure

Transcription

1 Cardis 2010 The ninth Smart Card Research and Advanced Application IFIP Conference When Clocks Fail: On Critical Paths and Clock Faults Jean-Max Dutertre Michel Agoyan Bruno Robisson Assia Tria David Naccache Ecole Normale Supérieure Département SAS Équipe mixte CEA-LETI/ENSMSE Site Georges Charpak Centre Microélectronique de Provence 880, route de Mimet Gardanne Département d Informatique Équipe de cryptographie 45, rue d Ulm Paris

2 Introduction! Fault attacks M K C Faulty cipher text Disturb the ciphering process through unusual environmental conditions in order to : reduce the ciphering complexity (e.g. round reduction number) Differential Fault Attack = comparison between correct and faulty cipher texts retrieve information on the encryption process (i.e. information leakage) 2 / 22

3 Introduction! Fault injection means: EM pulse Vcc Over clocking Clk glitch 0 Power glitch Component preparation (opening, thinning, etc.) Source : [Skorobogatov02] 3 / 22

4 Outline " Focus:! Clock modification. Well known. Emphasis on the ability to control the fault injection process : Single bit Confidence, Reproducibility Location control Ease of use 4 / 22

5 Outline " Outline! Why clock faults occur? Fault injection principle. An original and all digital injection platform.! Experimental results. The test chip (AES). Controllability of faults nature and location. Giraud s one-bit attack.! Conclusion and perspectives. 5 / 22

6 Why Clock Faults Occur?! Synchronous IC principle (reminder) propagation delay n-1 m-1 data Combinational D Q logic D Q Dff i Dff i+1 clk Data are captured on the clock s rising edge Time between two rising edges (i.e. clock period) depends on the propagation delay 6 / 22

7 Why Clock Faults Occur? n-1 m-1 data clk Combinational D Q logic D pmax D Q Dff i Dff i+1 D clk#q T clk + T skew - δ su Timing constraint: T clk > D clk!q + D pmax - T skew + δ su Violating this timing constraint results in fault injection. 7 / 22

8 Why Clock Faults Occur? Fault location - Propagation delay delay outputs = f (inputs) n Combinational logic D 0 D 1 D m-1 m f logical function each D i had its own propagation delay inputs outputs Fault location : where delay Di > Tclk setup time Propagation times depend on : the logical states ( 0 / 1 ) the propagation delay changes with the inputs allow to change the fault location the power supply voltage the temperature 8 / 22

9 Fault injection by setup time violation! Fault injection - Over clocking A well known approach decreasing the clock period until faults appear by setup time violation T clk clk propagation delay + setup time T clk fault clk drawback : faults are injected at each clock cycle no timing control 9 / 22

10 ! Fault injection Local over clocking Setup time violation by modifying one clock cycle Fault injection by setup time violation T clk clk T clk - Δ clk fault injection cycle choice fault-nature fine tuning through Δ fine control (one-bit, two-bits faults) δ t variation step = 35 ps Experiment T clk = 10 ns MHz 10 / 22

11 ! Fault injection Local over clocking (cont d) Fault injection by setup time violation clk generation : use of an on chip Delay Locked Loop (Xilinx Virtex-5). Tclk clk clk Tclk - Δ 11 / 22

12 ! Fault injection Local over clocking (cont d) Fault injection by setup time violation clk generation : use of an on chip Delay Locked Loop (Xilinx Virtex-5). Tclk clk Δ/2 clk clk Tclk - Δ 11 / 22

13 ! Fault injection Local over clocking (cont d) Fault injection by setup time violation clk generation : use of an on chip Delay Locked Loop (Xilinx Virtex-5). Tclk clk clk clk Δ clk Tclk - Δ All digital, easy to implement. 11 / 22

14 Experimental results! Experimental setup COM serial trigger Clock generation board AES board COM serial clock 12 / 22

15 Experimental results Δ = 0 13 / 22

16 Experimental results Δ = 20 x 35 ps 13 / 22

17 Experimental results Δ = 40 x 35 ps 13 / 22

18 Experimental results Δ = 60 x 35 ps 13 / 22

19 Experimental results Δ = 80 x 35 ps 13 / 22

20 Experimental results Δ = 100 x 35 ps 13 / 22

21 The test chip! AES 128 bits (Rijndael / FIPS - 197) Round key Plain text 128 Mux AddRoundKey 128 Cipher text 128 Round nb 128 MixColumns 128 ShiftRows 128 SubBytes Round nb clk 128 bits data path clocked on SubBytes inputs loop shape critical path location 14 / 22

22 Experimental results! Controllability of faults nature and location. Targeting the final round of the AES direct reading of the injected faults (by XORing a correct and faulty ciphertext) Test campaign pseudo-code : send the key K and the plaintext T to the test chip Δ 0 15 / 22

23 Target : final round (f clk, nom = 100 MHz) Step by step T clk decrease (δ t = 35 ps) Experimental results Byte index ps T clk - Δ 350ps 7340ps No fault One-bit fault Two-bits fault Other fault Byte nb. 6 D 0 D 1 D 2 D 3 D 4 D 5 No fault D 6 D 7 T clk = ps 16 / 22

24 Target : final round (f clk, nom = 100 MHz) Step by step T clk decrease (δ t = 35 ps) Experimental results Byte index ps T clk - Δ 350ps 7340ps No fault One-bit fault Two-bits fault Other fault Byte nb. 6 D 0 D 1 D 2 D 3 D 4 D 5 No fault D 6 D 7 T clk -Δ 16 / 22

25 Target : final round (f clk, nom = 100 MHz) Step by step T clk decrease (δ t = 35 ps) Experimental results Byte index ps T clk - Δ 350ps 7340ps No fault One-bit fault Two-bits fault Other fault Byte nb. 6 D 0 D 1 D 2 D 3 D 4 D 5 No fault D 6 D 7 T clk -Δ 16 / 22

26 Target : final round (f clk, nom = 100 MHz) Step by step T clk decrease (δ t = 35 ps) Experimental results Byte index ps T clk - Δ 350ps 7340ps No fault One-bit fault Two-bits fault Other fault Byte nb. 6 D 0 D 1 D 2 D 3 D 4 D 5 No fault D 6 D 7 T clk -Δ 16 / 22

27 Target : final round (f clk, nom = 100 MHz) Step by step T clk decrease (δ t = 35 ps) Experimental results Byte index ps T clk - Δ 350ps 7340ps No fault One-bit fault Two-bits fault Other fault Byte nb. 6 D 0 D 1 D 2 D 3 D 4 D 5 Single bit fault D 6 D 7 T clk -Δ 16 / 22

28 Target : final round (f clk, nom = 100 MHz) Step by step T clk decrease (δ t = 35 ps) Experimental results Byte index ps T clk - Δ 350ps 7340ps No fault One-bit fault Two-bits fault Other fault Byte nb. 6 D 0 D 1 D 2 D 3 D 4 D 5 2 faulted bits D 6 D 7 T clk -Δ 16 / 22

29 Target : final round (f clk, nom = 100 MHz) Step by step T clk decrease (δ t = 35 ps) Experimental results Byte index ps T clk - Δ 350ps 7340ps No fault One-bit fault Two-bits fault Other fault Byte nb. 6 D 0 D 1 D 2 D 3 D 4 D 5 3 faulted bits D 6 D 7 T clk -Δ 16 / 22

30 Experimental results Fault nature control : Single bit fault > 90% Single and two bits fault sequence > 70% Single, two, and three bits sequence > 50% high resolution step allows a fine control on the nature of the fault (with a high degree of confidence). 17 / 22

31 Experimental results Location control : plaintext variation Byte index ps 350ps 7340ps Byte nb. 13 No fault One-bit fault Two-bits fault Other fault Byte index Byte nb. 3 Same key Different plaintext 5485ps 7585ps 18 / 22

32 Giraud s one-bit attack 9th round M9 M9 e SR o SB SR o SB SB(M9) SB(M9 e) Final round ARK K10 ARK SB(M9) K10 SB(M9 e) K10 Ciphertext C Ciphertext D C D = SB(M9) SB(M9 e) Solving provides a set of candidates for M9 19 / 22

33 Giraud s one-bit attack Considering : K10 = C SB(M9) We obtain a set of candidates for K10 : s 1 s 3 AC FF 21 0B 3A E DC s 2 : multi bits fault s 4 The set size is decreased iteratively (same key different plaintext) The whole round key was always found. 20 / 22

34 Conclusion! An original and all digital fault injection platform : Fine fault nature control (1-bit fault or more), Very good timing control (choice of the injection cycle), Low location control (plaintext variation), Easy to use and implement (all digital), Require a clock access. A security characterization tool more than an attack platform.! Experimental validation : Giraud s one bit attack, Successful extension to two bits version. 21 / 22

35 Perspectives! A tool for IC and security characterization Number of occurrence Critical time is given for 1-bit faults Critical time (ps) Repeat algorithm times For each 1-bit fault -> retrieve Δ (i.e. critical time) for T, K random -> retrieve error (fault location) 22 / 22

36 Eli Biham and Adi Shamir, Differential fault analysis of secret key cryptosystems, In CRYPTO 97: Proceedings of the 17th Annual International Cryptology Conference on Advances in Cryptology, Lecture Notes in Computer Science, pages Springer, Dan Boneth, Richard A. DeMillo, and Lipton Richard J. On the importance of checking cryptographic protocols for faults. In Advances in Cryptology EUROCRYPT 97, Lecture Notes in Computer Science, pages Springer, Hamid Choukri and Michael Tunstall. Round reduction using faults. Proc. Second Int l Workshop Fault Diagnosis and Tolerance in Cryptography (FDTC 05), J. Daemen and V. Rijmen. Aes proposal: Rijndael, Pierre Dusart, Gilles Letourneux, and Olivier Vivolo. Differential fault analysis on aes. In ACNS: applied cryptography and network security, volume 2846 of Lecture Notes in Computer Science, pages Springer, Toshinori Fukunaga and Junko Takahashi. Practical fault attack on a cryptographic lsi with iso/iec block ciphers. In Proc. of the 2009 Workshop on Fault Diagnosis and Tolerance in Cryptography, FDTC09, pages 84 92, Christophe Giraud. DFA on aes. In H. Dobbertin, V. Rijmen, and A. Sowa, editors, Advanced Encryption Standard AES, volume 3373 of Lecture Notes in Computer Science, pages Springer, Sylvain Guilley, Laurent Sauvage, Jean-Luc Danger, Nidhal Selmane, and Renaud Pacalet. Silicon-level solutions to counteract passive and active attacks. In FDTC 08: Proceedings of the th Workshop on Fault Diagnosis and Tolerance in Cryptography, pages 3 17, H. Choukri, H. Bar-El, D. Naccache, M. Tunstall, C. Whelan. The sorcerer s apprentice guide to fault attacks. In Special Issue on Cryptography and Security 94(2), pages , Michael Hutter Jrn-Marc Schmidt. Optical and em fault-attacks on crt-based rsa: Concrete results. In Proceedings of the 15th Austrian Workhop on Microelectronics, NIST. Announcing the Advanced Encryption Standard (AES). Federal Information Processing Standards Publication, n. 197, November 26, Gilles Piret and Jean-Jacques Quisquater. A differential fault attack technique against spn structures, with application to the aes and khazad. In Proc. Cryptographic Hardware and Embedded Systems (CHES 03),, Lecture Notes in Computer Science, pages 77 88, JJ Quisquater and D Samyde. Eddy current for magnetic analysis with active sensor. In Proceedings of ESmart 2002, page pp Eurosmart, Bruno Robisson and Pascal Manet. Differential behavioral analysis. In Cryptographic Hardware and Embedded Systems, volume 4727 of Lecture Notes in Computer Science, pages Springer, Nidhal Selmane, Sylvain Guilley, and Jean-Luc Danger. Practical setup time violation attacks on aes. In EDCC-7 08: Proceedings of the 2008 Seventh European Dependable Computing Conference, pages 91 96, Sergei P. Skorobogatov and Ross J. Anderson. Optical fault induction attacks. In B.S. Kaliski Jr., C.K. Ko c, and C. Paar, editors, Cryptographic Hardware and Embedded Systems CHES 2002, volume 2523 of Lecture Notes in Computer Science, pages Springer, Sung-Ming Yen and Marc Joye. Checking before output may not be enough against fault-based cryptanalysis. IEEE Transactions on Computers, 49: , Bernhard Fechner, Dynamic delay-fault injection for reconfigurable hardware, Proceedings of the 19th International Parallel and Distributed Processing Symposium 2005.