Fault Attacks Made Easy: Differential Fault Analysis Automation on Assembly Code

Transcription

1 Fault Attacks Made Easy: Differential Fault Analysis Automation on Assembly Code Jakub Breier, Xiaolu Hou and Yang Liu 10 September / 25

2 Table of Contents 1 Background and Motivation 2 Overview of DATAC DFA Automation Tool for Assembly Code 3 Case Study on PRESENT Cipher 4 Conclusion 2 / 25

3 Table of Contents 1 Background and Motivation 2 Overview of DATAC DFA Automation Tool for Assembly Code 3 Case Study on PRESENT Cipher 4 Conclusion 3 / 25

4 Fault Injection Attacks Fault (injection) attacks are classified as semi-invasive physical attacks often, a device depackaging is required. Exploit the possibility to insert a fault in the process of the algorithm execution in a way that could help to reveal the key. The idea of fault attacks was introduced by Boneh, DeMillo and Lipton in D. Boneh, R. A. DeMillo, and R. J. Lipton. On the Importance of Checking Cryptographic Protocols for Faults, EUROCRYPT / 25

5 Fault Injection Techniques in Practice Voltage glitching EM injection Laser fault injection 5 / 25

6 Differential Fault Analysis One of the most popular FA techniques to attack symmetric block ciphers. Introduced by Biham and Shamir, targeting DES 2. Attacker injects a fault in a chosen round of the algorithm to get the desired fault propagation at the end of encryption. The secret key can then be determined by examining the differences between the correct and a faulty ciphertext. Round 1 Round i Round n Original Ciphertext Plaintext Compare 2 E. Biham and A. Shamir. Differential Fault Analysis of Secret Key Cryptosystems, CRYPTO 97. Round 1 Round i Round n Faulty Ciphertext 6 / 25

7 Why Automation? All the current symmetric block ciphers have been shown vulnerable against fault attacks (especially DFA). The question is not whether the algorithm is secure or not, but which part of it is insecure. Automated methods can provide an answer fast and with minimal need of human intervention. 7 / 25

8 Why Automation on Assembly Code? In practice, the attack always has to be mounted on a real-world device. Different implementations of the same encryption algorithm do not necessarily share the same vulnerabilities. There might be an exploitable spot in the implementation that is not visible from the cipher design. There are works on fault analysis of a cipher from the cipher design level, there is no work aiming at DFA on the assembly code level. 8 / 25

9 Table of Contents 1 Background and Motivation 2 Overview of DATAC DFA Automation Tool for Assembly Code 3 Case Study on PRESENT Cipher 4 Conclusion 9 / 25

10 DATAC DFA Automation Tool for Assembly Code 10 / 25

11 Assumptions Known-ciphertext model and a single fault adversary. The implementation is available to the attacker and he can add annotations to the assembly code for the purpose of distinguishing different rounds, round keys, ciphertext words, etc For the analysis in this work, we have chosen Atmel AVR instruction set. However, for analyzing different instruction sets, only the parsing subsystem of the analyzer has to be redefined. Also, the methodology is universal. The implementation is unrolled, no direct/indirect jumps. 11 / 25

12 Example Program and Data Flow Graph # Instruction //load plaintext 0 LD r0 X+ 1 LD r1 X+ //round 1 2 LD r2 key1+ 3 LD r3 key1+ 4 EOR r0 r2 5 EOR r1 r3 6 ANDI r0 0x0F 7 ANDI r1 0xF0 8 OR r0 r1 //round 2 9 LD r2 key2+ 10 LD r3 key2+ 11 EOR r0 r2 12 EOR r1 r3 //store ciphertext 13 ST x+ r0 14 ST x+ r1 load_plaintext X+ (0) ld (0) ld (1) r0 (0) r1 (1) eor (4) round_1 key1+ (2) 0xF0 (7) ld (2) ld (3) r2 (2) r3 (3) eor (5) eor (4) eor (5) andi (7) 0x0F (6) r0 (4) r1 (5) andi (6) andi (6) andi (7) round_2 r0 (6) r1 (7) key2+ (9) or (8) or (8) ld (9) ld (10) r0 (8) eor (12) r2 (9) r3 (10) eor (11) eor (11) eor (12) r0 (11) r1 (12) st (13) st (14) store_ciphertext x+ (13) x+ (14) 12 / 25

13 Output Criteria Selection of Vulnerable Nodes minaffectedct: minimal number of ciphertext nodes affected by the vulnerable node; mindist: minimal number of non-linear instructions between the node and a ciphertext node for at least minaffectedct nodes; maxdist: maximum distance between the node and all the ciphertext nodes; maxkey: the number of the round keys, counting from the last round key, that are related to node a is at most maxkey; minkeywords: there exists at least one round key such that the number of its corresponding key word nodes related to a is at least minkeywords. 13 / 25

14 Subgraph Example r1 (5) 0xF0 (7) r0 (4) 0x0F (6) andi (7) andi (7) andi (6) andi (6) r0 (6) r1 (7) key2+ (9) key2+ (9) r1 (7) r0 (6) or (8) or (8) ld (9) ld (10) ld (9) ld (10) or (8) or (8) r0 (8) r2 (9) r3 (10) r2 (9) r3 (10) r0 (8) eor (11) eor (11) r0 (11) eor (11) r0 (11) eor (11) x+ (13) st (13) x+ (13) st (13) (a) (b) Subgraphs for node r0 (6) with depth (a) 0 and (b) 1, output criteria (minaffectedct, mindist, maxdist, maxkey, minkeywords)= (1, 1, 1, 1, 1) 14 / 25

15 DFA Equations Example r0 (6) = r0 (4) 0x0F (6) (1) r1 (7) = r1 (5) 0xF0 (7) (2) r0 (8) = r0 (6) r1 (7) (3) r2 (9) = key2[0] (4) r0 (11) = r0 (8) r2 (9) (5) x+ (13) = r0 (11). (6) r1 (5) 0xF0 (7) r0 (4) 0x0F (6) andi (7) andi (7) andi (6) andi (6) key2+ (9) r1 (7) r0 (6) ld (9) ld (10) or (8) or (8) r2 (9) r3 (10) r0 (8) eor (11) eor (11) r0 (11) st (13) x+ (13) (1): r0 (6) = 0000b 4 b 5 b 6 b 7, b j {0, 1} (j = 4, 5, 6, 7). (3): if we skip instruction 8, the result of (1) will be used in instruction 11 (5) instead of the result of (3) (4) and (6): the instruction skip attack on instruction 8 would result in the first four bits of key2[0] to appear as the first four bits of the faulted ciphertext. 15 / 25

16 Table of Contents 1 Background and Motivation 2 Overview of DATAC DFA Automation Tool for Assembly Code 3 Case Study on PRESENT Cipher 4 Conclusion 16 / 25

17 PRESENT Cipher Block length: 64 bits Key length: 128 bits or 80 bits Based on SPN with following operations: addroundkey: xor with the round key sboxlayer: 4 bit SBox player: bitwise permutation 31x Plaintext addroundkey sboxlayer player addroundkey Ciphertext 17 / 25

18 8 (11) ldi (10) totalround (10) 4 (10) r1 (26) r6 (471) r14 (445) r10 (263) movw (471) movw (445) movw (263) eor (474) eor (448) r10 (419) r6 (393) eor (266) add (18) r9 (4) mul (26) r0 (470) r0 (444) movw (419) r0 (262) r6 (237) movw (393) r12 (131) eor (31) r0 (30) carry (18) x+ (593) r1 (496) r1 (418) add (18) eor (396) r14 (367) r1 (288) r1 (262) eor (240) r1 (212) r1 (156) r8 (105) r9 (31) add (18) st (593) r1 (444) eor (422) r0 (418) r0 (392) mul (262) adc (19) add (18) r4 (9) r8 (573) r6 (474) r10 (266) movw (131) r1 (130) eor (113) mul (26) r1 (470) r14 (448) r1 (238) eor (214) mul (418) movw (367) mul (262) r6 (240) eor (240) r0 (130) eor (37) eor (31) r9 (18) adc (19) x+ (589) eor (246) movw (237) eor (139) r8 (582) r1 (522) r0 (496) eor (474) mul (418) movw (573) r6 (396) r4 (157) r10 (3) movw (497) movw (105) r10 (19) mul (30) adc (19) ld (4) r0 (26) eor (480) mul (470) movw (289) r0 (288) eor (272) eor (266) r1 (264) r14 eor (214) (214) r8 (113) r1 (52) st (589) eor (582) eor (581) r1 (572) r10 (458) mul (444) mul (444) r10 (422) r1 (392) r0 (366) r10 (341) r14 (211) movw (157) r0 (156) mul (496) r6 (402) eor (402) eor (370) r14 (289) mul (156) r1 (472) eor (454) r6 (246) r1 (33) mul mul (288) (288) r0 (182) mul (130) mul (130) r0 (104) eor (582) r0 (572) eor (428) eor (396) r0 (236) r8 (183) adc (19) ld (3) eor (555) ld (458) key18+ (456) r6 (432) r14 (250) mul (238) r0 (212) movw (183) r1 (56) ld (9) r0 (522) r10 (497) mul (496) eor (422) mul (392) eor (344) r9 (223) mul (156) r12 (139) r9 (37) x+ (592) r12 (568) r8 (581) eor (448) r1 (182) mul (572) mul (572) r1 (553) mul (470) key15+ (378) eor (140) eor (556) r4 (555) eor (220) movw (211) eor (165) eor (114) eor (113) r1 (104) mul (56) eor (23) adc (19) eor (568) mul (522) eor (466) r14 (370) r10 (344) eor (292) r10 (272) mul (212) r13 (219) eor (213) r5 (8) ld carry (8) mul (56) eor (37) (19) eor (581) mul (553) mul (522) r6 (480) eor (440) r10 (428) r1 (420) r1 (394) eor (258) mul (238) r1 (111) adc (19) x+ eor (2) (35) add (564) ld (459) r1 (446) ld (378) ld (381) eor (246) ld (379) ld (380) mul (392) movw (341) mul (264) mul (212) r9 (187) r12 (140) r8 (114) st (592) r4 (556) eor (555) r14 (454) r5 (431) eor (370) r13 (23) mul (52) r0 (238) mul (236) eor (219) r13 (213) movw (27) r9 (564) eor (500) eor (480) mul (472) adc (410) eor (344) r14 (292) eor (272) r13 (249) r10 (224) r4 (165) add (122) r0 (85) r0 (56) adc (45) eor (22) mul (33) eor (568) r9 (583) r4 (547) r15 (533) eor r10 (528) (506) eor (428) r11 (381) r1 (342) r0 (527) ld (457) ld (456) r11 (459) eor (376) eor (191) ld (431) ld (432) r15 (251) r0 (210) mul (182) eor (58) eor (23) ld (6) carry (21) eor (577) add (564) r1 (579) eor (533) r15 (528) r0 (290) eor (193) mul (104) r13 (15) adc (20) adc (20) ld (2) ld (5) adc (21) r8 (378) adc (410) eor (402) r9 (379) r1 (368) eor (292) eor (231) r1 (186) eor (583) movw (523) ld (250) r14 (220) eor (139) r7 (86) eor (86) r10 (466) adc (488) eor (454) ld (223) eor (232) adc (227) mul (104) add (564) r14 (376) r0 (316) r9 (535) mul (553) adc (541) adc (488) r10 (380) mul (366) adc (254) eor (219) r9 (193) eor (187) mul (182) r0 (160) r12 (92) mul (111) mul (85) adc (45) carry (45) r8 (35) r7 (6) adc (21) eor (506) r6 (440) r14 (414) adc (253) eor (239) r13 (122) carry (20) adc (462) eor (388) r1 (366) r1 (290) r14 (258) ld (251) adc (253) add (148) carry (253) r10 (232) adc (227) r8 (66) mul (85) r15 (65) r15 (60) eor (36) adc (21) r9 (577) eor (543) eor (161) carry (564) ld (535) r0 (553) r0 (340) adc (280) ld (249) r0 (186) eor (166) carry (541) key17+ (430) r1 (416) ld (92) eor (91) eor (65) adc (514) r10 (500) r11 (488) r8 (456) ld (433) r7 (433) eor (414) adc (384) eor (350) r5 (245) r5 (205) eor (188) add (148) r13 (93) r1 (80) eor (60) r0 (59) add (44) r8 (36) mul (30) eor (35) r1 (85) ld (7) r12 (560) r9 (457) r13 (453) adc (435) r10 eor (388) (388) eor (135) r0 (368) mul (368) ld (224) eor (583) add (564) adc (514) r6 (227) r1 (208) adc (201) r9 (543) eor (556) adc (541) eor (533) adc (279) eor (245) mul (186) r5 (119) r14 (523) adc (488) adc (487) adc (461) eor (389) r7 (384) mul (394) adc (384) mul (316) key10+ (248) eor (187) add (122) ld (93) eor (57) adc (20) adc (20) eor (439) adc (461) eor (245) eor (231) eor (114) key4+ (92) r7 (91) ld (66) eor (36) r8 (5) eor (577) key21+ (534) movw (547) eor (291) eor (506) eor (466) r14 (435) mul (342) r13 (135) eor (467) adc (436) mul (368) r14 (279) adc (280) adc (254) eor (205) r4 (166) r5 (161) eor (165) mul (111) r12 (22) r11 (20) mul (33) r11 (2) adc (20) r4 (88) add (44) add (44) eor (86) adc (21) adc (21) eor (100) adc (73) r14 (58) r8 (27) r0 (579) mul (579) eor (554) eor (528) adc (487) adc (461) r11 (410) eor (140) adc (45) adc (46) adc (435) adc (436) carry (410) r0 (342) r1 (314) mul (290) eor (257) mul (264) r5 (239) r8 (191) mul (186) x+ (588) adc (565) mul (527) r15 (493) adc (488) eor (453) eor (376) mul (366) eor (213) eor (161) r1 (137) carry (567) r4 (508) adc r9 (254) add eor (122) (101) r0 (111) eor (74) r10 (68) adc (20) r7 (519) adc (541) adc (461) adc (462) adc (409) mul (290) eor (258) (231) adc (488) carry (487) carry (488) key9+ (222) eor (167) carry (148) eor (127) eor (126) add (44) ld (15) adc (21) st (588) r13 (569) adc (514) adc (410) add (226) ld (537) eor (492) eor (502) r7 (462) carry (461) eor (441) eor (439) eor (386) mul (420) eor (398) r0 (394) carry (384) eor r9 (369) (349) eor (220) add (174) r1 mul (316) (316) eor (317) r0 (264) adc (99) adc (47) r0 (576) r4 (541) eor (519) adc (514) eor (453) carry (434) adc (435) adc adc (410) (411) mul (342) eor (298) carry (280) adc (253) r14 (201) mul (210) r10 (188) r5 (167) r5 (148) add (148) eor (135) eor (88) ld (68) key3+ (66) eor (65) adc (45) carry adc (46) ld (560) eor (580) mul adc (567) ld (534) adc (541) adc (462) eor (440) r13 (297) adc (279) add (252) add (226) ld (95) mul (80) (44) adc (99) eor (87) carry (73) r14 (45) adc (45) carry (46) eor (34) r0 (33) r8 (21) r6 (7) adc (579) r8 (542) eor (569) (567) adc (541) adc (540) r15 (514) eor (507) r11 (389) r10 (350) eor (343) adc (279) adc (254) r6 (198) adc (201) eor (500) eor (493) adc (489) adc (488) mul (472) ld (430) mul (446) eor (414) adc (410)adc (410) carry (411) eor (387) mul (394) adc (279) carry (227) eor (193) eor (188) mul add (160) (148) r5 (127) eor (141) r0 (134) ld (94) add (96) eor (64) eor (34) r13 (561) r11 (254) adc (253) eor (569) adc (565) eor (557) carry (514) r7 (559) ld (536) eor (516) r13 (447) eor (259) eor (239) adc (228) eor (543) r10 (487) adc (227) add (174) r13 (101) r7 (554) r7 (511) r11 (467) adc (384) r12 (100) add (96) carry adc (99) (99) ld (69) adc (73) eor (60) mul (59) r0 (546) adc (384) eor (375) r13 (369) eor (297) adc (253) ld (222) adc (227) mul (208) add (122) eor (24) carry adc (540) eor adc (465) (489) adc (358) r5 (323) mul (340) carry (200) eor (91) r8 (74) eor (88) mul (52) adc (47) r5 (439) r12 adc (435) carry (409) r1 (340) r7 (72) r1 (30) eor (25) adc (541) eor (526) adc (437) r13 (291) r10 (565) adc (567) eor (559) r14 (492) carry (278) eor (232) eor (205) ld (561) adc (567) eor (493) r6 (461) adc (462) adc (411) r13 (375) eor (349) adc (228) eor r9 (194) (174) adc (175) r10 (185) r1 (163) eor (141) r11 (69) r12 (47) r11 (537) adc (384) adc (305) r5 (226) eor (206) eor (192) r4 (126) mul (137) eor (112) r14 (64) r13 (44) adc (47) r11 (34) eor (542) eor (545) eor (519) eor (464) adc (227) adc (461) adc (462) eor (441) r9 (271) adc (280) carry (252) r8 (99) adc (99) adc (72) adc r13 (73) mul (576) adc (409) r7 (398) r6 (362) ld (248) adc (227) eor (191) (57) adc (45) adc (46) eor (22) adc (487) adc (487) carry (436) adc (357) adc (201) adc (149) carry (122) eor (76) eor (57) adc (47) mul (28) eor (554) ld (508) eor (323) eor (518) adc (435) adc (409) adc (331) mul (314) adc (279) add (278) mul (236) r13 (483) adc add (434) adc (383) adc (384) eor (126) eor (100) adc (72) adc (514) adc (515) r11 (507) eor (398) eor (362) adc (280) key22+ (560) eor (585) r11 (580) r8 (567) eor (559) (513) adc (515) r8 (489) add (460) r15 (436) r15 (358) adc (565) r10 (536) carry (489) eor (465) r8 (534) r11 (502) eor (283) adc (228) ld (119) eor (77) r7 (540) eor (507) adc (487) r7 (441) eor (424) r9 (343) adc (253) ld (67) adc (72) eor (58) eor (51) r13 (200) add (200) ld (511) r4 (516) adc (514) adc (461) r8 (386) adc (385) eor (349) eor (271) r10 (194) r10 adc (175) (175) adc (149) r15 (95) r14 (24) adc (47) r15 eor (25) (39) mul (340) r6 (305) adc (279) carry adc (226) (228) r6 (206) add (200) carry (174) eor (127) eor (115) carry (96) eor (64) adc (72) key1+ (14) r11 (585) eor (545) adc (436) adc (436) r0 (397) adc (385) adc (383) eor (542) r12 (515) adc (515) adc (487) r14 (406) r5 (401) adc (357) eor (323) r5 (317) r15 (280) adc (281) r13 (257) carry (254) ld (225) r8 (222) eor (179) eor (166) r13 (141) adc (151) r4 (118) r14 (94) adc (99) adc (123) r11 (77) add (252) adc (72) carry (72) r7 (51) eor (39) ld (14) st (590) adc (565) adc (515) eor (476) carry (460) carry (435) adc (331) ld (563) eor (571) adc (567) adc (540) eor (481) eor (447) adc (411) eor (389) r7 (363) eor (318) adc (305) adc (149) mul (134) adc (125) eor (76) r4 (87) eor (49) r15 (46) adc (46) eor (362) adc (358) adc (280) r6 (539) adc (540) r1 (498) carry (279) r15 (485) eor (491) adc (489) adc (462) mul (416) eor (265) eor (230) add (200) add (200) eor (167) eor (152) eor (257) adc (125) eor (101) r9 (96) adc (72) eor (585) carry (565) r9 (465) adc (489) carry (383) eor (230) adc (99) adc (98) adc (73) adc (73) eor (50) r5 (557) mul (546) add (434) adc (435) adc (409) adc (383) carry (331) eor (297) adc (149) adc (46) eor (544)r11 (545) key20+ (508) adc (513) eor (491) eor (479) r0 (472) eor (447) eor (401) eor (395) adc (383) carry (357) eor (350) eor (309) r10 (253) r8 (192) adc (201) r13 (179) eor (77) eor (48) ld (17) x+ (590) ld (562) eor (580) adc (565) eor (544) carry (513) eor (467) r4 (430) adc (437) adc (409) adc (305) eor (284) adc (280) add (174) r6 (149) mul (163) eor (38) r11 (39) eor (25) carry (47) r12 (14) adc (539) eor (492) mul (498) carry (486) add (486) carry (462) eor (403) r9 (387) r14 (298) r7 (228) ld (198) r14 (123) r11 (117) eor (117) adc (254) adc (201) r11 (112) carry (71) r4 (73) eor r6 (63) (50) adc (47) r0 (28) adc (175) adc (151) carry (151) adc adc (540) r13 (413) adc (566) (567) eor (413) adc (411) adc (411) add (408) r15 (259) r5 (197) eor (103) adc (97) adc (97) adc (565) r6 (518) r9 (427) eor add (74) adc (539) adc (540) eor (530) r14 (526) r5 (479) eor (502) adc adc (489) add (460) eor (427) eor (375) r6 (354) r13 (335) r6 (324) eor (271) mul (210) adc (125) (96) eor (298) adc (71) r6 (284) ld (118) adc (123) eor (50) r6 (42) eor (24) r1 (189) add (174) eor (103) add (96) r0 (52) adc (46) eor (32) r15 (563) r15 (571) carry (515) mul (527) r10 (409) eor (403) eor (387) adc (358) r9 (309) adc (202) eor (109) adc r9 (67) ld (16) eor (571) adc (566) eor (438) adc (566) adc (566) r10 (544) r5 (538) eor (532) r8 (464) adc (463) adc (436) eor (291) eor (204) carry (98) r10 (98) eor (412) r9 (408) eor (335) r8 (230) r4 (196) eor (153) adc (123) adc (125) (76) adc (71) adc (305) eor (194) eor (51) carry eor (532) add (434) adc adc (436) (437) eor (324) adc (513) eor (526) add (408) eor (369) adc (331) r12 (248) adc (254) carry (149) eor (102) adc (305) adc (281) eor (268) adc (255) carry (228) eor (178) movw (185) r9 (115) mul (80) adc (73) r15 (17) movw (29) carry eor (125) (117) st (586) eor (557) eor (551) adc (539) r4 (438) adc (409) r4 (385) eor (363) adc (357) eor (335) mul (576) r14 (532) ld (510) ld (483) adc (515) adc (463) eor (450) r12 (412) eor (401) r6 (383) add (278) eor (206) adc (175) mul (137) r10 (97) adc (97) r10 (331) add (330) adc (255) adc (151) key5+ (118) eor (112) eor (75) adc (71) adc (539) add (538) r14 (513) r13 (491) eor (438) r13 (434) mul (446) eor (427) eor (421) eor (400) carry (385) r14 (357) r13 (327) adc (332) carry (305) eor (294) eor (259) add (226) adc (123) eor (115) adc (97) r5 (49) r14 (55) add (486) eor (473) r14 (562) r11 (566) carry (566) add mul (498) mul (501) r1 (512) (524) r0 (501) r7 (481) eor (455) mul (420) r6 (318) add (278) adc (255) r9 (153) adc (98) eor (75) ld (197) r6 (71) r10 (38) mul (59) eor (386) carry (408) ld (509) r12 (530) eor (516) adc (513) ld (485) r4 (463) adc (463) r11 (424) adc (437) adc (357) adc adc (332) r5 (283) eor (256) r11 (225) eor (204) adc carry (202)(201) r1 (210) r8 (152) mul r9 (75) add (358) (356) r0 (163) adc (163) r5 (551) add adc (538) mul (539) (548) eor (343) adc (331) carry (281) add (226) (149) r15 (143) carry (97) eor (87) adc (71) eor (518) eor (479) eor (464) add (434) mul (397) eor (361) r9 add (252) eor adc (63) (71) r7 (43) eor (570) eor (517) r0 (446) add (356) adc (357) adc (331) adc (305) adc (255) r1 (236) adc (228) r0 (137) adc (123) r12 (125) r15 (103) r9 (109) adc (98) r4 (48) ld (42) eor (38) r14 (16) x+ (586) eor (570) eor (558) r1 (548) adc r14 (515) (484) eor (481) r7 (476) adc (463) eor (426) add (408) eor (377) eor (372) adc (358) adc (332) adc (332) r9 eor (265) (265) ld (196) eor (192) adc (201) adc (177) add (70) add (70) movw (55) adc (566) r5 (517) add (538) add (538) carry (512) adc (513) r1 (527) add (486) eor (478) adc (437) ld r8 (406) (411) r14 (336) carry (330) r0 (319) adc (306) add (304) adc (281) eor (233) adc (175) adc (149) adc (151) eor (138) r4 (204) adc (202) eor (164) adc (151) r13 (63) ld (43) movw (53) mul (54) r10 (29) eor (551) adc (539) add (460) r9 (421) r1 (423) r7 (403) r5 (395) adc (383) adc (357) add (330) eor (256) adc (229) adc (228) mul (208) eor (143) adc (125) eor (102) r11 (98) eor (90) adc (71) adc (566) carry (538) ld (484) r8 (426) mul (423) adc (411) r7 (355) eor (324) eor adc (317) (306) mul (189) mul (160) eor (49) r1 (338) r4 (151) adc (150) r5 (361) eor (363) r7 (164) eor (143) r5 (70) carry (70) mul (54) r10 (32) eor (32) adc (385) r8 (255) eor (244) r15 (202) r14 (180) ld (121) eor (129) adc (97) adc (98) eor (531) eor eor (505) eor (415) carry adc (123) (123) adc (124) adc (124) mul (517) (548) add (512) adc (463) adc (513) r5 (473) r15 (415) eor (413) add (408) eor (336) eor (309) carry (304) r11 (233) eor (242) carry (177) r13 (278) r12 (256) adc (150) carry (356) key8+ (196) r15 (138) mul (134) r14 (102) eor (89) mul (423) adc (385) adc (385) st (587) r14 (570) r1 (576) mul (546) r6 (510) eor (452) carry (463) key19+ (482) mul (524) eor (473) r5 (460) mul (442) eor (424) adc (229) adc (97) eor (48) key2+ (40) r0 (54) eor (412) adc (383) adc (385) ld (354) adc (331) carry (333) carry (307) adc (177) r6 (128) r6 (558) eor (218) ld (120) adc (124) r0 (550) r13 (531) r12 (490) r0 (498) eor (429) eor (273) eor (109) eor (83) mul (82) add (70) eor (62) eor (128) eor (138) adc (125) eor (336) r5 (41) add (252) adc (202) ld (41) x+ (587) mul (550) r5 (509) eor (530) mul (501) eor (476) adc (463) r0 (442) eor (429) eor (421) r4 (400) eor (395) add (382) r14 (328) carry (332) adc (333) adc (306) eor (233) adc (229) eor (169) adc (124) eor (578) eor (529) eor (179) eor (164) adc (151) adc (98) r0 (80) mul (82) eor (490) r4 (352) add (304) carry (255) r4 (229) add (70) ld (40) r1 (59) carry (437) mul (314) adc (307) eor (284) carry (175) r4 (79) r1 (54) eor (584) mul (574) eor (558) ld (482) eor (499) r9 (486) adc (306) eor (270) r7 (129) r15 (124) carry (124) r0 mul (108) (108) mul (574) mul (550) eor (499) add (382) eor (360) ld (327) r15 (294) r12 (178) eor (180) r13 (512) add (460) r9 (505) r15 (455) r15 (450) r0 (423) r13 (356) carry (358) adc (281) adc (177) r0 (184) r5 (89) eor (584) r10 (578) eor (455) adc (437) eor (425) eor (360) r7 (207) adc (281) adc (177) adc (150) adc (150) eor (552) r1 (546) mul (475) r0 (420) r4 adc (307) (307) eor (129) eor (89) r12 (62) r4 (40) r1 (550) add (512) eor eor (505) (490) r9 (499) add (486) eor (426) ld (355) carry (306) eor (282) eor (294) r0 (293) add (278) r11 (268) eor (247) ld (199) r14 (172) adc (175) eor (155) eor (128) eor (116) r5 (83) adc (229) eor (83) eor (61) r10 (584) r4 (478) r0 (574) r1 (574) r6 (552) r0 (548) eor (531) eor (504) mul (442) r5 (382) r4 (360) adc (358) r11 (332) r10 (310) adc (307) adc (255) adc (176) r11 (429) r12 (404) r12 (218) mul (108) r15 (377) adc (177) r7 (150) r0 (82) r12 (53) eor (578) r0 (475) adc (359) adc eor (320) eor (152) carry (150) r1 (134) r7 (121) r6 (90) movw (81) movw (79) eor (552) eor (525) add (512) r12 (452) movw (443) add (333) (330) mul (319) r12 (281) r7 (169) eor (62) eor (450) eor (415) mul (416) ld (352) ld (328) r9 (330) adc (307) eor (273) r4 (244) eor r0 (207) (208) carry adc (202) (203) r8 (177) eor (153) eor (142) eor (361) eor (377) st (591) mul (524) r12 (529) movw (575) movw (549) r12 (482) mul (494) ld (404) r15 (337) eor (311) eor (283) adc (202) adc (124) adc (124) mul (468) mul (78) mul (475) mul (449) adc (332) adc (333) eor (216) eor (180) adc (177) r10 (154) eor (154) r1 (501) key16+ (404) eor (299) r8 (270) eor (90) r1 (82) eor (61) x+ (591) mul (494) eor (400) r15 (372) mul (338) r10 (575) r6 (549) r9 (301) eor (318) adc (307) adc (281) eor (268) adc (255) eor (207) adc (176) eor (84) r0 (449) carry (382) r5 (304) mul (293) r7 (242) adc (203) adc (150) r1 (108) mul (106) mul (106) mul (78) r13 (525) mul (468) r8 (425) r13 (405) ld (405) eor (346) adc (332) eor (310) eor (169) r6 (120) r0 (78) r12 (61) r1 (494) mul (397) key14+ (352) eor (337) adc (333) r4 (282) eor (247) eor (221) adc (203) carry (176) eor (136) r10 (116) r6 (81) eor (525) r0 (524) r8 (504) r1 (468) eor (110) eor (84) r6 (84) eor (503) eor (478) r12 (443) ld (407) r12 (359) eor (337) key13+ (326) adc (307) mul (286) r0 (267) r12 (203) r15 (173) r1 (160) adc (150) eor (529) eor (452) mul (449) add (356) add (330) r11 (273) adc (229) r7 (199) eor (181) eor (168) mul (184) r0 (468) eor (374) ld (353) ld (329) r8 (300) adc (306) eor (285) adc (202) r11 (311) eor (308) eor (504) r1 (397) r8 (333) add (304) mul (260) mul (267) r7 (247) carry (229) ld (172) adc (176) eor mul (116) (132) mul (520) r8 (503) r1 (442) r15 (407) r4 (399) add (382) add (356) eor (351) eor (334) mul (234) adc (203) eor (181) eor (451) eor (399) adc (359) mul (189) r11 (155) adc (176) r0 (494) r0 (416) eor (178) r14 (142) r14 (136) mul (132) r10 (110) r0 (106) r1 (106) r1 (78) r12 (521) mul (520) eor (425) adc (333) eor (242) adc (176) r5 (353) r13 (171) eor (142) eor (477) r1 (475) add (382) r15 (329) eor (308) r7 (306) mul (260) r1 (286) mul (234) movw (209) r15 (181) ld (173) movw (521) eor (503) r4 (477) r12 (451) eor (372) adc (359) eor (310) r15 (299) r6 (276) eor (244) eor (218) r11 (176) adc (176) eor (154) movw (469) movw (417) r11 (346) r8 (308) eor (325) eor (320) eor (299) eor (110) movw (107) movw (495) r1 (449) adc (359) adc (306) r0 (241) ld (171) mul (158) eor (477) eor (451) r4 (322) eor (322) eor adc (221) (229) eor (270) r15 (216) r6 (168) eor (162) r0 (132) r0 (520) r8 (417) adc (333) eor (296) r7 (285) r1 (132) r10 (107) r8 (495) eor (399) eor (351) r11 (351) eor (346) ld (326) ld (301) r7 (320) add (304) r0 (260) r1 (520) mul (241) r15 (221) r1 (184) mul (371) r8 (144) mul (184) r12 (374) eor (325) r0 (314) eor (282) mul (293) mul (267) carry (203) eor (136) r4 (469) mul (241) key7+ (170) r12 (334) mul (286) r9 (145) r0 (371) adc (359) ld (300) adc (203) eor (155) mul (158) movw (133) mul (390) r0 (345) mul (345) r7 (325) movw (315) r5 (275) eor (285) eor (168) eor (195) r1 (158) eor (348) r1 (260) eor (243) ld (170) eor (190) adc (359) eor (334) eor (311) r6 (315) ld (276) r4 (243) r1 (241) r12 (209) mul (319) r1 (234) eor (216) r12 (170) r4 movw (391) (391) mul (371) carry (359) mul (338) r0 (189) r0 (390) mul (390) ld (145) r10 (146) r8 (348) movw (261) eor (217) adc (203) eor (322) r12 (296) r8 (269) r11 (147) ld (144) r6 (162) r14 (133) eor (374) r12 (326) r7 (277) eor (190) r10 (302) r4 (274) eor (243) r0 (234) r12 (217) ld (147) ld (146) key12+ (300) ld (275) eor (195) r11 (190) r0 (158) ld (302) eor (269) r0 (215) mul (345) ld (274) r1 (267) r11 (195) eor (162) r1 (371) mul (364) ld (277) mul (215) eor (373) ld (303) eor (269) movw (235) key6+ (144) movw (159) mul (364) r1 (293) eor (348) r0 (338) r1 (319) key11+ (274) mul (312) r11 (303) eor (217) r1 (390) r12 (373) r4 (235) mul (215) r6 (159) eor (321) mul (312) eor (296) r0 (286) r1 (215) r0 (364) movw (339) eor (295) eor (373) r1 (364) r8 (347) r4 (321) r1 (312) r8 (261) eor (347) r1 (345) movw (365) r12 (295) movw (287) r12 (365) eor (347) eor (321) r0 (312) eor (295) r8 (339) movw (313) r4 (313) ldi (0) r26 (0) low(plaintext) (0) r27 (1) high(plaintext) (1) ldi (1) r12 (287) r29 (13) high(keysram) (13) ldi (13) ldi (12) r28 (12) low(keysram) (12) mul (28) r1 (28) Data Flow Graph of PRESENT Full Version Unrolled implementation consists of over 4700 instructions. 18 / 25

19 New Attack found on PRESENT-80 We chose a speed-optimized assembly implementation for 8-bit AVR publicly available on GitHub 3. output criteria: (minaffectedct, mindist, maxdist, maxkey, minkeywords)= (1, 1, 1, 1, 1). Recover the last round key by 16 fault injections. Implementation specific. Existing DFAs on PRESENT exploit Sbox look up which requires the analysis of the Sbox table by constructing DDT. Our new attack exploits OR operation which only requires the analysis of a simple truth table / 25

20 New Attack found on PRESENT-80 r22 (4529) r23 (4537) r23 (4545) 0x03 (4244) or (4538) or (4538) andi (4546) andi (4546) key32+ (4647) r22 (4538) r23 (4546) ldi (4648) ldi (4647) ldi (4649) ldi (4650) ldi (4651) ldi (4652) ldi (4653) ldi (4654) or (4547) or (4547) r1 (4648) r0 (4647) r2 (4649) r3 (4650) r4 (4651) r5 (4652) r6 (4653) r7 (4654) r22 (4547) eor (4656) eor (4656) r1 (4656) st (4664) x+ (4664) 20 / 25

21 New Attack found on PRESENT-80 0x09 (4241) r7 (4513) r22 (4519) 0xC0 (4219) r23 (4527) 0x30 (4226) ZH (4530) ZL (4535) ldi (4539) mov (4544) andi (4520) andi (4520) andi (4528) andi (4528) lpm (4536) lpm (4536) ZH (4539) ZL (4544) r22 (4520) r23 (4528) r23 (4536) 0x0C (4235) lpm (4545) lpm (4545) or (4529) or (4529) andi (4537) andi (4537) r23 (4545) 0x03 (4244) r22 (4529) r23 (4537) andi (4546) andi (4546) or (4538) or (4538) key32+ (4647) r23 (4546) r22 (4538) ldi (4648) ldi (4647) ldi (4649) ldi (4650) ldi (4651) ldi (4652) ldi (4653) ldi (4654) or (4547) or (4547) r1 (4648) r0 (4647) r2 (4649) r3 (4650) r4 (4651) r5 (4652) r6 (4653) r7 (4654) r22 (4547) eor (4656) eor (4656) r1 (4656) st (4664) x+ (4664) 21 / 25

22 Scalability of DATAC tested on AES with different number of rounds # of rounds of AES # of nodes 281 2,060 6,300 10,540 # of edges 415 3,209 9,909 16,609 # of instructions 259 1,901 5,801 9,701 Time (s) Average time per round (s) Memory (MB) Data collected on laptop computer with mobile Intel Haswell family CORE i7 processor, 8 GB RAM 22 / 25

23 Table of Contents 1 Background and Motivation 2 Overview of DATAC DFA Automation Tool for Assembly Code 3 Case Study on PRESENT Cipher 4 Conclusion 23 / 25

24 Conclusion Proposed a methodology capable of finding spots vulnerable to DFA in software implementations of cryptographic algorithms. Created DATAC, which takes an assembly implementation and a user-specified output criteria as an input. DATAC outputs subgraphs for vulnerable nodes in the code, together with equations that can be directly used for DFA on the cipher implementation. New attacks on PRESENT-80, exploiting implementation-specific weaknesses. DATAC is scalable and can analyze current algorithms efficiently. 24 / 25

25 Thank you! Any questions? Web: / 25