Sandrine AGAGLIATE, FTFC 2003 1

Power Consumption Analysis and Cryptography

S. Agagliate Canal+TechnologiesP. Guillot Canal+TechnologiesO. Orcières Thalès Communications

Sandrine AGAGLIATE, FTFC 2003 2

The Problem

A secret is hidden into a chipEx: Digital Signature…

How to find the secret? Which protection against these attacks?

Sandrine AGAGLIATE, FTFC 2003 3

Side Channel Attacks

Use leak of information Power consumption Electromagnetic radiation Fault provocation Computation time

Sandrine AGAGLIATE, FTFC 2003 4

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

Chip consumption

Sandrine AGAGLIATE, FTFC 2003 5

+

x

Known bit

XOR

XOR gate consumption

Sandrine AGAGLIATE, FTFC 2003 6

Methods

SPA = Simple Power Analysis DPA = Differential Power Analysis …

Sandrine AGAGLIATE, FTFC 2003 7

Counter measures

HardwareTimerBus encryption …

SoftwareAlgorithms

Constant timing Random Execution

Sandrine AGAGLIATE, FTFC 2003 8

Elliptic Curve Cryptosystems

For digital signature Use the computation of Q=k.P

k=private key

P=data

Advantages small key, small signature size high security

P1P2

P3=P1+P2

baxxyE K 32/ :

Sandrine AGAGLIATE, FTFC 2003 9

Random Execution

Variables blinding private key k base point P

Randomization of computation algorithm

Sandrine AGAGLIATE, FTFC 2003 10

Ternary techniques: optimisation

i

iikk 2

max

0

ki { -1, 0, 1 }

1111 = 1000-1-11 = 0-1111101111 = 1000-1000-1

Q := 0for i:=max down to 0

Q:=2Qif ki=1 then Q:=Q+Pif ki=-1 then Q:=Q-P

Result Q=k.P

Sandrine AGAGLIATE, FTFC 2003 11

Binary transducer ternary

1 : 1 0

0

3

1

2

0 1

-1

0 : 00 : 0 1

0

0 : -1 0

1

1 : 0 -1

1 : 0

-1 0

0

Sandrine AGAGLIATE, FTFC 2003 12

Sub-optimal alternate automaton

1 : 1 0

0 1

2

0 1

-1

0 : 00 : 0 1

1

1 : 0

0

0 : -1

Sandrine AGAGLIATE, FTFC 2003 13

1 : 1 0

0

3

1

2

0 1

-1

0 : 00 : 0 1 / p

0 / q

0 : -1 0

1

1 : 0 –1 / r

1 : 0

-1 0

0 0 : 1 -1 / 1 - p

0 : -1 / 1 - q

Randomized automaton

1 : -11 / 1 -r

Sandrine AGAGLIATE, FTFC 2003 14

Performances

2,2%2,1%Gain / previous work without DPA countermeasures

10,6%10,7%Loss / first automaton

300160Key size

Sandrine AGAGLIATE, FTFC 2003 15

Conclusion

Power Analysis can reveal secrets Solution: to interfere with power

consumption Ex: random execution

Cost : computation speed, memory…