International audience

International audience

Side-channel based instruction disassembly (SCBD) is a family of side-channel attacks that aims at recovering the code executed by a device from physical measurements. Over past decades researches have proved that instruction-level disassembly is feasible on simple controllers. Simultaneously, the computing power and architectural complexity of processors are increasing, even in constrained devices. Performing side-channel attacks on mid or high-end devices is inherently harder because of complex concurrent activities and an important amount of noise. While broad pattern identification, such as cryptographic primitives, has been proved possible, the feasibility of precise SCBD remains an open question on a complex System-on-Chip (SoC). In this work, we address some of the technical challenges involved in performing SCBD on SoCs. We propose an experimental setup and measurement methodology that enables reliable characterization of instruction-level electromagnetic (EM) leakages. We study the feasibility of three code reconstruction granularities: functional unit recognition, opcode recognition and full instruction recovery. Under a controlled experimental environment, our results show that functional unit recognition is achievable (100% classification accuracy) as well as opcode recognition (with evidence of leakage). In our setup, full instruction recovery (i.e., bit-level encoding) turned out to be more challenging. We show that the classification accuracy on instruction bits is better than random guesses and can be improved by combining multiple EM probe positions, but it is not high enough to foresee an attack in a real environment.

International audience

In this paper we investigate the problem of reverse engineering the specifications of a secret AES-like block cipher defined by a set of non-standard parameters. We allow the designer to modify all parameters of an AES (S-Box table, SR constants, MC coefficients as well as the RW and the RC values) provided that the SPN structure and sizes are preserved. We propose a chosen plaintext FIRE attack based on ineffective fault analysis (IFA) in the "byte stuck at 0" fault model. We describe a step-by-step procedure that recovers the AES-like secret parameters without requiring the knowledge of the encryption key. The soundness and the efficiency of each step is evaluated by simulations. As our attack assumes that no classical countermeasure against side-channel and fault analysis is implemented, it intends to demonstrate that protecting the implementation of such AES-like function is not a facultative option even if its specifications are not public.

Tamper resistance of hardware products is currently a very popular subject for researchers in the security domain. Since the first Kocher side-channel (passive)attack, the Bellcore researchers and Biham and Shamir fault (active) attacks, many other side-channel and fault attacks have been published. The design of efficient countermeasures still remains a difficult task for IC designers and manufacturers as they must also consider the attacks which combine active and passive threats. It has been shown previously that combined attacks can defeat RSA implementations if side-channel countermeasures and fault protections are developed separately instead of being designed together. This paper demonstrates that combined attacks are also effective on symmetric cryptosystems and shows how they may jeopardize a supposedly state of the art secure AES implementation.