Formal fault analysis of branch predictors: attacking countermeasures of asymmetric key ciphers
Formal fault analysis of branch predictors: attacking countermeasures of asymmetric key ciphers
复制标题
DOI：
10.1007/s13389-017-0165-6
复制
发表时间：
2017-05
影响因子：
1.9
通讯作者：
Sarani Bhattacharya;Debdeep Mukhopadhyay
中科院分区：
文献类型：
--
作者：
Sarani Bhattacharya;Debdeep Mukhopadhyay
由于底层分支预测器的行为，非对称密钥算法的实现已经通过定时侧信道受到威胁。然而，这种预测和后果的密码算法的安全性的故障的影响还没有被研究。由于标准处理器的未知分支预测器与2位动态预测器具有很强的相关性，本文对故障影响下的双模预测器进行了形式化分析。假设一个流行的位翻转故障模型，分析表明，这种故障的影响下的分支未命中的差异，可以利用攻击实现的RSA类非对称密钥算法，基于平方和乘法运算。此外，这些攻击还可能威胁到CRT-RSA（使用中国剩余定理实现的RSA）的蒙哥马利阶梯，甚至威胁到在故障情况下停止或随机化输出的故障攻击对策。详细的故障模拟已经证实了理论上的主张，其中分支未命中的差异已经使用Linux中的“perf”工具观察到。
Implementations of asymmetric key algorithm have been threatened via timing side channels due to the behavior of the underlying branch predictors. However, the effect of faults on such predictors and the consequences thereof on the security of crypto-algorithms have not been studied. Motivated by the fact that unknown branch predictors of standard processors bear a strong correlation with 2-bit dynamic predictors, this paper develops a formal analysis of such a bimodal predictor under the effect of faults. Assuming a popular bit-flip fault model, the analysis shows that differences of branch misses under the effect of such faults can be exploited to attack implementations of RSA-like asymmetric key algorithms, based on square and multiplication operations. Furthermore, these attacks can be also threatening against Montgomery ladder of CRT-RSA (RSA implemented using Chinese Remainder Theorem) and even against fault attack countermeasures which stop or randomize the output in case of a fault. The theoretical claims have been substantiated by detailed fault simulations, where the difference of branch misses has been observed using the “perf” tool in Linux.