Share-slicing: Friend or Foe?
Share-slicing: Friend or Foe?
复制标题
共享切片：是友还是敌？
DOI：
10.13154/tches.v2020.i1.152-174
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
E. Oswald
中科院分区：
文献类型：
--
作者：
Si Gao;Ben Marshall;D. Page;E. Oswald
掩蔽是一种广受欢迎和广泛部署的对抗侧信道攻击的对策，特别是在软件中。在某些假设下（w.r.t.独立性和噪声水平），屏蔽可以防止攻击达到一定的安全顺序，并导致成功攻击所需的泄漏数量可预测地增加。在使用软件掩蔽的典型处理器中，噪声水平可能不是很高，因此低掩蔽阶数不足以满足现实世界的安全性。然而，高阶掩码的成本很高，因此多年来已经发表了许多技术，通过以位或共享切片的形式并行化，使这种实现更有效。我们采用了两种备受推崇的方案（ISW和Barthe等人），以及一些相应的利用共享切片的开源实现，并讨论了它们在ARM Cortex-M0和ARM Cortex-M3处理器（都来自LPC系列）上的真正安全性。我们表明，M0和M3的微观结构特征破坏了掩蔽证明中所做的独立性假设，因此它们的理论保证不能转化为实践（更糟糕的是，它似乎无法预测顺序泄漏的预期）。我们的结果表明，将理论安全证明与实际的现实世界安全保证联系起来是多么困难。
Masking is a well loved and widely deployed countermeasure against side channel attacks, in particular in software. Under certain assumptions (w.r.t. independence and noise level), masking provably prevents attacks up to a certain security order and leads to a predictable increase in the number of required leakages for successful attacks beyond this order. The noise level in typical processors where software masking is used may not be very high, thus low masking orders are not sufficient for real world security. Higher order masking however comes at a great cost, and therefore a number techniques have been published over the years that make such implementations more efficient via parallelisation in the form of bit or share slicing. We take two highly regarded schemes (ISW and Barthe et al.), and some corresponding open source implementations that make use of share slicing, and discuss their true security on an ARM Cortex-M0 and an ARM Cortex-M3 processor (both from the LPC series). We show that micro-architectural features of the M0 and M3 undermine the independence assumptions made in masking proofs and thus their theoretical guarantees do not translate into practice (even worse it seems unpredictable at which order leaks can be expected). Our results demonstrate how difficult it is to link theoretical security proofs to practical real-world security guarantees.