Side-Channel Analysis of Cryptographic Software via Early-Terminating Multiplications
Side-Channel Analysis of Cryptographic Software via Early-Terminating Multiplications
复制标题
通过提前终止乘法对密码软件进行侧通道分析
DOI：
--
复制
发表时间：
2009
期刊：
影响因子：
--
通讯作者：
Michael Tunstall
中科院分区：
文献类型：
--
作者：
J. Großschädl;E. Oswald;D. Page;Michael Tunstall
嵌入式处理器的设计需要在性能、硅面积和功耗等许多相互冲突的目标之间进行仔细的权衡。寻找这样的权衡往往忽略了安全性问题，这可能会导致其他安全的加密软件通过所谓的微架构侧通道泄漏信息。在本文中，我们表明，早期终止整数乘法器中发现各种嵌入式处理器（例如，ARM7T）代表了这个问题的一个实例。提前终止机制根据操作数的大小导致执行乘法指令所花费的时间的差异（例如，在ARM7T处理器上最多三个时钟周期），这可以通过执行时间和功耗的变化来观察。利用提前终止机制使得简单功率分析（SPA）攻击相对简单，甚至可以允许攻击具有集成对策的实现，这些对策在具有恒定延迟乘数的处理器上执行时不会泄漏任何信息。我们描述了几个案例研究，包括秘密密钥（RC6，AES）和公钥算法（RSA，ECIES），以证明嵌入式处理器与提前终止乘法器所带来的威胁。
The design of embedded processors demands a careful trade-off between many conflicting objectives such as performance, silicon area and power consumption. Finding such a trade-off often ignores the issue of security, which can cause, otherwise secure, cryptographic software to leak information through so-called micro-architectural side channels. In this paper we show that early-terminating integer multipliers found in various embedded processors (e.g., ARM7TDMI) represent an instance of this problem. The early-termination mechanism causes differences in the time taken to execute a multiply instruction depending on the magnitude of the operands (e.g., up to three clock cycles on an ARM7TDMI processor), which are observable via variations in execution time and power consumption. Exploiting the early-termination mechanism makes Simple Power Analysis (SPA) attacks relatively straightforward to conduct, and may even allow one to attack implementations with integrated countermeasures that would not leak any information when executed on a processor with a constant-latency multiplier. We describe several case studies, including both secret-key (RC6, AES) and public-key algorithms (RSA, ECIES) to demonstrate the threat posed by embedded processors with early-terminating multipliers.