Security Evaluation of IoT Devices against Medium and Long-Range Side-Channel Attacks

点击翻译按钮获取中文摘要

This year, our research has yielded 2 achievements.Firstly, we developed two key recovery methods, based on the unique leakage model we discovered for the screaming channel. These methods leverage different assumptions about the leakage models, leading to the design of second-round attacks and final round key recovery method. In the experiment, we've seen a considerable enhancement in attack efficiency compared to previous methodologies.In particular, for the second-round attack, we capitalized on the similarity of leakages when the most significant 4 bits of the S-box input are the same. We devised a chosen-plaintext attack that employs the variance of the traces as a distinguisher, enabling independent key byte recovery. Our results indicated that the key could be retrieved with fewer than 200 plaintexts. For the final round attack, we utilized the Hamming weight of the most significant 4 bits of the S-box input to facilitate key recovery, resulting in a further boost in efficiency. These findings were published at SCIS 2023.Secondly, we investigated the conditions that trigger different leakage profiles. We discovered that the specific leakage observed in the screaming channel is connected to the memory employed in calculations. By altering the location of the S-box table, we can manipulate the leakage profiles for the information leakage.