[论文解读] Real-World Snapshots vs. Theory: Questioning the t-Probing Security Model

Thilo Krachenfels, Fatemeh Ganji+3 more|arXiv (Cornell University)|Sep 9, 2020

Physical Unclonable Functions (PUFs) and Hardware Security参考文献 86被引用 41

一句话总结

本文提出激光逻辑状态成像（LLSI），一种新型单次追踪光学侧信道攻击，通过调制供电电压并使用激光扫描芯片背面，实现对掩码硬件电路完整逻辑状态的非接触式、无限探针访问。该攻击打破了t-探针模型对探针数量有限的根本假设，即使在未知寄存器位置的情况下，也能通过快照和SAT求解从2、3和5重掩码的AES-128实现中实际恢复密钥。

ABSTRACT

Due to its sound theoretical basis and practical efficiency, masking has become the most prominent countermeasure to protect cryptographic implementations against physical side-channel attacks (SCAs). The core idea of masking is to randomly split every sensitive intermediate variable during computation into at least t+1 shares, where t denotes the maximum number of shares that are allowed to be observed by an adversary without learning any sensitive information. In other words, it is assumed that the adversary is bounded either by the possessed number of probes (e.g., microprobe needles) or by the order of statistical analyses while conducting higher-order SCA attacks (e.g., differential power analysis). Such bounded models are employed to prove the SCA security of the corresponding implementations. Consequently, it is believed that given a sufficiently large number of shares, the vast majority of known SCA attacks are mitigated. In this work, we present a novel laser-assisted SCA technique, called Laser Logic State Imaging (LLSI), which offers an unlimited number of contactless probes, and therefore, violates the probing security model assumption. This technique enables us to take snapshots of hardware implementations, i.e., extract the logical state of all registers at any arbitrary clock cycle with a single measurement. To validate this, we mount our attack on masked AES hardware implementations and practically demonstrate the extraction of the full-length key in two different scenarios. First, we assume that the location of the registers (key and/or state) is known, and hence, their content can be directly read by a single snapshot. Second, we consider an implementation with unknown register locations, where we make use of multiple snapshots and a SAT solver to reveal the secrets.

研究动机与目标

• 挑战基于掩码的侧信道防护中t-探针模型的根基性假设。
• 证明先进故障分析技术可被重新用于强大的侧信道攻击。
• 表明即使高阶掩码实现，在探针模型约束被违反时依然易受攻击。
• 验证利用单次追踪、非接触光学技术从掩码AES中恢复密钥的可行性。

提出的方法

• 利用已知的故障分析技术激光逻辑状态成像（LLSI），通过激光诱导反射调制提取晶体管的逻辑状态。
• 以特定频率调制IC核心电压，使激光反射具有数据依赖性并可检测。
• 使用热激光扫描仪在单个时钟周期内捕获整个芯片的逻辑状态快照。
• 当寄存器位置未知时，应用SAT求解器从多个快照中重构秘密密钥。
• 在两种场景下验证攻击：已知和未知寄存器位置的掩码AES-128实现。
• 证明攻击效果不受掩码阶数影响，因为探针数量近乎无限。

实验结果

研究问题

• RQ1 单次追踪、非接触光学技术是否能够绕过掩码实现中t-探针模型对探针数量有限的假设？
• RQ2 当先进光学探针技术（如LLSI）实现近乎无限探针访问时，t-探针模型在多大程度上仍具有效性？
• RQ3 即使敏感寄存器位置未知，从掩码AES实现中恢复密钥是否仍可行？
• RQ4 掩码方案引入的随机性是否仍能有效抵御此类无需重复测量的光学攻击？
• RQ5 此类新型光学侧信道攻击的实际限制和对策是什么？

主要发现

• LLSI攻击实现了单次追踪、非接触测量，可在任意指定时钟周期捕获掩码硬件实现中所有寄存器的完整逻辑状态。
• 当寄存器位置已知时，该攻击可在一个快照内成功从2、3和5重掩码的AES-128实现中恢复完整的128位AES密钥。
• 即使寄存器位置未知，该攻击仅需少数快照与SAT求解器即可恢复秘密密钥，证明了其实际可行性。
• 攻击效果不受掩码阶数影响，从而否定了t-探针模型中高阶掩码提供更强保护的假设。
• 该攻击绕过了基于重复测量与积分的传统防护措施，因其无需对相同数据重复采集轨迹。
• 结果表明，理论安全模型（如t-探针模型）可能被实际的先进物理探针技术所攻破，因此必须重新评估安全假设。