Practical Power Analysis Attacks to RSA on a Large IP Portfolio SoC

Practical Power Analysis Attacks to RSA on a Large IP Portfolio SoCGuido Marco BertoniSTMicroelectronics Agrate Brianza,Milan,ItalyLuca BreveglieriPolitecnico di MilanoMilan,ItalyAlessandro CominolaValue TeamMilan,ItalyFilippo MelzaniSTMicroelectronics Agrate Brianza,Milan,ItalyRuggero SusellaSTMicroelectronics Agrate Brianza,Milan,ItalyAbstractThe RSA algorithm is the most widely used public-key cryptosystem.For this reason it is important to protect RSA-based cryptosystems from the threat of Side Channels At-tacks and particularly from Power Analysis.This article presents the application of Power Analysis attacks based on real power measurements and describes the main experimental results obtained by attacking soft-ware implementations of the RSA algorithm executed on an ARM926processor running at266MHz.Few practical re-sults of similar type are reported in the literature,and none of them targets a complex SoC running at such a high fre-quency as that considered in this paper.Keywords:cryptography,RSA,side channel attacks,power analysis attack,DPA.1.IntroductionThe public-key cryptographic algorithm RSA[9]was publicly described in1977by Rivest,Shamir and Adleman. It is widely used in many practical applications for provid-ing both secrecy(IPSec,SSL,Smartcards,etc)and authen-tication by the use of digital signatures.The RSA algorithm can be made resistant to theoretical attacks(e.g.Chosen Cipher Text attacks)through the application of particular standards(PKCS#1)and a suitable length of the modulus can protect them from factorization.However,in recent years a new typology of attacks has become public:the so-called Side Channel Attacks(SCA). Firstly proposed in1995by Kocher et al.[5],these attacks exploit some information generated and leaked by the hard-ware device during the execution of a cryptographic func-tion.After the publication of the DPA paper by Kocher et al. in1999[6],a massive research activity in thefield of side channel attacks has taken place.Part of it has been focused on new types of attacks like those based on fault injection, electromagnetic emission,and similar ones.Other authors have refined the processing of power traces;in particular we highlight the Correlation Power Analisys of Brier et al.pre-sented in2004[2].Most of the focus of power analysis has been put on symmetric algorithms like DES and AES.Some publications are available on RSA,modular exponentiation in general and other public key cryptosystems like ECC. Messenger et al.presented some attacks against modular exponentiation,thus addressing RSA,in1999[7].In this case the device was a generic smart card with a hardware coprocessor performing modular exponentiation.The exact clock frequency of the device is not reported,but it is possi-ble to suppose that it is within10Mhz at most,and that no real operating system or other processes are running in the device while modular exponentiation is being computed.Apart from the paper presented by Messenger et al.,there have been more sophisticated attacks targeting the Mont-gomery multiplication in the modular exponentiation:as presented by Dhem et al.in[3],a conditionalfinal sub-traction at the end of the multiplication can be used to suc-cessfully mount a timing attack.Walter and Thomson[13] investigated the probability of thisfinal subtraction while a complete analysis has been done by Sato et al.[10].This article specifically describes the SCA based on the analysis of power consumption.The literature provides some documentation about Power Analysis Attacks,but al-most all the presented results are obtained by simulation or considering cryptosystems executed on a low frequency CPU,typical of smartcards.To our knowledge,there does not exist any publication about power analysis attacks based on the elaboration of data obtained by real measurements of the power consump-tion of RSA SW implementations executed on the CPU of a reasonably complex device.The results presented in this article are obtained by per-2009 Sixth International Conference on Information Technology: New Generationsforming different types of power attacks against various RSA implementations,focusing in particular on the Mont-gomery multiplication.Here RSA is executed on the266 MHz CPU of an evaluation board designed and used mainly for system development,not for side channel analysis.The rest of the article is organized as follows.In section 2,a recap of the RSA SW implementation is given.Sec-tion3describes the attacked evaluation board and the used acquisition equipment.Section4presents the considered types of power attacks,while section5gives the results of the various power analysis attacks executed,and summa-rizes them.In section6,a series of conclusive considera-tions about the work and a few potential further develop-ments,are provided.2.RSA AlgorithmThefirst step to be executed in order to generate any type of power attack is the study of the mathematical prin-ciples the target algorithm is based on and how they are concretized in the software implementation.In the case of RSA,the basic operation is the modular exponentiation,ob-tained as a series of modular squarings and multiplications. In the developed work,modular exponentiation has been implemented with the following characteristics:•Left-to-right:the exponent is processed one bit at a time,starting from the most significant one•Square and multiply:at every iteration of the expo-nentiation,a square is always computed while a mul-tiplication is executed only if the exponent bit actually processed is set to oneStarting from a base(a ciphertext in case of decryption),the sequence of powers of the base(squarings and multiplica-tions)directly depends on the values of the single bits of the processed exponent.Therefore it is possible to exploit such a correlation to generate power attacks in order to reveal the entire RSA secret key(i.e.the exponent).The modular mul-tiplication operation can be implemented in different ways. In order to avoid the problem represented by the computa-tion of the remainder of the division of the multiplication result(the product)by the RSA modulus,the Montgomery multiplication method has been used[8].There are differ-ent options for the Montgomery multiplication:Dusse et al. report an overview of the different methods in[4];here the CIOS method has been selected since it is one of the fastest.Afterfinishing the multiplication,dependently on the specific implementation the Montgomery method may want to compute a subtraction between the result and the RSA modulus if the former is greater than or equal to the lat-ter.It is possible to avoid suchfinal subtraction,as ex-plained by Walter[11,12].Squaring is computed simply using multiplication and not an optimized dedicated func-tion.The modular exponentiation was coded in plain C without the use of inline assembler.Big integer numbers are expressed as arrays of32-bit words and the basic oper-ations as addition,subtraction,and multiplication are per-formed on words of32bits.3.Platform and Acquisition Bench DescriptionThe system considered in this work is an evaluation board containing a few support chips and a complex SoC, SPEAr Head200[1],which is the main target of the attacks. The SoC contains an ARM926CPU running at266MHz,is fabricated in110nm HCMOS technology and is packaged in a PBGA package.The SoC also contains a few different auxiliary and peripheral devices:a Multilayer AMBA2.0 compliant Bus at133MHz,an embedded16KB single port SRAM,an interface for DDR SDRAM,an SPI interface for ROM and Flash,an Ethernet10/100with MII management interface,three USB2.0interfaces(PHY included),three UARTs,one I2C,six General Purpose I/Os,a Real Time Clock,a Watchdog,four General Purpose Timers,and an8 bit ADC with16analog input channels.The evaluation board allows to run an operating system on the CPU of the SoC;in this case Linux2.6.15has been installed.Thus the RSA algorithm runs on the top of such an OS.This may give additional noise due to the processes that are scheduled concurrently with the cryptographic op-eration.No particular care has been taken in order to avoid or reduce this perturbation effect.In order to acquire the power traces,a resistor of1ohm has been placed in series with the main power supply of the SoC.Once the resistor has been inserted,the board has been powered via an Agilent E3630A power supply.Notice that differently from smart cards,the SoC does not have single ground and Vcc pins,but that it has about20pins with such functions.In this work the resistor is connected at board level to the power supply main line and does not target a specific SoC pin.It would be possible to target specific power lines that are closer to the core CPU power supply,and in this way the attack would probably succeed more efficiently,but the aim of this paper is to be as general and as less invasive as possible at board level.The digital oscilloscope that has been used to acquire the power traces is an Agilent Infiniium80000series.The probe used for measuring the signals is a differential probe from Agilent,specifically an Infiniimax1131A with a band-width of3.5GHz.The practical acquisition of the power traces is performed through the use of two probes:a simple probe to detect the triggers generated by the board GPIOs and a differential probe put on the abovementioned resistor connected with the core CPU power supply.Once the probes have been correctly connected to theboard,the program running on the CPU executes the SW implementation of RSA for m·n times,where m represents the number of different inputs,ciphertexts in case of decryp-tion,that are considered and n is the number of times the program is executed with the same input in order to reduce the noise component through an average function provided by the oscilloscope.The trigger events are used to inform the oscilloscope to consider one execution for the average function and to store the resulting power traces.In order to collect power traces that can be successfully processed to reveal the bits of the secret key,it is important to properly define the acquisition window through the setup of the oscilloscope.Specifically,two variables have to be set:the Sampling Rate(the number of samples per second that the oscilloscope is able to acquire)and the Number of Samples(that represents the definition of each single trace). The width,in time,of the acquisition window is obtained as the ratio between the latter and the former element.A suitable tradeoff between these two variables has to be found.It has been decided to set the acquisition fre-quency at250Msample/s.With this setting almost a sample per clock cycle is available.The number of samples avail-able on the used oscilloscope is thus1M,and the size of the power tracefile produced with these settings is4.1MB. This allows to fully sample about8Montgomery multipli-cations.The complete exponentiation requires a number of samples of about100Msample.The oscilloscope used in this work does not reach such a very high performance,but Agilent produces devices with a sampling window up to128 Msample.Starting from the assumption that every iteration of the modular exponentiation implies the execution of at most two multiplications(actually one square and one mul-tiplication),a set of such power traces can be processed to reveal at least4bits and at most8bits of the secret key.For practical reasons,a modulus length of512bits has been used in this work.However the presented methods are independent of the modulus length,since only one bit of the exponent at a time is attacked.Therefore RSA versions with1024or2048bits that are commonly used in nowadays commercial applications can be attacked as well.The dif-ference will be only in a larger number of samples that may notfit entirely in the window of the oscilloscope and could require an acquisition in two or three steps.4.Power Analysis AttacksAs previously specified,power analysis attacks are a par-ticular category of SCA,based on the analysis of power consumption.Several types of power attacks exist.From a complexity point of view,power attacks are divided into:•Simple Power Analysis(SPA).It consists of a visual(or possibly automated)analysis of the power trace,or ofa small set of power traces,tofind in the trace a par-ticular behavior that clearly depends on the operation performed and is linked to the value of the key or to part of it.In modular exponentiation or scalar multi-plication(in the case of ECC)this is applied when it is possible to highlight the difference of a squaring froma multiplication(or a sum from a doubling for additivegroups like in ECC).•Differential Power Analysis(DPA).Starting from guesses on a properly selected intermediate result,the power traces are split into two subsets by a selection function.The selection function has to be chosen such that the two subsets are as homogeneous as possible and different from each other.For both subsets associated with each guess,the av-erage of the traces is computed and the two resulting average traces are compared by subtraction.The re-sult of this process is a differential trace,one for each guess,and the information about the value of the bit of the secret key that has been attacked manifests itself as one or more evident peaks in the differential trace correspondent to the correct guess.•Correlation Power Analysis(CPA).The basic idea of the Correlation Power Analysis is the computation of the Pearson correlation between the power traces(or parts of them)and the values of the intermediate re-sult for each key guess.The elements of the result-ing correlation matrix are plot in a cartesian diagram that has the number of considered traces on the x-axis and the correlation values on the y-axis.A CPA attack is successful if the trace correspondent to the correct guess shows correlation values greater in modulo than zero and greater than those correspondent to the wrong guesses.Independently of the specific type of power attack,two main phases have to be performed:the acquisition of data that describe the power consumption of the cryptosystem exe-cution(power traces)and their elaboration.4.1.Applied AttacksIn this section the results of the previously described at-tacks are reported.In all the cases the secret exponent has been kept constant and randomly chosen bases have been processed by the modular exponentiation function.4.1.1.Simple Power Analysis(SPA).Figure1depicts the acquisition of the modular exponentiation averaged over64 executions.In the trace it is possibile to identify the8Montgomery multiplications,but it is impossible to notice any differenceFigure1.Single trace averaged over64exe-cutionsbetween squaring and multiplication.We can then conclude that SPA is not practically applicable in this case.4.1.2.Differential Power Analysis(DPA).In order to per-form a DPA attack,guesses have to be formulated.The ex-ponent(i.e.the secret key)is processed serially,one bit at a time.Since a bit can be set either to1or0,only two guesses have to be made(one correct and the other one wrong).In this work,two particular RSA implementations have been attacked:basic(Montgomery withfinal subtraction) and optimized(Montgomery withoutfinal subtraction).In thefirst implementation,the differential trace of the cor-rect guess is represented by thefirst and most evident peak that appears in correspondence with the end of the attacked Montgomery multiplication(Figure2).Different selection functions,targeting various bits of the intermediate result,have been tested,but the only ones able to succeed with the attack are those that target thefirst and second most significant bits.This is due to the fact that these two most significant bits are closely related with the condi-tional subtraction operation at the end of the Montgomery multiplication.In fact,further analysis has demonstrated that the best selection function is the prediction of the actual presence of thefinal subtraction.When this selection function is used, the differential trace corresponding to the correct guess ex-hibits a peak of1.87·10−2V,while the differential trace of the wrong guess looks like white noise with mean of0V olt and amplitude of2.5·10−4V.The small peaks that follow the most evident one are caused by”shifting phenomena”due to the fact that the se-quence of software operations is not the same for every in-put.Figure3highlights the two sets,the differential trace, and shows how the average computed in a set exhibits a dif-ferent timing computation compared to the other set.This is due to the subtraction computed in one case and not in the other one.Once thefinal subtraction has been identified as avul-Figure 2.Differential trace of the correctguess.The selection function is the predic-tion of thefinalsubtractionFigure3.Sets and resulting differential trace(in the middle)of the correct guess nerability,the software function for computing the Mont-gomery multiplication has been modified in order to avoid such an operation.The result is an improved version of the RSA algorithm that has been attacked as well,which happens to be still vul-nerable to power analysis.It is important to note that this second version exhibits on the differential trace a peak that is much smaller compared to that in the previous version. With an attack using3600power traces,almost two times than the previous case,the peak of the correct differential trace is of1.88·10−4V,while the noise of the differen-tial trace of the wrong guess has an amplitude of1·10−4 V.This could mean that such a version is stronger,but it should be noted that the previous version has been success-fully attacked only using as selection functions the value of thefirst or the second bit of the intermediate result,because only these ones are closely related with the conditional ex-ecution of thefinal subtraction.This second version can be attacked using the Hamming weight of each word of the intermediate result,or even of more words.Specifically,the differential peak always ap-pears in correspondence with the point where the guessed value is used as input.This fact is confirmed by the re-sults of the DPA attacks that are based on different selection functions.In the case the selection function is the Ham-ming weight of one significant word of the intermediate re-sult (Figure 4),the success peak appears in correspondence with the iteration of the Montgomery multiplication where the square of that word is computed and less evident peaks appear in correspondence with each one of the remaining iterations where that word is anyway processed (e.g.,if the selection function is the 12-th significant word,the success peak appears in correspondence with the 12-th iteration of the multiplication).Furthermore,it is possible to use as se-lection function the Hamming weight of the entire interme-diate result (Figure 5);the differential trace shows a few ev-ident peaks in correspondence with the entire Montgomery multiplication that uses the intermediate result asinput.Figure 4.Differential trace of the correct guess.Selection function:Hamming weight of the least significant word of the intermedi-ate result4.1.3.Correlation Power Analysis (CPA).This typology of power attack is also useful for making an estimation of the amount of power traces that have to be processed for a successful attack.Considering the number of traces to be collected,gen-erally a CPA attack requires a number smaller than that needed for performing a correspondent DPA attack.More-over,CPA attacks have the advantage to consider each dif-ferent correlation value,differently from the DPA attacks where the power traces are split into only two sets.In Figure 6,it is possible to see the correlation traces for the two guesses and how the trace corresponding to the cor-rect guess,after processing about 2000traces,starts being higher than the other one and remains stable as thenum-Figure 5.Differential trace of the correct guess.Selection function:Hamming weight of the entire intermediateresultFigure 6.CPA attack to the implementation without final subtraction.Selection function:value of the least significant bit of the inter-mediate resultber of traces increases,while the trace of the wrong guess decreases.The DPA on the first RSA implementation was realized with 2000power traces,and the execution time of the at-tack,not including the acquisition time,was 4.5hours,while the DPA on the second RSA implementation,with-out final subtraction,was made with 3600power traces and required 7.5hours of execution time.Regarding CPA,the attack time is comparable to DPA (case by case).All the attacks have been executed using the Python programming language on a common desktop computer with an Intel Pen-tium 4CPU 2.40GHz and 768MB of RAM,running a Mi-crosoft Windows XP OS.Table1.Summary of DPA attacks to the Mont-gomery multiplication withfinal subtraction Selection Function Peak Value[V]SNR Value MSB0.74·10−235.09 Value2nd MSB0.2·10−224.39 Computation of subtraction1.87·10−249.84 Table2.Summary of DPA attacks withoutfi-nal subtractionSelection Function Peak Value[V]SNRValue MSB0.135·10−3 1.768Value LSB0.14·10−3 1.931HW(MSW)0.189·10−3 2.202HW(LSW)0.188·10−3 2.377HW(partial result)0.144·10−3 1.984.2.Attacks SummaryTables1and2summarize the results of the attacks,re-porting the absolute values of the peaks and the Signal-Noise Ratio,an indicator of the effectiveness of the attacks. It is possible to note that in the case of the Montgomery multiplication withfinal subtraction,the value of the peak in the differential trace is much higher compared to the case withoutfinal subtraction.But only three selection func-tions are capable of showing a peak in the differential trace, namely:the value of the most significant bit(MSB),that of the second most significant bit,and the presence or not of thefinal subtraction.In the second case several selection functions are capable of showing a peak in the differential trace;thus an attack can choose to point a single bit,the Hamming weight of a word,or the Hamming weight of the entire intermediate result.All the results reported for the former case are obtained with2000traces,each trace being computed as the average of64RSA executions.In the latter case3500traces are needed in order to exhibit well defined peaks;still every trace is the average of64computations.5.Conclusion and Further DevelopmentThis article shows the main results of the conducted at-tack campaign,where various types of power analysis have been successfully carried out against incrementally stronger software implementations of the RSA algorithm executed on a complex system(CPU of an evaluation board),which previously had not been attacked by anybody.All the at-tacks are successful and more or less efficient depending on how refined the exponentiation algorithm is,and they succeed even if the power consumption is measured at the board level and therefore is certainly affected by consider-able noise.This appears to be thefirst study of the effec-tiveness of DPA against SW RSA executed on a real and somewhat complex commercial system.Since the success of the attacks is principally due to the vulnerability of the modular multiplication operation,a first possible further development would be to perform the same power attacks to cryptosystems different from RSA, but based on the same operations of modular exponentia-tion and multiplication.References[1]STMicroelectronics SPEAr Head200SoC,URL:/stonline/products/families/computer/customizableproc/spearhead.htm.[2] E.Brier,C.Clavier,and F.Olivier.Correlation power anal-ysis with a leakage model.In M.Joye and J.-J.Quisquater, editors,CHES,volume3156of Lecture Notes in Computer Science,pages16–29.Springer,2004.[3]J.-F.Dhem, F.Koeune,P.-A.Leroux,P.Mestr´e,J.-J.Quisquater,and J.-L.Willems.A practical implementation of the timing attack.In CARDIS,pages167–182,1998. [4]S.R.Duss´e and B.S.K.Jr.A cryptographic library forthe motorola dsp56000.In EUROCRYPT,pages230–244, 1990.[5]P.C.Kocher.Timing attacks on implementations of diffie-hellman,rsa,dss,and other systems.In CRYPTO,pages 104–113,1996.[6]P.C.Kocher,J.Jaffe,and B.Jun.Differential power analy-sis.In M.J.Wiener,editor,CRYPTO,volume1666of Lec-ture Notes in Computer Science,pages388–397.Springer, 1999.[7]T.S.Messerges,E.A.Dabbish,and R.H.Sloan.Poweranalysis attacks of modular exponentiation in smartcards.In C¸etin Kaya Koc¸and C.Paar,editors,CHES,volume 1717of Lecture Notes in Computer Science,pages144–157.Springer,1999.[8]P.L.Montgomery.Modular multiplication without trial di-p.,44(170):519–521,1985.[9]R.L.Rivest,A.Shamir,and L.M.Adleman.A method forobtaining digital signatures and public-key cryptosystems.Commun.ACM,21(2):120–126,1978.[10]H.Sato,D.Schepers,and T.Takagi.Exact analysis of mont-gomery multiplication.In A.Canteaut and K.Viswanathan, editors,INDOCRYPT,volume3348of Lecture Notes in Computer Science,pages290–304.Springer,2004. [11] C.D.Walter.Montgomery exponentiation needs nofinalsubtractions.IEE Electronics Letters,35(21):1831–1832, 1999.[12] C.D.Walter.Montgomery’s multiplication technique:Howto make it smaller and faster.In CHES,pages80–93,1999.[13] C.D.Walter and S.Thompson.Distinguishing exponentdigits by observing modular subtractions.In D.Naccache, editor,CT-RSA,volume2020of Lecture Notes in Computer Science,pages192–207.Springer,2001.。