Provable Security for Physical Cryptography ⋆

The modern approach to cryptography is provable security, where one defines a meaningful formal security model and proves that schemes are secure in this model. An exception is the design of countermeasures against cryptographic sidechannel attacks, which even today is mostly based on heuristic arguments, which only try to prevent particular attacks. It was long believed that side-channels are a practical problem where theoretical cryptography was only of limited use, but recent results indicate that this view is too pessimistic, and in fact, it is possible to extend the realm of provable security also to side-channel attacks. This survey is a personal and incomplete view on the current state of this exciting and fast moving field. 1 Modern Cryptography For most of history, cryptography was the art of “secret communication”. The designers of encryption schemes were only guided by experience and intuition. Not surprisingly, pretty much all proposed schemes turned out to be insecure. It became evident that the only hope to get secure cryptosystems is by means of provable security, that is 1. to provide a precise and meaningful model capturing what it means to be “secure”. 2. to design systems which can be proven secure in this model. Provable security dates back at least to Shannon’s proof that the one-time pad hides all information about the encrypted message [Sha49], but only with the rise of public-key cryptography [DH76,RSA78,Ell70,Coc73,Wil74], which requires constructions with a rich mathematical structure that can also be exploited by cryptanalysts, did provable security really take off. Modern cryptographic security definitions usually consider a “security game”, which models how a potential adversary can attack the system. Classical examples are the definitions of CPA/CCA secure public-key encryption schemes [GM84,RS92], unforgeability for signatures schemes [GMR88] or pseudorandomness [Yao82,BM84]. More recent notions are security against key-dependent message attacks [CL01,BRS03,HK07,HU08] or security against selective openings [DNRS99,BHY09]. Proving security of a system then equates to showing that no (efficient) adversary can win the security game. Unfortunately, often one cannot hope to prove such a strong statement (as it e.g. would imply P 6 = NP). In this cases one shows that the existence of an adversary who can win the game would imply that some problem generally believed to be hard is actually easy. Public-key cryptosystems can be based on many well studies assumptions, like the hardness of factoring [Rab79,HK09], or the shortest vector problem in lattices ⋆ This survey accompanies a talk with the same title given at the WEWORC’09 workshop. First posted online September 27, 2009. Last update March 9, 2010 [GGH97,Reg05]. Symmetric cryptography (aka. secret-key cryptography) can be based on even much weaker assumptions, e.g. block-ciphers can be built from any one-way function [HILL99,GGM84,LR88], but for efficiency reasons, in practice block-ciphers like DES or AES are actually constructed from scratch and not via reductions ([NR97] is a notable exception). 1.1 Why Black-Box Isn’t Enough What basically all modern security notions have in common, is that the cryptographic algorithm is modelled as a “black-box”, where an adversary can only observe the input/output behavior of the cryptographic algorithm as specified by the security game. Unfortunately, such models do not capture many real world scenarios where an adversary can attack an actual implementation of a cryptosystem which potentially leaks information to the adversary that cannot be learned from black-box access alone. In the mid-90s Kocher demonstrated that the secret-key of the popular RSA cryptosystem can be recovered by simply measuring the time a cryptodevice needs to perform a decryption [Koc96a]. Such attacks, where an adversary exploits leakage of information from a cryptodevice during execution, are called “side-channel” attacks (as opposed to standard cryptanalytic attacks, where the adversary only exploits the “main-channel” – i.e. the legitimate input/output behavior– of the device.) Light-weight crypto devices like smart-cards or RFID chips are particularly susceptible to side-channel attacks, and although [Koc96b] was by no means the first side-channel attack, it came quite as a surprise to the cryptographic community how easily such devices could be broken. Since [Koc96b], many more ingenious side-channel attacks have been published, for example by measuring the power-consumption [KJJ99] or the electromagnetic radiation [QS01,GMO01] of a cryptodevice. Some attacks go beyond simply measuring some physical properties of a device. Cold-boot attacks [HSH08] exploit the fact that memory retains its content for several seconds or even minutes even after being ripped from a laptop. In a probing attack [AKA96], one measures the contents carried by some wires of the circuit which performs a computation (unlike the other attacks, probing attacks require rather elaborate equipment). A particularly intriguing class of attacks are “cache attacks” [OST06,RTSS09] which exploit leakage of information between different processes that run on the same CPU. Such leakage does occur due to the structure of memory caches on modern CPUs. Side-channel attacks are a very real threat for systems used in practice. A recent example is the complete break of the KeeLoq cipher which is used as anti-theft system in millions of cars [EKM08]. Not surprisingly, much research has concentrated on developing countermeasures against such attacks. This research is mostly done by practitioners (i.e., the cryptographic hardware community) who are also active in finding and exploiting new side-channels. It was long believed that theory can only be of limited use to prevent side-channel attacks. But recent results indicate that this view was much too pessimistic, and in fact it is possible to extend the realm of provable security also to side-channel attacks as we will see in this survey. We will only discuss countermeasures against passive attacks, where an adversary only observes leakage form a cryptodevice. In contrast, in an active attack [BDL97,BS91] the adversary does actively tamper with the device, for example by cutting wires in the circuit or by heating or overclocking it in order to introduce random errors to the computation or memory content. Currently, there are only very few results on provable security against active attacks [GLM04,IPSW06,DPW09], but this is likely to change in the near future. 2 Side-Channel Attacks and Countermeasures Countermeasures against side-channel attacks – as outlined above – can be on the hardware or algorithmic level. – On the hardware level, the aim is to construct physical devices which reduce the amount of leakage, for example by shielding the circuit (to avoid electromagnetic radiation) or by inserting transistors (to flatten the power consumption curve). – On the algorithmic level, the aim is to design cryptosystem which remain secure even if some information about the secret internal state is leaked. This is usually done by some kind of internal randomisation (called masking or blinding, cf. [oEE] for a list of relevant papers) in order to avoid the occurrence of predictable intermediate results. As argued in § 1.2 of [FRR10], due to the holographic bound conjecture – which asserts that the information contained in a volume of space is already encoded on the boundary to this region – in theory everything that goes on in a cryptodevice can be learned by measuring its surroundings. Fortunately, in practice we can still hope to get secure systems as (1) a real-world adversary will not even get close to a perfect measurement of that boundary, and (2) even if what the adversary measures contains all of the information about the secret state of the cryptodevice, it might still be computationally hard to extract any useful information (i.e. cryptographic keys) from it. In practice we thus can reasonably assume that a cryptodevice can keep at least some secrets, but it’s unrealistic to assume the other extreme, i.e. that a “useful” device like a smart-card will leak no information at all. Thus to get secure devices, a combination of hardware and algorithmic countermeasures must be in place. 2.1 Provable Security against Side-Channel Attacks? As already mentioned, most of the work on side-channel attacks and countermeasures is done by practitioners, i.e. the cryptographic hardware community, the CHES workshop is their major venue. The “side-channel cryptanalysis lounge” gives a good overview [oEE] on this field. To some extent this research is a cat and mouse game: new side-channels attacks are found, and subsequently countermeasures are proposed. Those are usually ad-hoc, in the sense that they aim at preventing some particular known type of attack and they often come without any formal security proof. Research on side-channel security is quite different from the provable-security approach followed by modern cryptography. For example, in many works on side-channel countermeasures one encounters security arguments involving simulations. Because simulations can only show that some particular countermeasure is secure against some particular attack, they are meaningless in the context of provable security, where one has to quantify over all (time and/or space bounded) adversaries. Clearly, this situation cannot be satisfying from a cryptographic point of view. What are our beautiful provably secure cryptosystems good for, when ultimately their security relies on some ad-hoc countermeasures against side-channel attacks? Despite this, until recently the theory community did not give much attention to this problem. One reason was the perception that side-channels are a practical problem, and theory can only be of limited use to prevent them. It is not obvious what “provable security” should mean in the context of side-channel at