1 / 16

Timing Attack Paper by Paul Kocher

Timing Attack Paper by Paul Kocher. presented by Greg Fletcher and Jef Considine. Introduction. Given known implementation, timing information can leak secret information. Possible values of secret data can be ruled out based on time trial based on value.

sachi
Download Presentation

Timing Attack Paper by Paul Kocher

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Timing Attack Paperby Paul Kocher presented by Greg Fletcher and Jef Considine

  2. Introduction • Given known implementation, timing information can leak secret information. • Possible values of secret data can be ruled out based on time trial based on value. • For example, the Hamming weight of a secret exponent can be calculated by timing exponentiation (e.g. RSA or Diffie-Hellman)

  3. Modular Exponentiation Let s0 = 1. For k = 0 upto w-1: If (bit k of x) is 1 then Let Rk = (sk * y) mod n. Else Let Rk = sk. Let sk+1 = Rk2 mod n. EndFor. Return (Rw-1).

  4. Assumptions • Multiplication takes variable time. • Otherwise, only Hamming weight can be determined. • Timing information is accurate relative to variance in execution time.

  5. The General Attack • Given j messages y0, y1, … yj-1 with corresponding timing measurements T0, T1, …, Tj-1 • xb is a guess for the first b bits of x • F is the expected probability distribution of T-t(y,xb) assuming xb is correct. • F will usually be difficult to find!

  6. The General Attack continued • Probability that xb is correct. • If xb-1 is correct, probability that xb is correct and xb’ is incorrect.

  7. Simplifying the Attack • Fortunately, we can avoid calculating F. • Given guess xb, we can calculate • yielding

  8. Analysis of Variance • Correct guesses are expected to reduce variance in time corresponding to unguessed bits. • Each multiplication is assumed to be independent and is treated as an independent variable. • Correct guesses effectively remove random variables from the equation. • Incorrect guesses magnify instead of negating random variables.

  9. Analysis of Variance continued • var(e) = error in timing measurements • var(t) = typical variation in each pass through the main loop • If xb is a correct guess, • var() = var(e)+(w-b)var(t) • If xc is a correct guess and the next bit is wrong, • var() = var(e)+(w-b+2(b-c))var(t)

  10. Error Correction • Incorrect guesses effectively randomize values being multiplied. • Further guesses will make no apparent progress. • By keeping track of variance, guesses can be weighted and the most promising guesses can be pursued.

  11. Attacking Alternate Methods • Reducing variance in relationship to measurement error makes attack more difficult • Montgomery Multiplication - mod n reduction steps are avoided so timing measurements must be more accurate. • Chinese Remainder Theorem - performing calculations mod p and q can allow p and q to be discovered. If y is less than p, mod p operations are skipped...

  12. Masking Timing Characteristics • Making operations take fixed time is inefficient. • All operations must take the same time as the slowest operation. • Adding random delays to make timing measurements is also infeasible. • Attackers can compensate by increasing the number of samples. • The average time must be large to allow significant variation from delays.

  13. Preventing the Attack • Blinding y • For random vi and vf=(vix)-1 mod n, calculate vf * (vi * y)x mod n. • vi and vf must change frequently to avoid timing attacks on them. • Blinding x • Add to x to blind exponent.

  14. Further Work • With the exception of RSA, this attack is only theoretical. • Theoretical attacks are given for DSS and RSA implemented using Montgomery multiplication and the Chinese Remainder Theorem.

  15. Conclusions • You’d be surprised where you can find holes...

  16. Acknowledgements • Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems, http://www.cryptography.com/timingattack/

More Related