Efficient entropy estimation for MIA using B-splines
Efficient Entropy Estimation for Mutual Information Analysis using B-splines Alexandre VENELLI
ATMEL Secure Microcontroller Solutions Rousset, FRANCE
IML – ERISCS Université de la Méditerranée Marseille, FRANCE
Efficient entropy estimation for MIA using B-splines
Outline Differential side-channel attacks – Power analysis Mutual Information Analysis Proposed B-splines estimation technique Experimental results
Conclusion
WISTP 2010
2
Efficient entropy estimation for MIA using B-splines
Differential side-channel attack workflow
WISTP 2010
3
Efficient entropy estimation for MIA using B-splines
Messerges et al. 1999 Linear relation between power consumption and Hamming Weight of a processed data.
P(t ) a.H (M ) b
power consumption
Power analysis and leakage model
time
WISTP 2010
4
Efficient entropy estimation for MIA using B-splines
Some statistical tests used in practice (1)
Kocher et al. 1999 Simplified T-Test (distance of means)
Brier et al. 2004 Pearson correlation factor,
Correlation Power Analysis (CPA)
WISTP 2010
5
Efficient entropy estimation for MIA using B-splines
Some statistical tests used in practice (2) Gierlichs et al. 2008 Mutual Information Analysis (MIA) + histograms
Veyrat-Charvillon et al. 2009 Cramér-von Mises test (nonparametric)
This presentation MIA + B-splines estimation (nonparametric)
WISTP 2010
6
Efficient entropy estimation for MIA using B-splines
Remainder on information theory Let X be a random variable with MX possible states Xi with i = {1…MX}. MX
Entropy of X:
H ( X ) p( X i ) log( p( X i )) i 1
Mutual information:
I ( X ;Y ) H ( X ) H ( X Y )
I ( X ; Y ) H ( X ) H (Y ) H ( X , Y ) WISTP 2010
7
Efficient entropy estimation for MIA using B-splines
Problem : estimating mutual information Mutual Information: very powerful, yet difficult to estimate.
Using the definition of entropy, the density has to be estimated. Goal: estimate a density given a finite number of data points drawn from that density function. Different approaches: histograms, kernel density estimation, …
WISTP 2010
8
Efficient entropy estimation for MIA using B-splines
Histogram based estimation
- Easy to calculate and understand.
- Systematic errors due to the finite size of the dataset.
WISTP 2010
9
Efficient entropy estimation for MIA using B-splines
MIA vs CPA
Figure taken from : Moradi A, Mousavi N, Paar C, Salmasizadeh M. A Comparative Study of Mutual Information Analysis under a Gaussian Assumption. Information Security Applications. 2009:193–205. WISTP 2010
10
Efficient entropy estimation for MIA using B-splines
What are B-spline functions ? (1) Degree-0 basis functions
1.5
WISTP 2010
11
Efficient entropy estimation for MIA using B-splines
What are B-spline functions ? (2) Degree-1 basis functions
1.5
WISTP 2010
12
Efficient entropy estimation for MIA using B-splines
What are B-spline functions ? (3) Degree-2 basis functions
1.5
WISTP 2010
13
Efficient entropy estimation for MIA using B-splines
B-splines for MI estimation Idea proposed by Daub et al. 2004 in the context of medical studies.
Instead of using a step function with histograms, a polynomial B-spline function is used to weight a data point.
Hence, data points can be in one or several intervals.
WISTP 2010
14
Efficient entropy estimation for MIA using B-splines
MI estimation in the presence of noise Histograms
1.5
2.5
WISTP 2010
15
Efficient entropy estimation for MIA using B-splines
MI estimation in the presence of noise Degree-2 B-spline functions
1.5
2.5
WISTP 2010
16
Efficient entropy estimation for MIA using B-splines
B-splines for MI estimation
- Better efficiency than histograms - Interesting propriety for side-channel
- Slower to compute than histograms
WISTP 2010
17
Efficient entropy estimation for MIA using B-splines
Cramér-von Mises with B-splines Cramér-von Mises test in Veyrat-Charvillon et al. 2009.
Its needs cumulative density functions.
B-splines can be used to estimate these density functions.
WISTP 2010
18
Efficient entropy estimation for MIA using B-splines
Experimental results Metrics to measure the efficiency of side-channel attacks by Standaert et al. 2008: first order success rate: given a number of traces, the probability that the correct hypothesis is the first best hypothesis of an attack. guessed entropy: average position of the correct hypothesis in the sorted hypothesis vector of an attack
Attacks efficiency tested with 2 different setups: on « DPA Contest 2008/2009a » power curves of a DES,
on power curves acquired on a Atmel STK600 board with a ATmega2560 chip of a multiprecision multiplication.
a: HTTP://WWW.DPACONTEST.ORG WISTP 2010
19
Efficient entropy estimation for MIA using B-splines
DES – DPA Contest 2008/2009 First order success rate
WISTP 2010
20
Efficient entropy estimation for MIA using B-splines
DES – DPA Contest 2008/2009 Guessed Entropy
WISTP 2010
21
Efficient entropy estimation for MIA using B-splines
Multiplication – STK600 / Atmega 2560 First order success rate
WISTP 2010
22
Efficient entropy estimation for MIA using B-splines
Page 1 ... They showed that the non-parametric Spearman rank correlation .... From these approximated probabilities, we calculate the entropies and finally.
algorithm. Then, the adversary computes the difference of means of the two sets ..... Goodman, L., Kruskal, W.: Measures of Association for Cross Classifications.
Elliptic curve NIST P-192. â¢. SSCA-resistance ... Exponent blinding : add a random multiple of the curve's order ... Background: side-channel attacks, ECC. 2.
help to find the word itself and knowing a word sometimes helps to find its entropy and ... min{µt(x),2ân} ⤠2â2k, and therefore ν(x|n) ⥠2k · min{µ(x),2ân}.
Analysis (FA) attacks take advantage of errors that occur while a cryptographic device is performing ...... The Elliptic Curve Digital Signature Algorithm (ECDSA).
Algorithms over Finite Fields. Background on ECC (1). â« Public Key (Asymmetric) cryptosystem. â« Based on a hard problem : â« Elliptic Curve Discrete Logarithm ...
and each (xi,Σi) lies on a specific sub-manifold of M. Then, we optimize the ... element-wise product and division of two matrices, respectively. e = (1,1,...,1)T ...
with equal volume ε (similar to figure 3.3 in [2]) and zero overlap. Within each patch Pi, ... (Published in Japanese in 1993). 2. V. Balasubramanian. MDL ...
Mar 21, 2012 - is a topic of ongoing research. The most sensitive part of the AES is the non-linear SubBytes operation, in particular, the inversion in GF(28), the Galois field of 28 ... In the case of the AES algorithm, several countermeasures have
Nov 1, 1999 - Efficient phase estimation for large-field-of-view ... number of equivalent layers (two or three) is required for accurate restoration of the phase in.
range limited to tens of centimeters, thousands of neighbors ... micrometers can be built. But such ... systems, in the order of centimetres or tens of centimetres [2].
1 / 10. Efficient Density Estimation Algorithm for Ultra Dense Wireless Networks. Thierry Arrabal ... hello method: I say "ping!", and each of you replies "pong!" â.
that the complexity of a classical DSCA is 212A to retrieve 16 bytes compared to 228A of Algorithm 1. In order to break a masked implementation, a higher-.
(i.e., ZADD with update) and is presented in Alg. 1. It is readily seen that it requires 5M + 2S. Moreover, as detailed in Alg. 19 (Appendix C), only 6 field registers.
2.1 Background on Elliptic Curves. Let Fp be a finite field of characteristic = 2, 3. Consider an elliptic curve E over. Fp given by the short Weierstraà equation y2 ...
to add new appropriate countermeasures into their code. To prevent those separate ... secret exponent with a practical number of faulted results. Our fault injections ..... different RSA keys (values and bit-length) with success. Table 1 gives ...
The assets not subject to arbitrage are characterized by the property that no risk-averse or risk-neutral agent with belief p would prefer to select such an asset.
entropy estimated through an MST algorithm was used as the registration func- ..... The Kruskal algorithm is widely believed to be the fastest general purpose ...
Feb 12, 2007 - This model arises naturally from retrospective studies and multinomial logistic regression model. A projection density estimator is constructed ...
