In general, we consider the output of s-box in AES as a “sensitive value” in order to perform a side channel attack. I would be very grateful if you could explain to me the reason of that consideration. Why should we consider the output of the AES s-box as a “sensitive value” in relation to side channel attacks?
$\begingroup$
$\endgroup$
Add a comment
|
3 Answers
$\begingroup$
$\endgroup$
I would like to complete poncho's answer by mentioning a point that has not been discussed here.
On top of being an internal state which directly depends on plaintexts (resp. ciphertexts) and the key if you attack the first round (resp. the last one), making hypothesis on S-box output (resp. input) allows to exploit the non-linearity of this operation. Indeed, due to this property, passing the hypotheses through the S-box operation ensures a good distinguishability between the correct and incorrect key guesses.
For example, let's say you are performing a correlation power analysis (CPA) by considering the Hamming weight as leakage model. Then if you choose to focus on the round key addition (which also constitutes an internal state which directly depends on plaintexts (resp. ciphertexts) and the key), then all your key hypotheses which have a small Hamming distance with the good key will also result in a high correlation coefficient. The S-box non-linearity offers the advantage to reduce the peak for all the wrong assumptions.
$\begingroup$
$\endgroup$
That's because that internal value gives insight to the attacker into the internals of the cipher operation; it can be expressed in terms of known plaintext (or ciphertext) bits, and subround key bits, and can allow the attacker to rederive the subround key bits.
The two simplest examples:
Suppose the attacker can deduce the outputs of a last round sbox (or, if he can't deduce it, isolate which plaintext/ciphertext pairs where a particular last round sbox generates a specific value); what AES does is (essentially) xor that last round sbox output with the last set of subkey bits and output that; the attacker would be able to xor the known ciphertext with those sbox outputs and rederive some subkey bits. And, if he can do that for all the last round sboxes, that gives him the entire AES-128 key.
Suppose the attacker can deduce the outputs of a first round sbox; what the attacker can do is then compute the inputs to that first round sbox (as the sbox is a known invertible function). AES xors the first round subkey with the plaintext to generate that first round sbox input; just like the previous attack, the attacker xor's that to recover first subkey bits, and like the last time, if he can do that for all 16 first round sboxes, that gives him the entire AES-128 key.
Middle round sboxes are a bit more subtle, but can also be used by the attacker.
$\begingroup$
$\endgroup$
I can extract the state for any circuit that is not dual rail encoded because a "clock" gives me a snapshot of a power condition. In practice, this is difficult because systems generally have so many transistors, things fall into noise. I can pull the top of an IC and tap the power line to the crypto core, but that point, I pretty much can just extract a hardware key.
Assuming the "classical" synchronous circuits, you have a two states for current between "1" and "0". In the ideal case, the power consumed by these digital states are identical, but practice this is not true. What the S-Box gives you is an intermediate state where I can look at the power spectrum. A note on AES, one way to get around this is to expand the S-Boxes in circuits.
