2
$\begingroup$

In a "Simple Power Analyse Attack", the difference in power consumption during multiply or square operation is used.

In the RSA decryption process with the "Square and Multiply" algorithm, both square and multiply operations are executed if bit value in key is $1$ and only square operation is executed if bit value in key is $0$. We can observe on the power graph which operations were executed during decryption process. With this kind of graph it is possible to reconstruct the key.

Which platforms are most vulnerable to this kind of attack ?

| improve this question | |
$\endgroup$
4
$\begingroup$

Power Analysis attacks rely on the attacker being able to analyse the power used by the computing device, so such attacks work best on platforms where the attacker can analyse the power drawn by the device with cycle accuracy. This points at smart cards, which:

  • use an external source of power;
  • have very little room for some isolation circuitry which would hide the per-cycle power consumption;
  • work in a security model where the attacker controls the external environment (contrary to, say, encryption on a server in a remote room);
  • run at low clock rates, facilitating analysis;
  • run on an external clock, under full control of the attacker, thus again facilitating analysis (the chip will refuse to run if the clock rate is too low or too high, but simply knowing the clock signal makes correlation much easier);
  • are economically forced to be cheap, preventing the application of the most effective but expensive tamper resistance countermeasures.

Smart card vendors still do a lot of work on the subject, and modern, FIPS 140-2 level 3 compliant smart cards, are fairly good at defeating simple power analysis. Countermeasures are both algorithmic (e.g. blinding), software (e.g. always computing the multiplication, regardless of whether the key bit is a zero or a one, but only keeping the multiplied or unmultiplied value at the end), and hardware (isolation with some capacitors, internal clock, extra noise-inducing circuits...).

| improve this answer | |
$\endgroup$
  • 1
    $\begingroup$ I don't think FIPS 140-3 compliant smart cards exist. Currently there are some smart cards attempting to meet a subset of requirements in FIPS 140-3 drafts, but compliance cannot be currently validated so they cannot be compliant. $\endgroup$ – user4982 Oct 6 '13 at 18:07
  • $\begingroup$ As to which platforms are most vulnerable, I'd say devices that are not based on modern Smart Card ICs, thus do not include countermeasures; like micro-controllers, FPGAs, and very old Smart Cards. $\endgroup$ – fgrieu♦ Oct 6 '13 at 19:03
  • $\begingroup$ @user4982: sorry, I meant "FIPS 140-2 level 3". I'll fix the text. $\endgroup$ – Thomas Pornin Oct 6 '13 at 20:55
  • $\begingroup$ And of course CC EAL 5+ and even higher certified smart cards exist, if you want a more international take at certification. Note that there are specific documents for smart cards within CC. Be warned that certification may be specific to some parts of the entire implementation $\endgroup$ – Maarten Bodewes♦ Jan 21 '14 at 0:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.