0
$\begingroup$

If I would like to exploit a used key by side-channel attack, one that measures electromagnetic fields, how many runs of the AES-128 do I need to spy on for a successful exploit?

I can't use any programs or software on that device. AES is software implemented. And I try (theoretically!) to spy in a distance of X meters. I am able to reduce the noise by surrounding emissions. But I can't have any type of access. So the attack model specifies using a sniffer.

I do not need an exact number of traces. There are only certain values for trace/distance that I could think of. I just found the TEMPEST attack, which needs 400k traces in a distance of 0.3 meters and 2.3m in 1 meter.

Improve this question
$\endgroup$
  • 5
    $\begingroup$ Any such value would be extremely dependent on the device being attacked; not only the AES implementation (e.g. are we talking about AES-NI, or the standard table-based implementation), but in addition to the physical details of the device. $\endgroup$ – poncho Jul 11 '17 at 16:18
2
$\begingroup$

As pointed out by poncho, it is not possible to precisely answer your question since too many parameters are involved:

  • About the AES implementation: is it an unsecured implementation? Does it use masking? If yes, at which order? And so on...
  • The physical properties of the device also matter, does it leak a lot? Are there some hardware countermeasures such as a shield, a jitter, etc...
  • What equipment is used to measure leakages? Depending on the probe, the oscilloscope and its setup, the number of AES executions to achieve a 100% success rate may vary greatly.

To put it in a nutshell, you have to make practical experiments to answer your question.

Improve this answer
$\endgroup$
  • $\begingroup$ Lets say it is an standard implementation of AES-GCM, released by any control instance like IEEE or ISO/NIST and so on. If I could sniff into 900 AES-Runs, is there a way to compromise the key? $\endgroup$ – Shalec Jul 12 '17 at 10:45
  • $\begingroup$ @Shalec Maybe, it depends on the other parameters. $\endgroup$ – Raoul722 Jul 12 '17 at 12:28
  • $\begingroup$ Hm.. to get a decision about side-channel security on a software implementation, it seems to depend allways on the special case. If I could sniff 1k AES-Operations, is there any way or worst-case Implementation, where I could exploit the used key? Furthermore, if I know a Plain/Ciphertext pair, which is used 4-times in a row (Dec, Enc, Dec, Enc) and produces 1k AES-Operation (because of block-length of the input), is there any benefit? I just need to figure out, if it is realistic, that someone could succesfully attack such a system without physical contact. $\endgroup$ – Shalec Jul 13 '17 at 10:56
  • $\begingroup$ could you recommend me a book for studying this in the deep? As I figured out, I can't imagine how to think about side channel attacks. $\endgroup$ – Shalec Jul 17 '17 at 7:09
  • $\begingroup$ Lets say we consider the weakest known hardware surrounding and the best known software implementation of AES. (In case of security) Is there something, we could use it as a reference, to say: Every improvement on hardware-hardness will be more save, than this, in case of side-channel? I'm just interested in the minimum of sniffed AES-uses. $\endgroup$ – Shalec Jul 21 '17 at 12:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.