19
$\begingroup$

This question is motivated by some bad Verilog. Due to someone being sloppy with port assignments and a output statement, I have an AES core that has a single-bit from a S-Box in the key schedule tied to a pin. This was caught in my audit of the HDL; however, it's sort of a neat error. Due to the nature of the hardware, I can get 10-bits of information about the key out of it as it's configured for AES-128 and it's a very parallel implementation (it's actually the LSB of the squaring module in the S-Box on the lowest byte of the key). This got me thinking:

If you are an attacker and could watch one bit of AES-128 for 10 rounds, which bit would you choose to recover the most useful information? I feel it would be a bit in the key schedule.

$\endgroup$
  • $\begingroup$ I assume all states means intra-round, not just inter-round? $\endgroup$ – forest Dec 15 '18 at 22:49
  • $\begingroup$ @forest yes, I was thinking of picking the line from the intermediate data. Just for reference, Figure 5: github.com/bpdegnan/aes/blob/master/aes-sbox/documentation/… They used my description so I got to verify the Verilog $\endgroup$ – b degnan Dec 15 '18 at 23:33
14
$\begingroup$

If you are an attacker and could watch one bit of AES-128 for 10 rounds, which bit would you choose to recover the most useful information? I feel it would be a bit in the key schedule.

Actually, I'd expect a leak of one of the internal state bits would give the attacker more information.

The key schedule is static, and so if you leak 10 bits, well, you still have (at best) 118 bits of uncertainty in the key; no where close to small enough to be useful for an attacker.

However, if you leak the internal state, you can look at (say) one of the internal state bits after each round. The advantage there is that we can look at the bits for a number of known plaintexts/ciphertexts; this yields considerably more information. After 1 round, an internal bit is a function of the plaintext and 33 key bits; by looking at a number of plaintexts, we can get enough information to deduce those 33 key bits.

$\endgroup$
  • $\begingroup$ I might have to look into this more. It's an amazingly small circuit, and honestly, they could have outsourced it and it was an exploit but I don't think so. $\endgroup$ – b degnan Dec 15 '18 at 23:35
  • 3
    $\begingroup$ This is a good answer, but it doesn't really explain how such an attack would work. $\endgroup$ – forest Dec 16 '18 at 4:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.