MAY 2022 |
|
|
“Security challenges and opportunities in emerging device technologies: a case study on flexible electronics“ by Nele Mentens (Leiden University, The Netherlands, and KU Leuven, Belgium) Date : 6 may 2022 While traditional chips in bulk silicon technology are widely used for reliable and highly efficient systems, there are applications that call for devices in other technologies. On the one hand, novel device technologies need to be re-evaluated with respect to potential threats and attacks, and how these can be faced with existing and novel security solutions and methods. On the other hand, emerging device technologies bring opportunities for building the secure systems of the future. This talk gives an overview of the minimal hardware resources that are needed to build secure systems and discusses a case study on flexible electronics on plastics.
|
|
MAY 2022 |
|
|
“Side Channel Analysis: Instruction extraction and Information estimation“ by Valence Cristiani (CEA-LETI; Université de Montpellier, LIRMM) Date : 6 may 2022 Side-channel usually aims at extracting cryptographic secrets from electronic devices through their physical leakages. However, these channels can leak other sensitive information. The first part of this talk will present a study of side channel-based disassembling (SCBD) that aims to recover instructions executed by a microcontroller. The main threat represented by SCBD is that it potentially allows to find a vulnerability in the executed code or to extract protected software IP.
|
|
APRIL 2022 |
|
|
“Bridging Deep Learning and Classical Profiled Side-Channel Attacks“ by Gabriel Zaid (Thales ITSEF, Toulouse) Date : 8 april 2022 Over the recent years, the cryptanalysis community leveraged the potential of research on Deep Learning to enhance attacks. In particular, several studies have recently highlighted the benefits of Deep Learning based Side-Channel Attacks (DLSCA) to target real-world cryptographic implementations. While this new research area on applied cryptography provides impressive result to recover a secret key even when countermeasures are implemented (e.g. desynchronization, masking schemes), the lack of theoretical results make the construction of appropriate models a notoriously hard problem. In this talk, we propose to investigate a new research axis in order to bridge Deep Learning and Side-Channel Attacks. In particular, we explain the similarities between the generative models and the classical profiled attack (i.e. template attacks, stochastic attacks), and we develop the first DLSCA model that can be fully explained from side-channel theoretical results. This model reduces the black-box property of DL and eases the architecture design for every real-world crypto-system. Finally, a discussion is provided to define the benefits and the limitations of this new solution and a new perspective is proposed for DLSCA models.
|
|
FEBRUARY 2022 |
|
|
“Implémentations sécurisées et évaluation pré-silicium contre les attaques physiques.” by Sofiane Takarabt (Secure-IC) Date: 4 february 2022 Side-channel attacks remain a permanent threat against embedded systems, thus reliable protections should be implemented and must be minutely evaluated. In this presentation, we study different possible ways to evaluate against such threats. We show how an evaluation can be carried out to validate a security level of a protected hardware implementation. This approach allows us to estimate in advance the expected security level on a real circuit. We explore an efficient and more exhaustive way to test a masked implementation against vulnerabilities induced by glitches. We took advantage in this approach to setup a better model for this phenomenon, and to explain the form of the generated leakage based on a spectral characterization that can be applied also to real acquisitions. This allows us to explain why standard leakage models are ineffective, and why a prior characterization is required to be able to exploit this kind of flaw. With this better understanding of the leakage, we can design more compact and robust functions, that we validate on simulated and real electromagnetic traces.
|
|
APRIL 2018 |
|
|
“Masked Proofs and Their Physical Assumptions” Date: 20 april 2018 Les attaques par canaux auxiliaires sont des menaces majeures contre les mises en uvre cryptographiques. Pour contrer ces attaques, le masquage est une contre-mesure populaire. Un de ces principaux avantages est de pouvoir prouver la sécurité apportée par cette contre-mesure. Ces preuves se basent sur un certain nombre d’hypothèses sur le matériel qui met en uvre le masquage. Dans cette présentation, nous allons nous intéresser à plusieurs effets mettant à mal ces hypothèses et voir leurs impacts sur la sécurité obtenue. Nous nous intéresserons aux problèmes des transitions, des glitches, du coupling et du bruit.
|
|
MAY 2018
|
|
|
“Cryptographie légère intrinsèquement résistante aux attaques physiques pour l’Internet des Objets” Date: 25 may 2018 Avec des applications telles que les smart phones , compteurs intelligents, capteurs et autres systèmes industriels de type SCADA, le nombre d objets connectés à Internet atteindrait les 20 milliards d ici 2020. Les contraintes de taille, coût et consommation ainsi que les problématiques de sécurité liées au déploiement de ces objets à si grande échelle ont mené à la conception de systèmes de chiffrement efficaces et ayant une faible empreinte matérielle, assurant la confidentialité, l authenticité et l intégrité des données contenues et manipulées par ces objets. Cependant, ces systèmes de chiffrement dits ‘légers’ sont déployés au sein d objets qui sont généralement en milieu hostile, à portée de main de tout type d attaquant et ce sur des durées souvent indéterminées . Ainsi, la vulnérabilité de ces objets face aux attaques physiques est une autre problématique de sécurité aujourd’hui au centre des débats. Biographie : Titulaire d’un Master CRYPTIS, parcours Mathématiques, Cryptologie, Codage et Applications, obtenu à la Faculté des Sciences et Techniques de Limoges, Benjamin Lac travaille aujourd’hui au sein du département Systèmes et Architectures Sécurisées (SAS) localisé à Gardanne (13) dans le cadre d’un doctorat Mines Saint-Étienne issu d’une collaboration entre le CEA, la DGA et l’Inria.
|
|
JUNE 2018 |
|
|
“HardBlare, a hardware/software co-design approach for Information Flow Control” Date: 22 june 2018 One way to increase the security level of computer systems is to rely on both software and hardware mechanisms. In this context, the HardBlare project proposes a software hardware co-design methodology to ensure that security properties are preserved all along the execution of the system but also during file storage. The HardBlare project is a multidisciplinary project between CentraleSupélec IETR SCEE research team, Centrale-Supélec Inria CIDRE research team and UBS Lab-STICC laboratory. Our approach is based on Dynamic Information Flow Tracking (DIFT) that generally consists in attaching marks to denote the type of information that are saved or generated within the system. These marks are then propagated when the system evolves and information flow control is performed in order to guarantee a safe execution and storage within the system. Existing solutions based on hardware modifications are hardly adopted in industry. This is for a large part due to the cost of these hardware modifications but also to the cost induced by the redevelopment of the whole software stack to be adapted to the specific hardware. To tackle this problem, the HardBlare project builds on top of a standard software and hardware platform. The goal is to make no modification of the main processor core and to implement hardware DIFT in a dedicated coprocessor using FPGA. The main challenge in such approach is to narrow the semantic gap between the main processor and the co-processor. To address this issue, we take profit of ARM CoreSight debug components and static analysis to reduce instrumentation time overhead. We developed an end-to-end system including a dedicated DIFT co-processor on FPGA, a modified Linux kernel with DIFT support for file system and a modified LLVM compiler to perform the static analysis of monitored software.
“Security of Hardware/Software Interfaces : Research Chair of the Cybersecurity Research Cluster” Date: 22 june 2018 We proposed to host a thematic semester on attacks based on the interaction between software and hardware. The goal would be to host one workshop, one summer school for young researchers, as well as multiple seminars and longer stays for researchers, spanning September 2019 to March or April 2020. This thematic semester will be funded by the DGA in the context of the Cybersecurity Research Cluster. The subject of the talk will be to present the organisation of this semester, the different research axes that will be covered as well as the possible interactions with people interested in that subject. |
|
SEPTEMBER 2018 |
|
|
“Schindler-Itoh/Wiemers revisited: recovering full RSA/ECC private key from noisy side-channel observations ” Date: 28 september 2018 Side-channel attacks on public-key cryptography (i.e. modular exponentiation for RSA or scalar multiplication for ECC) often boils down to distinguishing the 0s from the 1s in the binary representation of the secret exponent (resp. secret scalar).
|
|
DECEMBER 2018 |
|
|
“Étude des cellules oscillantes pour la génération d’aléa dans les circuits électroniques numériques” Date: 14 december 2018 Les objets connectés sont omniprésents dans notre société actuelle (ex : véhicules, transports en commun, santé, domotique, smartphone, moyen de paiement, etc.). La connexion et l’accès à distance des appareils d’usage quotidien améliore considérablement notre confort et notre efficacité dans notre vie professionnelle comme personnelle. Cependant, cela peut également nous confronter à des problèmes de sécurité sans précédent. Les risques liés à la large expansion des systèmes embarqués et de l’internet des objets sont double :
“Une approche pour l’accélération matérielle pour le chiffrement homomorphe” Date : 14 december 2018 Le chiffrement homomorphe est un outil cryptographique permettant la manipulation de données en aveugle. Son utilisation généralisée permettrait de proposer des solutions de calcul déporté impliquant des données confidentielles, par exemple des données génomiques pour la médecine personnalisée. Cependant, le chiffrement homomorphe doit faire face à de grandes complexités mémoires et calculatoires. La taille d’une donnée chiffrée est environ 10^5 fois plus importante que la donnée réelle, et une opération sur chiffré est environ 10^6 fois plus lourde que l’opération claire équivalente. Dans cet exposé, nous présenterons d’abord succinctement les problématiques d’accélération matérielle pour le chiffrement homomorphe et les différentes approches existantes. Nous exposerons ensuite plus particulièrement une approche couplant le système de représentation non-positionnel RNS et la multiplication de polynômes par transformée de Fourier sur corps-finis (NTT). Nous nous intéresserons notamment à la question du passage à l’échelle au regard de la grande dynamique des paramètres. Les perspectives d’implémentation apportées par cette approche viendront conclure cet exposé. |
|
MARCH 2019 |
|
|
“True Random Number Generators enabled hardware security ” Date: 29 march 2019 True randomness is all about unpredictability, which can neither be qualified nor quantified by examining statistics of a sequence of digits. Unpredictability is a property of random phenomena, which is measured in bits of information entropy. Application of randomness spans from art to numerical computing and system security. Random numbers enable various cryptographic algorithms, protocols and secured implementations by providing secret keys, initialization vectors, random challenges and masks. As embedded electronics continue to be integrated into our daily lives, security becomes an indispensable requirement for an embedded system. According to the renowned Kerckhoffs’ principle, a cryptographic system should be secure even if the attacker knows everything about the system, except the key. In modern computers and embedded systems, this key is usually generated by executing a True Random Number Generator. Therefore, it is essential that unpredictable random numbers are available in secure embedded systems. Unfortunately, designing a TRNG is not trivial and different from conventional digital circuit design, since most digital circuits are primarily developed to behave in a deterministic digital manner. Instead of pursuing a stable and predictable behavior of the circuit, the TRNG design aims for a stable and robust unpredictability. Producing unpredictable output is usually undesired for an integrated circuit, and is sometimes regarded as a design failure. Having mistakes or being careless at any step of the TRNG design and fabrication procedure may lead to insufficient entropy or/and a malfunctioned TRNG. A True Random Number Generator (TRNG) circuit is designed to be sensitive to a particular physical phenomenon when it is in use, and to be resistant to process variations and other unwanted random physical phenomena. In order to tackle the lack of compact and efficient TRNGs on FPGAs, we proposed a novel TRNG based on edge sampling.
|
|
APRIL 2019 |
|
|
“TRAITOR : a multi clock-glitch attack platform reproducing EMI effects at low-cost” Date: 05 april 2019 Electromagnetic injection (EMI) is a common and non-invasive technique used to perform fault attacks. In that case, an electromagnetic wave is radiated by an antenna in the close vicinity of the targeted microcontroller (STM32 in our case).
“Improved Blind Side-Channel Analysis by Exploitation of Joint Distributions of Leakages” Date: 05 april 2019 Les attaques side channel classiques nécessitent généralement la connaissance du clair (ou du chiffré) afin de calculer des données internes qui seront comparées à des fuites. Des attaques permettent cependant de s’affranchir de ces connaissances, les attaques par distributions jointes. Ces attaques supposent un attaquant capable d’inverser le modèle de consommation, mais aucune connaissance sur les entrées et les sorties du chiffrement. Un autre effet de ces attaques est qu’il est possible de les appliquer en milieu de chiffrement, ce qui peut s’avérer utile lorsque des protections sont appliquées uniquement aux extrémités pour des raisons de coût. Le principe réside dans le fait que la distribution des poids de Hamming (pour un modèle de consommation en poids de Hamming) d’une variable en début puis en fin de tour n’est pas uniforme, elle est même fonction de la clé utilisée. L’étude de ces distributions permet donc de discriminer la clé. Aujourd’hui le maximum de vraisemblance est l’outil qui semble être le plus approprié pour déduire la clé. Cette attaque peut aussi être menée dans certains cas d’implémentations protégées par du masquage booléen. Dans certains cas plus robustes, il est possible d’adapter cette attaque pour qu’elle fonctionne quand même. Pour cela, on utilise des distributions qui sont dites quadrivariées. La présentation aura donc pour but l’introduction à l’attaque de base, ainsi qu’à son adaptation contre des protections de type masquage d’ordre 1.
|
|
MAY 2019 |
|
|
“Title: Do Not Trust Modern System-on-Chips Date: 10 may 2019 Electromagnetic fault injection (EMFI) is a well known technique to disturb the behavior of a chip and weaken its security. These attacks are still mostly done on simple microcontrollers since the fault effects is relatively simple and understood.
“Automated software protection for the masses against side-channel attacks” Date: 10 may 2019 This presentation will present an approach and a tool that answer the need for effective, generic, and easily applicable protections against side-channel attacks. The protection mechanism is based on code polymorphism, so that the observable behaviour of the protected component is variable and unpredictable to the attacker. Our approach combines lightweight specialized runtime code generation with the optimization capabilities of static compilation. It is extensively configurable. Experimental results show that programs secured by our approach present strong security levels and meet the performance requirements of constrained systems.
|
|
JUNE 2019 |
|
|
“Challenges related to random number generation for cryptographic applications” Date: 7 june 2019 The main purpose of cryptography is to ensure secure communication. In order to achieve this goal, cryptographic schemes make an intensive use of random numbers. Given that the security of these schemes highly depends on these numbers, it is important to produce high-quality random numbers. Knowing that most cryptographic modules are nowadays implemented in logic devices, we investigated True Random Number Generators (TRNGs) that can be implemented in this kind of technology. Because of the critical nature of TRNGs in cryptographic schemes, their source and their quality must be evaluated in details.
“Laser-Based Attacks Against FPGA Bitstream Encryption” Date: 7 june 2019 Field programmable gate arrays (FPGAs) use encryption to protect the configuration data or “bitstream” containing the design to be run on the device. This encryption aims at protecting the intellectual property and other secrets contained in the bitstream and preventing e.g. cloning or tampering with an FPGA implementation.
|
|
NOVEMBER 2019 |
|
|
“One Fault Can Go A Long Way” Date: 15 november 2019 *Abstract:* Fault attacks are considered among critical threat to embedded cryptography. This talk will be divided into in two parts. The first part of the talk will explore application of faults on advanced security primitives. We present persistent fault analysis introduced at CHES 2017 and its capability to bypass state of the art fault countermeasures as well as higher-order masking with one and only one fault injection. Further, we present novel exploits in lattice based post-quantum cryptographic primitives with one (or few) faults. The second part of the talk will present, to our knowledge, the first practical combined side-channel and differential fault attacks. With application to bit permutation based ciphers like PRESENT and GIFT, practical attacks exploiting laser fault injection with power side-channel will be presented.
|
|
JANUARY 2020 |
|
| “Vers une meilleure compréhension de l’apprentissage profond appliqué aux attaques par observation.” by Loïc Masure (CEA) Date: 10 january 2020 Room: Métivier Les attaques par observation (SCA) exploitent les failles d’une primitive cryptographique embarquée sur un composant (type carte à puce, IoT, …), en mesurant des grandeurs physiques qui dépendent indirectement de la valeur de la clé secrète. C’est pourquoi il est primordial pour les développeurs de proposer des contre-mesures adaptées et d’évaluer leur efficacité face à un attaquant potentiel.
|
|
FEBRUARY 2020 |
|
| “libecc: a flexible open-source ECC library for embedded devices” by Ryad Benadjila and Arnaud Ebalard (ANSSI) Date: 14 february 2020 Room: Pétri/Turing libecc is a software library for elliptic curves based cryptography (ECC), with an API supporting signature algorithms specified in the ISO14888-3 standard.
|
|
MARCH 2021 |
|
|
“SideLine and the advent of software-induced hardware attacks” Date: 19 march 2021 In this talk, we will discuss software-induced hardware attacks and their impact for IoT, cloud and mobile security. More specifically, I will introduce SideLine, a new power side-channel attack vector that can be triggered remotely to infer cryptographic secrets. SideLine is based on the intentional misuse of delay-lines components embedded in SoCs that use external memory. I will explain how we exploit the delay-line relationship with on-chip power consumption to capture side-channel leakage, how we collect and store this information and how we use it to conduct power side-channel attacks. Different scenarios will be discussed along with the feasibility of remote hardware attacks in various scenarios. “Calibration Done Right: Noiseless Flush+Flush Attacks” Date: 19 march 2021 Caches leak information through timing measurements and so-called side-channel attacks. Several primitives exist with different requirements and trade-offs. Flush+Flush is a stealthy and fast cache attack primitive that uses the timing of the clflush instruction depending on the presence of a line in the cache. However, the CPU interconnect plays a bigger role than thought in these timings, and therefore in the error rate of Flush+Flush.
|
|
APRIL 2021 |
|
|
“Lattice-based NIST candidates: abstractions and ninja tricks” Date: 23 april 2021 I will present the remaining lattice-based candidates for standardization by NIST (2 signature schemes, 5 encryption schemes). At a high level, these can all be interpreted as straightforward instantiations of decades-old paradigms. But when we look under the hood, all of them make design choices which impact their security, efficiency and portability in distinct manners; we will discuss these. Finally, we will look at ninja tricks that can be pulled off with specific lattice-based schemes; in *some* contexts, these allow, with minimal changes to the schemes, to greatly decrease their communication overhead.
“Code-based postquantum cryptography : candidates to standardization” Date: 23 april 2021 At the third round of the NIST standardization process, three candidates remain with a security based on error correcting codes, all are key exchange mechanisms. We will explore them according to their security assumptions and properties. Among them, we find an historical scheme (Classic McEliece), as well as schemes using sparse and quasi-cyclic matrices (BIKE and HQC). We will examine pros and cons, as well as, for some of them, aspects of their implementation through possible use cases.
“Post-Quantum Cryptography Hardware: Monolithic Implementations vs. Hardware-Software Co-Design” Date: 23 april 2021 At PQShield, we’ve developed dedicated coprocessor(s) for lattice schemes, hash-based signatures, and code-based cryptography. These cryptographic modules are commercial rather than academic and designed to meet customer specifications such as a specific performance profile or Common Criteria and FIPS security certification requirements.
|
|
JUNE 2021 |
|
|
” Unique CAD-compatible SCA-security mechanisms, externally amplified coupling (EAC) attacks and (some) connection” by Itamar Levi (Bar-Ilan University (BIU)) Date : 25 june 2021 In this seminar I will first discuss unique computer aided design (CAD) compatible SCA security mechanisms. I will present an approach which can significantly increase the physical security-level of a design, be implemented with conventional design-tools and which does not require any special technological-support. The method consists with a correct by-design utilization of power-management libraries and tools; it embeds special and ultra low-cost randomization mechanisms in a local fashion into the RTL of a design. Therefore, making it mature and easy to master by any backend/frontend digital designer. This method is ideally suited for high security levels when used as a building block to reduce the SNR and amplify the noise in the leakage with mathematical solutions (e.g. masking). Theoretically, a limitation of the construction as a stand-alone is security-energy scaling, i.e. for very high security levels its energy cost is exponential. I will present a glimpse of our current work answering this challenge with an alternative construction which provide linear cost.
|
|
OCTOBER 2021 |
|
|
” Rank metric cryptography and its implementations” by Nicolas Aragon (XLIM – Université de Limoges) Date : 08 october 2021 In 2017, the NIST (National Institute for Standards and Technology) started astandardization process in order to select post-quantum encryption and digital signature schemes. Among the proposed solutions, two rank-metric based encryption schemes were selected for the second round of the standardization process: ROLLOand RQC.
|
|
OCTOBER 2021
|
|
|
“When Electromagnetic Signals Reveal Obfuscated Malware: Deep and Machine Learning Use cases” Date: 22 october 2021 The Internet of Things (IoT) is constituted of devices that are expo-nentially growing in number and in complexity. They use plentiful customized firmware and hardware, ignoring potential security issues, which make them a perfect victim for cybercriminals, especially malware authors.
|
