8 비트 구현 Ring-LWE 암호시스템의 SPA 취약점 연구
A Study of SPA Vulnerability on 8-bit Implementation of Ring-LWE Cryptosystem
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
포스트 양자 암호라 할지라도 실제 디바이스에 이를 적용 할 때 부채널 분석 취약점이 존재한다는 것은 이미 알려져있다. 코드 기반 McEliece 암호와 격자 기반 NTRU 암호에 대한 부채널 분석 연구 및 대응책 연구는 많이 이루어지고 있으나, ring-LWE 암호에 대한 부채널 분석 연구는 아직 미비하다. 이에 본 논문은 8비트 디바이스에서ring-LWE 기반 암호가 동작할 때 적용 가능한 선택 암호문 SPA 공격을 제안한다. 제안하는 공격은 ⌈log2q⌉개의 파형으로 비밀키를 복구 할 수 있다. q는 보안 레벨과 관련된 파라미터로 128비트 또는 256비트의 보안 레벨을 만족하기위해 각각 7681 또는 12289를 사용한다. 또한, 우리는 실제 디바이스에서 동작되는 ring-LWE 복호화 과정의 모듈러 덧셈에서 비밀키를 드러낼 수 있는 취약점이 존재함을 실험을 통해 보이고, 공격 시간 단축을 위한 두 벡터의 유사도측정 방법을 이용한 공격에 대해 논한다.
Abstract
It is news from nowhere that post-quantum cryptography has side-channel analysis vulnerability. Side-channel analysis attack method and countermeasures for code-based McEliece cryptosystem and lattice-based NTRU cryptosystem have been investigated. Unfortunately, the investigation of the ring-LWE cryptosystem in terms of side-channel analysis is as yet insufficient. In this paper, we propose a chosen ciphertext simple power analysis attack that can be applied when ring-LWE cryptography operates on 8-bit devices. Our proposed attack can recover the key only with⌈log2q⌉traces. q is a parameter related to the security level. It is used 7681 and 12289 to match the common 128 and 256-bit security levels, respectively. We identify the vulnerability through experiment that can reveal the secret key in modular add while the ring-LWE decryption performed on real 8-bit devices. We also discuss the attack that uses a similarity measurement method for two vectors to reduce attack time.
참고문헌 (14)
- P. Shor, "Algorithms for quantum computation : Discrete logarithms and factoring", Proceedings of the 35th Annual Symposium on Foundations of Computer Science, pp.124~134 (1994)
- P. Kocher, "Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems", Proceedings of the 16th Annual International Cryptology Conference, pp.104~113 (1996)
- P. Kocher, "Differential power analysis", Proceedings of the 19th Annual International Cryptology Conference, pp.388~397 (1999)
- C. Chen, "Differential Power Analysis of a McEliece Cryptosystem", Proceedings of the 13th International Conference on Applied Cryptography and Network Security, pp.538~556 (2015)
- M. K. Lee, "Countermeasures against the power analysis attack for the NTRU public key cryptosystem", IEICE Transactions on Fundamentals of Electronics on Communications and Computer Sciences, E93-A(1), pp.153~163 (2010)
- V. Lyubashevsky, "On Ideal Lattices and Learning with Errors over Rings", Proceedings of the 29th Annual International Conference on the Theory and Applications of Cryptographic Techniques, pp.1~23 (2010)
- S. Roy, "Compact ring-LWE cryptoprocessor", Proceedings of the 16th Workshop on Cryptographic Hardware and Embedded Systems, pp.371~391 (2014)
- N. Göttert, "On the Design of Hardware Building Blocks for Modern Lattice-Based Encryption Schemes", Proceedings of the 14th Workshop on Cryptographic Hardware and Embedded Systems, pp.512~529 (2012)
- Z. Liu, "Efficient Ring-LWE encryption on 8-bit AVR processors", Proceedings of the 17th Workshop on Cryptographic Hardware and Embedded Systems, pp.663~682 (2015)
- G. Perin, "Practical analysis of rsa countermeasures against side-channel electromagnetic attacks", Proceedings of the 12th Smart Card Research and Advanced Application Conference, pp.200~215 (2013)
- A. Park, "Chosen ciphertext Simple Power Analysis on software 8-bit implementation of ring-LWE encryption", Proceedings of the Hardware-Oriented Security and Trust(AsianHOST), pp.1~6 (2016)
- A. Park, "Chosen Ciphertext SPA attack on ring-LWE cryptosystem", CISC-W'16 (2016)
- O. Reparaz, "A masked ring-LWE implementation", Proceedings of the 17th Workshop on Cryptographic Hardware and Embedded Systems, pp.683~702 (2015)
- O. Reparaz, "Additively homomorphic ring-LWE masking", Proceedings of the 7th International Conference on Post-Quantum Cryptography, pp.233~244 (2016)