Side-channel attack

In cryptography, a side channel attack is any attack based on information gained from the physical implementation of a cryptosystem, rather than brute force or theoretical weaknesses in the algorithms (compare cryptanalysis). For example, timing information, power consumption, electromagnetic leaks or even sound can provide an extra source of information which can be exploited to break the system. Many side-channel attacks require considerable technical knowledge of the internal operation of the system on which the cryptography is implemented.

Attempts to break a cryptosystem by deceiving or coercing people with legitimate access are not typically called side-channel attacks: see social engineering and rubber-hose cryptanalysis. For attacks on computer systems themselves (which are often used to perform cryptography and thus contain cryptographic keys or plaintexts), see computer security.

General

General classes of side channel attack include:

* Timing attack — attacks based on measuring how much time various computations take to perform.
* Power monitoring attack — attacks which make use of varying power consumption by the hardware during computation.
* TEMPEST (aka van Eck or radiation monitoring) attack — attacks based on leaked electromagnetic radiation which can directly provide plaintexts and other information.
* Acoustic cryptanalysis — attacks which exploit sound produced during a computation (rather like power analysis).
* Differential fault analysis, in which secrets are discovered by introducing faults in a computation.
* Observing from a distance, with a telescope, the monitor image, reflected in e.g. eyeglasses, a tea pot, spoon, plastic bottle, or the eye of the user. [ [http://www.infsec.cs.uni-sb.de/~unruh/publications/reflections.pdf Compromising Reflections -or- How to Read LCD Monitors around the Corner.] ]

In all cases, the underlying principle is that physical effects caused by the operation of a cryptosystem ("on the side") can provide useful extra information about secrets in the system, for example, the cryptographic key, partial state information, full or partial plaintexts and so forth. The term cryptophthora (secret degradation) is sometimes used to express the degradation of secret key material resulting from side channel leakage.

Examples

A "timing attack" watches data movement into and out of the CPU, or memory, on the hardware running the cryptosystem or algorithm. Simply by observing how long it takes to transfer key information, it is sometimes possible to determine how long the key is in this instance (or to rule out certain lengths which can also be cryptanalytically useful). Internal operational stages in many cipher implementations provide information (typically partial) about the plaintext, key values and so on, and some of this information can be inferred from observed timings. Alternatively, a timing attack may simply watch for the length of time a cryptographic algorithm requires -- this alone is sometimes enough information to be cryptanalytically useful.

A "power monitoring attack" can provide similar information by observing the power lines to the hardware, especially the CPU. As with a timing attack, considerable information is inferable for some algorithm implementations under some circumstances.

As a fundamental and inevitable fact of electrical life, fluctuations in current generate radio waves, making whatever is producing the currents subject -- at least in principle -- to a "van Eck" (aka, TEMPEST) attack. If the currents concerned are patterned in distinguishable ways, which is typically the case, the radiation can be recorded and used to infer information about the operation of the associated hardware.

A recently declassified NSA document reveals that as far back as 1943, an engineer with Bell telephone observed decipherable spikes on an oscilloscope associated with the decrypted output of a certain encrypting teletype [http://blog.wired.com/27bstroke6/2008/04/nsa-releases-se.html] . According to former MI5 officer Peter Wright, the British Security Service analysed emissions from French cipher equipment in the 1960s [http://cryptome.org/tempest-time.htm] . In the 1980s, Soviet eavesdroppers were known to plant bugs inside IBM Selectric typewriters to monitor the electrical noise generated as the type ball rotated and pitched to strike the paper; the characteristics of those signals could determine which key was pressedFact|date=February 2007.

If the relevant currents are those associated with a display device (ie, highly patterned and intended to produce human readable images), the task is greatly eased. CRT displays use substantial currents to steer their electron beams and they have been 'snooped' in real time with minimum cost hardware from considerable distances (hundreds of meters have been demonstrated). LCDs require, and use, smaller currents and are less vulnerable -- which is not to say they are invulnerable. Some LCDs have been proven vulnerable too ( [http://www.newscientist.com/blog/technology/2007/04/seeing-through-walls.html] ).

Also as an inescapable fact of electrical life in actual circuits, flowing currents heat the materials through which they flow. Those materials also continually lose heat to the environment due to other equally fundamental facts of thermodynamic existence, so there is a continually changing thermally induced mechanical stress as a result of these heating and cooling effects. That stress appears to be the most significant contributor to low level acoustic (i.e. "noise") emissions from operating CPUs (about 10 kHz in some cases). Recent research by Shamir et al. has demonstrated that information about the operation of cryptosystems and algorithms can be obtained in this way as well. This is an acoustic attack; if the surface of the CPU chip, or in some cases the CPU package, can be observed, infrared images can also provide information about the code being executed on the CPU, known as a "thermal imaging attack".

Countermeasures

Because side channel attacks rely on emitted information (like electromagnetic radiation or sound) or on relationship information (as in timing and power attacks), the most reasonable methods of countering such attacks is to limit the release of such information or access to those relationships. Displays are now commercially available which have been specially shielded to lessen electromagnetic emissions reducing susceptibility to TEMPEST attacks. Power line conditioning and filtering can help with power monitoring attacks, as can some continuous-duty UPSs. Physical security of hardware can reduce the risk of surreptitious installation of microphones (to counter acoustic attacks) and other micro-monitoring devices (against CPU power draw or thermal imaging attacks).

Another countermeasure is to jam the emitted channel with noise. For instance, a random delay can be added to foil timing attacks. As the amount of data in the side channel increases, this rapidly becomes impractical; while useful against simple timing attacks or scripted attacks, it is not a practical countermeasure against TEMPEST attacks if the adversary is capable of sophisticated cryptanalysis (as such an adversary typically would be).

ee also

* Brute force attack
* Computer surveillance
* Covert channel

References

Additional reading

* An executive summary of side channel attacks, and references (http://www.hbarel.com/Misc/side_channel_attacks.html)
* Introduction to differential Power Analysis and Related attacks, 1998, P Kocher, J Jaffe, D Jun (http://www.cryptography.com/dpa/technical/)
* A cautionary Note Regarding Evaluation of AES Candidates on Smart Cards, 1999, S Chari, C Jutla, J R Rao, P Rohatgi (http://csrc.nist.gov/encryption/aes/round1/conf2/papers/chari.pdf)
* DES and Differential Power Analysis, L Goubin and J Patarin, in Proceedings of CHES'99, Lecture Notes in Computer Science Nr 1717, Springer-Verlag
* The Side Channel Cryptanalysis Lounge (http://www.crypto.ruhr-uni-bochum.de/en_sclounge.html)
* Listing of side channel attack related publications and patents (http://www.sidechannelattacks.com)

External links

* [http://www.hbarel.com/publications/Introduction_To_Side_Channel_Attacks.pdf Introduction to Side Channel Attacks] , an industrial 'White Paper' report (PDF file)