An Efficient Leakage Free Countermeasure of AES against Side Channel Attacks

Across generations many electronic devices have become more popular starting from cell phones, tablets, laptops, desktops and any communication devices. Globalization and various treaties have resulted in increased outsourcing of data, software, hardware and various services. This increases the need to protect data and information whether transmitted, processed, stored or distributed, which results in developing many cryptographic algorithms to secure different types of hardware and software. In 2001, the National Institute of Standards and Technologies (NIST) selected Rijndael as the advanced encryption standard (AES) [1]. The security of AES has received considerable attention, which encourages the community to compete in developing many hardware and software implementations for AES. AES has become the widely used encryption primitive to protect electronic data in many applications and platforms. Side-channel attacks (SCAs) are a real and successful threat to AES. SCAs obtain secret keys by exploiting the physical leakage of information from executing Abdulaziz Miyajan University of Connecticut, 2016 ii cryptographic algorithms such as those for power consumption, electromagnetic radiation, running time and cache profile information. In power and electromagnetic analysis attacks, the observable leakages are the power consumption and the electromagnetic radiation of the device, which are dependent on the processed data and the performed operations. Masking is a common and widely used countermeasure to defeat differential power analysis (DPA) and differential electromagnetic analysis (DEMA) attacks. In timing attacks which can be carried out remotely (e.g. over networks [2]), the observable leakage is the execution time variation to respond to queries or perform cryptographic operations that depend on critical data or secret keys. Having a constant-time implementation is a sound countermeasure to mitigate timing attacks. In cache attacks, an observable leakage (covert channel) about which part of the look-up table was accessed, might be revealed by the cache. One way to mitigate cache attacks is by having an implementation that does not use lookup tables. Another way is by using Data-Oblivious Memory Access Pattern. The second technique requires a small increment of memory but is more efficient, while the first one solves the memory overhead problem with negative impact on the performance. This thesis proposes an efficient, leakage-free countermeasure of AES, against multiple side channel attacks, meanwhile avoiding as much as we can, the negative impact in the performance as a result of combining those countermeasures, and the memory overhead that results from storing lookup tables. The first part of the thesis focuses on techniques to produce an efficient leakagefree countermeasure of AES against power analysis, electromagnetic emissions, timing Abdulaziz Miyajan University of Connecticut, 2016 iii and cache attacks. This countermeasure features a secure higher-order masking scheme (to defeat power and electromagnetic attacks), the elimination of lookup tables (to mitigate cache attacks and remove memory overhead), and a constant-time implementation (to defend against timing attacks). However, combining these countermeasures imposes a negative impact on performance. Therefore, we propose techniques to solve the performance problem at the algorithm and data levels. The second part of the thesis focuses on the bottleneck transformation of the AES which is the SubByte transformation. This thesis demonstrates the techniques, presenting an application of efficient SubByte transformation by working in three different levels: algorithm, byte and bit levels. The last part of the thesis focuses on the inversion operation which is the first part of the SubByte transformation, utilizing the squaring property of the normal basis. Consequently, these masks need to be converted between the two forms (polynomial and normal basis) based on the sequence of operations. This thesis presents a low cost basis conversion technique that can be applied with or without using lookup tables. Moreover, this thesis presents efficient and secure techniques, which mitigate cache attacks and further improve the running time of the algorithm, in exchange for a small memory requirement. Finally, to verify our work we deployed the several techniques in a real application (OpenSSL framework) as a case study.