Add correlation-enhanced collision attack #18

vogelpi · 2020-10-28T15:10:21Z

This attack is supposed to work both on unmasked AES implementations and implementations using the masked Canright S-Box. It uses the existing simple_capture_traces.py for the capture stage.

Note: Currently, the attack is not successful. I suspect because of noise in the traces or wrong configuration of the scope. I tried to use the ResyncSAD class of the ChipWhispererAPI and also implemented some very basic filtering, both without success. I am now collecting fresh traces with disconnected FTDI.

This is related to #11.

alphan

Thanks @vogelpi! Just some initial feedback:

alphan · 2020-10-28T17:08:21Z

cw/cw305/correlation-enhanced_collision_attack.py

+
+from util import plot
+
+# Open trace file


Can you add a if __name__ == '__main__' at the bottom and move this code to main()?

That's done now.

alphan · 2020-10-28T17:43:58Z

cw/cw305/correlation-enhanced_collision_attack.py

+# Create a local copy of the traces. This makes the remaining operations much
+# faster.
+traces = np.empty((num_traces, num_samples_use), np.double)
+for i_trace in range(num_traces):
+    traces[i_trace] = project.waves[i_trace][start_sample_use:stop_sample_use]


Is this because cw loads traces lazily? I wonder if there is something in the API to do this for us.

I believe you can do the following:

traces = np.array(project.waves)[:num_traces,start_sample:stop_sample]

I recommend the following:

import pandas as pd traces = pd.DataFrame(np.array(project.waves)[:num_traces,start_sample:stop_sample]) # Then you can do the following mean = traces.mean(axis=0) std = traces.std(axis=0) # the following requires pandas_bokeh pd.set_option("plotting.backend", "pandas_bokeh") mean.plot()

The problem is that project.waves is a memory mapped object that is not dense/contiguous and only indirectly accessed. This is really slow for big data sets.

I played around with this when trying to parallelize the computation. The way the memory mapping is implemented in the CW API, parallelization using multiprocessing etc. fails in most cases. Either the unpickling failed or I got errors that too many files where open (when giving each thread just the part of the project.waves it needs, this actually creates a new memory mapping for every thread). In the end, I ended up opening the project file separately for every thread. This worked, but it wasn't really efficient.

In contrast, creating this local dense copy is orders of magnitude faster. For example, the whole script now takes around 80 seconds on my machine. Working on the memory mapped traces such as with the approach of @moidx , the filtering alone takes around 3 - 4 minutes.

alphan · 2020-10-28T17:50:26Z

cw/cw305/correlation-enhanced_collision_attack.py

+    stop_sample = start_sample + num_samples
+    mean_trace = np.zeros(num_samples, np.double)
+    mean_sq_trace = np.zeros(num_samples, np.double)
+    for i in range(len(traces)):
+        mean_trace += traces[i][start_sample:stop_sample]
+        mean_sq_trace += (traces[i][start_sample:stop_sample]**2)
+    mean_trace /= num_traces
+    mean_sq_trace /= num_traces
+    return mean_trace, mean_sq_trace


I think we can use something like np.mean(traces, axis=0)[start_sample:stop_sample] instead of the loop.

That's changed, thanks for the suggestion.

alphan · 2020-10-28T17:55:41Z

cw/cw305/correlation-enhanced_collision_attack.py

+    stop_sample = start_sample + num_samples
+    mean_trace = np.zeros(num_samples, np.double)
+    mean_sq_trace = np.zeros(num_samples, np.double)
+    for i in range(len(traces)):
+        mean_trace += traces[i][start_sample:stop_sample]
+        mean_sq_trace += (traces[i][start_sample:stop_sample]**2)


traces is already truncated above using start_sample_use and stop_sample_use. Calls seem to be OK but can you consider removing this for the sake of simplicity?

alphan · 2020-10-28T17:57:20Z

cw/cw305/correlation-enhanced_collision_attack.py

+mean_trace, mean_sq_trace = get_mean_sq_traces(traces, num_samples_use, 0)
+sigma_trace = np.sqrt(mean_sq_trace - (mean_trace**2))


I think we can just use numpy.std and remove mean_sq_trace

Yes absolutely. I wasn't aware that these functions exist...

moidx

One initial comment. I will continue tomorrow

moidx · 2020-10-29T05:59:33Z

cw/cw305/correlation-enhanced_collision_attack.py

+# Create a local copy of the traces. This makes the remaining operations much
+# faster.
+traces = np.empty((num_traces, num_samples_use), np.double)
+for i_trace in range(num_traces):
+    traces[i_trace] = project.waves[i_trace][start_sample_use:stop_sample_use]


I believe you can do the following:

traces = np.array(project.waves)[:num_traces,start_sample:stop_sample]

I recommend the following:

import pandas as pd traces = pd.DataFrame(np.array(project.waves)[:num_traces,start_sample:stop_sample]) # Then you can do the following mean = traces.mean(axis=0) std = traces.std(axis=0) # the following requires pandas_bokeh pd.set_option("plotting.backend", "pandas_bokeh") mean.plot()

vogelpi · 2020-10-30T08:31:41Z

I am obviously not that experienced with Python yet :-) but happy to improve my skills, thanks @moidx and @alphan for your feedback!

This attack is supposed to work both on unmasked AES implementations and implementations using the masked Canright S-Box. It uses the existing simple_capture_traces.py for the capture stage. Signed-off-by: Pirmin Vogel <vogelpi@lowrisc.org>

This attack can be performed on the first round (recovering the deltas between bytes in the initial key) or the last round (recovering the deltas between bytes in the final round key). Signed-off-by: Pirmin Vogel <vogelpi@lowrisc.org>

vogelpi · 2020-11-20T10:45:22Z

Hey @moidx and @alphan ,
I've finally managed to get this attack working on the unmasked implementation. It produces the following output:

$ ./correlation-enhanced_collision_attack.py 
Will work with 997740/1000000 traces.
known_key: b'2b7e151628aed2a6abf7158809cf4f3c'
key guess: b'2b7e151628aed2a6abf7158809cf4f3c'
SUCCESS!
86/120 deltas guessed correctly.

I also needed to normalize the correlations such that we indeed select the relationships with the strongest peaks. Below you can see the correlation plot for the last round key - Byte 0 xor Byte 1 (green), Byte 0 xor Byte 2 (orange), Byte 0 xor Byte (blue):

Could you please take another look at the PR?

…tack This commit adds a possibility to sweep the number of traces used for the attack, which allows to determine the minimum number of traces used to successfully perform the attack. Signed-off-by: Pirmin Vogel <vogelpi@lowrisc.org>

When sweeping the number of traces used, most of the time is spent in computing the m_alpha_j-s. This commit parallelizes the corresponding code to speed up the attack. Signed-off-by: Pirmin Vogel <vogelpi@lowrisc.org>

vogelpi · 2020-11-23T14:31:40Z

Update: I've added a functionality to sweep the number traces used for the attack. This allows to produce a plot like this:

x-axis is the number of traces in steps of 100000, the y-axis is the percentage of correct guesses. The orange curve is the key bytes (max 16), the green curve is the number of key byte differences (max 120).

vogelpi · 2020-12-04T08:30:04Z

Based on yesterday's discussion, should we go ahead and merge this @alphan ?

alphan

Thank you and kudos for successfully implementing the attack @vogelpi! I think we should go ahead and merge this. We will revisit this as we make progress on the distributed implementation anyway.

alphan · 2020-12-04T16:15:06Z

cw/cw305/correlation-enhanced_collision_attack.py

+            for byte in range(15):
+                # Take the most promising delta that involves the available
+                # key bytes.
+                for rho, delta, a, b in max_rho_deltas:


Would you mind adding a comment here saying that this is a single-pass heuristic? Since we choose the delta value for each byte sequentially from 0 to 15, we don't consider cases where byte x could use the delta value of byte y where y > x.

Yes sure. I'll add a comment here.

vogelpi · 2020-12-04T17:03:11Z

Thanks @alphan!

I have now added a comment and force pushed, but the update isn't shown here. I don't understand why.

vogelpi requested review from alphan and moidx as code owners October 28, 2020 15:10

alphan reviewed Oct 28, 2020

View reviewed changes

moidx reviewed Oct 29, 2020

View reviewed changes

vogelpi force-pushed the correlation-enhanced-attack branch from 993ce82 to 285fc0b Compare October 30, 2020 09:47

vogelpi added 2 commits November 20, 2020 10:56

Add correlation-enhanced collision attack

31cb3ce

This attack is supposed to work both on unmasked AES implementations and implementations using the masked Canright S-Box. It uses the existing simple_capture_traces.py for the capture stage. Signed-off-by: Pirmin Vogel <vogelpi@lowrisc.org>

vogelpi force-pushed the correlation-enhanced-attack branch from 285fc0b to 1df3e2d Compare November 20, 2020 10:40

vogelpi requested review from moidx and alphan November 20, 2020 10:40

vogelpi mentioned this pull request Nov 20, 2020

Implement Correlation-Enhanced Power Analysis Collision Attack #11

Closed

vogelpi added 2 commits November 23, 2020 15:25

Increase parallelization for correlation-enhanced collision attack

b58d89b

When sweeping the number of traces used, most of the time is spent in computing the m_alpha_j-s. This commit parallelizes the corresponding code to speed up the attack. Signed-off-by: Pirmin Vogel <vogelpi@lowrisc.org>

alphan approved these changes Dec 4, 2020

View reviewed changes

vogelpi closed this Dec 4, 2020

vogelpi mentioned this pull request Dec 4, 2020

Add correlation-enhanced collision attack #27

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add correlation-enhanced collision attack #18

Add correlation-enhanced collision attack #18

vogelpi commented Oct 28, 2020 •

edited

Loading

alphan left a comment

alphan Oct 28, 2020

vogelpi Oct 30, 2020

alphan Oct 28, 2020

moidx Oct 29, 2020

vogelpi Oct 30, 2020

alphan Oct 28, 2020

vogelpi Oct 30, 2020

alphan Oct 28, 2020

vogelpi Oct 30, 2020

alphan Oct 28, 2020

vogelpi Oct 30, 2020

moidx left a comment

moidx Oct 29, 2020

vogelpi commented Oct 30, 2020

vogelpi commented Nov 20, 2020

vogelpi commented Nov 23, 2020

vogelpi commented Dec 4, 2020

alphan left a comment

alphan Dec 4, 2020

vogelpi Dec 4, 2020

vogelpi commented Dec 4, 2020

		mean_trace, mean_sq_trace = get_mean_sq_traces(traces, num_samples_use, 0)
		sigma_trace = np.sqrt(mean_sq_trace - (mean_trace**2))

Add correlation-enhanced collision attack #18

Add correlation-enhanced collision attack #18

Conversation

vogelpi commented Oct 28, 2020 • edited Loading

alphan left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

moidx left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vogelpi commented Oct 30, 2020

vogelpi commented Nov 20, 2020

vogelpi commented Nov 23, 2020

vogelpi commented Dec 4, 2020

alphan left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vogelpi commented Dec 4, 2020

vogelpi commented Oct 28, 2020 •

edited

Loading