Breaking real-world COTS USIM cards with unknown side-channel countermeasures. Issue 113 (February 2022)

• Record Type: Journal Article
• Authors: Jin, Chengbin; Zhou, Yongbin; Qiu, Xinkuan; Feng, Qi; Zhang, Qian
• Is Part Of: Computers & security. Issue 113(2022)
• Publication Date: 2022-02
• Subjects: COTS 4G USIM card -- Side-channel analysis -- Unknown countermeasures -- Black-box attack -- Adaptively chosen-plaintext attack; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2021.102531
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: In this paper, we examine the question of how to perform an efficient side-channel analysis (SCA) of real-world crypto products with proprietary side-channel countermeasures. Concretely, answering this question requires a suitable selection of side-channel analysis methods and various steps to instantiate it to break various side-channel countermeasures. We take the analysis of a protected prototype system as an example, to discuss how to efficiently use traditional SCA methods and Deep-Learning based SCA methods in the context of analyzing current side-channel countermeasures. Then, we extend the analysis research on a real-world commercial off-the-shelf (COTS) 4G Universal Subscriber Identity Module (USIM) card, showing how to reverse-engineer the embedded side-channel countermeasures by using side-channel information only. The experiment results show that the secret key and other operator-related parameters can be fully recovered without prior knowledge of side-channel countermeasures. This research allows us to provide a living case study of the physical security analysis of real-world crypto products, which might be worthy of more in-depth investigations.