Bit-policy based chosen-plaintext collision attack on reused-mask AES. (August 2022)

• Record Type: Journal Article
• Authors: Zhang, Meiling; Wang, Liusheng; Zhao, Bingyu; Zheng, Dong
• Is Part Of: Journal of information security and applications. Volume 68(2022)
• Publication Date: 2022-08
• Subjects: Collision attack -- Bit-policy -- LSM -- CMP -- Masked AES; Computer security -- Periodicals; Information technology -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.jisa.2022.103222
• Languages: English
• ISSNs: 2214-2126

Abstract

Abstract: Side-channel collision attacks have shown good efficiency on breaking unprotected or reused-mask implementations of block ciphers. Depending on the relationship between "Hamming distance of values" and "average distance of traces", this work presents a novel bit-policy based chosen-plaintext collision attack to break a software implementation of reused-mask AES. Some factors affecting the success rates of the proposed scheme and their reasons are analyzed, such as how to measure the distance of traces, signal-to-noise ratio ( S N R ), how to select points of interest ( P O I ) and the number of traces ( n ). In this paper, two measurements, the least square method ( L S M ) and the central moment product method ( C M P ), are adopted to calculate the distance of traces. Then their probability distribution and efficiency are theoretically analyzed and simulated. As a result, C M P outperforms L S M, and all the other three factors, i.e. S N R, P O I, n, are relevant to the distribution of L S M and C M P . When L S M and C M P are combined with the proposed scheme and the compared ones, both theoretical and practical analysis are given to illustrate how the number of traces impacts on the success rates at different levels of S N R ; as a result the developed attack has the best performance among all the compared schemes at both low and high level of S N R, especially at high level of S N R . To gain a success rate of 95%, at S N R of 0 dB and −8 dB, our optimal scheme and the compared optimal scheme have 800 and 4500 less energy traces, respectively. Furthermore, our attack requires no detailed knowledge about the design of SBoxes, nor does it require templates for profiling.