• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.2
• /
• pp.155-162
• /
• 2022

The SITM (See-In-The-Middle) attack proposed in CHES 2020 is a type of analysis technique that combines differential cryptanalysis and side-channel analysis, and can be applied even in a harsh environment with a low SNR (Signal-to-Noise Ratio). This attack targets partial 1^st or higher order masked block cipher, and uses unmasked middle round weakness. PRESENT is a lightweight blockcipher proposed in CHES 2007, designed to be implemented efficiently in a low-power environment. In this paper, we propose SITM attacks on 14-round masked implementation of PRESENT while the previous attacks were applicable to 4-round masked implementation of PRESENT. This indicates that PRESENT has to be implemented with more than 16-round masking to be resistant to our attacks.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.6
• /
• pp.1431-1441
• /
• 2016

In case of ARX based block cipher algorithms with masking countermeasures, there is a need for a method to convert between Boolean masking and arithmetic masking. However, to apply masking countermeasures to ARX based algorithms is less efficient compared to masked AES with single masking method because converting between Boolean and arithmetic masking has high computation time. This paper shows performance results on 32-bit platform implementations of LEA with various masking conversion countermeasures against first order side channel attacks. In the implementation point of view, this paper presents computation time comparison between actual measurement value and theoretical one. This paper also confirms that the masked implementations of LEA are secure against first order side channel attacks by using a T-test.

• Journal of the Korea Society of Computer and Information
• /
• v.27 no.1
• /
• pp.43-50
• /
• 2022

Correlation Power Analysis(CPA) is a sub-channel attack method that measures the detailed power consumption of attack target equipment equipped with cryptographic algorithms and guesses the secret key used in cryptographic algorithms with more than 90% probability. Since CPA performs analysis based on statistics, a large amount of data is necessarily required. Therefore, the CPA must measure power consumption for at least about 15 minutes for each attack. In this paper proposes a method of using a Convolutional Neural Network(CNN) capable of accumulating input data and predicting results to solve the data collection problem of CPA. By collecting and learning the power consumption of the target equipment in advance, entering any power consumption can immediately estimate the secret key, improving the computational speed and 96.7% of the secret key estimation accuracy.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.30 no.2
• /
• pp.179-187
• /
• 2020

The FBC(Fixed-Base Comb) is a method to efficiently operate scalar multiplication, a core operation for signature generations of the ECDSA(Elliptic Curve Digital Signature Algorithm), utilizing precomputed lookup tables. Since the FBC refers to the table depending on the secret information and the values of the table are publicly known, an adversary can perform HCA(Horizontal Correlation Analysis), one of the single trace side channel attacks, to reveal the secret. However, HCA is a statistical analysis that requires a sufficient number of unit operation traces extracted from one scalar multiplication trace for a successful attack. In the case of the scalar multiplication for signature generations of ECDSA, the number of unit operation traces available for HCA is significantly fewer than the case of the RSA exponentiation, possibly resulting in an unsuccessful attack. In this paper, we propose an improved HCA on lookup table based scalar multiplication algorithms such as FBC. The proposed attack improves HCA by increasing the number of unit operation traces by determining such traces for the same intermediate value through collision analysis. The performance of the proposed attack increases as more secure elliptic curve parameters are used.

• International Journal of Internet, Broadcasting and Communication
• /
• v.10 no.3
• /
• pp.11-25
• /
• 2018

While being believed that decrypting any RSA ciphertext is as hard as factorizing the RSA modulus, it was also shown that, if additional information is available, breaking the RSA cryptosystem may be much easier than factoring. For example, Coppersmith showed that, given the 1/2 fraction of the least or the most significant bits of one of two RSA primes, one can factorize the RSA modulus very efficiently, using the lattice-based technique. More recently, introducing the so called cold boot attack, Halderman et al. showed that one can recover cryptographic keys from a decayed DRAM image. And, following up this result, Heninger and Shacham presented a polynomial-time attack which, given 0.27-fraction of the RSA private key of the form (p, q, d, $d_p$, $d_q$), can recover the whole key, provided that the given bits are uniformly distributed. And, based on the work of Heninger and Shacham, this paper presents a different approach for recovering RSA private key bits from decayed key information, under the assumption that some random portion of the private key bits is known. More precisely, we present the algorithm of recovering RSA private key bits from erased key material and elaborate the formula of describing the number of partially-recovered RSA private key candidates in terms of the given erasure rate. Then, the result is justified by some extensive experiments.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.19 no.3
• /
• pp.51-59
• /
• 2009

The CRT-RSA cryptosystem is very vulnerable to fault insertion attacks in which an attacker can extract the secret prime factors p, q of modulus N by inserting an error during the computational operation on the cryptographic chip. In this paper, after implementing the CRT-RSA cryptosystem, we try to extract the secret key embedded in commercial microcontroller using optical injection tools such as laser beam or camera flash. As a result, we make sure that the commercial microcontroller is very vulnerable to fault insertion attacks using laser beam and camera flash, and can apply the prime factorization attack on CRT-RSA Cryptosystem.

• Proceedings of the Korea Institutes of Information Security and Cryptology Conference
• /
• 2003.07a
• /
• pp.83-88
• /
• 2003

부채널 공격(side channel attack)을 막는 새로운 접근방법으로 생각되는 랜덤 부호화 스칼라 곱 알고리즘은 Ha와 Moon에 의해서 제안되었다. 그러나 이 방법은 여전히 논쟁의 여지가 있다. 본 논문에서는 Ha-Moon 알고리즘이 기존의 세 가지 단순 전력 소모량 분석(simple power analysis, SPA)에 안전함을 보인다. 그리고 정수론의 성질을 이용하여 두 가지 중요한 정리를 제시하고 이 정리들을 이용하여 Ha-Moon 알고리즘에 적용할 수 있는 공격 알고리즘을 개발한다. 예를 들면, 163-비트 키들에 대하여 제안 알고리즘은 20개의 전력 소모량을 이용하여 키 복잡도 Ο(2$^{8}$ )를 가지고 공격할 수 있다.

• Bulletin of the Korean Mathematical Society
• /
• v.46 no.4
• /
• pp.721-741
• /
• 2009

Consider RSA with N = pq, q < p < 2q, public encryption exponent e and private decryption exponent d. We first study cryptanalysis of RSA when certain amount of the Most Significant Bits (MSBs) or Least Significant Bits (LSBs) of d is known. The basic lattice based technique is similar to that of Ernst et al. in Eurocrypt 2005. However, our idea of guessing a few MSBs of the secret prime p substantially reduces the requirement of MSBs or LSBs of d for the key exposure attack. Further, we consider the RSA variant proposed by Sun and Yang in PKC 2005 and show that the partial key exposure attack works significantly on this variant.

• Journal of Advanced Navigation Technology
• /
• v.16 no.3
• /
• pp.510-517
• /
• 2012

Piccolo-80 is a 64-bit ultra-light block cipher suitable for the constrained environments such as wireless sensor network environments. In this paper, we propose a differential fault analysis on Piccolo-80. Based on a random byte fault model, our attack can the secret key of Piccolo-80 by using the exhaustive search of $2^{24}$ and six random byte fault injections on average. It can be simulated on a general PC within a few seconds. This result is the first known side-channel attack result on Piccolo-80.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.25 no.6
• /
• pp.1319-1326
• /
• 2015

The symmetric key encryption algorithms, such as the AES or the ARIA, generate round keys by the key expansion mechanism. While the algorithm is executed, key expansion mechanism emits information about the secret key by the power consumption. The vulnerability exists that can reduce significantly the candidate of the secret key by the simple power analysis attack using a small number of the power traces. Therefore, we'll have to study about the attack and the countermeasure to prevent information leakage. While a simple power analysis attack on the AES key expansion has been studied since 2002, ARIA is insufficient. This paper presents a simple power analysis attack on 8-bit implementations of the ARIA-128 key expansion. The presented attack efficiently utilizes this information leakage to substantially reduce the key space that needs to be considered in a brute-force search for the secret key. We show that ARIA is vulnerable to a SPA attack based on hamming weight leakage.