Evidence of an information leakage between logically independent blocks

Loïc Zussa (1) , Ingrid Exurville (1) , Jean-Max Dutertre (1) , Jean-Baptiste Rigaud (1) , Bruno Robisson (1) , Assia Tria (2) , Jessy Clediere (3)

1 SAS-ENSMSE - Département Systèmes et Architectures Sécurisés
2 Laboratoire Systèmes et Architectures Sécurisés (LSAS)
3 CEA-LETI - Commissariat à l'énergie atomique et aux énergies alternatives - Laboratoire d'Electronique et de Technologie de l'Information

In this paper we study the information leakage that may exist, due to electrical coupling, between logically independent blocks of a secure circuit as a new attack path to retrieve secret information. First, an AES-128 has been implemented on a FPGA board. Then, this AES implementation has been secured with a delay-based countermeasure against fault injection related to timing constraints violations. The countermeasure's detection threshold was supposed to be logically independent from the data handled by the cryptographic algorithm. Thus, it theoretically does not leak any information related to sensitive values. However experiments point out an existing correlation between the fault detection threshold of the countermeasure and the AES's calculations. As a result, we were able to retrieve the secret key of the AES using this correlation. Finally, different strategies were tested in order to minimize the number of triggered alarm to retrieve the secret key.

Mots clés: fault injection; side channel analysis; Delay-based countermeasure; information leakage

Domaines: Cryptographie et sécurité [cs.CR]; Micro et nanotechnologies/Microélectronique

Loïc Zussa, Ingrid Exurville, Jean-Max Dutertre, Jean-Baptiste Rigaud, Bruno Robisson, et al.. Evidence of an information leakage between logically independent blocks. Second Workshop on Cryptography and Security in Computing Systems (CS2'2015), Jan 2015, Amsterdam, Netherlands. pp.25, ⟨10.1145/2694805.2694810⟩. ⟨hal-01855795⟩