KR20220096818A - Private key protection method against cache side channel attack - Google Patents

Abstract

The present invention relates to a private key protection method against a cache side channel attack and, more specifically, to a method for defending a secret key against a cache side channel attack through randomization of cryptographic reference table elements. According to the present invention, a shuffling table is configured in advance, a random RT-table is configured through this, a random RT-table value is obtained through this if plain text is inputted, and a cache side channel attack is fundamentally blocked by preventing a round key from being recovered even though an attacker performs a cache side channel attack by performing AES encryption by calculating with the round key.

Description

{Private key protection method against cache side channel attack}

The present invention relates to a method for protecting a secret key against a cache side-channel attack, and more particularly, to a method for protecting a secret key against a cache side-channel attack through randomization of a reference table element for encryption.

An encryption system such as Advanced Encryption Standard (AES) performs data encryption using a block encryption algorithm. In this case, for the optimization of the system implementation, four (T0~T3) T-tables of 1024 byte size are used for encryption. Basically, the table referencing structure is used as follows.

In this case, if the value in the T-table is fixed, the output value of T[i] can be predicted by searching the cache line in which the referenced T table is used through a cache side-channel attack. That is, it is possible to find candidates for the T[i] value with access information of the referenced cache line. Therefore, since the T[i] candidate value for which the cache access has occurred can be determined and the corresponding ciphertext can be stored, the attacker can extract the last round key through statistical analysis, and by extracting the last round key, the secret key can be calculated inversely. That is, there is a problem in that the secret key may be exposed by a cache side-channel attack in the encryption process, so a countermeasure technique in which the secret key is not exposed is required.

KR 10-2124443 B1

G, Irazoqui, M. Inci, T. Eisenbarth and B. Sunar, “Wait a minute! A fast, Cross-VM attack on AES," International Workshop on Recent Advances in Intrusion Detection, pp. 299-319, 2014.

The present invention was devised to solve such a problem. A shuffling table is configured in advance, a random RT-table is configured through this, and a random RT-table value is obtained through this when a plaintext is input, and a round key and operation are performed. The purpose of the AES encryption is to fundamentally block the cache side-channel attack by making it impossible to recover the round key even if an attacker performs a cache side-channel attack.

In order to achieve the above object, a method for protecting a secret key against a cache side-channel attack according to the present invention includes the steps of: (a) receiving a plaintext to be encrypted; (b) extracting random RT-table values; and, (c) performing encryption on the plaintext using the extracted random RT-table value and round key.

Prior to step (b), the method may further include (b0) rearranging the random RT-table.

The step (b0) includes: (b01) performing randomization of a shuffling table; and, (b02) rearranging the random RT-table according to the randomized shuffling table.

In the step (b02), the table value for the index i of the fixed T-table is set to T[i], the table value for the index i of the shuffling table is set to S[i], and the index i of the random RT-table is When the table value for RT[i] is RT[i], for all values of i, the value of T[i] may be arranged as RT[S[i]].

According to another aspect of the present invention, a computer program for protecting a secret key against a cache side-channel attack is stored in a non-transitory storage medium, comprising the steps of: (a) receiving, by a processor, plaintext to be encrypted; (b) extracting random RT-table values; and, (c) executing the step of encrypting the plaintext using the extracted random RT-table value and round key.

Prior to step (b), the method may further include (b0) rearranging the random RT-table.

The step (b0) includes: (b01) performing randomization of a shuffling table; and, (b02) rearranging the random RT-table according to the randomized shuffling table.

In the step (b02), the table value for the index i of the fixed T-table is set to T[i], the table value for the index i of the shuffling table is set to S[i], and the index i of the random RT-table is When the table value for RT[i] is RT[i], for all values of i, the value of T[i] may be arranged as RT[S[i]].

According to another aspect of the present invention, an apparatus for protecting a secret key against a cache side channel attack includes the steps of: (a) receiving a plaintext to be encrypted; (b) extracting random RT-table values; and (c) performing encryption on the plaintext using the extracted random RT-table value and round key.

Prior to step (b), the method may further include (b0) rearranging the random RT-table.

The step (b0) includes: (b01) performing randomization of a shuffling table; and, (b02) rearranging the random RT-table according to the randomized shuffling table.

In the step (b02), the table value for the index i of the fixed T-table is set to T[i], the table value for the index i of the shuffling table is set to S[i], and the index i of the random RT-table is When the table value for RT[i] is RT[i], for all values of i, the value of T[i] may be arranged as RT[S[i]].

According to the present invention, a shuffling table is configured in advance, a random RT-table is configured through this, and when a plaintext is input, a random RT-table value is obtained through this, and an AES encryption is performed by calculating with a round key. It has the effect of fundamentally blocking the cache side-channel attack by making it impossible to recover the round key even if it performs a cache side-channel attack.

1 is a diagram showing the structure of a T-table loaded in a cache memory;
2 is a diagram showing the structure of a shuffling table;
3 is a diagram for explaining an approach of a random RT table using a shuffling table.
4 is a diagram illustrating an embodiment of operating a random RT table approach using a shuffling table.
5 is a block diagram for implementing the existing AES ciphertext.
6 is a block diagram for implementing an AES ciphertext according to the present invention.
7 is a flowchart for implementing an AES ciphertext according to the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Prior to this, the terms or words used in the present specification and claims should not be construed as being limited to conventional or dictionary meanings, and the inventor should properly understand the concept of the term in order to best describe his invention. Based on the principle that it can be defined, it should be interpreted as meaning and concept consistent with the technical idea of the present invention. Accordingly, the embodiments described in this specification and the configurations shown in the drawings are only the most preferred embodiment of the present invention and do not represent all of the technical spirit of the present invention, so at the time of the present application, various It should be understood that there may be equivalents and variations.

1 is a diagram showing the structure of a T-table loaded in a cache memory.

The cache is configured in line units, and in general, one cache line can load 64 bytes of data as shown in FIG. 1 . Also, 16 cache lines are required to load one T-table.

Cryptographic operations are performed thousands to tens of thousands of times on messages with different plaintexts with the same key, and during each encryption process, an attacker monitors access to a specific cache line using a cache side-channel attack. An attacker can guess the table elements that are used or not used during the encryption process by using the access information about the cash line collected through monitoring.

Yes)

A ciphertext can be generated through the above operation, where i is the index of the T-table, and the T-table used is a fixed value according to the index calculated in advance.

In the case of such a fixed-value T-table, an attacker can find the index information accessed by a statistical method to the collected cache, and if the index information is known, the contents of the referenced table can be known, and as a result, the round key and the secret key can be extracted. An attack that finds the secret key in this way is called a cache side-channel attack.

That is, the attacker

i) It is possible to check whether the first 16 items of the T-table are used using the cache access information,

ii) When a fixed T-table is used, the ciphertext accessed to the first cache line of the T-table, that is, index 0-15, is stored,

iii) The secret key is extracted through statistical analysis by collecting the index candidates and ciphertext candidates who have accessed the first cash line.

A key factor for the success of such a cache side-channel attack is that, as described above, a T-table value that is used or not used during the encryption process can be specified through the cache access information.

2 is a diagram illustrating a structure of a shuffling table.

In the AES encryption algorithm using T-table, it is necessary to use a table method that prevents the secret key from being exposed even to a cache side channel attack. The key is to ensure that unused T-table values cannot be specified. Therefore, as a countermeasure, the order of T-table elements should be randomly mixed in each encryption process so that the T-table value cannot be specified from the collected cache access information.

Therefore, in the present invention, in order to create a new T-table in a random order, a shuffling table of 256 bytes as shown in FIG. 2 is created before encryption. The values of the shuffling table are initially initialized as shown in the left table of FIG. 2 and then randomly changed in every encryption process. The right table of FIG. 2 shows an embodiment of the randomly changed shuffling table. In this case, the shuffling table values are rearranged by a shuffling algorithm (eg, Fisher-Yates algorithm, etc.) so that the values from 0 to 255 do not overlap and are shuffled to arbitrary positions.

3 is a diagram for explaining a random RT-table access method using a shuffling table, and FIG. 4 is a diagram illustrating an embodiment of operating a random RT table access method using a shuffling table.

Fig. 3(a) shows a fixed T-table in which values are loaded into the cache memory, and Fig. 3(b) is a T-table (hereinafter, 'random RT-table') which is randomly changed and loaded onto the cache memory of the present invention. ') is indicated.

Referring to FIG. 3( b ), as described in FIG. 2 , a random RT-table as shown on the right is created according to the shuffling table on the left randomly generated for each encryption process. If i is an index, S[i] is a table value for index i of the shuffling table, and RT[i] is a table value for index i of a random RT-table. That is, the table value of the random RT-table for index i becomes RT[S[i]], and for index i, the table value T[i] of the fixed T-table of FIG. 3(a) and the random RT- The table value RT[S[i]] of the table constitutes the RT-table to be the same value.

As a result, referring to Fig. 4, the shuffling table values on the left side of Figs. 4(a) and 4(b) are changed for each encryption process, and accordingly, the values of Figs. 4(a) and 4(b) on the right side of Figs. Like a table, a random RT-table loaded into the cache memory also changes all the time, but for every index i, RT[S[i]] is always the same value. That is, when data is encrypted, instead of using T-table T[i], access is made like RT[S[i]] in order to use a newly created random RT-table, so that T for the same index i -The result of encryption using a table and a random RT-table is the same, but the location in the cache memory is always changed randomly. Therefore, even if the attacker monitors the cache line, the T-table value cannot be specified, and the key is always analyzed using a random element, so the cache side channel attack has no choice but to fail.

5 is a block diagram for implementing an existing AES cipher text, and FIG. 6 is a block diagram for implementing an AES cipher text according to the present invention.

과정이 필요하다. 도 5와 같이 고정된 T-테이블을 이용하는 경우, 이와 같은 암호문 생성, 즉, 암호화 시에 T[i]를 읽어오는 연산을 수행할 경우, 읽어온 T[i] 값이 캐시에 적재된다. 공격자는 공격 대상자가 이와 같이 캐시에 접근한 기록을 파악하여 인덱스 i값을 통계학적으로 찾아내고, T[i] 값을 구하여 최종적으로 라운드 키를 추출할 수 있게 된다.In AES cipher, when one byte of the last round key is rk and c is one byte of the ciphertext.

process is needed In the case of using a fixed T-table as shown in FIG. 5, when generating the ciphertext, ie, performing an operation to read T[i] during encryption, the read T[i] value is loaded into the cache. The attacker can find the index i value statistically by grasping the history of the attacker accessing the cache in this way, and finally extract the round key by obtaining the T[i] value.

However, according to the block diagram of FIG. 6 showing the present invention, if a shuffling table and a random RT-table are used for each encryption, as described with reference to FIGS. 2 to 4, information accessed to the cache according to index i is It will always be different, and the attacker will not be able to find the round key and will fail the attack.

7 is a flowchart for implementing the generation of a ciphertext for protecting a secret key against a cache side-channel attack according to the present invention.

First, when a new plaintext to be encrypted is input (S701), the value of the shuffling table is rearranged to a random value, that is, randomization is performed (S702). At this time, the values of the shuffling table are rearranged so that values within a certain range (eg, 0 to 255) do not overlap and are mixed in arbitrary positions by a shuffling algorithm (eg, Fisher-Yates algorithm, etc.).

The values of the random RT-table are rearranged according to the randomized shuffling table as described above (S703). At this time, the table value for index i of the fixed T-table is T[i], the table value for index i of the shuffling table is S[i], and the table value for index i of the random RT-table is RT[i] In this case, for all i values, the T[i] value is arranged as RT[S[i]], and the relocated random RT table is loaded into the cache memory. Accordingly, if the T[i] value of the fixed T table is used when generating the ciphertext, the same value is used by using the RT[S[i]] of the random RT-table, but in the cache memory, the random RT- The table is in a state in which random relocation is performed.

Thereafter, a random RT-table value is extracted using the shuffling table value for index i as an index (S704), and the plaintext is encrypted using the round key generated from the thus extracted random RT-table value and the secret key. A cipher text is generated (S705).

100: cipher text generator

Claims (12)

A secret key defense method against a cache side-channel attack, comprising:
(a) receiving an input of plaintext to be encrypted;
(b) extracting random RT-table values; and,
(c) performing encryption on the plaintext using the extracted random RT-table value and round key
A secret key defense method against cache side-channel attacks, including: The method according to claim 1,
Prior to step (b),
(b0) relocating the random RT-table
Secret key defense method against a cache side-channel attack, characterized in that it further comprises. 3. The method according to claim 2,
The step (b0) is,
(b01) performing randomization of a shuffling table; and,
(b02) rearranging the random RT-table according to the randomized shuffling table
A secret key defense method against a cache side-channel attack, comprising a. 4. The method according to claim 3,
The step (b02) is,
The table value for index i of the fixed T-table is T[i], the table value for index i of the shuffling table is S[i], and the table value for index i of the random RT-table is RT[i] ], for all i values, the T[i] value is arranged as RT[S[i]]
A secret key defense method against cache side-channel attacks, characterized in that A computer program for defending a secret key against a cache side-channel attack, comprising:
It is stored in a non-transitory storage medium, and by the processor,
(a) receiving an input of plaintext to be encrypted;
(b) extracting random RT-table values; and,
(c) performing encryption on the plaintext using the extracted random RT-table value and round key
containing the command to be executed,
A computer program for defending a secret key against cache side-channel attacks. 6. The method of claim 5,
Prior to step (b),
(b0) relocating the random RT-table
A computer program for defending the secret key against a cache side-channel attack, characterized in that it further comprises a. 7. The method of claim 6,
The step (b0) is,
(b01) performing randomization of a shuffling table; and,
(b02) rearranging the random RT-table according to the randomized shuffling table
A computer program for defending the secret key against a cache side-channel attack comprising a. 8. The method of claim 7,
The step (b02) is,
The table value for index i of the fixed T-table is T[i], the table value for index i of the shuffling table is S[i], and the table value for index i of the random RT-table is RT[i] ], for all i values, the T[i] value is arranged as RT[S[i]]
A computer program for defending the secret key against a cache side-channel attack, characterized in that. A device for defending a secret key against a cache side-channel attack, comprising:
(a) receiving an input of plaintext to be encrypted;
(b) extracting random RT-table values; and,
(c) performing encryption on the plaintext using the extracted random RT-table value and round key
to run,
A device for defending secret keys against cache side-channel attacks. 10. The method of claim 9,
Prior to step (b),
(b0) relocating the random RT-table
Device for defending the secret key against a cache side-channel attack, characterized in that it further comprises. 11. The method of claim 10,
The step (b0) is,
(b01) performing randomization of a shuffling table; and,
(b02) rearranging the random RT-table according to the randomized shuffling table
Apparatus for defending the secret key against a cache side-channel attack, characterized in that it comprises a. 12. The method of claim 11,
The step (b02) is,
The table value for index i of the fixed T-table is T[i], the table value for index i of the shuffling table is S[i], and the table value for index i of the random RT-table is RT[i] ], for all i values, the T[i] value is arranged as RT[S[i]]
A device for defending the secret key against a cache side-channel attack, characterized in that.

Images