Cold Boot Key Recovery by Solving Polynomial Systems with Noise

Transcription

1 Cold Boot Key Recovery by Solving Polynomial Systems with Noise Martin R. Albrecht 1 & Carlos Cid 2 Team Salsa, LIP6, UPMC Information Security Group, Royal Holloway, University of London DTU, 04. April 2011

2 Outline Coldboot Attacks Polynomial System Solving with Noise Mixed Integer Programming Application

3 Outline Coldboot Attacks Polynomial System Solving with Noise Mixed Integer Programming Application

4 Coldboot Attacks I In [5] a method for extracting cryptographic key material from DRAM used in modern computers was proposed. Contrary to popular belief information in DRAM is not instantly lost when the power is cut, but decays slowly over time. This decay can be further slowed down by cooling the chip. Thus, an attacker can 1. deep-freeze a DRAM module 2. move it to a target machine which dumps the content to disk 3. find the most likely key candidate (which is erroneous due to decay) 4. use some mechanism to correct those errors The technique is called Coldboot attack in literature.

5 Coldboot Attacks II Definition (The Coldboot Problem) We are given 1. K : F n 2 FN 2 where N > n, 2. two real numbers 0 δ 0, δ 1 1, 3. K = KS(k) and K i the i-th bit of K. 4. K = (K 0, K 1,..., K N 1 ) FN 2 with the following distribution: Pr[K i = 0 K i = 0] = 1 δ 1, Pr[K i = 1 K i = 0] = δ 1, Pr[K i = 1 K i = 1] = 1 δ 0, Pr[K i = 0 K i = 1] = δ and some control function E : F n 2 {True, False}, which returns true for the pre-image of the noise free version of K. The task is to recover k such that E(k) returns True or a noise-free K. The Coldboot problem is equivalent to decoding a (non-)linear code with biased noise.

6 Coldboot Attacks III A bit K i = 0 of K is correct with probability Pr[K i = 0 K i = 0] = Pr[K i = 0 K i = 0]Pr[K i = 0] Pr[K i = 0] Likewise, a bit K i = 1 of K is correct with probability denote these values by 0 and 1 respectively. = (1 δ 1) (1 δ 1 + δ 0 ). (1 δ 0) (1 δ 0+δ 1). We

7 Coldboot Attacks IV Results in [5]: Cipher δ 0 δ 1 Success Time DES % DES % AES % 1s AES % 30s Can we do better and can we recover keys for more complicated key schedules like Serpent?

8 Outline Coldboot Attacks Polynomial System Solving with Noise Mixed Integer Programming Application

9 PoSSo We define polynomial system solving (PoSSo) as the problem of finding a solution to a system of polynomial equations over some field. Definition (PoSSo) Consider the set F = {f 0,..., f m 1 } where each f i F[x 0,..., x n 1 ]. A solution to F is any point x F n such that f i F : f i (x) = 0. Note, that we restrict ourselves to solutions in the base field here.

10 Max-PoSSo I We can define a family of Max-PoSSo problems, analogous to the well known Max-SAT family of problems.

11 Max-PoSSo II Definition (Max-PoSSo) Find a point x F n which satisfies the maximum number of polynomials in F = {f 0,..., f m 1 } F[x 0,..., x n 1 ].

12 Max-PoSSo III Definition (Partial Max-PoSSo) Find a point x F n such that for two sets of polynomials H and S in F[x 0,..., x n 1 ] f H : f (x) = 0 and the number of polynomials f S with f (x) = 0 is maximised. Max-PoSSo is Partial Max-Posso with H =. H for hard and S for soft. Both terms are borrowed from Partial Max-SAT.

13 Max-PoSSo IV Definition (Partial Weighted Max-PoSSo) Find a point x F n such that f H : f (x) = 0 and f S C(f, x) is minimized where C : f S, x F n R 0 is a cost function which returns 0 if f (x) = 0 and some value > 0 if f (x) 0. Partial Max-PoSSo is Weighted Partial Max-PoSSo where C(f, x) returns 1 if f (x) 0 for all f S.

14 Coldboot as Partial Weighted Max-PoSSo Let F K be an equation system corresponding to K. Assume that for each noisy output bit K i there is some f i F K of the form g i + K i where g i is some polynomial. Assume that these are the only polynomials involving output bits. Denote the set of these polynomials S. Denote the set of all remaining polynomials F K as H. Define the cost function C as a function which returns for K i = 0, f (x) 0, for K i = 1, f (x) 0, 0 otherwise. Express E as a polynomial system which is satisfiable for k only and add these polynomials to H.

15 Other Applications RFID authentication protocols often based on the LPN problem which is easily described as a Max-PoSSo problem. Homomorphic Gentry s scheme rests on the LWE problem which is easily described as a Max-PoSSo problem. Side-Channel data leakage is often noisy. Alg. Attacks can be improved by simplifying equation systems using probabilistic equations.

16 Outline Coldboot Attacks Polynomial System Solving with Noise Mixed Integer Programming Application

17 Mixed Integer Programming I Integer optimization deals with the problem of minimising (or maximising) a function in several variables subject to linear equality and inequality constraints and integrality restrictions on some or all of the variables. Definition (MIP) A linear mixed-integer programming problem (MIP) is defined as a problem of the form where min x {c T x Ax b, x Z k R l } A is an m n-matrix (n = k + l), b is an m-vector and c is an n-vector.

18 Mixed Integer Programming II Example Maximise x + 5y, thus c = (1, 5), subject to the constraints x + 0.2y 4 and 1.5x + 3y 4 where x 0 is real valued and y 0 is integer valued. The optimal value for c T x is for x = 2 3 and y = 1. sage : p = M i x e d I n t e g e r L i n e a r P r o g r a m ( ) sage : x, y = p. n e w v a r i a b l e ( ), p. n e w v a r i a b l e ( ) sage : p. s e t i n t e g e r ( y [ 0 ] ) sage : p. a d d c o n s t r a i n t ( x [ 0 ] y [ 0 ], max=4) sage : p. a d d c o n s t r a i n t ( 1. 5 x [ 0 ] + 3 y [ 0 ], max=4) sage : p. s e t m i n ( x [ 0 ], 0 ) ; p. s e t m i n ( y [ 0 ], 0 ) sage : p. s e t o b j e c t i v e ( x [ 0 ] + 5 y [ 0 ] ) sage : p. s o l v e ( )

19 PoSSo as MIP I Consider some f F 2 [x 0,..., x n 1 ] and let Z a function that takes a polynomial over F 2 lifts it to the integers. Analogous for elements in F Restrict all x i to binary values. 2. Let l be zero if 1 does not appear in f and one otherwise.them 3. Let w be the number of monomials in f and u = 2 w/2. 4. Introduce some integer variable 0 m u Replace each monomial in f 2m by a new linearised variable, call the result g and add the linear constraint g = For each monomial t = N i=1 x i add a constraint xi t and add a constraint 0 N i=1 x i t N 1. This is the Integer Adapted Standard Conversion [2].

20 PoSSo as MIP II Example Consider f = ac + a + b + c + 1 u = 2 1. g = M + a + b + c + 1 2m = 0 2. a M 3. c M 4. 0 a + c M 1

21 PoSSo as MIP III sage : a t t a c h anf2mip. py sage : B.<a, b, c> = B o o l e a n P o l y n o m i a l R i n g ( ) sage : f = a c + a + b sage : bc = B o o l e a n P o l y n o m i a l M I P C o n v e r t e r ( ) sage : p = bc. i n t e g e r a d a p t e d s t a n d a r d c o n v e r s i o n ( [ f ] ) ; p Mixed I n t e g e r Program ( m i n i m i z a t i o n,... sage : p. show ( ) M i n i m i z a t i o n : x 1 +x 2 +x 3 +x 4 C o n s t r a i n t s : 0 <= 2 x 0 +x 1 +x 2 +x 3 <= 0 1 <= x 2 1 x 3 <= 0 1 <= x 2 1 x 4 <= 0 0 <= 1 x 2 +x 3 +x 4 <= 1 V a r i a b l e s : x 0 i s an i n t e g e r v a r i a b l e ( min =0.0, max=1.0) x 1 i s an b o o l e a n v a r i a b l e ( min =0.0, max=1.0) x 2 i s a r e a l v a r i a b l e ( min =0.0, max=1.0) x 3 i s an b o o l e a n v a r i a b l e ( min =0.0, max=1.0) x 4 i s an b o o l e a n v a r i a b l e ( min =0.0, max=1.0)

22 PoSSo as MIP IV sage : a t t a c h anf2mip. py sage : B.<a, b, c> = B o o l e a n P o l y n o m i a l R i n g ( ) sage : f = a c + a + b + 1 sage : g = a + c + 1 sage : p = bc. i n t e g e r a d a p t e d s t a n d a r d c o n v e r s i o n ( [ f ] ) ; p Mixed I n t e g e r Program (... sage : p. s o l v e ( ) 1. 0 sage : bc. s o l v e ( [ f ] ) CPU Time : Wall time : , Obj : {b : 1, c : 0, a : 0} sage : bc. s o l v e ( [ f, g ], s o l v e r= SCIP ) CPU Time : Wall time : , Obj : {b : 0, c : 0, a : 1}

23 Partial Weighted Max-PoSSo as MIP We only need to consider Partial Weighted Max-PoSSo because it is the most general case: Convert each f H to linear constraints as before. For each f i S add a new binary slack variable e i to f i and convert the resulting polynomial as before. The objective function we minimise is c i e i where c i is the value of C(f, x) for some x such that f (x) 0. Any optimal solution x S will be an optimal solution to the Partial Weighted Max-PoSSo problem.

24 Coldboot as MIP Coldboot Partial Weighted Max-PoSSo MIP This approach is essentially the non-linear generalisation of decoding random linear codes with linear programming [4].

25 Outline Coldboot Attacks Polynomial System Solving with Noise Mixed Integer Programming Application

26 Simplifications We do not model E since its representation is often too costly; consequently we have no guarantee that the optimal k returned is indeed the k we are looking for. We do not include all equations available to us but restrict our attention to a subset (e.g. one or two rounds). We may use an aggressive modelling strategy where we assume δ 1 = 0 which allows us to promote some polynomials from S to H. The normal modelling assumes δ 1 = 0 + ɛ.

27 AES [3] I Core Core

28 AES [3] II Most of the key schedule is linear. The original key k appears in the output. The S-box size is 8-bit (explicit degree: 7).

29 AES [3] III N δ 0 aggr limit t r min t avg. t max t % s s s s 63% 1.38 s 8.84 s s s 70% 1.78 s s s s 66% 4.81 s s s s 69% 4.86 s s s s 65% 4.66 s s s s 68% 4.45 s s s s 47% 4.95 s s s s 61% 4.97 s s s s 62% 7.72 s s s s 8% 6.57 s s s s 13% 6.10 s s s Table: AES considering N rounds of key schedule output.

30 Serpent [1] I w 8 w 7 w 6 w 5 w 4 w 3 w 2 w 1 φ i w i 8 w i 7 w i 6 w i 5 w i 4 w i 3 w i 2 w i 1 w i 11 w i w i+1 w i+2 w i+3 S k i k i+1 k i+2 k i+3

31 Serpent [1] II All key schedule output bits depend non-linearly on the input. The original key k does not appear in the output. The S-box size is 4-bit (explicit degree: 3).

32 Serpent [1] III N δ 0 aggr limit t r min t avg. t max t s 37% 8.22 s s s s 84% 0.67 s s s s 79% 0.88 s s s s 64% s s s s 74% 1.13 s s s s 21% s s s s 38% s s s Table: Serpent considering 32 N bits of key schedule output

33 Serpent [1] IV Ad-hoc approach: We wish to recover a 128-bit key, so we need to consider at least 128-bit of output. On average the noise free output should have 64 bits set to zero. In order to consider an error rate up to δ 0, we have to consider δ 0 64 i=0 candidates and test them. If δ 0 = 0.15 we have If δ 0 = 0.30 we have ( ) 64 + δ0 64 i

34 Thank you for your attention!

35 Literature I Eli Biham, Ross J. Anderson, and Lars R. Knudsen. Serpent: A new block cipher proposal. In S. Vaudenay, editor, Fast Software Encryption 1998, volume 1372 of Lecture Notes in Computer Science, pages Springer Verlag, Julia Borghoff, Lars R. Knudsen, and Mathias Stolpe. Bivium as a Mixed-Integer Linear programming problem. In Matthew G. Parker, editor, Cryptography and Coding 12th IMA International Conference, volume 5921 of Lecture Notes in Computer Science, pages , Berlin, Heidelberg, New York, Springer Verlag. Joan Daemen and Vincent Rijmen. AES Proposal: Rijndael, Available at rijndael/rijndael-ammended.pdf.

36 Literature II Jon Feldman. Decoding Error-Correcting Codes via Linear Programming. PhD thesis, Massachusetts Institute of Technology, J. Alex Halderman, Seth D. Schoen, Nadia Heninger, William Clarkson, William Paul, Joseph A. Calandrino, Ariel J. Feldman, Jacob Appelbaum, and Edward W. Felten. Lest we remember: Cold boot attacks on encryption keys. In Proceedings of 17th USENIX Security Symposium, pages 45 60, 2008.