Alessandro Barenghi, L. Breveglieri, I. Koren, Gerardo Pelosi, F. Regazzoni
In this paper we present software countermeasures specifically designed to counteract fault injection attacks during the execution of a software implementation of a cryptographic algorithm and analyze the efficiency of these countermeasures. We propose two approaches based on the insertion of redundant computations and checks, which in their general form are suitable for any cryptographic algorithm. In particular, we focus on selective instruction duplication to detect single errors, instruction triplication to support error correction, and parity checking to detect corruption of a stored value. We developed a framework to automatically add the desired countermeasure, and we support the possibility to apply the selected redundancy to either all the instructions of the cryptographic routine or restrict it to the most sensitive ones, such as table lookups and key fetching. Considering an ARM processor as a target platform and AES as a target algorithm, we evaluate the overhead of the proposed countermeasures while keeping the robustness of the implementation high enough to thwart most or all of the known fault attacks. Experimental results show that in the considered architecture, the solution with the smallest overhead is per-instruction selective doubling and checking, and that the instruction triplication scheme is a viable alternative if very high levels of injected fault resistance are required.
{"title":"Countermeasures against fault attacks on software implemented AES: effectiveness and cost","authors":"Alessandro Barenghi, L. Breveglieri, I. Koren, Gerardo Pelosi, F. Regazzoni","doi":"10.1145/1873548.1873555","DOIUrl":"https://doi.org/10.1145/1873548.1873555","url":null,"abstract":"In this paper we present software countermeasures specifically designed to counteract fault injection attacks during the execution of a software implementation of a cryptographic algorithm and analyze the efficiency of these countermeasures. We propose two approaches based on the insertion of redundant computations and checks, which in their general form are suitable for any cryptographic algorithm. In particular, we focus on selective instruction duplication to detect single errors, instruction triplication to support error correction, and parity checking to detect corruption of a stored value. We developed a framework to automatically add the desired countermeasure, and we support the possibility to apply the selected redundancy to either all the instructions of the cryptographic routine or restrict it to the most sensitive ones, such as table lookups and key fetching. Considering an ARM processor as a target platform and AES as a target algorithm, we evaluate the overhead of the proposed countermeasures while keeping the robustness of the implementation high enough to thwart most or all of the known fault attacks. Experimental results show that in the considered architecture, the solution with the smallest overhead is per-instruction selective doubling and checking, and that the instruction triplication scheme is a viable alternative if very high levels of injected fault resistance are required.","PeriodicalId":114446,"journal":{"name":"WESS '10","volume":"19 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126877661","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Wired embedded networks must include multicast authentication to prevent masquerade attacks within the network. However, unique constraints for these networks make most existing multicast authentication techniques impractical. Our previous work provides multicast authentication for time-triggered applications on embedded networks by validating truncated message authentication codes across multiple packets. In this work, we improve overall bandwidth efficiency and reduce authentication latency by using unanimous voting on message value and validity amongst a group of nodes. This technique decreases the probability of successful per-packet forgery by using one extra bit per additional voter, regardless of the number of total receivers. This can permit using fewer authentication bits per receiver. We derive an upper bound on the probability of successful forgery and experimentally verify it using simulated attacks. For example, we show that with two authentication bits per receiver, adding four additional bits per message to vote amongst four nodes reduces the probability of per-packet forgery by a factor of more than 100. When integrated with our prior work on time-triggered authentication, this technique reduces the number of authentication message rounds required for this example by a factor of three. Model-checking with AVISPA confirms data integrity and data origin authenticity for this approach.
{"title":"Low cost multicast authentication via validity voting in time-triggered embedded control networks","authors":"Christopher Szilagyi, P. Koopman","doi":"10.1145/1873548.1873558","DOIUrl":"https://doi.org/10.1145/1873548.1873558","url":null,"abstract":"Wired embedded networks must include multicast authentication to prevent masquerade attacks within the network. However, unique constraints for these networks make most existing multicast authentication techniques impractical. Our previous work provides multicast authentication for time-triggered applications on embedded networks by validating truncated message authentication codes across multiple packets. In this work, we improve overall bandwidth efficiency and reduce authentication latency by using unanimous voting on message value and validity amongst a group of nodes. This technique decreases the probability of successful per-packet forgery by using one extra bit per additional voter, regardless of the number of total receivers. This can permit using fewer authentication bits per receiver. We derive an upper bound on the probability of successful forgery and experimentally verify it using simulated attacks. For example, we show that with two authentication bits per receiver, adding four additional bits per message to vote amongst four nodes reduces the probability of per-packet forgery by a factor of more than 100. When integrated with our prior work on time-triggered authentication, this technique reduces the number of authentication message rounds required for this example by a factor of three. Model-checking with AVISPA confirms data integrity and data origin authenticity for this approach.","PeriodicalId":114446,"journal":{"name":"WESS '10","volume":"53 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2010-10-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128309338","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
京公网安备 11010802042870号
京ICP备2023020795号-1
扫码关注我们
求助内容：
应助结果提醒方式：