Hardware Security and Trust by Nicolas Sklavos Ricardo Chaves Giorgio Natale & Francesco Regazzoni

Author:Nicolas Sklavos, Ricardo Chaves, Giorgio Natale & Francesco Regazzoni
Language: eng
Format: epub
Publisher: Springer International Publishing, Cham

Recovering the Key

The key value for the 2a byte was already identified in the first step. Next, the byte that was identified as the 3a is determined by applying any nonzero difference from the corresponding scan cells of the byte and observe the output difference in the same byte as in Sect. 6.3.2.1.

For the remaining two bytes identified as the a bytes, the challenge is that the first step was not able to accurately classify the 16 bits into these two bytes. Nonetheless, by applying any nonzero difference as long as the difference is contained in one of the bytes (second condition of the attack), observing the output difference in the already identified bytes (2a and 3a bytes) will determine: (1) which of the a bytes the difference was applied from based on the relationship between the content of the already identified bytes (they can be either identical, or one can be thrice the other), and (2) the actual value of the output difference. From the input and the output differences, and the knowledge of which byte the difference was applied from, the key value can be recovered for this byte. The same operation can be repeated for the other a byte to recover its key.

For the first step of the attack 32 bits are required to identify the 2a byte. To identify the mapping of the remaining three bytes test vectors are applied. Therefore, the time complexity of the first step of the attack is , and test vectors are required. To recover the key byte of the rest of the three key bytes, 3 pairs of test vectors are required. Altogether, we need test vectors. In the second part of the attack we know the circular order of the four bytes. Therefore, we have four possible permutations of the four bytes. The search space of the key word is . The search space of the entire key is given by , which is also the time complexity of the attack.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.