Cryptology ePrint Archive: Report 2018/1002

"S-Box" Implementation of AES is NOT side-channel resistant

C Ashokkumar and Bholanath Roy and M Bhargav Sri Venkatesh and Bernard L Menezes

Abstract: Several successful cache-based attacks have provided strong impetus for developing side channel resistant software implementations of AES. One of the best-known countermeasures - use of a "minimalist" 256-byte look-up table - has been employed in the latest (assembly language) versions. Software and hardware prefetching and out-of-order execution in modern processors have served to further shrink the attack surface. Despite these odds, we devise and implement two strategies to retrieve the complete AES key. The first uses adaptively chosen plaintext and random plaintext in a 2-round attack. The second strategy employs only about 50 blocks of random plaintext in a novel single round attack. The attack can be extended to spying on table accesses during decryption in a ciphertext-only attack. We also present an analytical model to explain the effect of false positives and false negatives and capture various practical tradeoffs involving number of blocks of plaintext, offline computation time for key retrieval and success probability.

Category / Keywords: implementation / AES, Side- channel, Cache, Lookup table, 2-round attack

Date: received 17 Oct 2018, last revised 21 Oct 2018

Contact author: ashokkumar at cse iitb ac in

Available format(s): PDF | BibTeX Citation

Version: 20181022:155957 (All versions of this report)

Short URL: ia.cr/2018/1002


[ Cryptology ePrint archive ]