Timing Attack Paper by Paul Kocher

1. Timing Attack Paperby Paul Kocher presented by Greg Fletcher and Jef Considine

2. Introduction • Given known implementation, timing information can leak secret information. • Possible values of secret data can be ruled out based on time trial based on value. • For example, the Hamming weight of a secret exponent can be calculated by timing exponentiation (e.g. RSA or Diffie-Hellman)

3. Modular Exponentiation Let s0 = 1. For k = 0 upto w-1: If (bit k of x) is 1 then Let Rk = (sk * y) mod n. Else Let Rk = sk. Let sk+1 = Rk2 mod n. EndFor. Return (Rw-1).

4. Assumptions • Multiplication takes variable time. • Otherwise, only Hamming weight can be determined. • Timing information is accurate relative to variance in execution time.

5. The General Attack • Given j messages y0, y1, … yj-1 with corresponding timing measurements T0, T1, …, Tj-1 • xb is a guess for the first b bits of x • F is the expected probability distribution of T-t(y,xb) assuming xb is correct. • F will usually be difficult to find!

6. The General Attack continued • Probability that xb is correct. • If xb-1 is correct, probability that xb is correct and xb’ is incorrect.

7. Simplifying the Attack • Fortunately, we can avoid calculating F. • Given guess xb, we can calculate • yielding

8. Analysis of Variance • Correct guesses are expected to reduce variance in time corresponding to unguessed bits. • Each multiplication is assumed to be independent and is treated as an independent variable. • Correct guesses effectively remove random variables from the equation. • Incorrect guesses magnify instead of negating random variables.

9. Analysis of Variance continued • var(e) = error in timing measurements • var(t) = typical variation in each pass through the main loop • If xb is a correct guess, • var() = var(e)+(w-b)var(t) • If xc is a correct guess and the next bit is wrong, • var() = var(e)+(w-b+2(b-c))var(t)

10. Error Correction • Incorrect guesses effectively randomize values being multiplied. • Further guesses will make no apparent progress. • By keeping track of variance, guesses can be weighted and the most promising guesses can be pursued.

11. Attacking Alternate Methods • Reducing variance in relationship to measurement error makes attack more difficult • Montgomery Multiplication - mod n reduction steps are avoided so timing measurements must be more accurate. • Chinese Remainder Theorem - performing calculations mod p and q can allow p and q to be discovered. If y is less than p, mod p operations are skipped...

12. Masking Timing Characteristics • Making operations take fixed time is inefficient. • All operations must take the same time as the slowest operation. • Adding random delays to make timing measurements is also infeasible. • Attackers can compensate by increasing the number of samples. • The average time must be large to allow significant variation from delays.

13. Preventing the Attack • Blinding y • For random vi and vf=(vix)-1 mod n, calculate vf * (vi * y)x mod n. • vi and vf must change frequently to avoid timing attacks on them. • Blinding x • Add to x to blind exponent.

14. Further Work • With the exception of RSA, this attack is only theoretical. • Theoretical attacks are given for DSS and RSA implemented using Montgomery multiplication and the Chinese Remainder Theorem.

15. Conclusions • You’d be surprised where you can find holes...

16. Acknowledgements • Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems, http://www.cryptography.com/timingattack/