• 中国计算机学会会刊
  • 中国科技核心期刊
  • 中文核心期刊

J4 ›› 2014, Vol. 36 ›› Issue (04): 639-643.

• 论文 • 上一篇    下一篇

计时攻击漏洞识别与防护能力量化评估技术

贺章擎1,2,戴葵2,童元满3,邹雪城2   

  1. (1.湖北工业大学电气与电子工程学院,湖北 武汉 430068;
    2.华中科技大学光学与电子信息学院,湖北 武汉 430074;
    3.国防科学技术大学计算机学院,湖南 长沙 410073)
  • 收稿日期:2013-06-05 修回日期:2013-10-28 出版日期:2014-04-25 发布日期:2014-04-25
  • 基金资助:

    国家自然科学基金资助项目(60973035,61202481)

Quantitative security evaluation against
timing attacks in cryptographic algorithm

 HE Zhangqing1,2,DAI Kui2,TONG Yuanman3,ZOU Xuecheng2   

  1. (1.Department of Electrical & Electronic Engineering,Hubei University of Technology,Wuhan 430068;
    2.School of Optical and Electronic Information,Huazhong University of Science & Technology,Wuhan 430074;
    3.College of Computer,National University of Defense Technology,Changsha 410073,China)
  • Received:2013-06-05 Revised:2013-10-28 Online:2014-04-25 Published:2014-04-25

摘要:

计时攻击是最具威胁的旁路攻击之一,为了设计安全高效的抗计时攻击的密码运算部件,需要在设计实现过程中及时发现密码算法的安全漏洞,并量化分析密码运算部件的抗计时攻击防护能力。因此,提出了一种可发现在密码算法具体实现中可能存在的计时攻击漏洞的分析方法。将密码算法采用增强数据相关图表示,通过在数据相关图中查找可被计时攻击的过程变量来分析安全漏洞,给出了相应的识别算法。并以成功实施计时攻击所需的样本数来量化密码运算部件抗计时攻击能力,提出了一种估算所需样本数的计算方法。

关键词: 旁路攻击, 计时攻击, 增强数据相关图, 量化评估

Abstract:

Timing attack is one of the most threatening sidechannel attacks. In order to design efficient cryptosystems against timing attack, it is necessary to find the vulnerability at design time and quantitative analyze the resistibility to timing attack of the cryptographic algorithms. The paper proposes a unified method for identifying the feasible timing attack in various implementations of cryptographic algorithms, which are described by the Enhanced Data Dependence Graph (EDDG), and analyzes the timing attack vulnerabilities by finding some intermediary variable in the EDDG.The number of time samples required for a successful timing attack is used to characterize the resistibility, which is computed based on the signal-to-noise ratio of the corresponding timing attack.      

Key words: side-channel attack;timing attack;enhanced data dependence graph;quantitative evaluation