Piccolo相关性功耗分析攻击技术研究

Research on correlation power analysis attack against Piccolo

摘要:

为了评测轻量级密码算法Piccolo抗功耗分析攻击的能力, 提出一种针对首轮的功耗分析攻击模型, 搭建了功耗模拟采集平台, 对该算法进行了相关性功耗分析攻击. 针对Piccolo算法首轮运算中包含白化密钥和轮置换操作的特点, 将首轮相关攻击密钥(包括轮密钥RK0L、RK0R、WK₀、WK₁)分成6段子密钥, 逐个完成各段子密钥的攻击, 将80位种子密钥的搜索空间从2⁸⁰降低到(2×2²⁰+2×2⁴+2×2⁸+2¹⁶), 使种子密钥的恢复成为可能. 攻击结果表明, 只需500条功耗曲线即可恢复首轮攻击密钥, 由此可见, 未加任何防护措施的Piccolo硬件实现极易遭受相关性功耗分析攻击, 研究并采取切实有效的防护措施势在必行. 据现有资料, 这是首次评估Piccolo密码算法在相关性功耗分析攻击方面的安全性. 

Abstract:

To evaluate an ultra-lightweight blockcipher Piccolo’s ability to counteract Power Analysis Attack (PAA), an attack model, which focuses on the first round of Piccolo, was proposed and Correlation Power Analysis (CPA) was conducted on this cipher based on a power simulation acquisition platform. Due to the whiten keys and round permutation for the first round of Piccolo, attacking keys including RK0L, RK0R, WK₀ and WK₁ were divided into six sub-keys, which were disclosed one by one. This approach can reduce the 80-bit primary key search space from 2⁸⁰ to (2×2²⁰+2×2⁴+2×2⁸+2¹⁶) and make it possible to recover the primary key. The attack results show that 500 power traces are enough to recover Piccolo’s 80-bit primary key. It is concluded that the hardware implementation of Piccolo without any countermeasure is vulnerable to CPA and some countermeasures should be used. This work is the first known report about the security of Piccolo against PAA.