katagaitai CTF workshop #10 AESに対する相関電力解析

katagaitai
workshop #10
Crypto
by trmr

• T
• C F
• 22 3
• T 3
• F 3 C

• 9C9 9 C9 Nx eN
• # F # E MN oP
• # E k tgRhL78
• # ( sE 7240
• # ( E 865l Sx Nn
• # ( E 1 C l Sx Nn
• # ) sE ( gN I3 C 0 C C A
• # ) sE ) x P
• # ) E Sx
• # sE x P
• # sE x P
• # E # ia
• # E x P

• ( C t dg : o V
• R( C S( T Fnp ws
• ( E
•
• :
• 5 )
• t bcfi
• (
• r
• : : : 5 A :
• ce k
• R M ce kH E
• chla uyHmIE

• i M
• e Wt t
• e W t
• e W rh
a c y
H
• rh B
y H
• d W
ku
• H 6 (
2 ( w
• e W S
tx o
2
l a c
) 2
2
HG

&
• 50772842
• F H c
• a
• ::01 eF DC
• 2 2892 e EDA DC
• T S
•

• xt ro xt xt
b e k
• xt ro xt 8c l :e
• ro xt 8c l :e
• ro a g c b
e k
xt
(+
xt
xt
.
xt
a
y
)/(

• w : c n
• - R Iue j A cS9
• j w l a M 9 n
• - F t i M 9
I C t n
• n w
• 9 9T A d S9
• kdn w
• okd I C cS9

• eoimGf w u c
c Ta
• v wW u
sSa
• w r u pO
• w hjod gGf 0 B
Pa W
• w hjod
• klntgGf O
• Qb_ q
a
BB E E/ 1 B /:. . : ./. : /:. 1B
/ 1 A B 1 B/ B

• /03 /4D4 0 6 AD 3D4 4
• fed
• 18 D8 bc ed
• Kb
• ( 5 D S f
• 23. 28 36 8 E : . : D a
DDA - 6 6 D : F 6 6 8 4 AE5 64D 9 A (
4 6 F8 ) 6E 8 D 9 A ( A 9

( ( ) )
• +1 1 54 2 (528 4 6 + (
• 4 m K h 4 S m
• + ( A m 4
• ) 1 6 1 ) 84 1 g c
• 4 4 i
• ei D C 4 c
• 4 ) d
• ) g c
• )
• ei D C 4 l c
• b 4 S P m+

(
• 2
• E(86 24 2
• ) 1 K
• 25 8
• E 3 86 24 2
• 2 8
• E 86 24 2

!
• U R : 8
•
• E 4 4 8
• E 4 7K 4 8
• 4 8 1 T56
OP
U

• )- 0 10 ) 82 -8 0 0
• ()-AN
• - S E
• PA D SR )- A
9 0

) ( ( )
• + ( w (03
• 62 (03 A S
• E Rw (03 w
• - 62) W od c
• 80 62) 0 :nt c
• -1 ) u
• Rb w
i od c
• + ( RK c
•
• Rw w r

(
• :
• 8 : AC M B
• ) M A RKb -
• : B X
• 2 1: S R
• ( AS

• p pE CH rlf Ksa e
• S ) : 9 9 2 Brl E p
• 4 : 2 9 2 0 4 i m D f p
• 4332 2 40 9 2 0 4 i A ns p
• S ) ( 42 B)9 2 0 49 9 2 0 4 )
• )9 2 0 49 9 2 0 4 ) P okH i c A
ns p

• 2C D 4
• I C
• F I C
• , A I C PD 4

• C 9 BH9D A5 IE E ) su hdpm tb nf j
• . hdpm tbP Se K i
• c 2
• c a nf
• nf wg rtP S ol
5 2B 9D" 1BE 5 15::9" 5A 9A 5 A 1 A ::9D9A 5 CBH9D 5A5 IE E J
AA 5 A 9DA5 BA5 ,DIC B B I ,BA:9D9A 9 CD A 9D" 9D A" 9 9 69D " (((
2 c a nf

• 2 6
• + 6
• 6 2
2
2
2
6

• - ( 2 -( e i a e
BA i
• P B a
• D7 a
P B
a
P B D7
a
D
f a f a

• E ?
• 3 b i 2 e
• 1 0 e : - 1 D D
?D K68
• 1 0 D = S
• 1 0 D K
i
E
- 1
- 1
- 1
1 0 1 0 1 0

• b W 2 1
• b - W
• i i W 0
2
• W 0 9
b b W
b
W W W
b -
W
9 9
9 9 9

3
• E b= :
• 1 0 S
• S K - 3 2D
2D= 2D 6
• 2DK S e
• 2D e S
K
E
-
-
-
(
)

• ( : C
• () S S
C C
• A P AE3B 1
• S 1C
• DBA 6
(

!
• OS E6USD E3
• = E6= 4 2
• PT 3 PT
• R
)
( D 162
A
OS E

• 1 :
• 5 S
• t p5
• 4 5
• S 6 2 2
• 2
• 6 i 8 6 840
6
• S e 8 b 0
S 7 3
• S 7
p

• 0 4
• P6
1 UO
• S P
b R D 3E
T
P
)(

• - e
• p1 0 Sb 31 0
• p1 Sb 31
0
i i
W W 1 W 1
W 1 05 W W
W W
6 p1 0
i i
W W W
W 1 05 W W
W W
6 p1 0

• ( (122 10 1 2 0 63 3 oit w :
• ) aD
• s ) (
• e 12 n Pb
• b
• t lr P C A P
• lr t
• t
• y P b t oii P

• ρ",$ X :
• Y:
• X , 73
•
• %&' (, ) = + ( − -( ) − -)
• -( ( Y
• + ( ( Y
• . ( = +[ ( − -( 0]
• ρ",$ 1 1-
• ρ",$ =
234 ",$
5 " 5 $
=
6 "78" $78$
6[ "78" 9]6[ $78$ 9]

• 2 1-0 B
• b so = e
• 1- e 2 1-0 B
K EA S
• 1- :B e p B
• 1- K B e
3
K
8
1-
1- 1-
K

• ρ",$ - Y :
• , 30
• 19 , 30
: 30
X : 30
30

• SD D 4B
• P E E
D B B
• b 1 D 0:CA
e

• d b [ 7 6 5 x
• 6 3 d i 16 p
• 6 3 d 16 p
• 6 3 16 r 7 6 5
• 7 6 5 28 16 -
• 6 3 7 6 5 : ]
• 6 3 x s u
• 6 3 s uB ]S W 16 Bt
e: 6 3 : 16 p
• 6 3 6 3 : i 24 y : 16
16 i 6 3
o

• 1
• - K [o : e
B 4- 6 2 S
• 4- 6 2 S 05 e -
• u
• 1
• s - ] : 8 S K] p
b 8 u B i 8
• s - t 8 S Kt pb
8 u B i 8
e
-
( 8 3
( ) 8

• P ( 4 ) A
• P )
• 4C 4 )

• ) ( ))( ( (
• D
• !"#(%&) = ∑&*+
,-.
/0 %& + 2 − /.(2)
• S m o fb
m fb/. i 4., … , 40
n fb/0 5
c!"#(%&)を取得
o SAD(%&)4 %& AD 5
D e

• S ()
4:
• ρ",$ =
∑'()
*
+',,-+, .',/-./
∑'()
*
+',,-+,
0
∑'()
*
.',/-./
0
• 1 6 ()
• 2 B
• 3 B
• ℎ : 4:
• 5 B

b 1
E
1 2
27 ℎ",$ − ℎ$
d B A
7 &",' − (&'
b 1 E
1 ) 8 0
ℎ",$ S 84 ℎ",$ − ℎ$ を取得
d B A *7
&",' − (&' S
e ), *7 S
ρ$,' =
∑"./
0
ℎ",$ − ℎ$ &",' − (&'
∑"./
0
ℎ",$ − ℎ$
1
∑"./
0
&",' − (&'
1
e ), *7 2$,'

• R il C
• .
• ) ( ) /
• c ) ( ) /
• . / 9 . / 9 / / ?4.
9 4 . 4 . A 9 4. . . 49 . 4 .9 4
4 9 / .9 9 /4 9 9
9 . A 9 4. 9 49 A9 A
• n
• T mk e a fd EhD
• o g MC

( )
• be ogit A7 A7 @7 S d r
ogit d y c
1E 7 : 49 7 #$# 3E> 0 < $ ,$ , $ 125 -7 :E F 7@>
7 :E F.
49 7 O hpsk l u Te Od
• 49 7 iumn t v
7 > F 7@@ C9 7
• 49 7 A7 @7
• C Oa O
C9 7
C9 7 , .@C7: E79 F#A7
C9 7 , .F7 A7 E79 F# #A7
$

)(
• ). 5
• : 5 : S
•
• ( M
•
5 :. " : :
5 5 " :
: " 5 . :" "5
1 : 5 :
"
":2 =

( )
!" #", … , #&
!& 5
2 '()(+,)を取得
SAD(+,) +,
def synchronize(trace, reference, window, max_offset):
reference_window = reference[window[0]:window[1]]
sad = [0] *(max_offset * 2 + 1)
for x in range(0, max_offset * 2 + 1):
trace_slice = trace[window[0]-max_offset + x:window[1]-max_offset + x]
sad[x] = np.sum(np.abs(reference_window - trace_slice))
sad_idx = np.argmin(sad)
offset = -max_offset + sad_idx
synchronized_trace = trace
if offset < 0:
synchronized_trace = np.concatenate(([0] * abs(offset),
synchronized_trace[:-abs(offset)]))
elif offset > 0:
synchronized_trace = np.concatenate((synchronized_trace[abs(offset):],
[0]*abs(offset)))
return synchronized_trace

(
4
4 ! 4
ℎ#,% ℎ#,% − ℎ% を取得
B ' S
4 (#,) − *()
b +
∑#-.
/
ℎ#,% − ℎ% (#,) − *()
∑#-.
/
ℎ#,% − ℎ%
0
∑#-.
/
(#,) − *()
0
ρ%,) =
∑#-.
/
ℎ#,% − ℎ% (#,) − *()
∑#-.
/
ℎ#,% − ℎ%
0
∑#-.
/
(#,) − *()
0
d 5 ρ%,) !
for k_idx in range(16): # determine key index
cpaoutput = [0] *256
# follow valiables may not be need
maxcpa = [0] *256
for kguess in range(256): # determine word key candidate
sumnum = np.zeros(NUM_POINTS)
sumden1 = np.zeros(NUM_POINTS)
sumden2 = np.zeros(NUM_POINTS)
hyp = np.zeros(NUM_TRACES)
for t_idx in range(NUM_TRACES): # hypothesis hamming weight
hyp[t_idx] = humming[addkey_subbytes(pt_list[t_idx][k_idx], kguess)]
h_mean = np.mean(hyp, dtype=np.float64)
t_mean = np.mean(sync_traces, axis = 0, dtype = np.float64)
for t_idx in range(NUM_TRACES):
hdiff = (hyp[t_idx] - h_mean)
tdiff = sync_traces[t_idx] - t_mean
sumnum = sumnum + (hdiff * tdiff)
sumden1 = sumden1 + hdiff * hdiff
sumden2 = sumden2 + tdiff * tdiff
cpaoutput[kguess] = sumnum / np.sqrt(sumden1 * sumden2)
maxcpa[kguess] = max(abs(cpaoutput[kguess]))
bestguess[k_idx] = np.argmax(maxcpa)
print "best guess key [{0}] is {1:02x}".format(k_idx, bestguess[k_idx])

12 52 8
1
$ python CPA.py
best guess key [1] is fe
best guess key [2] is ba
best guess key [3] is be
best guess key [4] is de
best guess key [5] is ad
best guess key [6] is be
best guess key [7] is ef
best guess key [8] is 00
Best key guess: CAFEBABEDEADBEEF0001020304050607

• , : :
• tlu w c
• a W g bd M Lro
• Ud chn
• m ( a W x
• . / 6 / / : : : 5
• , ( ) /
• ei ,
• Ud c CR p
• ) / s

• 0 20 3
• 0 20 5
• W L
• 0 20 5 F5C W
• $ T
• + 7 =
$

) ( (
• . c
•
• . .5
N S W
f .8 _
• = aei lC
• hg .8 f
#Save as ChipWhisperer project
tc = TraceContainerNative()
for i in range(0, ntraces):
tc.addWave(traces['samples'][i])
tc.addTextin(inp[i])
tc.addTextout(out[i])
tc.addKey([0]*16)
os.mkdir('rhme3')
tc.saveAllTraces('rhme3')
tc.config.setConfigFilename('rhme3/rhme.cfg')
tc.config.saveTrace()

) ( (
• .
• .5
• . 5 9
• C

) (
• - - c
•
• 0 P e 6 a
d
• a d
•
• P P T 1
R

)(
• 1 -1 6 : R
1 6: a
• :1 -
6 :1
• 1 6: R W
a
• :1 6: eG
• d D M E I
• : 6: A S b fc
• : 0 PM
#

) (
• A
• 1
•
R
• 3 T 6

•
• ( )
• E
• H C 4 6 I C F
• E F S T 4 C
• F 6

• f
• 0 8850/ 9 98 0: 60 0: 8 4 0 .: 9 48 8 0 /8 5 8 0 50
0 8 5 8 8 . 0 .: 9 :4 2 81 ) . : . 0: 8
0 0: 4.0 9 ) ( ( :4 2 0 .: 9
• e
• ip y ʼ va wrk ou 4 h dn
• ʼ va 6 m
• s g
• xc
• b h ʼ tva wrk ou 4 h m
((

) (
• 2 8 7 61 :
1
• 28 2 8 7 2
7.1
• 7 EA
• 2 8 7 61
add $t1, $zero, $zero# clear out $t1 ;
00004820
addi $t1, $t1, 0x9e# TEA magic is
0x9e3779b7 ; 2129009E
sll $t1, $t1, 8# shift out making room
in the bottom 4; 00094a00
addi $t1, $t1, 0x37 ; 21290037

) (
• 8
• :
•
•
8 6 :
{'j1istE9p': [0, … , 0],
'EXdxTejF': [0, … , 0],
…
}

()
• + 1(
• s0 0
• 0 0 3 9^
e i
• m 3 ) 3 41 0
• s 3 k
• + 1(
• s0 +
• )b 3 3
• + t 9 = 6b
m 3
• m 3 ) 3 41 0
• 0 a
• s 0 k
• d: s k9e
lw $t8, $zero, 8# k0 mem[8-23] = k ; 8c180008
lw $s7, $zero, 12# k1 ; 8C17000C
lw $s6, $zero, 16# k2 ; 8C160010
lw $t3, $zero, 20# k3 now our keys are in
registers ; 8c0b0014
sll $s4, $t6, 4# (v1 << 4) ; 000ea100
add $s4, $s4, $t8# +k0 part 1 is in s4 ; 0298a020

) (
• S Z vtoe yr lfPh
• s M u Pb i F zgTC jw
• / 0 0 /3 c S
• R C Makp
• 3 : 3 . / 0
• m Makp
• 3 : /7 . 0/ / : 7 :

(
• 5 07 211070 92. 65 07 6 G
•
• CU P
• 570 2
• H
• B

• # # / 4 4 M
• 4 0 @
120 1 1 T
• 5
• 120 1 1 7
S @
#

• 2 8: .3 . /40 7 1 : 3880 : 750 3 1 0
• o kG h
• 08 S
• o S n
• 08 o c b
• o c b g a
•
• o Z
• i 2 me

• S
• 3 + 7+4
• +4+ 7+4
• 44+ 7+4
• P DCA
• 3 3+4+4 W DCA
• W DCA
• DCA

9 SK 6 B DP 5 S 5 EED MC .DMI HM 5SM 0HEEDPDMRH K O UDP M K H MMS K 4MRDPM RH M K
/P OR K F / MEDPDMBD OPHMFDP .DPKHM 3DHCDKADPF
1PHB .PHDP / PH R O D /K THDP MC 2P MBH KHTHDP / PPDK RH M O UDP M K H UHR KD J FD
CDK 4MRDPM RH M K PJ O M /P OR FP O HB 3 PCU PD MC 1 ADCCDC RD OPHMFDP
.DPKHM 3DHCDKADPF
mk hai j f_c n 0H ku
l bg d e vsw n t t ,
RRO ,""UUU HO F IO" DBSPHR "DMB" PRB PC"M CD R K
1. o r ,
RRO,"" R B SDB B IO" 6 : "OCE" 1. 9 :DO PR 5 O MD D OCE
/ HO H ODPDP UHJH, RRO ,""UHJH MDU D B "/ PPDK RH M 9 UDP M K H
ypzku77 , RRO ,""UHJH BKSA SDB B IO"/ 2" KJHR"W O

katagaitai CTF workshop #10 AESに対する相関電力解析

More Related Content

What's hot (20)

Similar to katagaitai CTF workshop #10 AESに対する相関電力解析 (20)

Recently uploaded (20)

katagaitai CTF workshop #10 AESに対する相関電力解析