Key Enumeration from the Adversarial Viewpoint

Abstract

In this work, we formulate and investigate a pragmatic question related to practical side-channel attacks complemented with key enumeration. In a real attack scenario, after an attacker has extracted side-channel information, it is possible that despite the entropy of the key has been significantly reduced, she cannot yet achieve a direct key recovery. If the correct key lies within a sufficiently small set of most probable keys, it can then be recovered with a plaintext and the corresponding ciphertext, by performing enumeration. Our proposal relates to the following question: how does an attacker know when to stop acquiring side-channel observations and when to start enumerating with a given computational effort? Since key enumeration is an expensive (i.e. time-consuming) task, this is an important question from an adversarial viewpoint. To answer this question, we present an efficient (heuristic) way to perform key-less rank estimation, based on simple entropy estimations using histograms.

A Error Bounds on the Histogram Estimations

The bounds on the estimation of the entropy and the key-less guessing entropy using the Glowacz et al. full key distribution histogram and based on its quantization error are given by:

$$ \mathrm {H}\underline{~}\mathrm {upper}\underline{~}\mathrm {bound}= \sum \limits _{i = 1}^{N_p\cdot N_{\mathrm {bin}} -(N_p-1)} H(i).\exp (\mathsf {bin}(i + N_p)).\mathsf {bin}(i + N_p) $$

$$ \mathrm {H}\underline{~}\mathrm {lower}\underline{~}\mathrm {bound}= \sum \limits _{i = 1}^{N_p\cdot N_{\mathrm {bin}} -(N_p-1)} H(i).\exp (\mathsf {bin}(i - N_p)).\mathsf {bin}(i - N_p) $$

$$ \mathrm {GE}_{kl}\underline{~}\mathrm {upper}\underline{~}\mathrm {bound}= \sum \limits _{i = 1}^{N_p\cdot N_{\mathrm {bin}} -(N_p-1)} \left( \sum \limits _{j = i - N_p}^{N_p\cdot N_{\mathrm {bin}} -(N_p-1)} H(j) \right) . \exp ({\mathsf {bin}(i + N_p)}) $$

$$ \mathrm {GE}_{kl}\underline{~}\mathrm {lower}\underline{~}\mathrm {bound}= \sum \limits _{i = 1}^{N_p\cdot N_{\mathrm {bin}} -(N_p-1)} \left( \sum \limits _{j = i + N_p}^{N_p\cdot N_{\mathrm {bin}} -(N_p-1)} H(j) \right) . \exp ({\mathsf {bin}(i - N_p)}) $$