Tutorial B6 Breaking AES (Manual CPA Attack) - Revision history

Adewar at 13:16, 29 July 2019

2019-07-29T13:16:49Z

2019-07-29T13:14:56Z

2018-05-01T18:45:43Z

2017-05-10T17:29:36Z

small spelling mistake

2016-05-20T14:12:05Z

Added template

2016-05-19T12:33:40Z

Added tutorial category

2016-05-19T12:30:49Z

‎Performing the Check: Minor fixes

2016-05-19T12:27:38Z

‎Performing the Guess: Minor fixes

2016-05-18T19:26:49Z

‎Future Changes: Added online equation

2016-05-18T19:19:41Z

‎Conversion of Correlation Equation: Added equations

← Older revision		Revision as of 13:14, 29 July 2019
Line 1:		Line 1:
		+	{{Warningbox\|This tutorial has been updated for ChipWhisperer 5 release. If you are using 4.x.x see the "V4" link in the sidebar.}}
		+
		+	{{Infobox tutorial
		+	\|name = B6: Breaking AES (Manual CPA Attack)
		+	\|image =
		+	\|caption =
		+	\|software versions =
		+	\|capture hardware = CW-Lite, CW-Lite 2-Part, CW-Pro
		+	\|Target Device =
		+	\|Target Architecture = XMEGA/Arm/Other
		+	\|Hardware Crypto = No
		+	\|Purchase Hardware =
		+	}}
		+
	This tutorial will demonstrate how to perform a CPA attack using a simple Python script. This will bring you through an entire CPA attack ''without'' using the ChipWhisperer Analyzer program, which will greatly improve your understanding of the actual attack method.		This tutorial will demonstrate how to perform a CPA attack using a simple Python script. This will bring you through an entire CPA attack ''without'' using the ChipWhisperer Analyzer program, which will greatly improve your understanding of the actual attack method.

@@ Line 602: / Line 602: @@
 [[File:Rij_conversion.png]]
 {{Template:Tutorials}}
 [[Category:Tutorials]]

@@ Line 14: / Line 14: @@
 == Setting Up the Project ==
-It is assumed you are experienced with Python development, or have at least run a Python program! If you are on Windows you'll probably use IDLE for as a code editor, although you can use any code editor you wish.
+It is assumed you are experienced with Python development, or have at least run a Python program! If you are on Windows you'll probably use IDLE as a code editor, although you can use any code editor you wish.
 Initially, we'll be using Python interactively. This means to just run <code>python</code> at the command prompt, and enter commands into the window. Later we'll move onto writing a simple script which executes these commands.

@@ Line 302: / Line 302: @@
 Next, let's again consider the three sums to be implemented:
-<math>sumnum = {\sum\nolimits_{d = 1}^D {\left[ {\left( {{h_{d,i}} - \overline {{h_i}} } \right)\left( {{t_{d,j}} - \overline {{t_j}} } \right)} \right]} }</math><math>sumdem1 = \sum\nolimits_{d = 1}^D {{{\left( {{h_{d,i}} - \overline {{h_i}} } \right)}^2}}</math><math>sumdem2 = \sum\nolimits_{d = 1}^D {{{\left( {{t_{d,j}} - \overline {{t_j}} } \right)}^2}}</math>
+<math>sumnum = {\sum\nolimits_{d = 1}^D {\left[ {\left( {{h_{d,i}} - \overline {{h_i}} } \right)\left( {{t_{d,j}} - \overline {{t_j}} } \right)} \right]} }</math>
 Note there is some common terms in all three of these, along with a common summation index. We can thus implement them as follows:
@@ Line 317: / Line 321: @@
 <pre>cpaoutput[kguess] = sumnum / np.sqrt( sumden1 * sumden2 )</pre>
-Tieing it all together, we end up with the following:
+Tying it all together, we end up with the following:
 <pre>import numpy as np
@@ Line 422: / Line 426: @@
 Best Key Guess:
 b  00  00  00  00  00  00  00  00  00  00  00  00  00  00  00 </pre>
 == Calculating The PGE ==

@@ Line 128: / Line 128: @@
 Note that in Python we can specify hex constants directly! Now the system will only be searching from 0x26 - 0x2F for the correct key. Once we have a guess, we need to calculate the intermediate value corresponding to the guess.
-Looking way back to how AES works, remember we are effectively attempint to target the position at the bottom of this figure:
+Looking way back to how AES works, remember we are effectively attemping to target the position at the bottom of this figure:
-<blockquote>[[File:Sbox_cpa_detail.png|frame|none|alt=|caption The AES algorithm involves a number of rounds, this is a detail from the first round of operation. Each input byte is XOR'd with a byte of the (unknown) secret key. This is passed through an S-Box, which is simply a look-up table. The output of this S-Box is what we'll use to 'check' our guessed value of the key.]]
+<blockquote>[[File:Sbox_cpa_detail.png|frame|none|alt=|The AES algorithm involves a number of rounds, this is a detail from the first round of operation. Each input byte is XOR'd with a byte of the (unknown) secret key. This is passed through an S-Box, which is simply a look-up table. The output of this S-Box is what we'll use to 'check' our guessed value of the key.]]
 </blockquote>
-The objective is thus to determine the output of the SBox, where the S-Box is defined as follows:
+The objective is thus to determine the output of the S-Box, where the S-Box is defined as follows:
 <pre>sbox=(

@@ Line 481: / Line 481: @@
 == Future Changes ==
-The implementation of the correlation function runs as a loop over all traces. Ideally we'd like to implement this as a 'online' calculation; that is we can add a trace in, observe the output, add another trace in, observe the output, etc. When generating plots of the Partial Guessing Entropy (PGE) vs. number of traces this is greatly preferred, since otherwise we need to run the loop many times!
+The implementation of the correlation function runs as a loop over all traces. Ideally we'd like to implement this as a 'online' calculation; that is, we can add a trace in, observe the output, add another trace in, observe the output, etc. When generating plots of the Partial Guessing Entropy (PGE) vs. number of traces this is greatly preferred, since otherwise we need to run the loop many times!
-We can use an alternate form of the [[File:rij.png]] equation, which explicitly stores sums of the variables. This is easier to perform online calculation with, since when adding a new trace it's simple to update these sums. This form of the equation looks like:
+We can use an alternate form of the correlation equation, which explicitly stores sums of the variables. This is easier to perform online calculation with, since when adding a new trace it's simple to update these sums. This form of the equation looks like:
 <blockquote></blockquote>
 == Complete Program ==

← Older revision		Revision as of 19:19, 18 May 2016
Line 592:		Line 592:

	The following shows the derivation of the online correlation equation from the original form:		The following shows the derivation of the online correlation equation from the original form:
		+
		+	[[File:Rij_conversion.png]]