Tutorial B8 Profiling Attacks (Manual Template Attack) - Revision history

Fheubach at 18:46, 1 May 2018

2018-05-01T18:46:22Z

Fheubach at 15:00, 1 May 2018

2018-05-01T15:00:57Z

Gdeon: Added tutorial category

2016-06-21T17:03:04Z

Added tutorial category

Gdeon: Added script in appendix and mentioned scipy include

2016-05-26T14:18:11Z

Added script in appendix and mentioned scipy include

Show changes

Gdeon: /* Gotchas */ Added section

2016-05-26T13:55:33Z

‎Gotchas: Added section

Gdeon: /* Performing the Attack */ Added section

2016-05-26T13:45:21Z

‎Performing the Attack: Added section

Gdeon: /* Sorting the Traces */ Fixed np.array() to work with list of arrays

2016-05-26T13:21:17Z

‎Sorting the Traces: Fixed np.array() to work with list of arrays

Gdeon: /* Covariance Matrices */ Added section

2016-05-26T13:20:19Z

‎Covariance Matrices: Added section

Gdeon: /* Points of Interest */ Added section

2016-05-26T12:44:13Z

‎Points of Interest: Added section

Gdeon: /* Sorting the Traces */ Minor addition

2016-05-25T19:59:34Z

‎Sorting the Traces: Minor addition

@@ Line 506: / Line 506: @@
      print P_k.argsort()[-5:]
 </pre>
 {{Template:Tutorials}}
 [[Category:Tutorials]]

@@ Line 5: / Line 5: @@
 Additionally, this tutorial uses some terminology from previous tutorials, such as ''Hamming weight'' and ''substitution box''. If you don't know what these are, [[Tutorial B6 Breaking AES (Manual CPA Attack)]] might be an easier starting point.
-= Scripting =
+== Scripting ==
 All of the work in this tutorial will be done using Python scripts. All you need for this tutorial is a text editor and a command terminal that can run Python. In my example, I am editing a file called <code>manualTemplate.py</code> in a text editor and using the command
@@ Line 14: / Line 14: @@
 to execute the script. You can work with a full IDE if you prefer.
-= Capturing the Traces =
+== Capturing the Traces ==
 As in the previous tutorial, this tutorial requires two sets of traces. The first set is a large number of traces (1000+) with random keys and plaintexts, assumed to come from your personal copy of the device. The second is a smaller number of traces (~50) with a fixed key and random plaintexts, assumed to come from the sensitive device that we're attacking. The goal of this tutorial is to recover the fixed key from the smaller set of traces.
@@ Line 21: / Line 21: @@
 Note that this tutorial will explain how to attack a single byte of the secret AES key. It would be easy to extend this to the full key by running the code 16 times. The smaller attack is used to make some of the code easier to grasp and debug.
-= Creating the Template =
+== Creating the Template ==
 This section describes how to generate a template from the random-key traces. Our template will attempt to recognize the Hamming weight of the AES substitution box output. This choice of attack point limits our template - we will not be able to find the secret key in one attack trace - but it allows us to use a smaller amount of preprocessing. A more robust template attack (for instance, creating a template for each of the 256 possible key bytes) would require at least 10 times more data.
-== Loading the Traces ==
+=== Loading the Traces ===
 The traces recorded from the ChipWhisperer Capture program are saved as NumPy arrays. These files can be loaded using the <code>np.load()</code> function. We're interested in the traces, plaintext, and random keys used in our template captures, so we can load this data with the code:
@@ Line 48: / Line 48: @@
 Get in the habit of checking your data with some basic print statements or plots - it's a good sanity check to make sure that your arrays are the size they should be! If everything looks okay, comment out these checks and move on.
-== Sorting the Traces ==
+=== Sorting the Traces ===
 With the data in-hand, our next task is to group the data according to our model. We're attacking an intermediate result in the AES algorithm where
@@ Line 116: / Line 116: @@
 </pre>
-== Points of Interest ==
+=== Points of Interest ===
 After sorting the traces by their Hamming weights, we need to find an "average trace" for each weight. We can make an array to hold 9 of these averages:
@@ Line 199: / Line 199: @@
 </pre>
-== Covariance Matrices ==
+=== Covariance Matrices ===
 With 5 (or <code>numPOIs</code>) POIs picked out, we can build our multivariate distributions at each point for each Hamming weight. We need to write down two matrices for each weight:
 * A mean matrix (<code>1 x numPOIs</code>) which stores the mean at each POI
@@ Line 249: / Line 249: @@
 Note that you may not have enough data to complete the covariance matrix - check out the Gotchas at the end of this tutorial if this step blew up on you.
-= Performing the Attack =
+== Performing the Attack ==
 Our template is ready, so we can use it to perform an attack now. We'll load our fixed-key traces and apply the template PDF to see how good each guess is, keeping a running total to check which subkey guesses are the best matches.
-== Loading the Traces ==
+=== Loading the Traces ===
 If you followed the instructions from the previous tutorial, you'll have a few dozen traces that use random plaintexts and a fixed key. We can load these in exactly the same way as the template traces:
 <pre>
@@ Line 270: / Line 270: @@
 We're only attacking the first subkey, so let's see if we can get <code>43</code> to come up as the best guess.
-== Using the Template ==
+=== Using the Template ===
 The very last step is to apply our template to these traces. We want to keep a running total of <math>\log P_k = \sum_j \log p_{k,j}</math>, so we'll make space for our 256 guesses:
 <pre>
@@ Line 328: / Line 328: @@
 so we successfully attacked the first subkey in 3 traces! This is a bit lucky - most of the subkeys tend to take a bit more data. Don't be surprised if your attack takes closer to a dozen trials.
-= Gotchas =
+== Gotchas ==
 One problem with template attacks is that they require a large amount of data to make good templates. Remember that every output of the AES substitution box is unique, so there is only one output with a Hamming weight of 0 and only one with a weight of 8. This means that, when using random inputs, there is only a 1/256 chance of a trace using a Hamming weight of 0 or 8.
@@ Line 337: / Line 337: @@
 If you ran into numerical problems while working through this tutorial, try recording another bigger data set. Instead of capturing 1000 template traces, try 5000 (on your coffee break), 10000 (on your lunch break), or 100000 (overnight). You'll probably find that the extra data makes the statistics work out better.
-= Appendix: Full Script =
+== Appendix: Full Script ==
 If you got lost, here's our full implementation:
 <pre>

← Older revision		Revision as of 17:03, 21 June 2016
Line 508:		Line 508:

	{{Template:Tutorials}}		{{Template:Tutorials}}
		+	[[Category:Tutorials]]

@@ Line 324: / Line 324: @@
 = Gotchas =
-* Too little data (0 or 1 trace)
+One problem with template attacks is that they require a large amount of data to make good templates. Remember that every output of the AES substitution box is unique, so there is only one output with a Hamming weight of 0 and only one with a weight of 8. This means that, when using random inputs, there is only a 1/256 chance of a trace using a Hamming weight of 0 or 8.
-* Flukes + statistics
 {{Template:Tutorials}}

@@ Line 250: / Line 250: @@
 = Performing the Attack =
-Steps to crack the code (tm)
+Our template is ready, so we can use it to perform an attack now. We'll load our fixed-key traces and apply the template PDF to see how good each guess is, keeping a running total to check which subkey guesses are the best matches.
 == Loading the Traces ==
 == Using the Template ==
 = Gotchas =

@@ Line 106: / Line 106: @@
 </pre>
-Now, <code>tempTracesHW[y]</code> is a list of all of the traces with an intermediate Hamming weight of <code>y</code>. As our last step, let's turn this into a NumPy array to make the math easier in the rest of the tutorial:
+Now, <code>tempTracesHW[y]</code> is a list of all of the traces with an intermediate Hamming weight of <code>y</code>. As our last step, let's turn this into a list of NumPy arrays to make the math easier in the rest of the tutorial:
 <pre>
-tempTracesHW = np.array(tempTracesHW)
+tempTracesHW = [np.array(tempTracesHW[HW]) for HW in range(9)]
 </pre>

← Older revision		Revision as of 13:20, 26 May 2016
Line 200:		Line 200:

	== Covariance Matrices ==		== Covariance Matrices ==
		+	With 5 (or <code>numPOIs</code>) POIs picked out, we can build our multivariate distributions at each point for each Hamming weight. We need to write down two matrices for each weight:
		+	* A mean matrix (<code>1 x numPOIs</code>) which stores the mean at each POI
		+	* A covariance matrix (<code>numPOIs x numPOIs</code>) which stores the variances and covariances between each of the POIs
		+
		+	The mean matrix is easy to set up because we've already found the mean at every point. All we need to do is grab the right points:
		+
		+	<pre>
		+	meanMatrix = np.zeros((9, numPOIs))
		+	for HW in range(9):
		+	for i in range(numPOIs):
		+	meanMatrix[HW][i] = tempMeans[HW][POIs[i]]
		+	</pre>
		+
		+	The covariance matrix is a bit more complex. We need a way to find the covariance between two 1D arrays. Helpfully, NumPy has the <code>cov(a, b)</code> function, which returns the matrix
		+	<pre>
		+	np.cov(a, b) = [[cov(a, a), cov(a, b)],
		+	[cov(b, a), cov(b, b)]]
		+	</pre>
		+
		+	We can use this to define our own covariance function:
		+	<pre>
		+	def cov(x, y):
		+	# Find the covariance between two 1D lists (x and y).
		+	# Note that var(x) = cov(x, x)
		+	return np.cov(x, y)[0][1]
		+	</pre>
		+
		+	As mentioned in the comments, this function can also calculate the variance of an array by passing the same array in for both <code>x</code> and <code>y</code>.
		+
		+	We'll use our function to build the covariance matrices:
		+	<pre>
		+	covMatrix = np.zeros((9, numPOIs, numPOIs))
		+	for HW in range(9):
		+	for i in range(numPOIs):
		+	for j in range(numPOIs):
		+	x = tempTracesHW[HW][:,POIs[i]]
		+	y = tempTracesHW[HW][:,POIs[j]]
		+	covMatrix[HW,i,j] = cov(x, y)
		+	</pre>
		+
		+	Make sure these matrices look okay before continuing:
		+
		+	<pre>
		+	print meanMatrix
		+	print covMatrix[0]
		+	</pre>
		+
		+	Note that you may not have enough data to complete the covariance matrix - check out the Gotchas at the end of this tutorial if this step blew up on you.

	= Performing the Attack =		= Performing the Attack =

← Older revision		Revision as of 12:44, 26 May 2016
Line 117:		Line 117:

	== Points of Interest ==		== Points of Interest ==
		+	After sorting the traces by their Hamming weights, we need to find an "average trace" for each weight. We can make an array to hold 9 of these averages:
		+
		+	<pre>
		+	tempMeans = np.zeros((9, len(tempTraces[0])))
		+	</pre>
		+
		+	Then, we can fill up each of these traces one-by-one. NumPy's <code>average()</code> function makes this easy by including an "axis" input. We can tell NumPy to find the average at each point in time and repeat this for all 9 weights:
		+
		+	<pre>
		+	for i in range(9):
		+	tempMeans[i] = np.average(tempTracesHW[i], 0)
		+	</pre>
		+
		+	Once again, it's a good idea to plot one of these averages to make sure that the average traces look okay:
		+
		+	<pre>
		+	plt.plot(tempMeans[2])
		+	plt.grid()
		+	plt.show()
		+	</pre>
		+
		+	[[File:Template-Mean-Trace.png\|800px]]
		+
		+
		+	We can use these average traces to find points of interest using the ''sum of differences'' method. If this sounds unfamiliar, take a look at [[Template_Attacks#Points_of_Interest\|the theory page]] for a review of the math. The first step is to create a "trace" that stores these differences:
		+
		+	<pre>
		+	tempSumDiff = np.zeros(len(tempTraces[0]))
		+	</pre>
		+
		+	Then, we want to look at all of the pairs of traces, subtract them, and add them to the sum of differences. This is simple to do with 2 loops:
		+
		+	<pre>
		+	for i in range(9):
		+	for j in range(i):
		+	tempSumDiff += np.abs(tempMeans[i] - tempMeans[j])
		+	</pre>
		+
		+	This sum of differences will have peaks where the average traces showed a lot of variance. Make sure that there are a handful of high peaks that we can use as points of interest:
		+
		+	<pre>
		+	plt.plot(tempSumDiff)
		+	plt.grid()
		+	plt.show()
		+	</pre>
		+
		+	[[File:Template-Sum-Of-Difference.png\|800px]]
		+
		+	Now, the most interesting points of interest are the highest peaks in this sum of differences plot. However, we can't just sort the array and pick the top points. Remember (because you read the theory page, right? <sup>right?</sup>) that we need to make sure our points have some space between them. For instance, it would be a bad idea to pick both 1950 and 1951 as points of interest.
		+
		+	We can use the algorithm from the theory page to pick out some POIs:
		+	* Make an empty list of POIs
		+	* Find the biggest peak in the sum of differences trace and add it to the list of POIs
		+	* Zero out some of the surrounding points
		+	* Repeat until we have enough POIs
		+	Try to code this on your own - it's a good exercise. If you get stuck, here's our implementation:
		+
		+	<pre>
		+	# Some settings that we can change
		+	numPOIs = 5 # How many POIs do we want?
		+	POIspacing = 5 # How far apart do the POIs have to be?
		+
		+	# Make an empty list of POIs
		+	POIs = []
		+
		+	# Repeat until we have enough POIs
		+	for i in range(numPOIs):
		+	# Find the biggest peak and add it to the list of POIs
		+	nextPOI = tempSumDiff.argmax()
		+	POIs.append(nextPOI)
		+
		+	# Zero out some of the surrounding points
		+	# Make sure we don't go out of bounds
		+	poiMin = max(0, nextPOI - POIspacing)
		+	poiMax = min(nextPOI + POIspacing, len(tempSumDiff))
		+	for j in range(poiMin, poiMax):
		+	tempSumDiff[j] = 0
		+
		+	# Make sure they look okay
		+	print POIs
		+	</pre>
		+
	== Covariance Matrices ==		== Covariance Matrices ==

← Older revision		Revision as of 19:59, 25 May 2016
Line 111:		Line 111:
	</pre>		</pre>

		+	One more check: make sure we have data in any one of these categories by printing
		+	<pre>
		+	print len(tempTracesHW[8])
		+	</pre>

	== Points of Interest ==		== Points of Interest ==