Difference between revisions of "Tutorial A6 Replication of Ilya Kizhvatov's XMEGA® Attack"

As in the Tutorial A5 Breaking AES-256 Bootloader tutorial, we will be using the Python script file to override the provided HW model. This will allow us to implement the model given by Kizhvatov for performing the CPA attack.

Remember that when you change settings in the GUI, the system is actually just automatically adjusting the attack script. You could modify the attack script directly instead of changing GUI settings. Every time you touch the GUI the autogenerated script is overwritten however, so it would be easy to lose your changes. As an example here is how setting the point range maps to an API call:

We will first automatically configure a script, and then use that as the base for our full attack.

1. Open the Analyzer software
2. From the File --> Open Project option, navigate to the .cwp file containing the capture of the power usage. This can be either the aes128_xmega_hardware.cwp file downloaded, or the capture you performed.

3. View the trace data as before, which should look something like this:

   

4. Set the 'Reporting Interval' to 50 or 100. We can change this later through the script.

5. We are now ready to insert the custom data into the attack module. On the General tab, make a copy of the auto-generated script. Do so by clicking on the autogenerated row, hit Copy, save the file somewhere. Double-click on the description of the new file and give it a better name. Finally hit Set Active after clicking on your new file. The result should look like this:

   

6. You can now edit the custom script file using the built-in editor OR with an external editor. In this example the file would be <code>C:\Users\Colin\AppData\Local\Temp\cw_testilya.py</code>.

   warning

   The API calling parameters changed a number of times. If using version 0.10 or older, either see the documentation that

   is present in the 'doc' directory (which will always correspond to your release), or see Appendix B-2/B-1 for the full attack script.

   The following defines the required functions to implement, you should refer to the academic paper for details of the correlation model:

   # Imports
   from chipwhisperer.analyzer.attacks.models.AES128_8bit import getHW
   
   class AESXMega(object):
       numSubKeys = 16
   
       @staticmethod
       def leakage(pt, ct, guess, bnum, setting, state):
           #In real life would recover this one at a time, in our case we know entire full key, so we cheat to make
           #the iterations easier
           knownkey = [0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6, 0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c]
   
           s1 = pt[bnum-1] ^ knownkey[bnum-1]
           s2 = pt[bnum] ^ guess
   
           #We subtract 8 as way measurements are taken a higher current results in a lower voltage. Normally this
           #doesn't matter due to use of absolute values. In this attack we do not use absolute mode, so we simply
           #"flip" the expected hamming weight, which results in the correlation changing signs.
           return 8-getHW(s1 ^ s2)

7. Add the above function to your custom script file.

8. Change the <code>setAnalysisAlgorithm</code> to use your custom functions by making the following call, see the full script in the Appendix:

   self.attack.setAnalysisAlgorithm(CPAProgressive,AESXMega,None)

9. Adjust the attack bytes to NOT attack the first byte, as our hacked script will not work with it:

   self.attack.setTargetBytes([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15])

10. We want to disable 'absolute mode', where by default the absolute value of the CPA attack is taken. We can do this by adding a call to self.attack.setAbsoluteMode(False) before the return statement, for example:

    self.attack.setPointRange((0,996))
    self.attack.setAbsoluteMode(False)
    

11. Run Start Attack as before! Wait for the attack to complete, which should show the key (except for the first byte) being recovered:

    

12. At this point you can also look at the output values, which one can compare to the shape of the values published in the paper:

    

    For more detailed plotting, turn off the 'Fast Draw' option:

    

    You can also use the 'GUI Override' on the byte highlighting to change the highlighted byte.

# Based on Ilya Kizhvatov's work, published as "Side Channel Analysis of AVR XMEGA Crypto Engine"
from chipwhisperer.common.api.CWCoreAPI import CWCoreAPI
from chipwhisperer.common.scripts.base import UserScriptBase
# Imports from Preprocessing
import chipwhisperer.analyzer.preprocessing as preprocessing
# Imports from Attack
from chipwhisperer.analyzer.attacks.cpa import CPA
from chipwhisperer.analyzer.attacks.cpa_algorithms.progressive import CPAProgressive
import chipwhisperer.analyzer.attacks.models.AES128_8bit
# Imports from utilList
from chipwhisperer.analyzer.attacks.models.AES128_8bit import getHW

class AESXMega(object):
    numSubKeys = 16

    @staticmethod
    def leakage(pt, ct, guess, bnum, setting, state):
        #In real life would recover this one at a time, in our case we know entire full key, so we cheat to make
        #the iterations easier
        knownkey = [0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6, 0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c]

        s1 = pt[bnum-1] ^ knownkey[bnum-1]
        s2 = pt[bnum] ^ guess

        #We subtract 8 as way measurements are taken a higher current results in a lower voltage. Normally this
        #doesn't matter due to use of absolute values. In this attack we do not use absolute mode, so we simply
        #"flip" the expected hamming weight, which results in the correlation changing signs.
        return 8-getHW(s1 ^ s2)

class UserScript(UserScriptBase):
    name = "Auto-generated"
    description = "Auto-generated Attack Script"
    def __init__(self, api):
        UserScriptBase.__init__(self, api)
        self.initProject()
        self.initPreprocessing()
        self.initAnalysis()
        self.initReporting()

    def initProject(self):
        pass

    def initPreprocessing(self):
        self.traces = self.api.project().traceManager()

    def initAnalysis(self):
        self.attack = CPA()
        self.attack.setTraceSource(self.traces, blockSignal=True)
        self.attack.setAnalysisAlgorithm(CPAProgressive,AESXMega,None)
        self.attack.setTraceStart(0)
        self.attack.setTracesPerAttack(3000)
        self.attack.setIterations(1)
        self.attack.setReportingInterval(50)
        self.attack.setTargetBytes([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15])
        self.attack.setPointRange((0,995))
        self.attack.setAbsoluteMode(False)

    def initReporting(self):
        # Configures the attack observers (usually a set of GUI widgets)
        self.api.getResults("Attack Settings").setAnalysisSource(self.attack)
        self.api.getResults("Correlation vs Traces in Attack").setAnalysisSource(self.attack)
        self.api.getResults("Output vs Point Plot").setAnalysisSource(self.attack)
        self.api.getResults("PGE vs Trace Plot").setAnalysisSource(self.attack)
        self.api.getResults("Results Table").setAnalysisSource(self.attack)
        self.api.getResults("Save to Files").setAnalysisSource(self.attack)
        self.api.getResults("Trace Output Plot").setTraceSource(self.traces)
        self.api.getResults("Trace Recorder").setTraceSource(self.traces)

    def run(self):
        self.attack.processTraces()

if __name__ == '__main__':
    import chipwhisperer.analyzer.ui.CWAnalyzerGUI as cwa
    from chipwhisperer.common.utils.parameter import Parameter
    Parameter.usePyQtGraph = True            # Comment if you don't need the GUI
    api = CWCoreAPI()                        # Instantiate the API
    app = cwa.makeApplication("Analyzer")    # Comment if you don't need the GUI
    gui = cwa.CWAnalyzerGUI(api)             # Comment if you don't need the GUI
    gui.show()                               # Comment if you don't need the GUI
    api.runScriptClass(UserScript)           # Run UserScript through the API
    app.exec_()                              # Comment if you don't need the GUI

Here is the full attack script for older releases:

# Based on Ilya Kizhvatov's work, published as "Side Channel Analysis of AVR XMEGA Crypto Engine"
from chipwhisperer.common.autoscript import AutoScriptBase
#Imports from Preprocessing
import chipwhisperer.analyzer.preprocessing as preprocessing
#Imports from Capture
from chipwhisperer.analyzer.attacks.CPA import CPA
from chipwhisperer.analyzer.attacks.CPAProgressive import CPAProgressive
import chipwhisperer.analyzer.attacks.models.AES128_8bit
# Imports
from chipwhisperer.analyzer.attacks.models.AES128_8bit import getHW

class AESXMega(object):
    numSubKeys = 16

    @staticmethod
    def leakage(pt, ct, guess, bnum, setting, state):
        #In real life would recover this one at a time, in our case we know entire full key, so we cheat to make
        #the iterations easier
        knownkey = [0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6, 0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c]

        s1 = pt[bnum-1] ^ knownkey[bnum-1]
        s2 = pt[bnum] ^ guess

        #We subtract 8 as way measurements are taken a higher current results in a lower voltage. Normally this
        #doesn't matter due to use of absolute values. In this attack we do not use absolute mode, so we simply
        #"flip" the expected hamming weight, which results in the correlation changing signs.
        return 8-getHW(s1 ^ s2)

class userScript(AutoScriptBase):
    preProcessingList = []
    def initProject(self):
        pass

    def initPreprocessing(self):
        self.preProcessingList = []
        return self.preProcessingList

    def initAnalysis(self):
        self.attack = CPA(self.parent, console=self.console, showScriptParameter=self.showScriptParameter)
        self.attack.setAnalysisAlgorithm(CPAProgressive,AESXMega,None)
        self.attack.setTraceStart(0)
        self.attack.setTracesPerAttack(2999)
        self.attack.setIterations(1)
        self.attack.setReportingInterval(500)
        self.attack.setTargetBytes([0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15])
        self.attack.setTraceManager(self.traceManager())
        self.attack.setProject(self.project())
        self.attack.setPointRange((0,996))
        return self.attack

    def initReporting(self, results):
        results.setAttack(self.attack)
        results.setTraceManager(self.traceManager())
        self.results = results

    def doAnalysis(self):
        self.attack.doAttack()

Here is the full attack script:

# Based on Ilya Kizhvatov's work, published as "Side Channel Analysis of AVR XMEGA Crypto Engine"
from chipwhisperer.common.autoscript import AutoScriptBase
#Imports from Preprocessing
import chipwhisperer.analyzer.preprocessing as preprocessing
#Imports from Capture
from chipwhisperer.analyzer.attacks.CPA import CPA
from chipwhisperer.analyzer.attacks.CPAProgressive import CPAProgressive
import chipwhisperer.analyzer.attacks.models.AES128_8bit
#Imports from utilList

# Imports
from chipwhisperer.analyzer.attacks.models.AES128_8bit import getHW

def AES128_HD_ILYA(pt, ct, key, bnum):
    """Given either plaintext or ciphertext (not both) + a key guess, return hypothetical hamming weight of result"""

    #In real life would recover this one at a time, in our case we know entire full key, so we cheat to make
    #the iterations easier
    knownkey = [0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6, 0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c]

    if pt != None:
        s1 = pt[bnum-1] ^ knownkey[bnum-1]
        s2 = pt[bnum] ^ key

        #We subtract 8 as way measurements are taken a higher current results in a lower voltage. Normally this
        #doesn't matter due to use of absolute values. In this attack we do not use absolute mode, so we simply
        #"flip" the expected hamming weight, which results in the correlation changing signs.

        return 8-getHW(s1 ^ s2)

    elif ct != None:
        raise ValueError("Only setup for encryption attacks")
    else:
        raise ValueError("Must specify PT or CT")

class userScript(AutoScriptBase):
    preProcessingList = []
    def initProject(self):
        pass

    def initPreprocessing(self):
        self.preProcessingList = []
        return self.preProcessingList

    def initAnalysis(self):
        self.attack = CPA(self.parent, console=self.console, showScriptParameter=self.showScriptParameter)
        self.attack.setAnalysisAlgorithm(CPAProgressive,chipwhisperer.analyzer.attacks.models.AES128_8bit,AES128_HD_ILYA)
        self.attack.setTraceStart(0)
        self.attack.setTracesPerAttack(2999)
        self.attack.setIterations(1)
        self.attack.setReportingInterval(50)
        self.attack.setTargetBytes([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15])
        self.attack.setKeyround(0)
        self.attack.setDirection('enc')
        self.attack.setTraceManager(self.traceManager())
        self.attack.setProject(self.project())
        self.attack.setPointRange((0,996))
        self.attack.setAbsoluteMode(False)
        return self.attack

    def initReporting(self, results):
        results.setAttack(self.attack)
        results.setTraceManager(self.traceManager())
        self.results = results

    def doAnalysis(self):
        self.attack.doAttack()

Atmel and XMEGA are registered trademarks or trademarks of Atmel Corporation or its subsidiaries, in the US and/or other countries.