Approved_users, bureaucrat, administrator
1,956
edits
| As of August 2020 the site you are on (wiki.newae.com) is deprecated, and content is now at rtfm.newae.com. |
Changes
→13th Round Key
Unfortunately, we cannot use the GUI to attack the 13th round key. The system has no built-in model for round 13 of the AES-256 algorithm. Instead, we can write our own script and insert a custom model into the system. See [[#Appendix D: AES-256 13th Round Key Script]] for complete script used here.
# Recall from the 14th round attack that the trace data becomes unsynchronized around sample 7000. This is due to a non-constant AES implementation: the code does not always take the same amount of time to run for every input. (It's actually possible to do a timing attack on this AES implementation! We'll stick with our CPA attack for now.)
#: [[File:syncproblems.png|image]]
# Resynchronize the traces:## In the ''Attack Script Generator'' tab, enable see the separate 'Preprocessing'Resync: Sum of Difference'' preprocessing:##: [[File:resyncsad.png|image]]## Enable the module and configure the input points. To start, set the reference points to tutorial (9063, 9177) and the input window to (9010, 9080), but don't be afraid to change these rangesNB:##: [[File:resyncsad2.png|image]]## Redraw the traces and confirm we only in slides right now have synchronization on the second half:##: [[File:resyncsad3.png|image]]!)
{{warningbox|Make sure you get a nice aligned last section of the traces, as in the above figure. You may need to adjust the "input window" or "reference points" slightly. If you do not see the nice alignment the remaining attack will fail!}}
The next step is to program our own leakage model. The following Python code models the Hamming weight model of the 13th round S-box:
<pre>
# Imports for AES256 Attack
class AES256_ModelAES256_Round13_Model(AESLeakageHelper): name = 'Our model'
def leakage(self, pt, ct, guess, bnum):
block = xored
block = self.inv_shiftrows(block)
# Add the above function to your custom script file.
# Change the <code>setAnalysisAlgorithm</code> in the script to use your custom functions by making the following call:
#:<pre>leakage_object leak_model = AES128_8bit(AES256_Model)</pre>
# As we did in the 14th round attack, reducing the point range can speed up the attack. For example, to use a smaller range of points, try changing the <code>setPointRange()</code> function call to
#:<pre>self.attack.setPointRange((8000,10990))</pre>
