Embedded Cryptography 3

Emmanuel Prouff is a researcher in Applied Cryptography and Embedded Security. He has worked as an expert for ANSSI, France, as well as for major security companies such as IDEMIA and SAFRAN, both to develop secure implementations against physical attacks.Guénaël Renault is Deputy Head of the Hardware Security Lab at ANSSI, France. His research interests include cryptography, algebraic (symbolic) computation and computational number theory.Mattieu Rivain is a researcher and entrepreneur in Cryptography, currently working as CEO at CryptoExperts, France. His research interests include provable security against side-channel attacks, white-box cryptography, zero-knowledge proofs and post-quantum signatures.Colin O'Flynn is Assistant Professor in Embedded Hardware Security at Dalhousie University, Canada. His interests include embedded hardware security, PCB design and prototype construction.

• Preface xiiiEmmanuel PROUFF, Guénaël RENAULT, Matthieu RIVAIN and Colin O'FLYNNPart 1. White-Box Cryptography 1Chapter 1. Introduction to White-Box Cryptography 3Pierre GALISSANT and Louis GOUBIN1.1. Introductory remarks 31.2. Basic notions for white-box cryptography 61.3. Proposed (and broken) solutions 91.4. Generic strategies to build white-box implementations 121.5. Applications of white-box cryptography 151.6. Notes and further references 171.7. References 19Chapter 2. Gray-Box Attacks against White-Box Implementations 23Aleksei UDOVENKO2.1. Introduction 232.2. Specifics of white-box side-channels 242.3. Fault injections 302.4. Exact matching attack 352.5. Linear decoding analysis/algebraic attacks 392.6. Countermeasures against the algebraic attack 432.7. Conclusions 492.8. Notes and further references 502.9. References 50Chapter 3. Tools for White-Box Cryptanalysis 53Philippe TEUWEN3.1. Introduction 533.2. Tracing programs 553.3. Target recognition 573.4. Acquiring traces for side-channel analysis 593.5. Preprocessing traces 613.6. Differential computation analysis 623.7. Linear decoding analysis also known as algebraic attack 643.8. Injecting faults 653.9. Differential fault analysis 673.10. Coping with external encodings 693.11. Conclusion 703.12. Notes and further references 703.13. References 72Chapter 4. Code Obfuscation 73Sebastian SCHRITTWIESER and Stefan KATZENBEISSER4.1. Introduction 734.2. Obfuscation methods 764.3. Attacks against obfuscation 854.4. Application of code obfuscation 874.5. Conclusions 894.6. Notes and further references 894.7. References 90Part 2. Randomness and Key Generation 93Chapter 5. True Random Number Generation 95Viktor FISCHER, Florent BERNARD and Patrick HADDAD5.1. Introduction 955.2. TRNG design 965.3. Randomness and sources of randomness 975.4. Randomness extraction and digitization 1005.5. Post-processing of the raw binary signal 1045.6. Stochastic modeling and entropy rate management of the TRNG 1055.7. TRNG testing and testing strategies 1095.8. Conclusion 1135.9. Notes and further references 1135.10. References 114Chapter 6. Pseudorandom Number Generation 115Jean-René REINHARD and Sylvain RUHAULT6.1. Introduction 1156.2. PRNG with ideal noise source 1166.3. PRNG with imperfect noise sources 1216.4. Standard PRNG with inputs 1256.5. Notes and further references 1286.6. References 129Chapter 7. Prime Number Generation and RSA Keys 131Marc JOYE and Pascal PAILLIER7.1. Introduction 1317.2. Primality testing methods 1337.3. Generation of random units 1337.4. Generation of random primes 1367.5. RSA key generation 1407.6. Exercises 1437.7. Notes and further references 1447.8. References 146Chapter 8. Nonce Generation for Discrete Logarithm-Based Signatures 151Akira TAKAHASHI and Mehdi TIBOUCHI8.1. Introduction 1518.2. The hidden number problem and randomness failures 1538.3. Lattice attacks 1548.4. Fourier transform attack 1608.5. Preventing randomness failures 1668.6. Notes and further references 1678.7. Acknowledgment 1698.8. References 169Chapter 9. Random Error Distributions in Post-Quantum Schemes 173Thomas PREST9.1. Introduction 1739.2. Why post-quantum schemes need random errors 1749.3. Distributions for random errors 1789.4. Sampling algorithms 1849.5. Notes and further references 1939.6. References 197Part 3. Real-World Applications 203Chapter 10. ROCA and Minerva Vulnerabilities 205Jan JANCAR, Petr SVENDA and Marek SYS10.1. The Return of Coppersmith's Attack 20610.2. Minerva 21610.3. References 222Chapter 11. Security of Automotive Systems 225Lennert WOUTERS, Benedikt GIERLICHS and Bart PRENEEL11.1. Introduction 22511.2. The embedded automotive attacker 22611.3. An overview of automotive attacks 22711.4. Application of physical attacks in automotive security 23111.5. Case study: Tesla Model X keyless entry system 23311.6. Conclusion 23711.7. References 237Chapter 12. Practical Full Key Recovery on a Google Titan Security Key 245Laurent IMBERT, Victor LOMNE, Camille MUTCHLER and Thomas ROCHE12.1. Introduction 24512.2. Preliminaries 24612.3. Reverse-engineering and vulnerability of the ECDSA algorithm 24912.4. A key-recovery attack 25212.5. Take-home message 25512.6. References 255Chapter 13. An Introduction to Intentional Electromagnetic Interference Exploitation 257José LOPES ESTEVES13.1. IEMI: history and definition 25713.2. Information security threats related to electromagnetic susceptibility 25913.3. Electromagnetic fault injection 26013.4. Destruction, denial of service 26113.5. Denial of service on radio front-ends 26113.6. Signal injection in communication interfaces 26213.7. Signal injection attacks on sensors and actuators 26213.8. IEMI-covert channel 26313.9. Electromagnetic watermarking 26913.10. Conclusion 27313.11. References 274Chapter 14. Attacking IoT Light Bulbs 279Colin O'FLYNN and Eyal RONEN14.1. Introduction 27914.2. Preliminaries 28014.3. Hardware AES and AES-CTR attacks 28214.4. AES-CCM bootloader attack 28614.5. Application of attack 29314.6. Notes and further references 29414.7. References 295List of Authors 297Index 301Summary of Volume 1 305Summary of Volume 2 313