This document is downloaded from DR‑NTU (https://dr.ntu.edu.sg) Nanyang Technological University, Singapore.

Interceptive side channel attack on AES‑128 wireless communications for IoT applications

Pammu, Ali Akbar; Chong, Kwen‑Siong; Ho, Weng‑Geng; Gwee, Bah Hwee

2016

Pammu, A. A., Chong, K.‑S., Ho, W.‑G., & Gwee, B. H. (2016). Interceptive side channel attack on AES‑128 wireless communications for IoT applications. 2016 IEEE Asia Pacific Conference on Circuits and Systems (APCCAS), 650‑653. https://hdl.handle.net/10356/80478 https://doi.org/10.1109/APCCAS.2016.7804081

© 2016 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. The published version is available at: [https://doi.org/10.1109/APCCAS.2016.7804081].

Downloaded on 27 Sep 2021 00:09:09 SGT Interceptive Side Channel Attack on AES-128 Wireless Communications for IoT Applications Ali Akbar Pammu*, Kwen-Siong Chong, Weng-Geng Ho and Bah-Hwee Gwee School of Electrical and Electronic Engineering Nanyang Technological University, 50 Nanyang Avenue, Singapore 639798 Email: *[email protected]

Abstract–We propose wireless interceptive side-channel Confidential Data attack (SCA) technique to reveal the 16-byte secret of the Internet AES-128 algorithm in wireless communications Transceiver Server through Correlation Electromagnetic Analysis (CEMA) for Internet of Things (IoT) applications. The encrypted wireless communication link is established using two ATmega-processor Sensors Actuators based Arduino boards. There are two key features in our proposed interceptive SCA technique. First, we identify the sensitive modules, which emit significant EM signal (physical leakage information) of the ATmega processor during the Adversary encryption process. The significant EM signals are highly correlated with processed data to reveal the secrete key. Second, we investigate the resistance of AES-128 encryption algorithm Fig. 1: Interceptive of IoT system by Adversary implementation on ATmega processor against CEMA based SCA. The wireless signal is intercepted and correlated with EM The AES algorithm has been proven to be more effective signals generated during the encryption process. Based on our compared with other symmetric algorithm such as Data experimental results, the correlated EM signals leak out at the Encryption Standard (DES) in protecting the plaintext [5]. In three modules - FLASH memory, data bus and SRAM modules 1998, the key of DES (256 possible keys) has been during the encryption process are 101.56 dBµV, 105.34 dBµV successfully broken by brute force attack. In addition, the and 121.79 dBµV respectively. In addition, we perform the AES algorithm can process large block size of plaintext such CEMA attacks on the AES-128 implementation on the ATmega as 128-bit, 192-bit and 256-bit with dissipate low power (i.e. processor and the secret key is successfully revealed at 20,000 in FPGA, dissipate about 10.5mW) and fast process (i.e. EM traces. Keywords–Electromagnetic Attack, Arduino, ATmega, SCA processing 128-bit requires only 50µs) [5]. Therefore, the AES has high potential to be implemented in the future IoT system, particularly at sensor based application with powered I. INTRODUCTION by battery at high-end user systems. Advanced technology, nowadays, enables the integration A physical-attack approach which is known as side- of wireless communication devices with multiple sensors channel attack (SCA) [6] has been reported to successfully which is well-known as Internet-of-Things (IoT). However, extract the secret key of the encryption algorithm by the wireless communication platform used in IoT such as Wi- analyzing the physical parameters and the processed data. Fi, Bluetooth and Radio Frequency (RF) are easily The physical parameters such as power dissipation [7], intercepted by unauthorized party (i.e. adversary) as depicted electromagnetic (EM) interference [8] and timing [9] are in Fig. 1. The intercepted communication can be abused for generated by electronic devices during the encryption another purpose and eventually make the IoT applications process. is the most common SCA where it such as E-Healthcare system [1], Micro Energy Harvesting analyzes the power dissipation profile to extract the secret [2], Smart Building [3] and Vehicle-to-Vehicle (V2V) key. However, power analysis is more invasive compared communication [4] unsecured and vulnerable. In addition, with EM analysis [10]. This is due the adversary is required the adversary is not only able to intercept the communication to modify the circuit in order to obtain a valid power signals but also able to manipulate it. Therefore, the wireless measurement. In this context, the adversary should identify communication in IoT may no longer be trustfully due to the VDD and put the resistor between the VDD and main supply malicious attack. of encrypted devices (i.e. crypto-chip). The current across the In order to address the aforementioned issues, the resistor is measured during the encryption process. wireless communication system in IoT must be capable to Correlation Electromagnetic Analysis (CEMA) is one of the communicate with other devices over an air interface and popular techniques in EM based attack, which is provide privacy and security capabilities. In this context, it is implemented to reveal the secret key of the AES equipped with security module, which can protect the implementation. necessary information sent to and received from an intended The AES-128 algorithm, which processes 128-bit key party. The security module is embedded with encryption size, requires 10 rounds of iterations to encrypt the plaintext algorithm such as Advanced Encryption Standard (AES) into ciphertext. The 10 rounds of iterations make AES-128 which is typically transform the message (i.e. plaintext) into highly effective when compared to other encryption encrypted information (i.e. ciphertext) using a secret key algorithms such as DES and triple-DES (3-DES). However, (known only by intended party). Therefore, any unauthorized due to the leaking of physical parameters correlate with party that intercept the wireless signals is almost impossible intermediate data, the AES-128 implementation may still be to interpret it without the secret key of the cryptographic vulnerable against SCA, particularly against the CEMA algorithms (i.e. AES). attack, as depicted in Fig. 2.

In this section, feature of Arduino based on ATmega EM Sampled EM Traces signal processor (specifically on ATmega328P) is discussed to investigate the possibility of leaking the SCA information.

CEMA attack Secret Key The processor technology is based on 8-bit AVR in which embed on-chip flash memory for program storage. As tabulated in Table I, size of the FLASH memory is 32KB EM Model used to store the program such as AES which occupies only

EM Probe EM Probe Processing

Ciphertext 4KB. Temporary state of 16-byte of each rounds AES (totally AES-128 10 rounds iteration) is stored in data SRAM. The changes of Plaintext Encrypted Ciphertext the value for each state transitions in data SRAM is possible Secret Key Device to be corresponded with the Hamming Distance (HD), EM Fig. 2: General scheme of CEMA based SCA on AES-128 model, which is derived from ciphertext. The switching activities with frequency of 20MHz generates EM signals The SCA on small embedded devices, such as which depends on the value of the processed information. microcontrollers and cryptographic co-processors, are popular nowadays due to its ubiquitous application at high- TABLE I. SPECIFICATION OF ATMEGA PROCESSOR BASED end devices of IoT. However, there are only few literatures ARDUINO ATmega328P and studies of SCA on these systems (i.e. microcontroller and Processor Technology 8-bit AVR programmable chip) due to complexity on the program Operating Voltage 1.8 – 5.5 V implementation. In the near future, there will be high chance Switching Frequency 20MHz to shift towards moving the cryptographic operation to the Power Dissipation* 0.36mW microcontroller, as implemented in IoT, mobile payments FLASH Memory 32Kbyte and host card emulation [10]. EEPROM 1Kbyte SRAM 2Kbyte In this paper, we propose a wireless interceptive SCA *at voltage 1.8V and Frequency 1MHz technique to reveal the secret key of the AES-128 encryption In order to protect the sensitive information, the 8-bit algorithm. There are two key features of our proposed AVR microcontroller is implemented for high-performance wireless interceptive SCA technique. First, we analyze the encryption and decryption engine which can support 128-bit, physical leakage information, the correlated EM signals, of 192-bit and 256-bit as lengths size key for AES. All AVR the processed data generated during the encryption process microcontrollers contain lock mechanisms to prevent reading based on the circuit architecture of the ATmega processor. and copying the program stored in on-chip Flash memory Therefore, our analysis is able to identify the particular [11]. The lock mechanism program is stored in EEPROM. module of the processor leaks the correlated EM signals. The intermediate result of AES, which is the output of each Second, we investigate the resistance of AES-128 encryption round is stored in data SRAM before sending to I/O lines and algorithm in ATmega processor implementation against I/O modules as depicted in Fig. 3. CEMA based SCA. Thus, our investigation is able to evaluate the security level of AES implementation in ATmega processor against CEMA attack. Based on the experimental result, the correlated EM signals, corresponded with the processed data, noticeably leak out at FLASH memory, data bus and SRAM module during the encryption process. In addition, based on CEMA attack, the secret key is successfully revealed by 20,000 EM measurements. This paper is organized as follows. Section II presents the ATmega structure in Arduino for high-end user application. Section III presents the proposed investigation of CEMA attack on Arduino ATmega based on AES-128 implementation. Section IV presents the measurement results and finally, conclusions are drawn in Section V.

II. ATMEGA ARCHITECTURE The basic circuits design architecture of the processor can determine the robustness and resistance against SCA. Cell logic, switching activities, placement and routing of the Fig. 3: Block diagram of 8-bit AVR architecture ATmega328P modules and wiring structure are the key parameters which can potentially leak information out during the encryption The instruction from Flash memory during the encryption process. In the cell logic perspective, the binary input (0 or is sent to 32×8 General Purpose Register (GPR) and 1) can be identified from variant of power dissipation Arithmetic Logic Unit (ALU) to process the temporary stored measurement, hence the attacker can easily identify the information (i.e. plaintext) in the data SRAM. The result of internal processed data of the processor. For the switching the encryption is sent back to data SRAM by overwriting the activities, placement and wiring, its EM signal can be previous result. The interface from GPU and ALU to SRAM identified and measured during the transferred binary value is using data bus 8-bit as well as to the I/O modules. The EM (0 or 1) in the wire. The EM signal generated by the processor of data flowing in data bus is emitted can be corresponded during the encryption is relatively easy to measure by placing with processed data. In this context, the processed data is the EM probe close to the chip. derived from ciphertext by employing HD EM model. The HD EM model is correlated with EM measurement and analyzed both parameters in Personal (PC) as analyze the correct key. Since the ciphertext is more depicted in Fig. 5. accessible than plaintext in practice, the HD model in this context is the changes between input and output of the last round. The key obtained at this round is reversed back using Arduino_1 Ciphertext Arduino_2 reverse expansion key AES to get the original key. Plaintext A_1 A_2 Key AES ADC III. CEMA ON AES-128 BASED ARDUINO IMPLEMENTATION EM Probe The CEMA is the most prevalent type of EM analysis EM Signal PC Ciphertext attack against encrypted devices [8] based on the EM model. CEMA An attacker exploits the correlation between the EM emanation by the device and the intermediate data (EM Fig. 5: CEMA attack scenario on Arduino model) generated during the encryption process. In the AES- The CEMA attack is a byte-based EM analysis attack. 128 encryption process, there are 10 rounds of operations and Each byte of key (sub-key) is estimated by means of 256 at the last round consists of three operations such as S-Box, possible values (1 byte = 8 bits and possibility is 28 = 256), ShiftRow and AddRoundKey (XOR). As depicted in Fig. 4, hence the correct sub-key is one of the 256 sub-key the HD of the input (output of round 9) and the output candidates. The CEMA attack is performed by analyzing the (ciphertext) of the last round (round 10) is obtained to correlation coefficient (,,) of two variables, EM model generate the HD EM model. The correlation coefficient (,,) and EM traces (,), for i = 1, ···, 16 sub-keys, j = 1, based on the correlation between the EM model and the EM ···, 256 sub-key candidates, t = 1, ···, 1000 sampling points, traces can then be determined to reveal the secrete key. as follows:

EM Traces Input ∑,,,(, ) ,, = (1) (Output round 9) ∑ .∑ CEMA attack Key ,, , , S-Box HD EM Model The correct sub-key, i, corresponds to the highest ,, at

ShiftRow Hamming particular sub-key candidate, j, and sampling point of power Distance AES-128 traces, t. For instance, in attacking the first sub-key (i =1),

Last round of Key with 1,000 EM traces (n = 1,000), the highest correlation

coefficient (,, = 0.9) occurs at sampling point 61 (t = 61) Output for sub-key candidate 45 (j = 45), thus the correct first sub- (Ciphertext) key is 45. Fig. 4: CEMA attack is based on HD EM model of the last round AES IV. MEASUREMENT RESULTS The CEMA attack is performed based on the analysis of The experiment is conducted based on two Arduino correlation coefficient. The highest value of correlation microcontrollers, which are implementing AES-128 coefficient occurs at the highest variance (2) of EM traces algorithm. The EM emanation signal of Arduino_1 generated [6]. The variance of EM traces is defined as the distribution during the encryption process is measured and recorded in of the EM emanation generated from different values of the oscilloscope (2.5GS/sec) as depicted in Fig. 6. The encrypted processed intermediate data. Highest variance corresponds to data, ciphertext, intercepted by Arduino_2, which is sent sampled EM traces (sampling points) which have highest from Arduino_1 through wireless communication (i.e. RF). probability of leaking the information of the secret key. The AES-128 algorithm is implemented on Arduino EM microcontroller which are the random plaintext and key pre- measurement programmed in the flash memory. In this context, the AES- Signal 128 is based on T-Table approach [10], where the internal Amplifier operations (i.e. S-Box, MixColumn and ShiftRow) are merged in one Look-Up-Table (LUT), hence the EM Probe implementation dissipates low power and compatible with Arduino_2 high-end user (i.e. IoT application). There are two Arduinos A_1 A_2 employed in this experiment, Arduino_1 to encrypt the Arduino_1 plaintext and send it in the form of ciphertext and Arduino_2 intercepts the ciphertext in wireless communication. Fig. 6: EM measurement of AES-128 based Arduino implementation Our main objective is to reveal the stored and programmed key on unprotected Arduino_1 by analyzing the The encryption process is initiated by loading the ciphertext and the EM signals. In Arduino_1, it requires two plaintext from I/O module to SRAM through data bus 8-bit. sub-modules, AES-128 and RF with A_1, which are Subsequently, the data in the SRAM is processed in 10 round processing the plaintext and the key into a form of ciphertext iterations with the instruction from FLASH memory to GPR and send it through wireless channel. In Arduino_2, the and ALU through data bus 8-bit. During the encryption ciphertext is received by RF antenna A_2 and convert the process, the EM probe is used to detect the EM signal. The analog signal into digital by means of Analog to digital EM probe is carefully place on particular location of the converter (ADC) module. The EM signal is measured module and measure the corresponding EM signals. together with ciphertext during the encryption process and Although the EM is detected on whole surface of the processer as depicted in Fig. 7, however the maximum EM is V. CONCLUSION generated at particular location, which are FLASH memory, We have proposed a wireless interceptive SCA technique SRAM and data bus 8-bit. This is due to the temporary output to reveal the secret key of the AES-128 encryption algorithm which is stored in SRAM from flash memory through data in wireless communications through CEMA for IoT bus 8-bit generate EM during the encryption process. The applications. The physical leakage information, the measurement result EM generated during the encryption correlated EM signals, of the processed data generated during process is tabulated in Table II. The maximum and minimum the encryption process based on the circuit architecture of the of EM for each module is clearly identified during the ATmega processor has been analyzed. Therefore, our encryption. This implies that each module potentially leaks analysis is able to identify the particular module of the information (i.e. secrete key) through EM signal while processor leaks the correlated EM signals. We have also performing the encryption. investigated the resistance of AES-128 encryption algorithm implemented on ATmega processor against CEMA based

EEPROM SCA. Based on the experimental result, the correlated EM

CLOCK signals, corresponded with the processed data, noticeably FLASH leak out at data bus processor and SRAM module during the memory encryption process. In addition, we have performed the CEMA attack against AES-128 algorithm based on ATmega processor implementation and the secret key is successfully

SRAM revealed by 20,000 EM measurements.

ACKNOWLEDGMENT Fig. 7: Layout view of the ATmega328P Oscillator/ Clock control TABLE II. EM MEASUREMENT RESULTS OF MODULES IN ATMEGA328P This research work was supported by Agency for Science, DURING THE ENCRYPTION PROCESS Technology and Research, Singapore, under SERC 2013 Public Sector Research Funding, Grant No: SERC1321202098. The EM measurement authors thank A*STAR for the kind support in funding this research. Module Max Min Difference We also thank Mr. Chua Chung Tah for his help to delayer the (dBµV) (dBµV) ATmega328P, which enable us to analyze the internal architecture. 32×8 GPR 96.74 95.41 1.33 REFERENCES ALU 100.23 96.51 3.72 [1] Boyi Xu, Li Da Xu, Hongming Cai, Cheng Xie, Jingyuan Hu and I/O Modules 85.21 84.27 0.94 Fenglin Bu, "Ubiquitous Data Accessing Method in IoT-Based FLASH Information System for Emergency Medical Services," in IEEE 101.56 96.33 5.23 memory Transactions on Industrial Informatics, vol. 10, no. 2, pp. 1578-1586, Instruction May 2014. 98.63 97.67 0.96 Register [2] R. Gomez Cid-Fuentes, A. Cabellos-Aparicio and E. Alarcon, "Area Model and Dimensioning Guidelines of Multisource Energy Harvesting EEPROM 75.44 70.14 5.3 for Nano–Micro Interface," in IEEE Internet of Things Journal, vol. 3, SRAM 121.79 85.32 36.47 no. 1, pp. 18-26, Feb. 2016. [3] F. Zafari, I. Papapanagiotou and K. Christidis, "Microlocation for 8-bit Data Bus 105.34 95.33 10.01 Internet-of-Things-Equipped Smart Buildings," in IEEE Internet of Things Journal, vol. 3, no. 1, pp. 96-112, Feb. 2016. [4] L. Du and H. Dao, "Information Dissemination Delay in Vehicle-to- The 30,000 random plaintext are processed during the Vehicle Communication Networks in a Traffic Stream," in IEEE encryption process and the corresponding EM signals is Transactions on Intelligent Transportation Systems, vol. 16, no. 1, pp. measured. The SRAM module generate high EM signals and 66-80, Feb. 2015. [5] Ali Akbar Pammu, Kwen-Siong Chong, Kyaw Zwa Lwin Ne and Bah- difference between maximum and maximum EM Hwee Gwee, “High Secured Low Power Multiplexer-LUT Based AES measurement is highest. This implies that the EM signals is S-Box Implementation,” IEEE International Conference on Information highly corresponded with the processed data and vulnerable System Engineering (ICISE) 2016, Los Angeles, Apr 2016, pp. 3-7 against CEMA attacks. In this experiment, the EM [6] P. Kocher, J. Jaffe, and B. Jun, "Differential Power Analysis," in Advances in Cryptology — CRYPTO’ 99. vol. 1666, M. Wiener, Ed., ed: measurement is focused on SRAM module during the Springer Berlin Heidelberg, 1999, pp. 388-397. encryption process. The EM measurement is depicted in Fig. [7] Kwen-Siong Chong et al., "Counteracting differential power analysis: 8(a). The HD EM model is employed in this experiment, Hiding encrypted data from circuit cells," IEEE International measuring the changes of input and output of the last round Conference on Electron Devices and Solid-State Circuits (EDSSC) 2015, Singapore, 2015, pp. 297-300. in SRAM of the AES-128 implementation. The CEMA result [8] Y. Hori, T. Katashita, A. Sasaki and A. Satoh, "SASEBO-GIII: A shows that the secret key is start to reveal at 20,647 EM traces evaluation board equipped with a 28-nm FPGA," The as depicted in Fig. 8(b), where the black and grey color are 1st IEEE Global Conference on Consumer 2012, Tokyo, denoted as correct and the wrong key respectively. 2012, pp. 657-660. [9] B. Coppens, I. Verbauwhede, K. D. Bosschere and B. D. Sutter, "Practical Mitigations for Timing-Based Side-Channel Attacks on Modern x86 Processors," 30th IEEE Symposium on Security and Privacy, Berkeley, CA, 2009, pp. 45-60. [10] J. Balasch, B. Gierlichs, O. Reparaz, and I. Verbauwhede, "DPA, Bitslicing and Masking at 1 GHz," In Cryptographic Hardware and Last round 20.647 Embedded Systems - CHES 2015, Lecture Notes in Computer AES-128 Science 9293, T. GÃneysu, and H. Handschuh (eds.), Springer-Verlag, 5 10 15 20 25 30 Sampling Points EM Traces ×103 pp. 599-619, 2015.

(a) (b) [11] Amel-8271J-AVR-ATmega-Datasheet_11/2015: ATmega48A/ PA/ Fig. 8: (a) EM measurement of AES-128 at SRAM module ATmega328P, 88A/ PA/ 168A/ PA/ 328/P (b) Correlation coefficient vs EM Traces of the secrete key AES-128 key based Arduino implementation