A Hacker’s Guide to Reducing Side Channel Attack Surfaces Using Deep Learning
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Bursztein, Elie
Picod, Jean-Michel
In recent years, deep-learning based side-channel attacks have been proven to be very effective and opened the door to automated implementation techniques. Building on this line of work, this talk explores how to take the approach a step further and showcases how to leverage the recent advance in AI explainability to quickly assess which parts of the implementation is responsible for the information. Through a concrete set by step example, we will showcase the promise of this approach, its limitations, and how it can be used today.
 Hello, my name is Zerli, I work at Google where I lead the security and anti-abuse research team. Today, with Jean-Michel, who is here in spirit, we're going to tell you how we can use deep learning to reduce such an attack surface. Before getting started, I would like to point out that the results you're about to see are part of a larger project that we do in collaboration with many Googlers and external collaborators around hardening hardware cryptography to create more secure devices. Such an attack is one of the most efficient ways to attack secure hardware because instead of targeting the algorithm, which is usually well understood and well scrutinized, let's say AES, instead, it targets the implementation and the interplay with the given hardware. This is well less scrutinized because A, there is many of them and B, it is way more subtle to understand how side effects of code affect a specific hardware and how that can be exploited by attackers. Here is a concrete example to show you how powerful such an attack are. Back in 2017, researchers were able to recover Bitcoin private keys out of a treasure hardware wallet by using such an attack. They show you that despite the algorithm being well reviewed and the hardware being well understood, the interplay between the two still has some problems that you can exploit through such an attack. From this, different size such an attack are very difficult because they are very hard to debug and fix it. Even if you know you have a such an attack, it's really hard to know where it's coming from and what you can do to fix it. If such an attack are both very important and hard to debug, it means that there is a room for innovation on how to help with the situation. That's where this project comes in. Our idea was maybe we can try to develop new technology to accurately pinpoint the code which is available to such an attack so developers can quickly isolate it and try to improve it and improve the quality of their implementation and be more resilient to such an attack. That was the idea we had. Then the way we went about that was we proposed to use deep learning and dynamic analysis and commiser tool to be able to accurately pinpoint the origin of the leakage which is responsible for which is exploited by a given size such an attack. I know, I know. What you're thinking, you're going to be like, oh my god, one more deep learning talk. Really, it's all going to be all hype and etc. Well, actually no, this talk, as I promised, is a hack and journey. So we want to make it very concrete. What we really want to do today is showcase to you our deep learning tool which we call Skould which stands for such an attack-like detector and how that works in practice. To make it very concrete, today I'm going to show you how we can use Skould to debug Tanias, a very vanilla plain implementation of AS running on a well-known CPU which is the SMT32F4. So we're going to really see in practice today how you can use the technique we developed to isolate a very clear leakage and hopefully by the end of the talk you will have a good understanding of what the tool is about and why it might be useful if you are working in the field of cryptography and hardware crypto or if you are interested in a subject. So with this, how are we going to go about that? First I'm going to briefly detail how Session Attack works. Then we're going to discuss how AI-based Session Attack works because we need those to be able to pinpointer leakage. Then I'm going to tip dive a little bit into what is AI explainability and how you go about explaining what a machine learning is or understand or how it makes a decision. And finally, we're putting everything together. I'll talk to you a little bit about the dynamic analysis part of the project and how we fit all together to pinpointer leakage and I'll show you how it works in practice for the target, our Tanias or SMT32. We can follow along by getting your site as a very list and hopefully link to the code by going to elite.net.com. As I mentioned, the purpose of this talk is to be very practical, done to us on how can you use and how this type of tool works at a high level and how can you use it as a practitioner, not necessarily how you can develop such a technique and how you can research on how to improve it. If this is something you are interested in, we are working on a paper, a research paper which has all the technical details about the expansion technique we use, the benchmarking and alternative and all the good stuff and hopefully the paper will be out shortly by the time you see this recording or will have been already put on archive by the time you see it. Without of the way, what is let us with the copying what section attack are? At its core, a section attack is an indirect measurement of a computation result using an auctionary mechanism. So basically, instead of observing directly the result, we try to infer what it is using a third party way, which is what we call an auctionary mechanism. Section attack are used in many, many ways to attack biased target. Obviously, as discussed in this talk, they are used to recover encryption key out of hardware secure implementation. They also use in Web Security to perform blind disclosure injection when you cannot see the return of a SQL statement on SQL injection. And then they also used into seal password and pins from secure implementation. And they also use, as I mentioned in the early example at the beginning, to recover crypto wallet product keys. Those are only for example of the many way you can use section attack, which is basically when do you need to ever write something you cannot observe section attack is usually the way to go. And it makes up a little bit more concrete for use case. So when you do a computation for crypto, what you do is you feed a plain text and you feed a secret key and the algorithm is running on the CPU. And while it's running, we have some leakage. The first one is how long to computation text. What is not very relevant to AS when you have hardware acceleration? Actually depending on the computation, the time might change depending on the key. That was mostly used for our say a long time ago because our say use exponentiation saying when it's not constant time, it can actually have to recover the key. That's one of the example. But again, timing is probably the computation text. Then we have the one we use in this talk, which is current, of course, depending on the operation you do, depending on how many register you load, how many register you unload, the amount of power consumption will rise from clock to clock. And so that's what we can measure and that's what we can use to infer what is happening. Then we have a third one, which is less used, but it's still possible it is heat, of course, depending on which part of the, which type of operation you do, different part of the CPU will be used and as a result, some part will be hotter than others. But a little bit of arcane, not most rarely used, I think. I haven't seen very much concrete example, but that does exist. But not least, we also have what we call extra magnetic emission, EM. And EM is also a very powerful channel widely used to recover public keys. It is with current probably one of the two most used in section attack timing being also important as I mentioned, but really current and EM is probably like the two leading technologies in the days. What it looks like in practice. So here is a power trace of a AS and if you look carefully in the middle of the slide, you'll see where about 10 times the same pattern and they do correspond to the 10 round of a ES. So you can visually see on a non-protected or very likely protected AS that we can observe the round by just looking at the power trace. If we can observe it at human, it means there are some statistical information there that can be exploited to understand what is happening and that's in a sense, this side-effect that we can use to recover an AS key. In no chair how you go about that. Well, you get a CPU, but the target, to do the encryption. And what you do is you do record while the encryption is performed, the power trace using an oscilloscope. And then in the traditional section attack, the state of the art is called a template attack where you basically combine the traces you observe and you make statistical estimates on what it could be and the statistical estimate will help you to recover your AS key. This is how it works. If you wonder what type of hardware we use, and again, this is what we use, doesn't mean that the best just works for us. We use a new IE chip whisperer pro and for some of our work, however, not this talk, we also use a PicoScope 6000 when we need faster sampling, when the target is very fast and when there are information. So for example, last year, when we took about SCAMM-O, which is a way to do such an attack using machine learning, which we're going to briefly recap in a second, then we do use a PicoScope. For this work, we just use plain old chip whisperers. And again, this is not an ad, this is just happened to be what we use in practice as we want to make this talk as concrete as we can. Now that we have an idea of what a section attack are, let's talk about how you would go about that using AI to perform such an attack. Well, this is something we call a section attack automated with machine learning, also known as CAMO. This is what we did present in depth last year, but let me briefly recap how they work in practice because we're going to need a model that would create using a SCAMM-O attack to do the explainability and then find out what the leak is. If you want to have more detail, by the way, about this type of attack, well, you can check out last year's talk. It's available on my website at edi.net slash camo. I also probably put a link on to Twitter if you want to follow along. And again, you have a lot more detail. I'm going to try to shrink down the explanation as much as I can so you can follow along. But if you want all the detail, there are in the previous talk. I also want to say this year is different from last year, so for people who follow both, in two senses. This time, last year when we talked about using machine learning to attack hardware encryption, we took the worst case, which is we are doing black box attack where we are the attacker, doesn't have any knowledge about the target, and for example, cannot have access to the clock because the clock is usually not accessible after when the key is in or the hardware implementation is in production mode. And so as a result, we were creating trace in an asynchronous manner, which means that the clock of the target and the clock of the oscilloscope were different, which is why we had to use very high sampling rate. In this specific case, we, this year, we are changing the model because this time, it's called is for people who are developing implementation. So we do assume you have the code, you have the hardware target, you can put it in debug mode. And so we don't need to create asynchronous traces, we also have a good idea if your developer at what time I start and what time it ends. So you can also create shorter traces. The reason why to do shorter captures is because machine learning have an easier time if you don't capture the whole thing, because that means spend less time when it train to eliminate part of the trace which is useless. So again, this is a white box attack your model, it makes more sense for that work. However, do not try to compare the model you use in this talk, which are easier and smaller than the one in the previous talk where we had a way harder task for the machine learning, right? So when you're in the black box, the machine learning work harder, which means you have to train more and use more complicated and more deeper architectures. In the case of a white box, when you are really laser focusing on one part of the implementation, so it will be the first round, we don't need that. So way, such an attack assisted by machine learning works is very similar to the traditional such an attack, right? As in the previous case, you have the encryption machine running and then you have, you capture the trace, don't forget that you capture the trace and you store them to normalize them between one and minus one because machine learning actually works in that range, which is not what your traditional oscilloscope will output. And then we feed those traces to a deep neural network and we try to make predictions on what he thinks are the value which can be used to recover the key. And then we combine those with to do a statistical estimate and hopefully you get back to your ASCII. So one of the advantage of that as illustrated last year is that you do not need to do any kind of pre-processing. You can just feed the trace directly and there is less expert knowledge on it, so it's open to place to do that almost automatically. And so that make it a little bit easier and also it's more powerful than in a sense than the traditional template attack because of the reason mentioned. When you do a session and attack, you do not necessarily directly target to recover the key. You target what we call attack point in the case of tiny AS. There are three, two points which works really well, which is a sub byte in which is when you XOR the key with the plain text and there is also the sub byte out which is when you look at the output of the S-box. In this talk, we're going to focus on one of them which is a sub byte in which we know works really well, better than our experience and this is something which is a point. So basically, the machine learning will not predict the key that really doesn't work when you try that but instead going to predict the sub byte in and will basically, if you want to do the real attack, you take the sub byte in and then you have to invert it using the plain text or do another XOR and then you get the key and then you can do your prediction. So the target point today is sub byte in. When the machine learning will predict the sub byte in, what it does is you get a trace and it tells you, okay, it's a softmax, so almost a probabilistic output of 256 value until you which is the most important value but also what you think is the second best value, so best value and so forth and that's what the softmax do. So what you do on how to combine those things, that's why we call it a probabilistic attack is you basically sum them up using lockdown because of finding errors and then you combine them and hopefully by combining them, you get the most likely value and machine learning is correct most of the time, so it will quickly converge. Last year we showed that for 10 years on a full trace, we only need four traces, so you can see, you will see that in the specific settings today where it's even easier while you need less than two. So basically, three, four traces for simple cases, you get the correct value and you have to recover one byte of the key. What's important to mention as well here is we have one model per byte, so we should have 16 bytes which is normal input, we have in reality 16 models which are performing one byte at a time. It is easier for the machine learning to predict one byte at a time, so well, you have to train 16 times. I'm not going to show that on the slide because it's not relevant, if you can wait for one, you can wait for 16, however there are some differences between the byte but that's not too relevant for this talk. For those fractures, this year we used a hyper tuned residual 1D convolution neural network, it's different between this model and last year, this model is way more efficient, it's smaller and I think it's 300,000 points or something, 300,000 neurons per meters. It's way too tuned and it works really well out of the box. This is kind of like our go to model these days, which is based on our previous work and testing a ton and a ton of models. The paper, I said last year it's kind of funny but the paper on all our tests about all the machine learning model will be out at some point, I said last year it will be soon, we have some technical difficulty to make everything reproducible and we have a lot of improvement but hopefully, I'm really hopeful you're not going to be able to use these models and the data set we used to gain our expertise into this will be out and you guys can test it out hopefully in the near future. For Scalel, you need the 16 models because you need to know what is the commonality between all the bytes to know exactly what is the main source of leakage, so you train 16 models. As I mentioned, the accuracy varies, as you can see, you're reaching something, it's a validation accuracy to be clear, so on data which has not been seen during the training, there is something between 63 for the worst one which I think is byte 4 up to 87% for the best one which is byte 0 and again they're all between that. For Scalel, it doesn't really matter, what you need is to be able to isolate enough examples that the machine learning is correct because those are the ones we're going to use for explainability because we want to know what is the model is using when it's correct. That's why we don't train more than that, try to imagine each of them is about I would say 15 to 20 minutes, so you do 3 per hour and you have 16 to go, so you know that's already about 5 hours of training time, so we don't want to do 20 epochs which will be completely overkill. As I said, unsurprisingly because the Taniers is not protected against high channel attacks and our model is really well optimized, we have high accuracy in the variable for all of them. Now, the model is good at extracting the key, so we are able to use it and we can consistently recover keys, now the question is okay, how does it help us to go back and find where the leak is coming from? Well, this is why you need to add another piece which is the learning explainability. So what is the learning explainability? The learning explainability was first developed I believe for vision and the idea was I have a deep learning network and it says in this picture we have a boxer and we have a tiger cat. Now you can ask the question okay but why? Does it really look at the cat, does it really look at the dog or does it look at 36? I don't know, maybe the stripe colors of the tail of the cat or maybe the dog have a leash or something like that. So what you want to do is you want to have a way to ask the neural network what do you look at, right? And that's what explainability is about, is being able to say for a model how does it come up with a given prediction? Why for this specific class I will put one output neuron, what did you use as input and what was input marathon? Right? So it basically almost inverting the machine learning model if you will. And so we call that explainability, there are many techniques but the idea is you, all the techniques have in common that you feed the machine to the model, to the explainer, then you feed the input you would like information about and then you have to tell him which class you want to have an explanation for. This is why as I explained earlier we need first call to have model which work well, not necessarily 99% but at least very well because we need to have example of prediction which are successful because we want to know for a given trace and a successful prediction what to think. So as I mentioned you give it to the explainer, the other side you put the picture we had and we say okay why do you believe it was a boxer and hopefully they will tell you well I look at the face of the puppy and it's a boxer. Okay, that's understandable and you can ask also okay how about the cat? And hopefully and again those are real example out of one of the expansion techniques you will tell you well I look at the cat and the reason why I think it's a cat is because well there is a face of the cat but the most important thing is there are stripes. As you can see the right part of the image and you're like okay that makes sense I guess a cat which have stripes is probably a tiger cat makes sense the machine learning is actually looking at what it should. Was it technique ever useful and the answer is yes absolutely. There is this very very famous data set in machine learning for vision and it's called the path code vocabulary visual vocabulary and what happened was in the early version of this data set I think one picture in five for horses had a top bottom left sorry bottom left name of who took it and what the machine learning learned was not to recognize a horse it was to recognize well that there was something on the bottom left. Alright so that's what the connectivity is for so therefore we would like because essentially what we want to ask the machine learning is given a input and a prediction can you tell me how you figure why it's leaking right where what do you get information to get to the conclusion that the correct key or the current attack point. Well that seems quite in practice just to be quite in theory and we can see what's going the thing is so I don't tell us how we're going to combine this experiment with the next and dynamic analysis to develop leakage right because so far all I explained to you is maybe how we can get some part of the output highlighted that doesn't tell you how you go back to know where the leakage comes from and so that's all the difficulty of school this event and that's why it took us about one year over a year to actually really now don't know how to get that done is because you need to be very creative around how to combine those things which in theory if we make sense to actually get the results you want so let's dive into how you get there. Our game plan was fairly straightforward again we start with an explainer we're going to give it our train models and then we're going to give it the trace and the prediction and say okay please tell me of the trace what are the important points for you to make your prediction we're going to call that the leakage map then we're going to also do run not necessarily after but using power a target emulator which is basically we're going to run our target which is the equivalent CPU in this specific talk the SMT-F4 32F4 and the firmware so in our case a few more which is 10 years and we're going to emulate it to be able to know at which every cycle instruction cycle in the ARM CPU correspond which upcode right so basically we need to know at what time precise point in time a given code instruction was run and then which code instruction was run right and so with that we can combine both of them we can combine the leakage map which are according to machine learning which part at what time the leakage occurred and the emulation which starts at what time each instruction was run to be able to annotate the code which was the leakage at the idea. In practice this is where it becomes complicated there is of course a lot of techniques here is a screenshot here is a figure from one of the recent paper which is called fancy check for scientist map which basically we're looking at how efficient is different type of the chrono busy technique and you can see some of them have more defined output than others in this specific in our research we tried a bunch of them including a guided grad cam which seemed when we started to be giving the most defined and precise leakage and then we tested a bunch of them right and the idea was which technique would work best for us because we want to highlight a very precise which part of the trace was the most important one how you do that well you get the explanation so you run a lot of traces which was successful into the explanation here is the activation map technique then you combine them and you normalize between 0 and 1 to create some sort of a mask and then you eliminate all the noise and hopefully you get the bottom images which is this leakage map and you can see it's tried it here and you can see that some places which are lighter are supposed to be the place where the model is the king's the most so according to activation maps there is I think it's possible by zero the very very early there was a leakage and they were late around the four thousand points so at the end of our traces some leakage right depending on the technique you use you're going to get different results the first one we tested is SNR which is not a deep learning technique but is the standard technique used in traditional attacks to detect whether or not there is a leak so it's a very much a very robust way statistical what would weigh kind of like our baseline so the senior to nose ratio tell you that as you can see there is a main leak and there is a secondary leak somewhere in the middle of the tricycle and then if we look at rad cam plus plus which is one of the latest technique the results are not so clear we have a bunch of different points which doesn't seem to align very well with the SNR or at least they are less different there are some places that are not exactly the same and then the activation map looks almost equivalent to the grad cam that was one of the activation map look at the output of the layer the lowest layer this seems very very much the same so how do you benchmark how good these are so the idea is well we have a leak map right so what we can do is we can take our test traces that we know the machine learning is successful at predicting and then we can decide to use a link made the link map and let's say we move the four point or the eight points which are supposed to be the most important according to leakage map out of the tracks we can just literally blank them blanking them means put them to zero or to minus one put them to zero but some idea you basically remove the information there and hopefully either the most important part of the prediction then the accuracy of the model which you feel it again should result in aggregate to decrease accuracy right the idea is like if you blank out the point which I use by the machine to make the prediction the accuracy should decrease so mechanically the best technique should yield the best decrease baseline as I said 100% because we only used traces you remove four points why four points is because an instruction text when we capture them with the oscilloscope is four points right so each cycle of the CPU is supposed to be four points so if we know that we say okay let's try to remove the most important cycle if we do it with SNR the techniques seems to work right it seems we reduce by 57% and 44% if we do the activation map and it was our first very big disappointment some day the project last year not last year but like a few months back was like oh well does it work that well SNR is better so activation map doesn't work really well and then if you remember I should use that the leakage map almost the same and the result has the same for graph can plus so the idea seems to right to work in the sense that SNR works our deep learning expandability which is way more complicated and should be way better doesn't so that was a little bit disappointing and so it was like back to the drawing board what can we do let's go back to that and so the way we would do went about that is like okay let's write our own technique because what we want is to only find the top point so we can probably do something with a very old idea which is occlusion and try to make it a little bit better so I know it seems weird to say okay let's invent a new technique for specific type but the thing is we are trying to do something very very unique our very precise we don't want to have like the exact region and have more like a holistic understanding we want to have like top five or top 20 points so because our optimization for our technique is different and type of underlying algorithm you want to use is a little bit different we can use occlusion which is literally try to use a window to do that and so skilled explanation technique is actually exactly that it's a hybrid version of occlusion where we start to eliminate large region until we zoom it down to small region and then with convolutions convolutive occlusion which is something we developed for this to actually really pinpoint which part of the trace for the region that we think are predictive which of the point exact point are the most important and as you can see the trace is a way cleaner than the one we had before and they clearly outline leakage also as you can see if we took byte 0 and byte 7 it is clear that byte 0 is before byte 7 for in term of leakage which make a ton of sense because obviously tiny as process one after the other it's not victorized code so that will be exactly what we expect okay so we're like okay trace to the code should work right so go back to the benchmark from the thing and voila the number way better or at least better for byte 7 and so again so now we have a technique which works better our map is more precise so we hope that the leakage will be more precise and just to give you a visual comparison to finish on that side it's very clear that a the SNR is called basically fine both with the same region except the region that better defined with cold which is good because the SNR is not wrong in general and b we have something which is cleaner which means that we have improved over existing set of the art and also finding something completely out of the protocol model so physical model is more precise it was good and so as I said benchmark shows that in every cases as cold actually outperform everything we tested it's not to say there is not a better way but this is working for us and this is good enough as we will see so we tend to favor this thing because it's also quite fast text I don't know about 10 minutes to explain a network okay now that I explained in greater detail how you go from leakage maps how will you go from model to leakage map the question is how you go from leakage map to cold well for that as I mentioned we have an emulator which is based on unicorn and rainbow and basically we run it with a firmware and the CPU and we basically have a state automaton who tries to emulate what's happening during the leakage map but the idea is you want to do a start run the ES it stop and basically pick up what is in sync with the leakage map and then what happens then is you get mapped ESM so what you get is you get okay this cycle maps to this time this this point in the trace map is that cycle that cycle map to this specific CPU instruction and then what we do is when we have a CPU instruction we build a tree and the tree we bubble up the instruction to a given code line using the debug symbol of our firmware the firmware will run both for the firmware the firmware we have is in debug mode again we back to this idea that this is a tool for developers so when you test for leakage you can compile with debug symbol because you don't try to harden it you just want to debug it so when the debug symbol would help us to go back from the instruction back to the line of code and hopefully that gives us an idea of where to map the code so that's a theory but we haven't told you or haven't shown you briefly working practice and the thing is before I do that I want to be on phase three important thing about this project the first one is we spend a lot of time talking about explainability because if we don't have extremely precise explaining technique which exactly out point which exactly pinpoint what point in the trace is responsible for the leakage we're going to fair we're going to fair because most instructions on arm are two maybe three maybe four cycle long at most right not at most but two one to two instruction for an addition since that is standard so it's literally four to eight points like our margin of error is maybe one point but that's about all we get so if we don't have precise mapping then if we map let's say 10 point ahead or if we have a windows of 10 points it's meaningless for us because then it might be three instruction and those instructions might belong to different line of code so basically your analysis is completely botched at the same time we need to have an emulator which is also single cycle precision because what happens is if you do not take into account you say pipeline flush if you don't take into account the cpu pipeline size and things like that you get it wrong you get wrong because you're going to shift everything by let's say you're wrong let's say by one cycle for each addition then your whole traces is completely shifted and then even if your leakage mapping is good you get somewhere in the code which is not relevant so you need cycle precision emulator the cycle precision single point precision explanation so you need something extremely precise this is very very much a precise work and then on top of that you need a bit of computation again as I said you need to generate about a we use a I think a one million data points something like that and then even for the explanation time we use 60 000 traces you need 16 models as I mentioned you can shorten the time of course by using a good model who converge very quickly you need to generate 16 explanations for all those models in your trace and then you need to map everything so with our with our optimizations that will take you a day or so of work and of course as I said most of it is parallel to the board because the 16 model and 16 explanation can be run on distinct CPU right so it's you can make it 16 time faster freely so that's really good because we want to use that as a fast iterative tool for developers all right so at that point you're like okay he gave me a long speech of why it's really hard so probably they failed and that's really really hard because yeah emulating a CPU is hard and I'm telling you it's true I don't think we have perfect emulation of CPU I think we have very precise emulation of the instruction we need for AES in particular one thing we don't have and disclaimer if we don't have implemented mapping for division for divide why is because division is actually takes a lot of cycle and a very different range of cycle on ARM CPU so we don't really know what to do there so that's only working for now for AES in full transparency that being said if we try to apply what I said to our model what we expect to see in the theoretical sense is we supposed to is the model is targeting sub-ighting then it must exploit something in the add one key because add one key is where you do the key extort the plain text so it must have most of the mainly case should be there so there's a very cool thing and so what we do to verify that what we said it works is to actually try to verify that and so that's what the schedule output looks like it's a terminal thing you basically run it and at the end you spit out this as I said tree which map cycle instruction which is now displayed for visibility to codeline which is basically the numbers and then I filter everything which is not leaking and then what this mapping tell you is yes the main leakage is online 213 of add one key so that's promising it also have interestingly enough a signal leakage which is later on into the cipher functions so what is the line 2013 right well the good news is it's exactly what we predicted this is exactly the line in the whole code that you can find on github which is exactly where the key is xor with the plain text so the model and it's called in general we clearly is using what a terrible predict which is there is a leak in that specific line because they are doing just they are sending the values register there's some assignation some assignment sorry and so this is what is so that's a success that's what gives us confidence that what we do works in practice it's not a it's really giving us interesting result I will not claim it's works in every case I'm sure that with more complex implementation like mass as or more complicated security the result might be drastically different as I said our military do not fully emulate all the operation it can do on arm there is still a lot of uncertainty but however it works I think it's a very promising step towards the right direction of having tool who go back from leakage to exact line of code as far as we can see out the first time it has never been done by secondary leakage I don't have a good explanation for it so best thing we can come up I can come with today is that it probably when some of the register are unloaded and so this is where it's started with a mixed column if you look at line 371 so maybe that's what happened is it's unloading some of the registers and then we'll go back we did a bit more analysis for that but basically it would be interesting to know why there is another leakage so hopefully today I showed you how we use caddler to automatically isolate the noble code and show you how it works in practice and show you completely what is the benefit of the tool and really our hope is this type of tool we keep building it and we get feedback from the community to build something which will empower people who develop secure hardware to quickly figure out and patch where the leakage are coming from so we can develop stronger crypto in an easier way and faster iterations so we all benefit from stronger more secure devices and take a look at the talk as I said as we discussed last year machine learning is a way to automate session attack and you reach out of the earth with it so it's really one of the most it's at the forefront of session attack and this year we flipped the use case on its head which is really what was in terms of the project from the onset two years ago which is to try to use all those knowledge to actually have developer building better tooling for them to reduce the cost of developing secure implementation and make them better so I've been said this is very very new field very exciting field with a lot of ideas a lot of energy around it and it can really use more interest more people interested in it so if you have some interest into crypto a bit of machine learning it's a great time to get in and work with the community on this type of ideas thank you so much for attending this virtual talk I wish it would be in person I'm going to miss DevCon as you will probably do I hope you are aware and if you would like to follow up and keep up with what we're doing we try to publish as fast as we can modulo some delay to provide you information about what we do on session attacks on the website hopefully we'll have a new future project website in the future as well thank you so much for listening to this talk and then do not hesitate to reach out on twitter or by email or any other main happy to answer questions thank you so much bye
 Hello, my name is Zerli, I work at Google where I lead the security and anti-abuse research  team.  Today, with Jean-Michel, who is here in spirit, we're going to tell you how we can use deep  learning to reduce such an attack surface.  Before getting started, I would like to point out that the results you're about to see are  part of a larger project that we do in collaboration with many Googlers and external collaborators  around hardening hardware cryptography to create more secure devices.  Such an attack is one of the most efficient ways to attack secure hardware because instead  of targeting the algorithm, which is usually well understood and well scrutinized, let's  say AES, instead, it targets the implementation and the interplay with the given hardware.  This is well less scrutinized because A, there is many of them and B, it is way more subtle  to understand how side effects of code affect a specific hardware and how that can be exploited  by attackers.  Here is a concrete example to show you how powerful such an attack are.  Back in 2017, researchers were able to recover Bitcoin private keys out of a treasure hardware  wallet by using such an attack.  They show you that despite the algorithm being well reviewed and the hardware being well  understood, the interplay between the two still has some problems that you can exploit  through such an attack.  From this, different size such an attack are very difficult because they are very hard  to debug and fix it.  Even if you know you have a such an attack, it's really hard to know where it's coming  from and what you can do to fix it.  If such an attack are both very important and hard to debug, it means that there is  a room for innovation on how to help with the situation.  That's where this project comes in.  Our idea was maybe we can try to develop new technology to accurately pinpoint the code  which is available to such an attack so developers can quickly isolate it and try to improve  it and improve the quality of their implementation and be more resilient to such an attack.  That was the idea we had.  Then the way we went about that was we proposed to use deep learning and dynamic analysis  and commiser tool to be able to accurately pinpoint the origin of the leakage which is  responsible for which is exploited by a given size such an attack.  I know, I know.  What you're thinking, you're going to be like, oh my god, one more deep learning talk.  Really, it's all going to be all hype and etc.  Well, actually no, this talk, as I promised, is a hack and journey.  So we want to make it very concrete.  What we really want to do today is showcase to you our deep learning tool which we call  Skould which stands for such an attack-like detector and how that works in practice.  To make it very concrete, today I'm going to show you how we can use Skould to debug  Tanias, a very vanilla plain implementation of AS running on a well-known CPU which is  the SMT32F4.  So we're going to really see in practice today how you can use the technique we developed  to isolate a very clear leakage and hopefully by the end of the talk you will have a good  understanding of what the tool is about and why it might be useful if you are working in  the field of cryptography and hardware crypto or if you are interested in a subject.  So with this, how are we going to go about that?  First I'm going to briefly detail how Session Attack works.  Then we're going to discuss how AI-based Session Attack works because we need those to be able  to pinpointer leakage.  Then I'm going to tip dive a little bit into what is AI explainability and how you go about  explaining what a machine learning is or understand or how it makes a decision.  And finally, we're putting everything together.  I'll talk to you a little bit about the dynamic analysis part of the project and how we fit  all together to pinpointer leakage and I'll show you how it works in practice for the  target, our Tanias or SMT32.  We can follow along by getting your site as a very list and hopefully link to the code  by going to elite.net.com.  As I mentioned, the purpose of this talk is to be very practical, done to us on how can  you use and how this type of tool works at a high level and how can you use it as a practitioner,  not necessarily how you can develop such a technique and how you can research on how  to improve it.  If this is something you are interested in, we are working on a paper, a research paper  which has all the technical details about the expansion technique we use, the benchmarking  and alternative and all the good stuff and hopefully the paper will be out shortly by  the time you see this recording or will have been already put on archive by the time you  see it.  Without of the way, what is let us with the copying what section attack are?  At its core, a section attack is an indirect measurement of a computation result using  an auctionary mechanism.  So basically, instead of observing directly the result, we try to infer what it is using  a third party way, which is what we call an auctionary mechanism.  Section attack are used in many, many ways to attack biased target.  Obviously, as discussed in this talk, they are used to recover encryption key out of  hardware secure implementation.  They also use in Web Security to perform blind disclosure injection when you cannot see the  return of a SQL statement on SQL injection.  And then they also used into seal password and pins from secure implementation.  And they also use, as I mentioned in the early example at the beginning, to recover crypto  wallet product keys.  Those are only for example of the many way you can use section attack, which is basically  when do you need to ever write something you cannot observe section attack is usually  the way to go.  And it makes up a little bit more concrete for use case.  So when you do a computation for crypto, what you do is you feed a plain text and you feed  a secret key and the algorithm is running on the CPU.  And while it's running, we have some leakage.  The first one is how long to computation text.  What is not very relevant to AS when you have hardware acceleration?  Actually depending on the computation, the time might change depending on the key.  That was mostly used for our say a long time ago because our say use exponentiation saying  when it's not constant time, it can actually have to recover the key.  That's one of the example.  But again, timing is probably the computation text.  Then we have the one we use in this talk, which is current, of course, depending on the  operation you do, depending on how many register you load, how many register you unload, the  amount of power consumption will rise from clock to clock.  And so that's what we can measure and that's what we can use to infer what is happening.  Then we have a third one, which is less used, but it's still possible it is heat, of course,  depending on which part of the, which type of operation you do, different part of the  CPU will be used and as a result, some part will be hotter than others.  But a little bit of arcane, not most rarely used, I think.  I haven't seen very much concrete example, but that does exist.  But not least, we also have what we call extra magnetic emission, EM.  And EM is also a very powerful channel widely used to recover public keys.  It is with current probably one of the two most used in section attack timing being also  important as I mentioned, but really current and EM is probably like the two leading technologies  in the days.  What it looks like in practice.  So here is a power trace of a AS and if you look carefully in the middle of the slide,  you'll see where about 10 times the same pattern and they do correspond to the 10 round of  a ES.  So you can visually see on a non-protected or very likely protected AS that we can observe  the round by just looking at the power trace.  If we can observe it at human, it means there are some statistical information there that  can be exploited to understand what is happening and that's in a sense, this side-effect that  we can use to recover an AS key.  In no chair how you go about that.  Well, you get a CPU, but the target, to do the encryption.  And what you do is you do record while the encryption is performed, the power trace using  an oscilloscope.  And then in the traditional section attack, the state of the art is called a template  attack where you basically combine the traces you observe and you make statistical estimates  on what it could be and the statistical estimate will help you to recover your AS key.  This is how it works.  If you wonder what type of hardware we use, and again, this is what we use, doesn't mean  that the best just works for us.  We use a new IE chip whisperer pro and for some of our work, however, not this talk, we  also use a PicoScope 6000 when we need faster sampling, when the target is very fast and  when there are information.  So for example, last year, when we took about SCAMM-O, which is a way to do such an attack  using machine learning, which we're going to briefly recap in a second, then we do use  a PicoScope.  For this work, we just use plain old chip whisperers.  And again, this is not an ad, this is just happened to be what we use in practice as we  want to make this talk as concrete as we can.  Now that we have an idea of what a section attack are, let's talk about how you would  go about that using AI to perform such an attack.  Well, this is something we call a section attack automated with machine learning, also  known as CAMO.  This is what we did present in depth last year, but let me briefly recap how they work  in practice because we're going to need a model that would create using a SCAMM-O attack  to do the explainability and then find out what the leak is.  If you want to have more detail, by the way, about this type of attack, well, you can check  out last year's talk.  It's available on my website at edi.net slash camo.  I also probably put a link on to Twitter if you want to follow along.  And again, you have a lot more detail.  I'm going to try to shrink down the explanation as much as I can so you can follow along.  But if you want all the detail, there are in the previous talk.  I also want to say this year is different from last year, so for people who follow both,  in two senses.  This time, last year when we talked about using machine learning to attack hardware encryption,  we took the worst case, which is we are doing black box attack where we are the attacker,  doesn't have any knowledge about the target, and for example, cannot have access to the  clock because the clock is usually not accessible after when the key is in or the hardware implementation  is in production mode.  And so as a result, we were creating trace in an asynchronous manner, which means that  the clock of the target and the clock of the oscilloscope were different, which is why  we had to use very high sampling rate.  In this specific case, we, this year, we are changing the model because this time, it's  called is for people who are developing implementation.  So we do assume you have the code, you have the hardware target, you can put it in debug  mode.  And so we don't need to create asynchronous traces, we also have a good idea if your developer  at what time I start and what time it ends.  So you can also create shorter traces.  The reason why to do shorter captures is because machine learning have an easier time if you  don't capture the whole thing, because that means spend less time when it train to eliminate  part of the trace which is useless.  So again, this is a white box attack your model, it makes more sense for that work.  However, do not try to compare the model you use in this talk, which are easier and smaller  than the one in the previous talk where we had a way harder task for the machine learning,  right?  So when you're in the black box, the machine learning work harder, which means you have  to train more and use more complicated and more deeper architectures.  In the case of a white box, when you are really laser focusing on one part of the implementation,  so it will be the first round, we don't need that.  So way, such an attack assisted by machine learning works is very similar to the traditional  such an attack, right?  As in the previous case, you have the encryption machine running and then you have, you capture  the trace, don't forget that you capture the trace and you store them to normalize them  between one and minus one because machine learning actually works in that range, which  is not what your traditional oscilloscope will output.  And then we feed those traces to a deep neural network and we try to make predictions on what  he thinks are the value which can be used to recover the key.  And then we combine those with to do a statistical estimate and hopefully you get back to your  ASCII.  So one of the advantage of that as illustrated last year is that you do not need to do any  kind of pre-processing.  You can just feed the trace directly and there is less expert knowledge on it, so it's open  to place to do that almost automatically.  And so that make it a little bit easier and also it's more powerful than in a sense than  the traditional template attack because of the reason mentioned.  When you do a session and attack, you do not necessarily directly target to recover the  key.  You target what we call attack point in the case of tiny AS.  There are three, two points which works really well, which is a sub byte in which is when  you XOR the key with the plain text and there is also the sub byte out which is when you  look at the output of the S-box.  In this talk, we're going to focus on one of them which is a sub byte in which we know  works really well, better than our experience and this is something which is a point.  So basically, the machine learning will not predict the key that really doesn't work when  you try that but instead going to predict the sub byte in and will basically, if you  want to do the real attack, you take the sub byte in and then you have to invert it using  the plain text or do another XOR and then you get the key and then you can do your prediction.  So the target point today is sub byte in.  When the machine learning will predict the sub byte in, what it does is you get a trace  and it tells you, okay, it's a softmax, so almost a probabilistic output of 256 value  until you which is the most important value but also what you think is the second best  value, so best value and so forth and that's what the softmax do.  So what you do on how to combine those things, that's why we call it a probabilistic attack  is you basically sum them up using lockdown because of finding errors and then you combine  them and hopefully by combining them, you get the most likely value and machine learning  is correct most of the time, so it will quickly converge.  Last year we showed that for 10 years on a full trace, we only need four traces, so  you can see, you will see that in the specific settings today where it's even easier while  you need less than two.  So basically, three, four traces for simple cases, you get the correct value and you have  to recover one byte of the key.  What's important to mention as well here is we have one model per byte, so we should  have 16 bytes which is normal input, we have in reality 16 models which are performing  one byte at a time.  It is easier for the machine learning to predict one byte at a time, so well, you have to train  16 times.  I'm not going to show that on the slide because it's not relevant, if you can wait for one,  you can wait for 16, however there are some differences between the byte but that's not  too relevant for this talk.  For those fractures, this year we used a hyper tuned residual 1D convolution neural network,  it's different between this model and last year, this model is way more efficient, it's  smaller and I think it's 300,000 points or something, 300,000 neurons per meters.  It's way too tuned and it works really well out of the box.  This is kind of like our go to model these days, which is based on our previous work  and testing a ton and a ton of models.  The paper, I said last year it's kind of funny but the paper on all our tests about all the  machine learning model will be out at some point, I said last year it will be soon, we  have some technical difficulty to make everything reproducible and we have a lot of improvement  but hopefully, I'm really hopeful you're not going to be able to use these models and the  data set we used to gain our expertise into this will be out and you guys can test it  out hopefully in the near future.  For Scalel, you need the 16 models because you need to know what is the commonality between  all the bytes to know exactly what is the main source of leakage, so you train 16 models.  As I mentioned, the accuracy varies, as you can see, you're reaching something, it's a  validation accuracy to be clear, so on data which has not been seen during the training,  there is something between 63 for the worst one which I think is byte 4 up to 87% for  the best one which is byte 0 and again they're all between that.  For Scalel, it doesn't really matter, what you need is to be able to isolate enough examples  that the machine learning is correct because those are the ones we're going to use for  explainability because we want to know what is the model is using when it's correct.  That's why we don't train more than that, try to imagine each of them is about I would  say 15 to 20 minutes, so you do 3 per hour and you have 16 to go, so you know that's  already about 5 hours of training time, so we don't want to do 20 epochs which will  be completely overkill.  As I said, unsurprisingly because the Taniers is not protected against high channel attacks  and our model is really well optimized, we have high accuracy in the variable for all  of them.  Now, the model is good at extracting the key, so we are able to use it and we can consistently  recover keys, now the question is okay, how does it help us to go back and find where  the leak is coming from?  Well, this is why you need to add another piece which is the learning explainability.  So what is the learning explainability?  The learning explainability was first developed I believe for vision and the idea was I have  a deep learning network and it says in this picture we have a boxer and we have a tiger  cat.  Now you can ask the question okay but why?  Does it really look at the cat, does it really look at the dog or does it look at 36?  I don't know, maybe the stripe colors of the tail of the cat or maybe the dog have a leash  or something like that.  So what you want to do is you want to have a way to ask the neural network what do you  look at, right?  And that's what explainability is about, is being able to say for a model how does it  come up with a given prediction?  Why for this specific class I will put one output neuron, what did you use as input and  what was input marathon?  Right?  So it basically almost inverting the machine learning model if you will.  And so we call that explainability, there are many techniques but the idea is you, all  the techniques have in common that you feed the machine to the model, to the explainer,  then you feed the input you would like information about and then you have to tell him which class  you want to have an explanation for.  This is why as I explained earlier we need first call to have model which work well,  not necessarily 99% but at least very well because we need to have example of prediction  which are successful because we want to know for a given trace and a successful prediction  what to think.  So as I mentioned you give it to the explainer, the other side you put the picture we had  and we say okay why do you believe it was a boxer and hopefully they will tell you well  I look at the face of the puppy and it's a boxer.  Okay, that's understandable and you can ask also okay how about the cat?  And hopefully and again those are real example out of one of the expansion techniques you  will tell you well I look at the cat and the reason why I think it's a cat is because  well there is a face of the cat but the most important thing is there are stripes.  As you can see the right part of the image and you're like okay that makes sense I guess  a cat which have stripes is probably a tiger cat makes sense the machine learning is actually  looking at what it should.  Was it technique ever useful and the answer is yes absolutely.  There is this very very famous data set in machine learning for vision and it's called  the path code vocabulary visual vocabulary and what happened was in the early version  of this data set I think one picture in five for horses had a top bottom left sorry bottom  left name of who took it and what the machine learning learned was not to recognize a horse  it was to recognize well that there was something on the bottom left.  Alright so that's what the connectivity is for so therefore we would like because essentially  what we want to ask the machine learning is given a input and a prediction can you tell  me how you figure why it's leaking right where what do you get information to get to the  conclusion that the correct key or the current attack point.  Well that seems quite in practice just to be quite in theory and we can see what's going  the thing is so I don't tell us how we're going to combine this experiment with the  next and dynamic analysis to develop leakage right because so far all I explained to you  is maybe how we can get some part of the output highlighted that doesn't tell you how you  go back to know where the leakage comes from and so that's all the difficulty of school  this event and that's why it took us about one year over a year to actually really now  don't know how to get that done is because you need to be very creative around how to  combine those things which in theory if we make sense to actually get the results you  want so let's dive into how you get there.  Our game plan was fairly straightforward again we start with an explainer we're going to  give it our train models and then we're going to give it the trace and the prediction and  say okay please tell me of the trace what are the important points for you to make your  prediction we're going to call that the leakage map then we're going to also do run not necessarily  after but using power a target emulator which is basically we're going to run our target  which is the equivalent CPU in this specific talk the SMT-F4 32F4 and the firmware so in  our case a few more which is 10 years and we're going to emulate it to be able to know  at which every cycle instruction cycle in the ARM CPU correspond which upcode right  so basically we need to know at what time precise point in time a given code instruction  was run and then which code instruction was run right and so with that we can combine  both of them we can combine the leakage map which are according to machine learning which  part at what time the leakage occurred and the emulation which starts at what time each  instruction was run to be able to annotate the code which was the leakage at the idea.  In practice this is where it becomes complicated there is of course a lot of techniques here  is a screenshot here is a figure from one of the recent paper which is called fancy  check for scientist map which basically we're looking at how efficient is different type  of the chrono busy technique and you can see some of them have more defined output than  others in this specific in our research we tried a bunch of them including a guided grad  cam which seemed when we started to be giving the most defined and precise leakage and then  we tested a bunch of them right and the idea was which technique would work best for us  because we want to highlight a very precise which part of the trace was the most important  one how you do that well you get the explanation so you run a lot of traces which was successful  into the explanation here is the activation map technique then you combine them and you  normalize between 0 and 1 to create some sort of a mask and then you eliminate all the noise  and hopefully you get the bottom images which is this leakage map and you can see it's  tried it here and you can see that some places which are lighter are supposed to be the place  where the model is the king's the most so according to activation maps there is I think  it's possible by zero the very very early there was a leakage and they were late around  the four thousand points so at the end of our traces some leakage right depending on the  technique you use you're going to get different results the first one we tested is SNR which  is not a deep learning technique but is the standard technique used in traditional attacks  to detect whether or not there is a leak so it's a very much a very robust way statistical  what would weigh kind of like our baseline so the senior to nose ratio tell you that  as you can see there is a main leak and there is a secondary leak somewhere in the middle  of the tricycle and then if we look at rad cam plus plus which is one of the latest technique  the results are not so clear we have a bunch of different points which doesn't seem to  align very well with the SNR or at least they are less different there are some places  that are not exactly the same and then the activation map looks almost equivalent to  the grad cam that was one of the activation map look at the output of the layer the lowest  layer this seems very very much the same so how do you benchmark how good these are so  the idea is well we have a leak map right so what we can do is we can take our test  traces that we know the machine learning is successful at predicting and then we can decide  to use a link made the link map and let's say we move the four point or the eight points  which are supposed to be the most important according to leakage map out of the tracks  we can just literally blank them blanking them means put them to zero or to minus one  put them to zero but some idea you basically remove the information there and hopefully  either the most important part of the prediction then the accuracy of the model which you feel  it again should result in aggregate to decrease accuracy right the idea is like if you blank  out the point which I use by the machine to make the prediction the accuracy should decrease  so mechanically the best technique should yield the best decrease baseline as I said  100% because we only used traces you remove four points why four points is because an  instruction text when we capture them with the oscilloscope is four points right so each  cycle of the CPU is supposed to be four points so if we know that we say okay let's try to  remove the most important cycle if we do it with SNR the techniques seems to work right  it seems we reduce by 57% and 44% if we do the activation map and it was our first very  big disappointment some day the project last year not last year but like a few months back  was like oh well does it work that well SNR is better so activation map doesn't work really  well and then if you remember I should use that the leakage map almost the same and the  result has the same for graph can plus so the idea seems to right to work in the sense  that SNR works our deep learning expandability which is way more complicated and should be  way better doesn't so that was a little bit disappointing and so it was like back to the  drawing board what can we do let's go back to that and so the way we would do went about  that is like okay let's write our own technique because what we want is to only find the top  point so we can probably do something with a very old idea which is occlusion and try  to make it a little bit better so I know it seems weird to say okay let's invent a new  technique for specific type but the thing is we are trying to do something very very unique  our very precise we don't want to have like the exact region and have more like a holistic  understanding we want to have like top five or top 20 points so because our optimization for  our technique is different and type of underlying algorithm you want to use is a little bit different  we can use occlusion which is literally try to use a window to do that and so skilled explanation  technique is actually exactly that it's a hybrid version of occlusion where we start to eliminate  large region until we zoom it down to small region and then with convolutions  convolutive occlusion which is something we developed for this to actually really pinpoint  which part of the trace for the region that we think are predictive which of the point exact  point are the most important and as you can see the trace is a way cleaner than the one we had before  and they clearly outline leakage also as you can see if we took byte 0 and byte 7 it is clear  that byte 0 is before byte 7 for in term of leakage which make a ton of sense because obviously  tiny as process one after the other it's not victorized code so that will be exactly what we expect  okay so we're like okay trace to the code should work right so go back to the benchmark from the  thing and voila the number way better or at least better for byte 7 and so again so now we have a  technique which works better our map is more precise so we hope that the leakage will be more  precise and just to give you a visual comparison to finish on that side it's very clear that a  the SNR is called basically fine both with the same region except the region that better defined  with cold which is good because the SNR is not wrong in general and b we have something which  is cleaner which means that we have improved over existing set of the art and also finding  something completely out of the protocol model so physical model is more precise it was good  and so as I said benchmark shows that in every cases as cold actually outperform everything we  tested it's not to say there is not a better way but this is working for us and this is good enough  as we will see so we tend to favor this thing because it's also quite fast text I don't know  about 10 minutes to explain a network okay now that I explained in greater detail how you go from  leakage maps how will you go from model to leakage map the question is how you go from leakage map  to cold well for that as I mentioned we have an emulator which is based on unicorn and rainbow  and basically we run it with a firmware and the CPU and we basically have a state automaton  who tries to emulate what's happening during the leakage map but the idea is you want to do  a start run the ES it stop and basically pick up what is in sync with the leakage map  and then what happens then is you get mapped ESM so what you get is you get okay this cycle  maps to this time this this point in the trace map is that cycle that cycle map to this specific  CPU instruction and then what we do is when we have a CPU instruction we build a tree and the  tree we bubble up the instruction to a given code line using the debug symbol of our firmware  the firmware will run both for the firmware the firmware we have is in debug mode again we back  to this idea that this is a tool for developers so when you test for leakage you can compile  with debug symbol because you don't try to harden it you just want to debug it so when  the debug symbol would help us to go back from the instruction back to the line of code and  hopefully that gives us an idea of where to map the code so that's a theory but we haven't told you  or haven't shown you briefly working practice and the thing is before I do that I want to  be on phase three important thing about this project the first one is we spend a lot of time  talking about explainability because if we don't have extremely precise explaining technique  which exactly out point which exactly pinpoint what point in the trace  is responsible for the leakage we're going to fair we're going to fair because most instructions  on arm are two maybe three maybe four cycle long at most right not at most but two one to two  instruction for an addition since that is standard so it's literally four to eight points like our  margin of error is maybe one point but that's about all we get so if we don't have precise mapping  then if we map let's say 10 point ahead or if we have a windows of 10 points it's meaningless for  us because then it might be three instruction and those instructions might belong to different  line of code so basically your analysis is completely botched at the same time we need to  have an emulator which is also single cycle precision because what happens is if you do not  take into account you say pipeline flush if you don't take into account the cpu pipeline size and  things like that you get it wrong you get wrong because you're going to shift everything by let's  say you're wrong let's say by one cycle for each addition then your whole traces is completely  shifted and then even if your leakage mapping is good you get somewhere in the code which is not  relevant so you need cycle precision emulator the cycle precision single point precision explanation  so you need something extremely precise this is very very much a precise work and then on top of  that you need a bit of computation again as I said you need to generate about a we use a I think  a one million data points something like that and then even for the explanation time we use 60 000  traces you need 16 models as I mentioned you can shorten the time of course by using a good model  who converge very quickly you need to generate 16 explanations for all those models in your trace  and then you need to map everything so with our with our optimizations that will take you  a day or so of work and of course as I said most of it is parallel to the board because the 16 model  and 16 explanation can be run on distinct CPU right so it's you can make it 16 time faster  freely so that's really good because we want to use that as a fast iterative tool for developers  all right so at that point you're like okay he gave me a long speech of why it's really hard so  probably they failed and that's really really hard because yeah emulating a CPU is hard and I'm  telling you it's true I don't think we have perfect emulation of CPU I think we have very precise  emulation of the instruction we need for AES in particular one thing we don't have and disclaimer  if we don't have implemented mapping for division for divide why is because division is actually  takes a lot of cycle and a very different range of cycle on ARM CPU so we don't really know what to  do there so that's only working for now for AES in full transparency that being said if we try to  apply what I said to our model what we expect to see in the theoretical sense is we supposed to  is the model is targeting sub-ighting then it must exploit something in the add one key because  add one key is where you do the key extort the plain text so it must have most of the mainly  case should be there so there's a very cool thing and so what we do to verify that what we said it  works is to actually try to verify that and so that's what the schedule output looks like it's a  terminal thing you basically run it and at the end you spit out this as I said tree which map  cycle instruction which is now displayed for visibility to codeline which is basically the  numbers and then I filter everything which is not leaking and then what this mapping tell you is yes  the main leakage is online 213 of add one key so that's promising it also have interestingly enough  a signal leakage which is later on into the cipher functions so what is the line 2013 right  well the good news is it's exactly what we predicted this is exactly the line in the whole code  that you can find on github which is exactly where the key is xor with the plain text so  the model and it's called in general we clearly is using what a terrible predict which is there is  a leak in that specific line because they are doing just they are sending the values register  there's some assignation some assignment sorry and so this is what is so that's a success that's  what gives us confidence that what we do works in practice it's not a it's really giving us  interesting result I will not claim it's works in every case I'm sure that with more complex  implementation like mass as or more complicated security the result might be drastically different  as I said our military do not fully emulate all the operation it can do on arm there is  still a lot of uncertainty but however it works I think it's a very promising step towards the  right direction of having tool who go back from leakage to exact line of code as far as we can  see out the first time it has never been done by secondary leakage I don't have a good explanation  for it so best thing we can come up I can come with today is that it probably when some of the  register are unloaded and so this is where it's started with a mixed column if you look at line  371 so maybe that's what happened is it's unloading some of the registers and then we'll go back  we did a bit more analysis for that but basically it would be interesting to know why there is  another leakage so hopefully today I showed you how we use caddler to automatically isolate  the noble code and show you how it works in practice and show you completely what is the  benefit of the tool and really our hope is this type of tool we keep building it and we get feedback  from the community to build something which will empower people who develop secure hardware to quickly  figure out and patch where the leakage are coming from so we can develop stronger crypto  in an easier way and faster iterations so we all benefit from stronger more secure devices  and take a look at the talk as I said as we discussed last year machine learning is a way  to automate session attack and you reach out of the earth with it so it's really one of the most  it's at the forefront of session attack and this year we flipped the use case on its head  which is really what was in terms of the project from the onset two years ago which is to try to  use all those knowledge to actually have developer building better tooling for them to reduce the  cost of developing secure implementation and make them better so I've been said this is very very  new field very exciting field with a lot of ideas a lot of energy around it and it can really use  more interest more people interested in it so if you have some interest into crypto a bit of  machine learning it's a great time to get in and work with the community on this type of ideas  thank you so much for attending this virtual talk I wish it would be in person I'm going to miss  DevCon as you will probably do I hope you are aware and if you would like to follow up and keep up  with what we're doing we try to publish as fast as we can modulo some delay to provide you information  about what we do on session attacks on the website hopefully we'll have a new future project website  in the future as well thank you so much for listening to this talk and then do not hesitate to  reach out on twitter or by email or any other main happy to answer questions thank you so much bye
DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_0_119.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_120_863.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_864_1571.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_1572_2243.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_2244_2627.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_2628_3443.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_3444_3827.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_3828_4091.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_4092_5483.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_5484_6227.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_6228_6731.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_6732_7715.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_7716_7859.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_7860_8327.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_8328_12167.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_12168_13247.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_13248_14003.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_14004_15119.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_15120_15347.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_15348_15551.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_15552_15935.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_15936_19535.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_19536_21311.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_21312_22667.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_22668_24911.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_24912_26459.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_26460_28151.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_28152_28487.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_28488_28847.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_28848_28979.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_28980_29867.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_29868_30143.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_30144_30359.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_30360_31859.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_31860_32639.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_32640_32711.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_32712_34043.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_34044_34091.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_34092_34631.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_34632_35135.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_35136_37235.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_37236_38147.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_38148_38447.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_38448_39707.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_39708_40451.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_40452_41291.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_41292_44231.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_44232_44459.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_44460_45407.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_45408_47327.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_47328_47603.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_47604_48395.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_48396_48947.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_48948_49199.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_49200_50291.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_50292_51299.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_51300_51443.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_51444_51611.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_51612_56483.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_56484_57251.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_57252_60851.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_60852_61127.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_61128_61715.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_61716_63083.png DEF_CON_Safe_Mode_-_Elie_Bursztein_-_A_Hacker_s_Gu_oPHWLIo88b8_63084_64066.png