以學習為本的方法於分組密碼分析及副通道攻擊

Abstract

本論文旨在探討二件問題------副通道攻擊與分組密碼分析。對於前者，我們提出一種新型的非監督式學習(unsupervised learning)方法用於電力分析，其為副通道攻擊的一種形式。與現有利用監督式學習(supervised learning)框架的不同的是，我們的方法不需要已標記好之電力紀錄與所使用金鑰的資訊以供訓練，但仍然能以高準確率找出金鑰。我們提出一種基於回歸分析的方法用於此處。此外我們進一步利用不同回合之間金鑰的相依關係改進原有之方法。實驗結果表明，該方法可以超越目前最先進的非監督式學習方法。 對於後者，我們將焦點置於密碼學中的區分攻擊(distinguishing attacks)，攻擊者可以從加密的訊息中提取足夠的資訊以分類其加密的方法，以便後續理論或實踐上的分析。在本文中，我們報告以最先進的機器學習技術應用的經驗，在一些公共數據集上的密碼區分攻擊。我們嘗試了幾種現有及全新的特徵(feature)在一些數據集(dataset)上，並發現加密時的操作模式(modes of operation)主導分類任務的效能。當採用CBC模式以及對每個明文給予隨機初始向量時，表現極為惡劣，但使用ECB模式時對於某些數據集的性能較佳。我們的實驗得到了與一些現有的文獻不同的結論:在採用較為安全的操作模式如CBC模式下，我們所採用的機器學習方法及特徵並無法在現代加密法所加密的密文中提取任何有用的資訊，因此也無法用於分類加密方法。

This paper aims to two problems – side-channel attack and identification of block ciphers. For the first problem a novel unsupervised learning approach is proposed for the task of Power Analysis – a form of side channel attack in Cryptanalysis. Different from some existing works that exploit supervised learning framework to this problem, our method does not require the labeled pairs which contains {X,Y}={key, power-trace} information for training, though is still capable of deciphering the secret key with high accuracy. A regression-based, unsupervised approach is proposed for this purpose. Later we further propose an enhanced model through exploiting the dependency of key bits between different rounds. Our experiment shows that the proposed method can outperform the state-of-the-art non-learning based decipherment methods. For the second problem we focus on cryptographic distinguishing attacks, in which the attacker is able to extract enough “information” from an encrypted message to distinguish it from a piece of random data, allow for powerful cryptanalysis both in theory and in practice. In this chapter, we report our experience of applying state-of-the-art machine learning techniques to launch cryptographic distinguishing attacks on several public datasets. We try several kinds of existing and new features on these datasets and found the ciphers’ “modes of operation” dominate the performance of classification tasks. When CBC mode is used with random initial vectors for each plaintext, the performance is extremely bad, while the performance for certain datasets is relatively good when ECB mode is used. We conclude that, in contrary to the findings of several existing works, the state-of-the-art machine learning techniques and cannot extract useful information from ciphertexts produced by modern ciphers operating in a reasonably secure mode such as CBC, let alone distinguish them from random data.