Googlers show off AI that can help developers protect crypto code from key-slurping side-channel attacks

Deep-learning model pinpoints the pain in your AES

DEF CON Convolutional neural networks can reveal which parts of an AES implementation are vulnerable to snooping, according to research by Googlers.

At the online DEF CON conference this month, Elie Bursztein, who leads the anti-abuse research team at the Chocolate Factory, demonstrated how to analyze a chip running AES encryption code to pinpoint the software instructions responsible for any side-channel leakage.

You can watch his talk below, and find the slides and more info here. Code and a paper describing the work, developed and written with the help of fellow Googler Jean-Michel Picod, is expected to be shared at some point.

Youtube Video

Side-channels can be abused to, for example, obtain the encryption key being used by an AES algorithm. Thus, it's in a programmer's interest to protect their algorithms to avoid leaking any information during the numerous rounds of calculations performed when encrypting and decrypting data.

It's well-known that AES implementations can cause slight changes in the operation of a chip running the code – such as variances in power draw and temperature, patterns of signals on pins, memory and cache accesses, electromagnetic emissions, timings of results, and so on – and these can be observed to gradually discern, say, the secret key used in the cryptography.

In Bursztein's presentation, he used an emulated Arm Cortex-M4-based STM32F4 microcontroller running the tinyAES algorithm to show it was possible to use a machine-learning model to figure out where in the source code the algorithm was leaking information, and thus pinpoint where countermeasures should be placed in the code to prevent data escaping.

This model relies on a so-called leakage map generated with the help of previous research – specifically, a machine-learning model that determines secret keys used by tinyAES on a real STM32F415 by studying its signals and traces.

As Bursztein put it, the latest tool, Side-Channel Attack Leak Detector aka SCALD, "is able to accurately trace back the origin of the leakage to the exact CPU instructions or lines of code responsible for it."

Thus, SCALD joins the dots between the leakage of encryption key data to the very lines of code causing that spillage. Which is neat.

This may sound straightforward, yet it requires a fair bit of equipment, technical know-how, and time – though the results are rather useful. Check out the video and slides for the full deep dive; this is just our brief overview. ®