Thermal Side Channel Analysis

Abstract

Within a world that increasingly relies on connected devices, security and reliability have become more important then ever. Whereas failures in digital components used to have a limited effect, nowadays an attack on a critical digital infrastructure impacts our daily lives on a huge scale. Due to these impacts it is estimated that the financial burden of cybercrime is going to increase to 6 trillion dollars by 2021. These costs are estimated to increase even more with the ever increasing amount of connected devices to the internet. To limit this problem, new ways of protecting digital systems must be developed. However, to be able to protect something, it is first necessary to identify the possible threats. In order to do so, vulnerabilities in digital systems have to be found. Preferably before a potential attacker finds them. This thesis looks for such vulnerabilities with respect to Thermal Side Channel Attacks. Whilst power side channel analysis has been around since the mid 90s, the amount of research on thermal side channel analysis has been very limited. However, when it comes to non-invasive side channel analysis, thermals can be of great use. Compared to power side channel analysis, it is much easier to do a non invasive thermal measurement. In some cases, the sensors for thermals are already included and available in the chip itself. This makes them a very suitable target. To perform Thermal Side Channel Attacks, three passive side channel attacks were developed based on existing power attacks. These attacks, Simple Thermal Analysis, Correlation Thermal Analysis and Convolutional Neural Network Thermal Analysis aimed at retrieving a private key from a RSA decryption. Because the thermal traces show a very different behaviour compared to the power traces, some extensive pre-processing techniques had to be developed. This pre-processing consists of removing a drifting offset and filtering unwanted frequencies in the collected trace. To further improve the attack success, a novel attack was created to retrieve the private key from a Montgommery Ladder based RSA implementation. This protected RSA algorithm is used as a counter measure against many side channel attacks. Using Progressive Correlation Thermal Analysis (PCTA), it was possible to attack this algorithm. As this attack does not exist in the power domain, it was also converted to work with power traces referred to as Progressive Correlation Power Analysis (PCPA). Using this technique, the existence of a Thermal Side Channel Attack was proven by successfully attacking multiple temperature traces and retrieving the private key.