A Cautionary Note Regarding Evaluation of AES Candidates on Smart-Cards

Abstract

NIST has considered the performance of AES candidates on smart-cards as an important selection criterion and many submitters have highlighted the compactness and efficiency of their submission on low end smart cards. However, in light of recently discovered power based attacks, we strongly argue that evaluating smart-card suitability of AES candidates requires a very cautious approach. We demonstrate that straightforward implementations of AES candidates on smart cards, are highly vulnerable to power analysis and readily leak away all secret keys. To illustrate our point, we describe a power based attack on the Twofish Reference 6805 code which we implemented on a ST16 smart card. The attack required power samples from only 100 independent block encryptions to fully recover the 128-bit secret key. We also describe how all other AES candidates are susceptible to similar attacks. We review the basis of power attacks and suggest countermeasures for a secure implementation. Unf...