Revisiting Side-Channel Resistance of GCM Implementations on AVR Microcontrollers

초록

Galois/Counter Mode (GCM) serves as a mandatory or default authenticated encryption mode in widely deployed security protocols, including TLS 1.3, IPsec, MACsec (IEEE 802.1AE), SSH, WPA3, and QUIC, which makes implementation-level vulnerabilities in GCM a concern of broad practical significance. In this study, we revisit the side-channel resistance of GCM binary field multiplication implementations optimized for 8-bit AVR microcontrollers, which employ Dummy XOR with garbage registers and instruction-level atomicity (ILA) as countermeasures against simple power analysis (SPA) and timing attacks (TA). Despite the designers' claims of SPA resistance based on experimental evaluation, we demonstrate that these implementations remain vulnerable. Using autoencoder-based dimensionality reduction followed by clustering, our approach achieves perfect key bit recovery (clustering accuracy 1.00, residual entropy 0) using only 576 subtraces from a single ciphertext block-representing more than a 98% reduction in the number of required traces compared with prior work, which used 10,000 traces and achieved accuracies no higher than 0.64. Furthermore, through sensitivity analysis of the trained neural network, we identify a concrete design flaw: the RJMP instruction at the transition between partial products uses different displacement operands on the true and false execution paths, violating the intended instruction-level atomicity. These findings demonstrate that experimental validation alone cannot establish side-channel resistance, and that the security claims of the affected implementations should be reassessed-a concern that extends to deployed protocols built on them, such as the recently proposed KEM-MQTT.

키워드