Git Product home page Git Product logo

scaaml's Introduction

SCAAML: Side Channel Attacks Assisted with Machine Learning

SCAAML banner

SCAAML (Side Channel Attacks Assisted with Machine Learning) is a deep learning framework dedicated to side-channel attacks. It is written in python and run on top of TensorFlow 2.x.

Available components

  • scaaml/: The SCAAML framework code. Its used by the various tools.
  • scaaml_intro/: A Hacker Guide To Deep Learning Based Side Channel Attacks. Code, dataset and models used in our step by step tutorial on how to use deep-learning to perform AES side-channel attacks in practice.

Install

Dependencies

To use SCAAML you need to have a working version of TensorFlow 2.x and a version of Python >=3.6

SCAAML framework install

  1. Clone the repository: git clone github.com/google/scaaml/
  2. Create and activate Python virtual environment: python3 -m venv my_env source my_env/bin/activate
  3. Install dependencies: python3 -m pip install --require-hashes -r requirements.txt
  4. Install the SCAAML package: python setup.py develop

Update dependencies

Make sure to have: sudo apt install python3 python3-pip python3-venv and activated the virtual environment.

Install requirements: pip install --require-hashes -r base-tooling-requirements.txt

Update: pip-compile --allow-unsafe requirements.in --generate-hashes --upgrade and commit requirements.txt.

Dataset and models

Every SCAAML component rely on a datasets and optional models that you will need to download in the component directory. The link to download those are available in the components specific README.md. Simply click on the directory representing the component of your choice, or the link to the component in the list above.

Publications & Citation

Here is the list of publications and talks related to SCAAML. If you use any of its codebase, models or datasets please cite:

@online{bursztein2019scaaml,
  title={SCAAML:  Side Channel Attacks Assisted with Machine Learning},
  author={Bursztein, Elie and others},
  year={2019},
  publisher={GitHub},
  url={https://github.com/google/scaaml},
}

To cite the paper describing the approach, please cite:

@misc{bursztein2023generic,
      title={Generic Attacks against Cryptographic Hardware through Long-Range Deep Learning}, 
      author={Elie Bursztein and Luca Invernizzi and Karel Král and Daniel Moghimi and Jean-Michel Picod and Marina Zhang},
      year={2023},
      eprint={2306.07249},
      archivePrefix={arXiv},
      primaryClass={cs.CR}
}

SCAAML AES tutorial

DEF CON talk that provides a practical introduction to AES deep-learning based side-channel attacks

@inproceedings{burszteindc27,
title={A Hacker Guide To Deep Learning Based Side Channel Attacks},
author={Elie Bursztein and Jean-Michel Picod},
booktitle ={DEF CON 27},
howpublished = {\url{https://elie.net/talk/a-hackerguide-to-deep-learning-based-side-channel-attacks/}}
year={2019},
editor={DEF CON}
}

Disclaimer

This is not an official Google product.

scaaml's People

Contributors

dependabot[bot] avatar ebursztein avatar invernizzi avatar jmichelp avatar kralka avatar wsxrdv avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

scaaml's Issues

cleanup readme

  • put the hash at the end of the table
  • Make sure to ask them to install the package
  • Add explained files
  • fixme the citeme etc

Consistent UX colors

Ensure a consistent UX (and somehow give a purpose to color printing) by having helpers. Make sure that color printing give a consistant UX throughout our code and instead of writing the color, on each cprint() call, we could have a bunch of helpers that wrap them (e.g. cprint_info(), cprint_warning(), cprint_error(), etc.).

Correct group and part counters when restarting capture

Currently the group and part counters are reset to zero when restarting a failed capture. This produces shards which belong to wrong groups / parts. An existing dataset can be fixed using scaaml.io.Dataset.reshape_into_new_dataset.

Refactor scald colab

| results_analysis.ipynb | Vizualize SCALD results on a given target. Used at the end of the pipeline. |
| explainers_benchmark.ipynb | Benchmark explaination techniques efficiency. Used to reproduce results. |
| scald_explainer_benchmark.ipynb | Benchmark various configuations for the scald explainer. |

| find_leak_results.ipynb | Visualize the result of the explainability technique |

mypy is questionable

It seems that mypy has not discovered wrong return type typehint in scaaml.io.Dataset.as_tfdataset.

There are two issues:

  1. Fixing the typehint.
  2. Debugging and fixing mypy typechecking.

Python interpreter types the output as a tuple, when unpacking the types are tf.data.PrefetchDataset, dict, dict. The proper type should be Tuple[tf.data.Dataset, Dict, Dict]. Definitely not a Union of those.

Make writing examples in tfrec files parallel

This could significantly speed up (save days, maybe a week) both capture and converting from other formats to our format.

Potential pitfalls:

  • running out of memory for very long traces
  • need proper integration with resuming capture

Randomness checks

Implement checks that the attack points and traces seem random enough (and in case of traces correlated between different splits).

Framework where it is easy to add other tests is needed. Preferably single pass over the data (parsing seems slow, but not measured yet).

Fix typos

Python notebooks contain typos.

There are some typos which are a part of the api or need more attention (bibtex name burzteindc):

burzteindc
chipwispher
comparaison
filepattern

scaaml.aes still contains non-word variables.

Provide helpful debug when Unicorn is not installed

Currently the leak mapping code don't work when unicorn is not installed but don't crash and as a result silently fail

[Emulating target]
Starting emulation
Traceback (most recent call last):
  File "_ctypes/callbacks.c", line 234, in 'calling callback function'
  File "/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/site-packages/unicorn-1.0.2rc4-py3.6.egg/unicorn/unicorn.py", line 479, in _hookcode_cb
  File "/Users/elieb/git/scaaml/scaaml/scald/tracer/devices/rainbow/generics/cortexm.py", line 109, in block_handler
    self.base_block_handler(address)
  File "/Users/elieb/git/scaaml/scaaml/scald/tracer/devices/rainbow/rainbow.py", line 414, in base_block_handler
    r = self.stubbed_functions[f](self)
  File "/Users/elieb/git/scaaml/scaaml/scald/tracer/chipwhisperer_leakage_automaton.py", line 194, in trigger_high
    self.trigger_hook = e.emu.hook_add(uc.UC_HOOK_MEM_WRITE,
NameError: name 'uc' is not defined
Traceback (most recent call last):
  File "_ctypes/callbacks.c", line 234, in 'calling callback function'
  File "/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/site-packages/unicorn-1.0.2rc4-py3.6.egg/unicorn/unicorn.py", line 479, in _hookcode_cb
  File "/Users/elieb/git/scaaml/scaaml/scald/tracer/devices/rainbow/generics/cortexm.py", line 109, in block_handler
    self.base_block_handler(address)
  File "/Users/elieb/git/scaaml/scaaml/scald/tracer/devices/rainbow/rainbow.py", line 414, in base_block_handler
    r = self.stubbed_functions[f](self)
  File "/Users/elieb/git/scaaml/scaaml/scald/tracer/chipwhisperer_leakage_automaton.py", line 205, in trigger_low
    e.emu.hook_del(self.trigger_hook)
  File "/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/site-packages/unicorn-1.0.2rc4-py3.6.egg/unicorn/unicorn.py", line 592, in hook_del
TypeError: an integer is required (got type NoneType)
Encryption: FAIL
KEY=2b7e151628aed2a6abf7158809cf4f3c
 PT=6bc1bee22e409f96e93d7e117393172a
EXP=3ad77bb40d7a3660a89ecaf32466ef97

Redo leak visualization colab

Show for aggregation function (sum)

  • How different bytes same attack point are on the trace
  • Show where different attack point are on the trace (put both if possible with different byte)

Properly reload Dataset when resuming capture

When resuming capture (see PR #24 and PR #25) the info.json file gets rewritten instead of updated. This results in the shard file names not being present in the info.json and possibly broken metadata (such as min and max values).

Make capture runner appear as not to lose progress

Currently when a capture is restarted, the progress bar is showing how many traces need to be captured and starts at zero percent. This is confusing, since it looks like progress has been lost. It should instead start where it ended (show all shards that have been captured so far as the immediate progress).

Improve code quality

Ideas:

  • Set up automation of tests and code quality checks
  • Add docstrings
  • Improve formatting (yapf)
  • Fix typing (mypy)
  • Work in linter advice (pylint)
  • Run spell checker

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.