Practical reverse engineering of secret Sboxes by side-channel analysis

Abstract

Although security by obscurity has been proven useless for years, it is still used in some application, such as industry or government agencies. In this paper, we demonstrate practical recovery of substitution box (Sbox) from secret AES-like ciphers by side-channel analysis for reverse engineering or SCARE. By detecting side-channel collision, one can determine the Sbox mapping in an iterative manner. The Sbox recovery is demonstrated with practical measurements from a commercial microcontroller. Three different collision techniques are tested and with all the three techniques, the secret Sbox is recovered with high success.