Chapter 7: Side-Channel Resistance

7.1 Introduction — Locating the Side-Channel Threat Model

TLS Lite is a lightweight secure-channel standard designed for constrained environments. However mathematically rigorous its envelope format and handshake may be, that rigor must traverse the physical medium on which abstract algorithms execute. Information leaks through power consumption, electromagnetic radiation, computation time, cache occupancy, fault-induced branch deviation, and even acoustic vibration. Building on the "constant-time implementation" advisory of RFC 8446 §9.4 and aligning with the testing procedures defined by ISO/IEC 17825:2024 and NIST SP 800-140F, this chapter explains how a TLS Lite host withstands non-invasive side-channel attacks.

The side-channel threat model differs from the conventional active/passive attacker model. A Dolev-Yao adversary attempts to violate integrity or confidentiality of network messages, whereas a side-channel adversary measures byproducts emitted by the circuit while messages are being constructed. Paul Kocher's 1996 timing-attack paper (CRYPTO '96) demonstrated that branches in modular exponentiation statistically leak the RSA secret exponent. In 1999, Kocher, Jaffe, and Jun published Differential Power Analysis (DPA), empirically showing that roughly 1,000 power traces suffice to recover an entire key. Over the subsequent three decades, side-channel research has simultaneously driven academic venues (CHES, COSADE) and certification regimes (Common Criteria EAL 4+, FIPS 140-3).

The side-channel scope addressed by TLS Lite is fivefold. First, "timing" — leaks caused by early-exit returns in password comparison or MAC verification. Second, "power" — leaks whereby secret-dependent operations appear as amplitude graphs in the circuit's dynamic power consumption. Third, "electromagnetic" — pathways that recover key bits by measuring the EM field radiated from the chip surface with an H-field probe. Fourth, "cache" — microarchitectural channels such as Flush+Reload, Prime+Probe, and the Spectre/Meltdown aftermath, which infer secret-dependent branches by measuring shared cache-line occupancy. Fifth, "fault" — Differential Fault Analysis (DFA) using clock glitches, voltage glitches, or laser pulses to force branch deviations. The standard classifies the minimum defense level for all five channels at SHOULD/SHALL granularity.

Evaluating side-channel resistance is not satisfied by a self-declaration of "our implementation is constant-time". Evaluators verify that the Welch's t-test threshold |t| ≤ 4.5 from TVLA (Test Vector Leakage Assessment) is met under the non-invasive testing procedure of ISO/IEC 17825:2024, and confirm — per the test-tool calibration procedure of ISO/IEC 20085-1 and 20085-2 — that the claimed masking order actually achieves the stated security level. This chapter explains step by step how a host must respond to that evaluation procedure.

7.2 Attack Categories and Cost

Side-channel attacks are classified by "the degree of access permitted to the target device": invasive, semi-invasive, and non-invasive. ISO/IEC 17825:2024 absorbs these three categories into a standardized testing structure, specifying how far an evaluator may modify the target device package. Table 7-1 summarizes definitions, tooling, and average evaluation durations.

Non-invasive evaluation is the lowest-cost path and therefore represents a generalized threat for mass-produced devices. The standard classifies defense against non-invasive threats at SHALL granularity, semi-invasive at SHOULD, and invasive as an advisory subject to additional review at certification grades EAL 4+ and above. Table 7-2 compares equipment cost and mean measurement time for the five non-invasive attacks.

A noteworthy point in Table 7-2 is the steep decline of "equipment cost" over time. Open hardware platforms such as ChipWhisperer have made DPA experiments feasible for as little as $300, and consequently the baseline of side-channel defense for IoT device production lines has been raised to "at least first-order masking + shuffling + constant-time". A CHES 2018 analysis demonstrated that constant-time alone cannot defeat DPA, and only the combination of masking and shuffling meaningfully suppresses statistical leakage.

7.3 Constant-Time Implementation Principles

A constant-time implementation is code that "produces no branch, no memory access, and no latency variation that depends on secret data". The most frequent violation is the strcmp/memcmp pattern that early-exits at the first mismatching byte, since the mean comparison time scales with the matching prefix length and therefore creates a timing leak. Token verification, MAC verification, and password comparison in this standard SHALL all use constant-time comparison functions. The recommended pseudocode follows.

// Constant-time byte comparison — presupposes equal length
// Returns 0 if all bytes match, non-zero otherwise
int ct_memcmp(const uint8_t *a, const uint8_t *b, size_t n) {
    uint8_t diff = 0;
    for (size_t i = 0; i < n; i++) {
        diff |= a[i] ^ b[i];   // no secret-dependent branch
    }
    // returns 0 if diff is 0, else 1 (no branch)
    return (diff | -diff) >> 7;
}

// Constant-time conditional select — avoids if-branches
uint32_t ct_select(uint32_t mask, uint32_t a, uint32_t b) {
    // mask must be either 0 or 0xFFFFFFFF
    return (mask & a) | (~mask & b);
}

Table 7-3 catalogues representative differences between variable-time and constant-time code. T-table AES implementations are vulnerable to cache side-channels because they access an S-box lookup table at a key-dependent index; for this reason, the standard recommends at SHOULD level the use of bitslicing or the hardware instructions of AES-NI / ARMv8 Crypto Extension.

RFC 7748 stipulates that the X25519 curve is "constant-time by design": the Montgomery ladder performs exactly one point doubling and one point addition per bit regardless of the secret bit value. The RFC 8032 Ed25519 signature uses a deterministic nonce, structurally avoiding the nonce-leakage risk that RSA faces. The TLS Lite handshake selects X25519 as the default key-agreement algorithm and Ed25519 as the default signature algorithm. For AEAD, TLS_AES_128_GCM_SHA256 and TLS_CHACHA20_POLY1305_SHA256 are the defaults, with TLS_AES_256_GCM_SHA384 as the recommended option — all listed in the RFC 8446 §B.4 advisory cipher-suite roster.

7.4 Masking

Masking is the technique of "splitting a secret value with a random mask so that neither share alone reveals the secret". First-order masking decomposes a secret s into s = s₁ ⊕ s₂ and processes each share along an independent circuit path. Differential Power Analysis exploits the correlation between secret-dependent intermediate values and the power trace; when the secret is dispersed into two random shares, observation of one share alone cannot recover it. Order-d masking decomposes the secret into d+1 shares to defeat order-d DPA.

// First-order Boolean masking AES S-box — pseudocode
// Input: masked byte (x_m1, x_m2), with x = x_m1 XOR x_m2
// Output: masked S-box output (y_m1, y_m2), with y = S(x) = y_m1 XOR y_m2
void masked_sbox(uint8_t x_m1, uint8_t x_m2, uint8_t *y_m1, uint8_t *y_m2) {
    uint8_t fresh_mask = random_byte();   // fresh mask each call (TRNG)
    *y_m2 = fresh_mask;
    // precomputed masked S-box table, indexed by (x_m2, fresh_mask)
    *y_m1 = masked_sbox_table[x_m1][x_m2][fresh_mask];
    // now (*y_m1) XOR (*y_m2) == S(x_m1 XOR x_m2)
}

The cost of masking grows steeply with order. Table 7-4 summarizes security strength and performance overhead by order. Many CHES papers have made clear that first-order masking alone does not stop second-order DPA, so an EAL 5+ evaluation typically requires the combination of second-order masking and shuffling.

Alongside masking, "shuffling" randomizes the order of secret-dependent operations at every invocation. If AES's 16 S-box calls are executed in a different permutation each time, DPA can no longer assume that the same secret bit appears at the same temporal point across traces. The standard recommends combined use of masking and shuffling at SHOULD level; the two techniques are orthogonal, so their combined application yields additive security.

7.5 ISO/IEC 17825:2024 Evaluation Tiers

ISO/IEC 17825:2024 concretizes the non-invasive side-channel testing requirement of NIST FIPS 140-3 §4.10 as an international standard. Evaluators collect a large number of power traces from the target device and apply Welch's t-test under TVLA to statistically check for secret-dependent leakage. Table 7-5 shows the evaluation tiers defined by the standard.

The threshold |t| ≤ 4.5 in Table 7-5 is the conservative TVLA bound proposed by Cryptography Research Inc. (CRI); under the standard-normal assumption, it permits roughly one false positive per hundred million tests. TVLA computes the t-statistic by dividing the mean difference of two trace sets (fixed-plaintext vs random-plaintext) by their pooled standard deviation. Table 7-6 decomposes the pass/fail threshold across critical time points.

A security evaluation engineer once found |t| = 7.2 (exceeding threshold) at the "I/O boundary" point during an ISO/IEC 17825 Class B evaluation of an industrial IoT gateway. Analysis revealed that the bus-interface DMA was transferring key-expansion intermediates in cleartext. The case illustrates that even when masking and shuffling are applied to core operations, statistical leakage reappears if any one point along the data path exposes plaintext. After remediation, |t| fell to 2.1 and the device passed Class B.

7.6 Fault Injection, Acoustic, and Cache Side-Channels

Fault injection (FI) is an attack that transiently corrupts the target device's branch instructions via clock glitch, voltage drop, laser pulse, or EM pulse. For instance, COSADE 2017 reported a case in which a fault injected at the "advance on PIN match, reject on mismatch" branch caused the device to accept all PINs. The standard mandates the following defenses at SHALL level for boot-loader and handshake branches: (1) double-checked conditional comparisons, (2) authenticated boolean of the comparison result, (3) monotonic fault counter, and (4) permanent key zeroization upon reaching the fault threshold. For Differential Fault Analysis (DFA), the Piret-Quisquater attack — recovering a key by injecting a 1-byte fault into AES's last round — is well known, and the standard recommends at SHOULD level a post-execution recomputation-comparison of the last round's result.

Acoustic side-channels became prominent through the 2014 work of Genkin, Shamir, and Tromer that recovered an RSA secret key with only a microphone. The attack exploited the fact that micro-vibrations in laptop coils vary subtly in audible frequency bands according to the branches in modular exponentiation. The standard discourages host-side RSA and adopts Ed25519 as the default signature algorithm, structurally reducing the acoustic-leakage surface. Cache side-channels have grown more severe since Spectre/Meltdown. Flush+Reload, Prime+Probe, and Evict+Time infer branch history through the occupancy time of shared cache lines. The standard requires at SHALL level the use of bitslicing AES or AES-NI hardware instructions, which avoid secret-dependent memory indices.

The ARM PSA Crypto attack profile classifies "realistically assumed threat models" by tier. PSA Level 1 assumes a software-only adversary, Level 2 adds remote side-channels, and Level 3 includes physical access. The default recommended grade for TLS Lite is PSA Level 2, and hosts pursuing Common Criteria EAL 4+ certification additionally need Level 3 mitigations. ISO/IEC 20085-1 and 20085-2 define calibration procedures for non-invasive side-channel test tools so that evaluation laboratories can test the same target at the same precision. Calibration records under these two standards are reported in the certificate as "Calibration record per ISO/IEC 20085-1 dated …".

The TLS Lite cipher-suite roster — TLS_AES_128_GCM_SHA256, TLS_CHACHA20_POLY1305_SHA256, TLS_AES_256_GCM_SHA384 — aligns with the RFC 8446 §B.4 advisory list. All key exchanges use X25519, and all signatures use ed25519. These five ENUMs are the standard's IANA-registered aliases and correspond exactly to the identifiers displayed when selecting an algorithm in Panel 1 of the reference simulator.

7.7 CC EAL 4+ Certification and TVLA Pass Examples

Under the Common Criteria CCRA (Common Criteria Recognition Arrangement) regime, EAL 4+ is the tier "methodologically designed, tested, and reviewed" and serves as the typical certification ceiling for commercial IT products. The "+" denotes augmented conditions that additionally require side-channel evaluation (e.g., AVA_VAN.5). If a host implementation of the standard pursues EAL 4+ certification, the evaluator runs an ISO/IEC 17825 Class B or C test and verifies that the TVLA |t| ≤ 4.5 condition holds. The standard's conformance suite defines a recommended procedure in which evaluators confirm the following five areas on the target host: (1) cipher-suite negotiation simultaneously exposes the TLS_AES_128_GCM_SHA256 and TLS_CHACHA20_POLY1305_SHA256 ENUMs, (2) X25519 key agreement is implemented as a branch-free Montgomery ladder, (3) ed25519 signing uses deterministic nonces, (4) AES-NI or bitslicing is used even for sessions that negotiated TLS_AES_256_GCM_SHA384, and (5) the masking order matches the targeted ISO/IEC 17825 Class.

Note on Korean Edition

The Korean edition of this chapter maps the side-channel and CC-evaluation ecosystem in Korea to the standard. Operators outside Korea may treat the Korean section as informative. Korea operates KCMVP (Korea Cryptographic Module Validation Program) through the National Intelligence Service, with the Korea Internet & Security Agency (KISA) acting as the national certification body. The Electronics and Telecommunications Research Institute (ETRI) and the National Security Research Institute (NSR) maintain national-level side-channel evaluation laboratories. The Telecommunications Technology Association (TTA) maintains the Korean Standard KS X ISO/IEC 17825 and operates the calibration framework for non-invasive test tools. KAIST, POSTECH, and Korea University Graduate School of Information Security host active CHES / COSADE research groups. Combined, these institutions form a CC EAL 4+ evaluation infrastructure fully aligned with the international standard.

Chapter 7 Notes

1. ISO/IEC 17825:2024 — Information technology — Security techniques — Testing methods for the mitigation of non-invasive attack classes against cryptographic modules.
2. ISO/IEC 20085-1:2019 — IT Security techniques — Test tool requirements and test tool calibration methods — Part 1.
3. ISO/IEC 20085-2:2020 — Part 2: Test calibration methods and apparatus.
4. NIST SP 800-140F — CMVP Approved Non-Invasive Attack Mitigation Test Metrics.
5. NIST FIPS 140-3 §4.10 — Non-Invasive Security.
6. Paul Kocher, "Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems", CRYPTO 1996. DOI 10.1007/3-540-68697-5_9.
7. Kocher, Jaffe, Jun, "Differential Power Analysis", CRYPTO 1999, Cryptography Research Inc. white paper.
8. IETF RFC 7748 — Elliptic Curves for Security (X25519, X448).
9. IETF RFC 8032 — Edwards-Curve Digital Signature Algorithm (EdDSA) — Ed25519.
10. IETF RFC 8446 §9.4 — TLS 1.3 Implementation Notes on Side-Channel Attacks.
11. CHES — Cryptographic Hardware and Embedded Systems, IACR workshop series.
12. COSADE — Constructive Side-Channel Analysis and Secure Design.
13. Common Criteria CCRA — Common Methodology for IT Security Evaluation v3.1 R5, AVA_VAN.5.
14. ARM PSA Certified — Platform Security Architecture Crypto Attack Profile, ARM Ltd.
15. Piret & Quisquater, "A Differential Fault Attack Technique against SPN Structures", CHES 2003.
16. Genkin, Shamir, Tromer, "RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis", CRYPTO 2014.
17. GitHub: WIA-Official/wia-standards-public/tls-lite — chapter source, errata, and reproducibility assets.