lab.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Side-Channel Workshop\n",
    "In this lab, we will walk through a simple power analysis (SPA) side-channel attack.\n",
    "\n",
    "The provided data client will connect you to an embedded device that accepts 4-digit PINs, compares them to the correct PIN using the `strcmp` (string compare) function, and returns the result (correct/incorrect) and a power side-channel trace of the device performing the operation.\n",
    "\n",
    "**Your goal: use the power traces to crack the 4-digit PIN**"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Step 1: Create Lock\n",
    "First, we need to create the lock. You can create one of three locks, each with a different difficulty.\n",
    "\n",
    "Just run this once (click the cell and press the play button on the top bar or hit shift-enter)."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "from lab import Door\n",
    "import matplotlib.pyplot as plt\n",
    "%matplotlib widget\n",
    "\n",
    "# basic difficulty (large trigger signal, 4-digit numeric)\n",
    "door = Door(path=Door.BASIC)\n",
    "\n",
    "# medium difficulty (no trigger signal, 4-digit numeric)\n",
    "# door = Door(path=Door.MED)\n",
    "\n",
    "# advanced difficulty (no trigger signal, random 4-digit numeric)\n",
    "# door = Door(path=Door.ADV)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Step 2: Try PINs\n",
    "Now that we have a lock, we can start guessing PINs! Your first guess may take a bit to generate.\n",
    "\n",
    "The `unlock` method will attempt to unlock the door with the given PIN, collect the power trace, and plot it.\n",
    "\n",
    "**NOTE: The `plt.figure()` line is needed in every cell to create a new plot**"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "plt.figure()\n",
    "door.unlock('0000')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Running `unlock` multiple times in one block will attempt to unlock the lock multiple times and plot the different traces onto the same plot.\n",
    "\n",
    "By running the next cell, we can see that the device running this comparison operation results in a structured trace, where (presumably) different operations result in different amounts of power draw. We will be able to use this structure to infer the correctness of our key guesses by comparing traces of different PINs.\n",
    "\n",
    "\n",
    "**NOTE: Even though we enter the same PIN, there is still variability in the trace. This is expected in a real system, so trying PINs multiple times can help tell you which features are normal and which are random**"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "plt.figure()\n",
    "door.unlock('0000')\n",
    "door.unlock('0000')\n",
    "door.unlock('0000')"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "By default, `unlock` returns the entire, unmodified trace. You can use the buttons on the left of the plot to interract with the trace and zoom into areas of interest.\n",
    "\n",
    "We can smooth out the trace with the second argument `smooth`. Higher values cause more smoothing and value of 1 does nothing to the trace."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "plt.figure()\n",
    "door.unlock('0000', 1) # no smoothing; raw trace\n",
    "door.unlock('0000', 50)\n",
    "# ^ is equivalent to\n",
    "# door.unlock('0000', smooth=50)\n",
    "door.unlock('0000', 100)"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Additionally, once we eventually identify a time section of interest, we can crop to that section with the third argument `crop`."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "plt.figure()\n",
    "door.unlock('0000', crop=None) # no crop; full trace\n",
    "door.unlock('0000', crop=(100, 200))\n",
    "# ^ is equivalent to\n",
    "# door.unlock('0000', 1, (100, 200))\n",
    "door.unlock('0000', crop=(800, 1000))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "\n",
    "---\n",
    "## Your Turn!\n",
    "Now, using these steps, see if you can crack the password!\n",
    "\n",
    "Please don't just brute-force all 10k possible combinations. That will both bog down the server for your fellow attackers and defeat the purpose of the exercise 😊 \n",
    "\n",
    "Feel free to add more Python code cells to work with using the `+` button in the upper left. **Remember to start every cell that needs a plot with  `%matplotlib widget`**"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "plt.figure()\n",
    "\n",
    "# your code here"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "---\n",
    "## Finished?\n",
    "If you've finished early or just want a challenge, try some of the following:\n",
    "\n",
    "* Figure out the optimal strategy for guessing passwords (what is the minimum number of guesses to ensure cracking the PIN?)\n",
    "* Try using the advanced data client. The timing-critical section will be harder to spot and the password is 4 bytes of binary input instead of 4 digits"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "---\n",
    "## Need a hint?\n",
    "Run each cell below to reveal another hint\n",
    "\n",
    "**NOTE:** Some details of the clues only apply to the basic difficulty challenge.\n",
    "\n",
    "## Hint 1"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%load hints/hint1.py"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Hint 2"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%load hints/hint2.py"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Hint 3"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%load hints/hint3.py"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Hint 4:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%load hints/hint4.py"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Hint 5"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%load hints/hint5.py"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Hint 6"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%load hints/hint6.py"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Hint 7"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%load hints/hint7.py"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.12"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}