Damien Jauvart
|
0
|
October 12, 2026
Hardware Security
Evaluating Botan’s Resistance to Physical Attacks: An End-to-End Study
This work was accepted at HS3, the 2nd Workshop on Hardware-Supported Software Security, held on September 17, 2026 in Rome, Italy, co-located with ESORICS 2026. The workshop focuses on hardware-assisted defenses against software and micro-architectural exploits, covering side-channel analysis, trusted execution environments, and cryptographic hardware. More at https://hs3-workshop.github.io/2026.html.
About the Paper
"Evaluating the Security of Open-Source Cryptographic Libraries Against Physical Attacks: An End-to-End Study on Botan" by Damien Jauvart and Aurélien Vasselle presents a side-channel security evaluation of Botan 3.7.1's elliptic curve cryptography (ECC) implementation.
The Botan project has received funding by the German BSI to integrate some protections against side-channel attacks, making it a very interesting target for this study. See Botan’s documentation for a description of their mitigations.
Our analysis followed a systematic methodology, from source code analysis through emulated leakage assessment to real-device exploitation. The full paper is available on the HS3 2026 workshop page and will appear in the Springer LNCS post-proceedings.
What Was Studied
The evaluation targets Botan 3.7.1's 4-bit fixed window scalar multiplication used as the core primitive of ECDH. The implementation incorporates several countermeasures against side-channel attacks, in particular: scalar blinding (additive 64-bit mask on a 256-bit scalar), input point randomization over the first four windows, and a masked table lookup, with the library claiming constant-time execution.
Our assessment exploited the BSI AIS 46 guidelines, mapping each leakage against recommended attacks. Four layers were combined:
- Source code analysis of Botan's implementation.
- Statistical leakage assessment (t-test, CPA, and ANOVA) on emulated instruction-level traces from eShard's esFirmware.
- Emulated traces analysis and attack path validation.
- Attacks validation on electromagnetic trace captured on an NXP i.MX 8 device.
Why Is It Important?
The work reveals a fundamental gap between claimed and actual constant-time guarantees. Botan states its ECC algorithms avoid timing leaks, yet we identified a microarchitectural timing vulnerability; it stems from microarchitectural behavior that emulators abstract away. More broadly, the study demonstrates that emulation and real-device testing capture similar behaviors, with a fundamental difference highlighted by a first exploit described below. Additionally, the collision oracle converged in emulation but failed on real hardware due to a noisy environment on the real device. This means all four methodology steps are essential: source code analysis identifies candidates, emulation designs and validates attacks in a noise-free baseline, and real-device testing uncovers microarchitectural effects and physical noise. Omitting any layer risks false negatives and false positives.
Which New Insights Have Been Contributed?
Three distinct attack paths were identified and validated:
Attack 1: Zero-Window Leakage
In a 4-bit window, the value 0 occurs with 6.25% probability. Botan handles it by performing a dummy addition with the point at infinity (affine coordinates (0, 0)), but the resulting field multiplications produce a distinctly different side-channel signature. On real hardware, the window=0 trace is measurably faster, due to a microarchitectural timing difference. In emulation at ISA (Instruction Set Architecture), this is only visible as a significantly lower signal amplitude, caused by registers containing zero.
Unsupervised KMeans clustering achieved 99% success in separating the two classes. The attack is particularly dangerous for ECDSA: the revealed nonce bits could be exploited with a lattice-based Hidden Number Problem attack, enabling full private key recovery even under scalar blinding (see [1] for details about the scalar blinding role in this attack).
Attack 2: Table Lookup Leakage
In order to securely access secret values within memory without facing deadly timing discrepancies, the library implements ct_select (short constant time selection) to lookup elements in a table. The ct_select function iterates over all 15 table entries to ensure a constant time process, but only the matching index triggers the conditional_assign: a copy of the table point into the output buffer. However, this deterministic assignment creates a direct SPA-level leakage in the emulated traces:
On real traces, this leakage is not visually detectable, but a 4-layer MLP trained on 59,300 traces achieved 98.85% accuracy in classifying window values, enabling full scalar recovery from a single trace.
Attack 3: Collision-Based Precomputation Attack via DL Oracle
This is the most novel contribution and generalizes the attack in [2] with more efficient techniques based on deep learning. We developed a deep learning-based collision oracle that classifies whether the same EC point [i]P is manipulated both during table precomputation (in this case, an affine coordinate conversion) and during scalar multiplication (point addition in mixed coordinates). Trace chunks from both operations are concatenated and fed to DNNs trained to recognize collision patterns, even though the two operations have fundamentally different leakage characteristics, since one is a coordinate conversion and the other is an elliptic curve addition.
The attack achieved 84% success of window value recovery on emulated traces. Yet, on real hardware, models failed to converge due to the lower signal-to-noise ratio and weak leakages. This result is significant because it extends correlation-based collision attacks (previously limited to similar operations) and exposes the precomputation step, often assumed safe, as a previously understudied leakage vector.
How Practical Are the Results?
The emulation vs. real-device comparison across all three attacks validates the methodology: emulation provides a fast, noise-free baseline for attack design, but physical validation is essential to discover microarchitectural vulnerabilities that simulators cannot model.
Attack 1 is unsupervised and profile-free, requiring only EM/Power access to the device. Any Botan deployment on an accessible target is vulnerable, and the partial nonce bits recovered enable full ECDSA key recovery via lattice attacks.
Attack 2 is a single-trace, profiled attack with near-perfect key recovery. The clone-device requirement limits the threat model, but for open-source libraries on commodity hardware, obtaining a clone is accessible.
Attack 3 validates a genuinely novel technique in emulation, but real-device applicability remains to be demonstrated.
The found vulnerabilities were reported to Botan’s authors with potential mitigation. We invite the reader to consult the full paper for these details.
What's Next?
Botan 3.8.0 has already switched to Booth scalar recording, requiring updating these specific attacks. However, the identified vulnerabilities likely persist in the core function of the Botan's scalar multiplication implementation.
Our ambition is to extend this end-to-end methodology to Post-Quantum Cryptography (PQC) algorithms. As NIST-standardized PQC schemes are progressively integrated into real-world libraries, assessing their physical implementation security is essential. Many PQC candidates use fundamentally different primitives whose side-channel leakage profiles may behave differently from ECC. Our emulation-first approach, combined with targeted real-device validation, provides a natural pipeline for this next wave of evaluation.
[1] Roche, T., Imbert, L. and Lomné, V., 2019, November. Side-channel attacks on blinded scalar multiplications revisited. In International Conference on Smart Card Research and Advanced Applications (pp. 95-108). Cham: Springer International Publishing.
[2] Järvinen, K. and Balasch, J., 2016, November. Single-trace side-channel attacks on scalar multiplications with precomputations. In International Conference on Smart Card Research and Advanced Applications (pp. 137-155). Cham: Springer International Publishing.