arXiv subjects

Karel Král

Publications and source records attributed to Karel Král.

7 recordsLinked to original sources

arXiv2026

Profiling Resilient to Change in Probe Position

Side Channel Analysis (SCA) relaxes the black-box assumption of conventional cryptanalysis by incorporating physical measurements acquired during cryptographic operations. Electro-magnetic (EM) emissions of a chip during computations often provide a very valuable source of side channel leakage. During the evaluation of a chip for electro-magnetic side channel emissions one needs to position an electro-magnetic probe in an advantageous position relative to the chip. Previous literature focused on hot-spot finding and to a lower extend repositioning. Trace augmentations have been considered to aid portability of profiling using one physical device and attacking another device. This paper focuses on training a single neural network using traces from multiple EM probe positions to detect leakage from a larger area over the attacked device. We provide dual evaluation of EM traces - from two completely independent labs - profiling on data from one lab and attacking traces from the other lab.

cs.CR↗

arXiv2024

Generalized Power Attacks against Crypto Hardware using Long-Range Deep Learning

To make cryptographic processors more resilient against side-channel attacks, engineers have developed various countermeasures. However, the effectiveness of these countermeasures is often uncertain, as it depends on the complex interplay between software and hardware. Assessing a countermeasure's effectiveness using profiling techniques or machine learning so far requires significant expertise and effort to be adapted to new targets which makes those assessments expensive. We argue that including cost-effective automated attacks will help chip design teams to quickly evaluate their countermeasures during the development phase, paving the way to more secure chips. In this paper, we lay the foundations toward such automated system by proposing GPAM, the first deep-learning system for power side-channel analysis that generalizes across multiple cryptographic algorithms, implementations, and side-channel countermeasures without the need for manual tuning or trace preprocessing. We demonstrate GPAM's capability by successfully attacking four hardened hardware-accelerated elliptic-curve digital-signature implementations. We showcase GPAM's ability to generalize across multiple algorithms by attacking a protected AES implementation and achieving comparable performance to state-of-the-art attacks, but without manual trace curation and within a limited budget. We release our data and models as an open-source contribution to allow the community to independently replicate our results and build on them.

cs.CR↗

arXiv2021

Sorting Short Integers

We build boolean circuits of size $O(nm^2)$ and depth $O(\log(n) + m \log(m))$ for sorting $n$ integers each of $m$-bits. We build also circuits that sort $n$ integers each of $m$-bits according to their first $k$ bits that are of size $O(nmk(1 + \log^*(n) - \log^*(m)))$ and depth $O(\log^{3}(n))$. This improves on the result of Asharov et al. arXiv:2010.09884 and resolves some of their open questions.

cs.CC↗

arXiv2021

Data Structures Lower Bounds and Popular Conjectures

In this paper, we investigate the relative power of several conjectures that attracted recently lot of interest. We establish a connection between the Network Coding Conjecture (NCC) of Li and Li and several data structure like problems such as non-adaptive function inversion of Hellman and the well-studied problem of polynomial evaluation and interpolation. In turn these data structure problems imply super-linear circuit lower bounds for explicit functions such as integer sorting and multi-point polynomial evaluation.

cs.CC↗

arXiv2019

Ramsey numbers of ordered graphs

An ordered graph is a pair $\mathcal{G}=(G,\prec)$ where $G$ is a graph and $\prec$ is a total ordering of its vertices. The ordered Ramsey number $\overline{R}(\mathcal{G})$ is the minimum number $N$ such that every ordered complete graph with $N$ vertices and with edges colored by two colors contains a monochromatic copy of $\mathcal{G}$. In contrast with the case of unordered graphs, we show that there are arbitrarily large ordered matchings $\mathcal{M}_n$ on $n$ vertices for which $\overline{R}(\mathcal{M}_n)$ is superpolynomial in $n$. This implies that ordered Ramsey numbers of the same graph can grow superpolynomially in the size of the graph in one ordering and remain linear in another ordering. We also prove that the ordered Ramsey number $\overline{R}(\mathcal{G})$ is polynomial in the number of vertices of $\mathcal{G}$ if the bandwidth of $\mathcal{G}$ is constant or if $\mathcal{G}$ is an ordered graph of constant degeneracy and constant interval chromatic number. The first result gives a positive answer to a question of Conlon, Fox, Lee, and Sudakov. For a few special classes of ordered paths, stars or matchings, we give asymptotically tight bounds on their ordered Ramsey numbers. For so-called monotone cycles we compute their ordered Ramsey numbers exactly. This result implies exact formulas for geometric Ramsey numbers of cycles introduced by Károlyi, Pach, Tóth, and Valtr.

math.CO↗

arXiv2019

Stronger Lower Bounds for Online ORAM

Oblivious RAM (ORAM), introduced in the context of software protection by Goldreich and Ostrovsky [JACM'96], aims at obfuscating the memory access pattern induced by a RAM computation. Ideally, the memory access pattern of an ORAM should be independent of the data being processed. Since the work of Goldreich and Ostrovsky, it was believed that there is an inherent $ Ω(\log n) $ bandwidth overhead in any ORAM working with memory of size $ n $. Larsen and Nielsen [CRYPTO'18] were the first to give a general $ Ω(\log n) $ lower bound for any online ORAM, i.e., an ORAM that must process its inputs in an online manner. In this work, we revisit the lower bound of Larsen and Nielsen, which was proved under the assumption that the adversarial server knows exactly which server accesses correspond to which input operation. We give an $Ω(\log n) $ lower bound for the bandwidth overhead of any online ORAM even when the adversary has no access to this information. For many known constructions of ORAM this information is provided implicitly as each input operation induces an access sequence of roughly the same length. Thus, they are subject to the lower bound of Larsen and Nielsen. Our results rule out a broader class of constructions and specifically, they imply that obfuscating the boundaries between the input operations does not help in building a more efficient ORAM. As our main technical contribution and to handle the lack of structure, we study the properties of access graphs induced naturally by the memory access pattern of an ORAM computation. We identify a particular graph property that can be efficiently tested and that all access graphs of ORAM computation must satisfy with high probability. This property is reminiscent of the Larsen-Nielsen property but it is substantially less structured; that is, it is more generic.

cs.CR↗

arXiv2018

ARRIVAL: Next Stop in CLS

We study the computational complexity of ARRIVAL, a zero-player game on $n$-vertex switch graphs introduced by Dohrau, Gärtner, Kohler, Matoušek, and Welzl. They showed that the problem of deciding termination of this game is contained in $\text{NP} \cap \text{coNP}$. Karthik C. S. recently introduced a search variant of ARRIVAL and showed that it is in the complexity class PLS. In this work, we significantly improve the known upper bounds for both the decision and the search variants of ARRIVAL. First, we resolve a question suggested by Dohrau et al. and show that the decision variant of ARRIVAL is in $\text{UP} \cap \text{coUP}$. Second, we prove that the search variant of ARRIVAL is contained in CLS. Third, we give a randomized $\mathcal{O}(1.4143^n)$-time algorithm to solve both variants. Our main technical contributions are (a) an efficiently verifiable characterization of the unique witness for termination of the ARRIVAL game, and (b) an efficient way of sampling from the state space of the game. We show that the problem of finding the unique witness is contained in CLS, whereas it was previously conjectured to be FPSPACE-complete. The efficient sampling procedure yields the first algorithm for the problem that has expected runtime $\mathcal{O}(c^n)$ with $c<2$.

cs.CC↗