AES Hardware Research Articles

A Provably Secure Scheme to Prevent Master Key Recovery by Fault Attack on AES Hardware

A Provably Secure Scheme to Prevent Master Key Recovery by Fault Attack on AES Hardware

Retrofitting Leakage Resilient Authenticated Encryption to Microcontrollers

The security of Internet of Things (IoT) devices relies on fundamental concepts such as cryptographically protected firmware updates. In this context attackers usually have physical access to a device and therefore side-channel attacks have to be considered. This makes the protection of required cryptographic keys and implementations challenging, especially for commercial off-the-shelf (COTS) microcontrollers that typically have no hardware countermeasures. In this work, we demonstrate how unprotected hardware AES engines of COTS microcontrollers can be efficiently protected against side-channel attacks by constructing a leakage resilient pseudo random function (LR-PRF). Using this side-channel protected building block, we implement a leakage resilient authenticated encryption with associated data (AEAD) scheme that enables secured firmware updates. We use concepts from leakage resilience to retrofit side-channel protection on unprotected hardware AES engines by means of software-only modifications. The LR-PRF construction leverages frequent key changes and low data complexity together with key dependent noise from parallel hardware to protect against side-channel attacks. Contrary to most other protection mechanisms such as time-based hiding, no additional true randomness is required. Our concept relies on parallel S-boxes in the AES hardware implementation, a feature that is fortunately present in many microcontrollers as a measure to increase performance. In a case study, we implement the protected AEAD scheme for two popular ARM Cortex-M microcontrollers with differing parallelism. We evaluate the protection capabilities in realistic IoT attack scenarios, where non-invasive EM probes or power consumption measurements are employed by the attacker. We show that the concept provides the side-channel hardening that is required for the long-term security of IoT devices.

A Fast AES Hardware Security Module for Internet of Things Applications

As the Internet of Things is used in various fields, Internet of Things security has become important. Since most Internet of Things devices is implemented as embedded systems, they provide a software-implemented encryption algorithm. Most embedded systems use relatively low-performance CPUs and the software processes data serially, making it difficult to process complex security algorithms in real-time. Therefore, it is necessary to have a stable encryption module with less impact on system performance. In this paper, we designed an AES hardware security module. Because it is implemented with dedicated hardware, it can process a strong encryption algorithm in real time without affecting the performance of the system. The proposed AES hardware module is designed using Verilog-HDL, tested in ModelSim and implemented in Altera FPGA Cycloneâ…£. The designed AES hardware adopts parallel processing technique and pipeline structure considering the computational complexity and processing order of the algorithm. As a result, it is faster than AES modules implemented in software. In addition, its latency was reduced to about 280 ns, which is about 16 % of the latency of the previous AES hardware module. Not only did the performance improve, but the number of logic elements and registers also decreased to 83.6% and 92.8%, respectively. The proposed AES hardware module is verified by applying it to a door lock system and is expected to be applied to various Internet of Things devices.

High-Performance Architecture for Concurrent Error Detection for AES Processors

This paper proposes an efficient scheme for concurrent error detection for hardware implementations of the block cipher AES. In the proposed scheme, the circuit component for the round function is divided into two stages, which are used alternately for encryption (or decryption) and error checking in a pipeline. The proposed scheme has a limited overhead with respect to size and speed for the following reasons. Firstly, the need for a double number of clock cycles is eliminated by virtue of the reduced critical path. Secondly, the scheme only requires minimal additional circuitry for error detection since the detection is performed by the remaining encryption (or decryption) components within the pipeline. AES hardware with the proposed scheme was designed and synthesized by using 90-nm CMOS standard cell library with various constraints. As a result, the proposed circuit achieved 1.66Gbps @ 12.9 Kgates for the compact version and 4.22Gbps @ 30.7 Kgates for the high-speed version. These performance characteristics are comparable to those of a basic AES circuit without error detection, where the overhead of the proposed scheme is estimated to be 14.5% at maximum. The proposed circuit was fabricated in the form of a chip, and its error detection performance was evaluated through experiments. The chip was tested with respect to fault injection by using clock glitch, and the proposed scheme successfully detected and reacted to all introduced errors.

On Clock-Based Fault Analysis Attack for an AES Hardware Using RSL

As one of the logic-level countermeasures against DPA (Differential Power Analysis) attacks, Random Switching Logic (RSL) was proposed by Suzuki, Saeki and Ichikawa in 2004 [9]. The RSL technique was applied to AES hardware and a prototype chip was implement with a 0.13-µm standard CMOS library for evaluating the DPA resistance [10]. Although the main purpose of using RSL is to resist the DPA attacks, our experimental results of Clock-based Fault Analysis (CFA) show that one can reveal the secret information from the prototype chip. This paper explains the mechanism of the CFA attack and discusses the reason for the success of the attack against a prototype implementation of AES with RSL (RSL-AES). Furthermore, we consider an ideal RSL-AES implementation that counteracts the CFA attacks.