ARM Cortex-M4 Microcontroller Research Articles

A high gain Z-source boost DC–DC converter with common ground for solar PV applications

This paper proposes a high-gain dc–dc converter with common ground utilizing a Z-source network for low voltage solar photovoltaic (PV) applications. This converter features a common ground and a high output–input voltage conversion factor at a low duty cycle. These converters find their most common application in grid-tied or stand-alone solar photovoltaic systems, particularly those with low output voltages that must be increased to the required level. The presented converter operating duty ratio is within 0–0.5 and maintains similar voltage stress on Z-network components since it employs the conventional Z-source configuration. The presented converter provides a common ground between source and load, unlike conventional Z-network converter. A type-2 closed-loop voltage controller and state–space average model evaluate the converter’s dynamic behavior for reliable and steady performance. A laboratory hardware prototype of 250 Watts is built and low gate signals are generated by using a ARM cortex M4 Microcontroller (STM32F407VGT6). The experimental results confirm that the proposed converter, with a gain of 10.46 and a power of 250 Watts, has a maximum efficiency of around 93%. The experimental results validates the effectiveness of the proposed converter under both constant and shifts in amounts of solar irradiation.

Realization of ultracapacitor as sole energy storage device in induction motor drive electric vehicle with modified state timing based field weakening control algorithm

This article employs the concept of realizing an electric vehicle (EV) driven by an induction motor (IM) with an ultracapacitor (UC) as a sole energy storage device for a short distance range in city drive. In battery-driven EVs, the performance of batteries will extensively degrade during frequent start, stop, acceleration and deceleration of the vehicle. However, UC can withstand that circumstance without any degradation. High charge/discharge efficiency, high power density, high temperature withstand capabilities and quick charging capability allows UC to run the EV for an extended range, including the regenerative braking technique. Apart from source, EVs also require efficient drive control for a smooth vehicle operation in the entire driving range. To achieve the vehicle characteristics, it is preferred to operate the propulsion drive in the field weakening (FW) region over the constant torque region. This paper also proposes a Modified State Timing SVPWM Based Control Algorithm for the FW region operation of IM for EV applications. The proposed algorithm is designed to overcome the torque ripple issue of the conventional SVPWM Based Control Algorithm in the FW region. The reduction in torque ripple is achieved by imposing current and voltage limits on the motor d and q axis by considering a maximum modulation index of 1.2732 and with an additional current loop for mitigating the transients in the torque due to sudden variation of the load. The simulation/hardware studies show a smooth operation of UC-driven EV for an entire driving range with a 78.57 percent improvement in torque ripple in the FW region by the proposed algorithm compared with the conventional FW control algorithm. The real time Lab prototype of UC driven EV has been developed and the proposed algorithm has been validated in real-time using the STM32F407VGTx ARM Cortex M4 microcontroller.

A Reconfigurable Near-Sensor Processor for Anomaly Detection in Limb Prostheses.

This paper presents a reconfigurable near-sensor anomaly detection processor to real-time monitor the potential anomalous behaviors of amputees with limb prostheses. The processor is low-power, low-latency, and suitable for equipment on the prostheses and comprises a reconfigurable Variational Autoencoder (VAE), a scalable Self-Organizing Map (SOM) Array, and a window-size-adjustable Markov Chain, which can implement an integrated miniaturized anomaly detection system. With the reconfigurable VAE, the proposed processor can support up to 64 sensor sampling channels programmable by global configuration, which can meet the anomaly detection requirements in different scenarios. A scalable SOM array allows for the selection of different sizes based on the complexity of the data. Unlike traditional time accumulation-based anomaly detection methods, the Markov Chain is utilized to detect time-series-based anomalous data. The processor is designed and fabricated in a UMC 40-nm LP technology with a core area of 1.49 mm2 and a power consumption of 1.81 mW. It achieves real-time detection performance with 0.933 average F1 Score for the FSP dataset within 24.22 μs, and 0.956 average F1 Score for the SFDLA-12 dataset within 30.48 μs, respectively. The energy dissipation of detection for each input feature is 43.84 nJ with the FSP dataset, and 55.17 nJ with the SFDLA-12 dataset. Compared with ARM Cortex-M4 and ARM Cortex-M33 microcontrollers, the processor achieves energy and area efficiency improvements ranging from 257×, 193× and 11×, 8×, respectively.

Design and Implementation of an Atrial Fibrillation Detection Algorithm on the ARM Cortex-M4 Microcontroller.

At present, a medium-level microcontroller is capable of performing edge computing and can handle the computation of neural network kernel functions. This makes it possible to implement a complete end-to-end solution incorporating signal acquisition, digital signal processing, and machine learning for the classification of cardiac arrhythmias on a small wearable device. In this work, we describe the design and implementation of several classifiers for atrial fibrillation detection on a general-purpose ARM Cortex-M4 microcontroller. We used the CMSIS-DSP library, which supports Naïve Bayes and Support Vector Machine classifiers, with different kernel functions. We also developed Python scripts to automatically transfer the Python model (trained in Scikit-learn) to the C environment. To train and evaluate the models, we used part of the data from the PhysioNet/Computing in Cardiology Challenge 2020 and performed simple classification of atrial fibrillation based on heart-rate irregularity. The performance of the classifiers was tested on a general-purpose ARM Cortex-M4 microcontroller (STM32WB55RG). Our study reveals that among the tested classifiers, the SVM classifier with RBF kernel function achieves the highest accuracy of 96.9%, sensitivity of 98.4%, and specificity of 95.8%. The execution time of this classifier was 720 μs per recording. We also discuss the advantages of moving computing tasks to edge devices, including increased power efficiency of the system, improved patient data privacy and security, and reduced overall system operation costs. In addition, we highlight a problem with false-positive detection and unclear significance of device-detected atrial fibrillation.

IoT-Enabled System for Detection, Monitoring, and Tracking of Nuclear Materials

A low-cost embedded system for high-energy radiation detection applications was developed for national security proposes, mainly to detect nuclear material and send the detection event to the cloud in real time with tracking capabilities. The proof of concept was built with state-of-the-art electronics such as an adequate Si-based photodetector, a trans-impedance amplifier, an ARM Cortex M4 microcontroller with sufficient ADC capture capabilities, an ESP8266 Internet of Things (IoT) module, an optimized Message Queuing Telemetry Transport (MQTT) protocol, a MySQL data base, and a Python handler program. The system is able to detect alfa particles and send the nuclear detection events to the CloudMQTT servers. Moreover, the detection message records the date and time of the ionization event for the tracking application, and due to a particular MQTT-optimized protocol the message is sent with low latency. Furthermore, the designed system was validated with a standard radiation instrumentation preamplifier 109A system from ORTEC company, and more than one node was demonstrated with an internet connection employing a 20,000 bits/s CloudMQTT plan. Therefore, the design can be escalated to produce a robust big data multisensor network.

DNN Is Not All You Need: Parallelizing Non-neural ML Algorithms on Ultra-low-power IoT Processors

Machine Learning (ML) functions are becoming ubiquitous in latency- and privacy-sensitive IoT applications, prompting a shift toward near-sensor processing at the extreme edge and the consequent increasing adoption of Parallel Ultra-low-power (PULP) IoT processors. These compute- and memory-constrained parallel architectures need to run efficiently a wide range of algorithms, including key Non-neural ML kernels that compete favorably with Deep Neural Networks in terms of accuracy under severe resource constraints. In this article, we focus on enabling efficient parallel execution of Non-neural ML algorithms on two RISCV-based PULP platforms, namely, GAP8, a commercial chip, and PULP-OPEN, a research platform running on an FPGA emulator. We optimized the parallel algorithms through a fine-grained analysis and intensive optimization to maximize the speedup, considering two alternative Floating-point (FP) emulation libraries on GAP8 and the native FPU support on PULP-OPEN. Experimental results show that a target-optimized emulation library can lead to an average 1.61× runtime improvement and 37% energy reduction compared to a standard emulation library, while the native FPU support reaches up to 32.09× and 99%, respectively. In terms of parallel speedup, our design improves the sequential execution by 7.04× on average on the targeted octa-core platforms leading to energy and latency decrease up to 87%. Last, we present a comparison with the ARM Cortex-M4 microcontroller, a widely adopted commercial solution for edge deployments, which is 12.87× slower than PULP-OPEN.

Fiddling the Twiddle Constants - Fault Injection Analysis of the Number Theoretic Transform

In this work, we present the first fault injection analysis of the Number Theoretic Transform (NTT). The NTT is an integral computation unit, widely used for polynomial multiplication in several structured lattice-based key encapsulation mechanisms (KEMs) and digital signature schemes. We identify a critical single fault vulnerability in the NTT, which severely reduces the entropy of its output. This in turn enables us to perform a wide-range of attacks applicable to lattice-based KEMs as well as signature schemes. In particular, we demonstrate novel key recovery and message recovery attacks targeting the key generation and encryption procedure of Kyber KEM. We also propose novel existential forgery attacks targeting deterministic and probabilistic signing procedure of Dilithium, followed by a novel verification bypass attack targeting its verification procedure. All proposed exploits are demonstrated with high success rate using electromagnetic fault injection on optimized implementations of Kyber and Dilithium, from the open-source pqm4 library on the ARM Cortex-M4 microcontroller. We also demonstrate that our proposed attacks are capable of bypassing concrete countermeasures against existing fault attacks on lattice-based KEMs and signature schemes. We believe our work motivates the need for more research towards development of countermeasures for the NTT against fault injection attacks.

A 96.2-nJ/class Neural Signal Processor With Adaptable Intelligence for Seizure Prediction

This work presents the world’s first neural signal processor for seizure prediction, which includes a preprocessing unit, a feature extractor, a reconfigurable support vector machine (SVM) kernel, and a postprocessing unit. Seizure prediction performance is enhanced by on-chip training for model adaptation. Design optimization is applied across the layers of abstraction to minimize the area and energy. The area of the feature extractor is reduced by 28% with an approximated energy operator (AEO). The proposed scaling-based Newton–Raphson (NR) divider reduces the required number of iterations for division by 62.5%. For alternating direction method of multipliers (ADMM)-based SVM training, the computational complexity is reduced by up to 99.9% through pointer-based matrix multiplication. By leveraging the LDL decomposition, 80% multiplications for updating weights are saved. The chip achieves a seizure prediction performance with a 92.0% sensitivity and a 0.57/h false alarm rate (FAR). The training latency is 8.44 ms with a power dissipation of 2.31 mW at 6.05 MHz. Compared with an ARM Cortex-M3 microcontroller, this work achieves a <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$124\times $ </tex-math></inline-formula> higher area efficiency and a <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$299\times $ </tex-math></inline-formula> higher energy efficiency. The chip also supports seizure detection and achieves a sensitivity of 98.6% and an FAR of 0.18/h, exceeding the state-of-the-art designs.

RESEARCH OF A MICROCONTROLLER CHARGER FOR LITHIUM BATTERIES

Lithium battery chargers work on the principle of limiting the charge voltage. Among the features of such a charge, the following parameters are distinguished, such as a 3—4 times increase in the voltage of the lithium battery cell, smaller allowable deviations of the charge voltage (linearity of the current-voltage characteristic) and the absence of the need for a compensatory charge (jet recharging) after the battery reaches a state of full charge . Let's consider the specifics of the charge on the example of portable lithium batteries with an output voltage of 4.2 V, the specifics of the charge of which (and with a higher output voltage) consists in the use of the CC-CV method.&#x0D; To simulate the operation of the charger and debug the MK program, an electrical schematic diagram was compiled in the ISIS Proteus environment. To test this circuit, the model includes an STM32F103 MC, which is used to generate a PWM signal whose frequency is 62 kHz. Next, the output current is measured, with a setting of the PWM signal strength within 50 %. According to the indicators at the output of the operational amplifier in the current measurement mode, it is possible to determine the current in the ammeter battery circuit.&#x0D; Based on the simulation results of the developed scheme and algorithm, it can be concluded that this scheme ensures the fulfillment of the necessary modes of operation of the investigated charging device and is suitable for further implementation. A 32-bit MC of the STM32F103C8 series, located on the BluePill platform — a development board for the ARM Cortex M3 microcontroller, was selected as the control element of the control unit. The stable operating mode of the MK is ensured by two crystal oscillators of 8 MHz and 32768 Hz, and using the built-in frequency multiplier, the MK provides support for the operating frequency equal to 72 MHz.&#x0D; As a result, the functionality of the charger circuit and the SS-СV algorithm for fast charging of lithium batteries was developed and confirmed. The use of the CC-CV charge method made it possible to increase the output current of the charge, as well as reduce the time required to restore the energy properties of the battery, while current fluctuations are reduced by 96 %, compared to schemes that use only constant voltage methods.

Find the Bad Apples: An efficient method for perfect key recovery under imperfect SCA oracles – A case study of Kyber

Side-channel resilience is a crucial feature when assessing whether a postquantum cryptographic proposal is sufficiently mature to be deployed. In this paper, we propose a generic and efficient adaptive approach to improve the sample complexity (i.e., the required number of traces) of plaintext-checking (PC) oracle-based sidechannel attacks (SCAs), a major class of key recovery chosen-ciphertext SCAs on lattice-based key encapsulation mechanisms (KEMs). This new approach is preferable when the constructed PC oracle is imperfect, which is common in practice, and its basic idea is to design new detection codes that can determine erroneous positions in the initially recovered secret key. These secret entries are further corrected with a small number of additional traces. This work benefits from the generality of PC oracle and thus is applicable to various schemes and implementations.Our main target is Kyber since it has been selected by NIST as the KEM algorithm for standardization. We instantiated the proposed generic attack on Kyber512 and then conducted extensive computer simulations against Kyber512 and FireSaber. We further mounted an electromagnetic (EM) attack against an optimized implementation of Kyber512 in the pqm4 library running on an STM32F407G board with an ARM Cortex-M4 microcontroller. These simulations and real-world experiments demonstrate that the newly proposed attack could greatly improve the state-of-the-art in terms of the required number of traces. For instance, the new attack requires only 41% of the EM traces needed in a majority-voting attack in our experiments, where the raw oracle accuracy is fixed.

SoK: SCA-secure ECC in software – mission impossible?

This paper describes an ECC implementation computing the X25519 keyexchange protocol on the Arm Cortex-M4 microcontroller. For providing protections against various side-channel and fault attacks we first review known attacks and countermeasures, then we provide software implementations that come with extensive mitigations, and finally we present a preliminary side-channel evaluation. To our best knowledge, this is the first public software claiming affordable protection against multiple classes of attacks that are motivated by distinct real-world application scenarios. We distinguish between X25519 with ephemeral keys and X25519 with static keys and show that the overhead to our baseline unprotected implementation is about 37% and 243%, respectively. While this might seem to be a high price to pay for security, we also show that even our (most protected) static implementation is at least as efficient as widely-deployed ECC cryptographic libraries, which offer much less protection.

A Faster Third-Order Masking of Lookup Tables

Masking of S-boxes using lookup tables is an effective countermeasure to thwart side-channel attacks on block ciphers implemented in software. At first and second orders, the Table-based Masking (TBM) schemes can be very efficient and even faster than circuit-based masking schemes. Ever since the customised second-order TBM schemes were proposed, the focus has been on designing and optimising Higher-Order Table-based Masking (HO-TBM) schemes that facilitate masking at arbitrary order. One of the reasons for this trend is that at large orders HO-TBM schemes are significantly slower and consume a prohibitive amount of RAM memory compared to circuit-based masking schemes such as bit-sliced masking, and hence efforts were targeted in this direction. However, a recent work due to Valiveti and Vivek (TCHES 2021) has demonstrated that the HO-TBM scheme of Coron et al. (TCHES 2018) is feasible to be implemented on memory-constrained devices with pre-processing capability and a competitive online execution time. Yet, currently, there are no customised designs for third-order TBM that are more efficient than instantiating a HO-TBM scheme at third order.In this work, we propose a third-order TBM scheme for arbitrary S-boxes that is secure in the probing model and under compositions, i.e., 3-SNI secure. It is very efficient in terms of the overall running time, compared to the third-order instantiations of state-of-the-art HO-TBM schemes. It also supports the pre-processing functionality. For example, the overall running time of a single execution of the third-order masked AES-128 on a 32-bit ARM-Cortex M4 micro-controller is reduced by about 80% without any overhead on the online execution time. This implies that the online execution time of the proposed scheme is approximately eight times faster than the bit-sliced masked implementation at third order, and it is comparable to the recent scheme of Wang et al. (TCHES 2022) that makes use of reuse of shares. We also present the implementation results for the third-order masked PRESENT cipher. Our work suggests that there is a significant scope for tuning the performance of HO-TBM schemes at lower orders.

An Auto-Encoder Based TinyML Approach for Real-Time Anomaly Detection

&lt;div class="section abstract"&gt;&lt;div class="htmlview paragraph"&gt;Condition monitoring plays a crucial role in the automotive space because they reduce the downtime and maintenance costs by preventing sudden catastrophic breakdown of vehicles. Condition monitoring solutions primarily monitor onboard sensor data to detect anomalies. However, with vehicles becoming more complex each day, the number of sensors to be monitored is also growing. This increases the data volume to be processed to make decisions. It is not feasible to send all the embedded sensor data captured to the cloud for processing. The network bandwidth, latency for transferring the data and finally the cost associated with data transfer are the factors which impede us from taking this approach. Much of the previous work done to address these issues has proposed Deep Learning driven onboard anomaly detection approaches. The deployment of these implementations requires power hungry and costly hardware with high computational resources. The recent advances in the field of Tiny Machine Learning have made it possible to design and deploy Deep Neural Networks on resource constrained low-cost embedded hardware. In this paper, we propose an Auto-Encoder based approach for anomaly detection in time-series vibration sensor data. The designed Auto-Encoder model has a 7.5 KB footprint and was finally deployed on a highly resource constrained ARM Cortex-M4 microcontroller with 256KB of SRAM and 1MB Flash. The model has been validated on the previous machine data. It has achieved an accuracy and precision close to 80%. Currently, by using post training quantization we are trading-off model accuracy for a reduction in model size. In future, we plan to use Quantization Aware Training which will help us in achieving even higher model accuracy.&lt;/div&gt;&lt;/div&gt;

An Intelligent Real-Time Edge Processing Maintenance System for Industrial Manufacturing, Control, and Diagnostic

This paper presents an artificial intelligence (AI) based edge processing real-time maintenance system for the purposes of industrial manufacturing control and diagnostics. The system is evaluated in a soybean processing manufacturing facility to identify abnormalities and possible breakdown situations, prevent damage, reduce maintenance costs, and increase production productivity. The system can be used in any other manufacturing or chemical processing facility that make use of motors rotating equipment in different process phases. The system combines condition monitoring, fault detection, and diagnosis using machine learning (ML) and deep learning (DL) algorithms. These algorithms are used with data resulting from the continuous monitoring of relevant production equipment and motor parameters, such as temperature, vibration, sound/noise, and current/voltage. The condition monitoring integrates intelligent Industrial Internet of Things (IIoT) devices with multiple sensors combined with AI-based techniques and edge processing. This is done to identify the parameter modifications and distinctive patterns that occur before a failure and predict forthcoming failure modes before they arise. The data from production equipment/motors is collected wirelessly using different communication protocols - such as Bluetooth low energy (BLE), Long range wide area network (LoRaWAN), and Wi-Fi - and aggregated into an edge computing processing unit via several gateways. The AI-based algorithms are embedded in the processing unit at the edge, allowing the prediction and intelligent control of the production equipment/motor parameters. IIoT devices for environmental sensing, vibration, temperature monitoring, and sound/ultrasound detection are used with embedded signal processing that runs on an ARM Cortex-M4 microcontroller. These devices are connected through either wired or wireless protocols. The system described addresses the components necessary for implementing the predictive maintenance (PdM) strategy in soybean industrial processing manufacturing environments. Additionally, it includes new elements that broaden the possibilities for prescriptive maintenance (PsM) developments to be made. The type of ML or DL techniques and algorithms used in maintenance modeling is dictated by the application and available data. The approach presented combines multiple data sources that improve the accuracy of condition monitoring and prediction. DL methods further increase the accuracy and require interpretable and efficient methods as well as the availability of significant amounts of (labeled) data.

A Wearable, Multi-Frequency Device to Measure Muscle Activity Combining Simultaneous Electromyography and Electrical Impedance Myography.

The detection of muscle contraction and the estimation of muscle force are essential tasks in robot-assisted rehabilitation systems. The most commonly used method to investigate muscle contraction is surface electromyography (EMG), which, however, shows considerable disadvantages in predicting the muscle force, since unpredictable factors may influence the detected force but not necessarily the EMG data. Electrical impedance myography (EIM) investigates the change in electrical impedance during muscle activities and is another promising technique to investigate muscle functions. This paper introduces the design, development, and evaluation of a device that performs EMG and EIM simultaneously for more robust measurement of muscle conditions subject to artifacts. The device is light, wearable, and wireless and has a modular design, in which the EMG, EIM, micro-controller, and communication modules are stacked and interconnected through connectors. As a result, the EIM module measures the bioimpedance between 20 and 200 with an error of less than 5% at 140 SPS. The settling time during the calibration phase of this module is less than 1000 ms. The EMG module captures the spectrum of the EMG signal between 20–150 Hz at 1 kSPS with an SNR of 67 dB. The micro-controller and communication module builds an ARM-Cortex M3 micro-controller which reads and transfers the captured data every 1 ms over RF (868 Mhz) with a baud rate of 500 kbps to a receptor connected to a PC. Preliminary measurements on a volunteer during leg extension, walking, and sit-to-stand showed the potential of the system to investigate muscle function by combining simultaneous EMG and EIM.

Design, analysis and implementation of electronically interfaced photovoltaic system using ARM Cortex-M4 microcontroller

This research article presents a detailed documentation regarding test-bench development of Grid Interfaced Solar Photovoltaic (GIPV) system. The proposed GIPV system is developed using Voltage Source Converter (VSC) and DC-DC boost converter. The GIPV test-bench is developed using various auxiliary circuits including voltage/current measuring circuit, signal conditioning circuit, phase-shifting circuit, complementary pulse generation circuit, and driver circuit etc. These auxiliary circuits are designed in express printed circuit board software and fabricated in laboratory to develop a complete GIPV system test-bench. A combination of modified Synchronous Reference Frame (SRF) scheme and Proportional Resonant (PR) controller is proposed for current reference generation. Amplitude adaptivity based SRF-Phase Locked Loop (SRF-PLL) is presented to precisely detect the phase-angle of grid voltage under distorted and unbalanced conditions. The prototype is implemented using a commercially cheap ARM Cortex-M4 based STM32F407VGT6 microcontroller. This microcontroller has diversified peripherals for flexible target set-up with faster computation capability and a sophisticated user interface having TCP/IP connectivity. The control structure is developed in waijung environment for automatic code generation. The effectiveness of the proposed control algorithm is tested by numerical simulations in MATLAB/Simulink. Finally, practicality of the proposed GIPV system is experimentally demonstrated using ARM based microcontroller under various operating conditions.

Embedded AM-FM Signal Decomposition Algorithm for Continuous Human Activity Monitoring

AM-FM decomposition techniques have been successfully used for extracting significative features from a large variety of signals, helping realtime signal monitoring and pattern recognition, since they represent signals as a simultaneous composition of amplitude modulation and frequency modulation, where the carriers, amplitude envelopes, and the instantaneous frequencies are the features to be estimated. Human activities often involve repetitive movements, such as in running or cycling, where sinusoidal AM-FM decompositions of signals have already demonstrated to be useful to extract compact features to aid monitoring, classification, or detection. In this work we thus present the challenges and results of implementing the iterated coherent Hilbert decomposition (ICHD), a particularly effective algorithm to obtain an AM-FM decomposition, within a resource-constrained and low-power ARM Cortex-M4 microcontroller that is present in a wearable sensor we developed. We apply ICHD to the gyroscope data acquired from an inertial measurement unit (IMU) that is present in the sensor. Optimizing the implementation allowed us to achieve real-time performance using less then 16 % of the available CPU time, while consuming only about 5.4 mW of power, which results in a run-time of over 7 days using a small 250 mAh rechargeable cell.

Practical Multiple Persistent Faults Analysis

We focus on the multiple persistent faults analysis in this paper to fill existing gaps in its application in a variety of scenarios. Our major contributions are twofold. First, we propose a novel technique to apply persistent fault apply in the multiple persistent faults setting that decreases the number of survived keys and the required data. We demonstrate that by utilizing 1509 and 1448 ciphertexts, the number of survived keys after performing persistent fault analysis on AES in the presence of eight and sixteen faults can be reduced to only 29 candidates, whereas the best known attacks need 2008 and 1643 ciphertexts, respectively, with a time complexity of 250. Second, we develop generalized frameworks for retrieving the key in the ciphertext-only model. Our methods for both performing persistent fault attacks and key-recovery processes are highly flexible and provide a general trade-off between the number of required ciphertexts and the time complexity. To break AES with 16 persistent faults in the Sbox, our experiments show that the number of required ciphertexts can be decreased to 477 while the attack is still practical with respect to the time complexity. To confirm the accuracy of our methods, we performed several simulations as well as experimental validations on the ARM Cortex-M4 microcontroller with electromagnetic fault injection on AES and LED, which are two well-known block ciphers to validate the types of faults and the distribution of the number of faults in practice.

Will You Cross the Threshold for Me?

In this work, we propose generic and novel side-channel assisted chosenciphertext attacks on NTRU-based key encapsulation mechanisms (KEMs). These KEMs are IND-CCA secure, that is, they are secure in the chosen-ciphertext model. Our attacks involve the construction of malformed ciphertexts. When decapsulated by the target device, these ciphertexts ensure that a targeted intermediate variable becomes very closely related to the secret key. An attacker, who can obtain information about the secret-dependent variable through side-channels, can subsequently recover the full secret key. We propose several novel CCAs which can be carried through by using side-channel leakage from the decapsulation procedure. The attacks instantiate three different types of oracles, namely a plaintext-checking oracle, a decryptionfailure oracle, and a full-decryption oracle, and are applicable to two NTRU-based schemes, which are NTRU and NTRU Prime. The two schemes are candidates in the ongoing NIST standardization process for post-quantum cryptography. We perform experimental validation of the attacks on optimized and unprotected implementations of NTRU-based schemes, taken from the open-source pqm4 library, using the EM-based side-channel on the 32-bit ARM Cortex-M4 microcontroller. All of our proposed attacks are capable of recovering the full secret key in only a few thousand chosen ciphertext queries on all parameter sets of NTRU and NTRU Prime. Our attacks, therefore, stress on the need for concrete side-channel protection strategies for NTRUbased KEMs.

Supersingular Isogeny Key Encapsulation (SIKE) Round 2 on ARM Cortex-M4

We present the first practical software implementation of Supersingular Isogeny Key Encapsulation (SIKE) round 2, targeting NIST's 1, 2, 3, and 5 security levels on 32-bit ARM Cortex-M4 microcontrollers. The proposed library introduces a new speed record of all SIKE Round 2 protocols with reasonable memory consumption on the low-end target platform. We achieved this record by adopting several state-of-the-art engineering techniques as well as highly-optimized hand-crafted assembly implementation of finite field arithmetic. In particular, we carefully redesign the previous optimized implementations of finite field arithmetic on the 32-bit ARM Cortex-M4 platform and propose a set of novel techniques which are explicitly suitable for SIKE primes. The benchmark result on STM32F4 Discovery board equipped with 32-bit ARM Cortex-M4 microcontrollers shows that entire key encapsulation and decapsultation over SIKEp434 take about 184 million clock cycles (i.e., 1.09 seconds @168 MHz). In contrast to the previous optimized implementation of the isogeny-based key exchange on low-end 32-bit ARM Cortex-M4, our performance evaluation shows feasibility of using SIKE mechanism on the low-end platform. In comparison to the most of the post-quantum candidates, SIKE requires an excessive number of arithmetic operations, resulting in significantly slower timings. However, its small key size makes this scheme as a promising candidate on low-end microcontrollers in the quantum era by ensuring the lower energy consumption for key transmission than other schemes.