Cryptographic Circuits Research Articles

Timing issues on power side-channel leakage of advanced encryption standard circuits designed by high-level synthesis

In recent years, field programmable gate array (FPGA) have been used in many internet of things (IoT) devices and are equipped with cryptographic circuits to ensure security. However, they are exposed to the risk of cryptographic keys being stolen by side-channel attacks. Countermeasures against side-channel attacks have been developed, but they are becoming more of a threat to IoT devices due to the diversity of attacks. Therefore, it is necessary to understand the basic characteristics of side-channel attacks. Therefore, this study clarifies the relationship between two timing issues, the clock period of the circuit and the power sampling interval, and the amount of side-channel leakage. We design seven advanced encryption standard (AES) circuits with different clock periods and conduct empirical experiments using logic simulations to clarify the correlation between the two timings and the amount of side-channel leakage. T-test is used to evaluate the leakage amount, which is evaluated based on four metrics. From the results, we argue that the clock period and sampling interval do not interfere with each other in the side-channel leakage amount.

Photonic Cryptographic Circuits for All-Photonics Network

Photonic Cryptographic Circuits for All-Photonics Network

SAT-based Formal Verification of Fault Injection Countermeasures for Cryptographic Circuits

Fault injection attacks represent a type of active, physical attack against cryptographic circuits. Various countermeasures have been proposed to thwart such attacks, however, the design and implementation of which are intricate, error-prone, and laborious. The current formal fault-resistance verification approaches are limited in efficiency and scalability. In this paper, we formalize the fault-resistance verification problem and show that it is coNP-complete. We then devise a novel approach for encoding the fault-resistance verification problem as the Boolean satisfiability (SAT) problem so that modern off-the-shelf SAT solvers can be utilized. The approach is implemented in an open-source tool FIRMER which is evaluated extensively on realistic cryptographic circuit benchmarks. The experimental results show that FIRMER is able to verify fault-resistance of almost all (72/76) benchmarks in 3 minutes (the other three are verified in 35 minutes and the hardest one is verified in 4 hours). In contrast, the prior approach fails on 31 fault-resistance verification tasks even after 24 hours (per task).

Fault-Resistant Partitioning of Secure CPUs for System Co-Verification against Faults

Fault injection attacks are a serious threat to system security, enabling attackers to bypass protection mechanisms or access sensitive information. To evaluate the robustness of CPU-based systems against these attacks, it is essential to analyze the consequences of the fault propagation resulting from the complex interplay between the software and the processor. However, current formal methodologies combining hardware and software face scalability issues due to the monolithic approach used. To address this challenge, this work formalizes the k-fault-resistant partitioning notion to solve the fault propagation problem when assessing redundancy-based hardware countermeasures in a first step. Proven security guarantees can then reduce the remaining hardware attack surface when introducing the software in a second step. First, we validate our approach against previous work by reproducing known results on cryptographic circuits. In particular, we outperform state-of-the-art tools for evaluating AES under a three-fault-injection attack. Then, we apply our methodology to the OpenTitan secure element and formally prove the security of its CPU’s hardware countermeasure to single bit-flip injections. Besides that, we demonstrate that previously intractable problems, such as analyzing the robustness of OpenTitan running a secure boot process, can now be solved by a co-verification methodology that leverages a k-fault-resistant partitioning. We also report a potential exploitation of the register file vulnerability in two other software use cases. Finally, we provide a security fix for the register file, prove its robustness, and integrate it into the OpenTitan project.

Optical Cryptographic Circuit Technology Consisting of Optical Logic Gates for a Secure Information-processing Platform

Optical Cryptographic Circuit Technology Consisting of Optical Logic Gates for a Secure Information-processing Platform

High Performance M-Term Karatsuba-Like Multiplier for Finite Field Arithmetic

Abstract: Finite field multiplication plays a crucial role in cryptographic circuits due to its widespread application. However, building circuits for these multiplications poses significant challenges due to their complexity. To mitigate this, the Karatsuba algorithm is employed, dividing each number into n/2 bits to reduce space complexity. While this approach reduces space complexity, it also increases time complexity. In our research, we introduce a hybrid approach, implementing a Karatsuba-like multiplier that combines elements of both Karatsuba and SBM (school book multiplication) techniques. Here in the proposed design, we replace the Array multiplier with a Wallace tree multiplier to further enhance design performance. This combination effectively reduces both time and space complexity. Our findings, based on reported device utilization and latency, demonstrate that the proposed multiplier outperforms the standard Karatsuba multiplier in terms of speed and efficiency, particularly in the area–delay product metric.

Double laser-faults based PFA on cryptographic circuits with algebraic analysis

Cryptographic algorithms have been employed in a variety of fields as the primary method to protect information security. The security of a cryptographic algorithm is closely related to its operating environment and physical devices. Algebraic Persistent Fault Analysis (APFA) is a new fault analysis method for block ciphers proposed in CHES 2022, which utilizes the fault that persists in encryptions and introduces algebraic analysis in the fault analysis step. In the fault injection step, as the transistors of the integrated circuit are getting smaller and tighter, even high-precision devices may cause more than one fault per injection. However, more faults may lead to a more efficient attack in the fault analysis step. In this paper, APFA for double faults is proposed, which can deal with the double faults model and reduce the number of required ciphertexts. The practicality of our fault injection is validated by laser fault injection experiments on the SRAM embedded in an ATmega163L microcontroller. The effectiveness of our fault analysis is proven by successfully recovering the key of PRESENT-128 and AES-128. The number of ciphertexts needed for key recovery is reduced by 46% compared to PFA with a single fault.

Locking-Enabled Security Analysis of Cryptographic Circuits

Hardware implementations of cryptographic primitives require protection against physical attacks and supply chain threats. This raises the question of secure composability of different attack countermeasures, i.e., whether protecting a circuit against one threat can make it more vulnerable against a different threat. In this article, we study the consequences of applying logic locking, a popular design-for-trust solution against intellectual property piracy and overproduction, to cryptographic circuits. We show that the ability to unlock the circuit incorrectly gives the adversary new powerful attack options. We introduce LEDFA (locking-enabled differential fault analysis) and demonstrate for several ciphers and families of locking schemes that fault attacks become possible (or consistently easier) for incorrectly unlocked circuits. In several cases, logic locking has made circuit implementations prone to classical algebraic attacks with no fault injection needed altogether. We refer to this “zero-fault” version of LEDFA by the term LEDA, investigate its success factors in-depth and propose a countermeasure to protect the logic-locked implementations against LEDA. We also perform test vector leakage assessment (TVLA) of incorrectly unlocked AES implementations to show the effects of logic locking regarding side-channel leakage. Our results indicate that logic locking is not safe to use in cryptographic circuits, making them less rather than more secure.

Secure nano-communication framework using RSCV cryptographic circuit in IBM Q

In the cryptographic domain, quantum and its real-time hardware simulation make it easier to secure data during communication. Here, using quantum logic, a unique encryption technique called Reversible select, cross, and variation (RSCV) encryption and decryption, which involves swapping input data halves, is shown. In this article using IBM Q, we created a cryptographic encoder and decoder circuit design utilizing various quantum gates. Based on the encoder/decoder circuit, a simple nanocommunication framework is proposed. Further, to explore the application of the noise model, how to utilize this model to create noisy replicas of these quantum circuits to research the impacts of noise that occur for actual device output is shown. To reduce measurement mistakes, measurement calibration is performed using qiskit ignis model. Preparing all 2n basis input states and calculating the likelihood of counting in the other basis states are the key concepts. The percentage improvement we achieved is 40%, 30%, and 30%, respectively, compared to earlier ones, in RSCV encryption, decryption, and RSCV cryptographic communication architecture for fake provider noise error model. It is feasible to adjust the average outcomes of an additional interesting experiment using these calibrations.

Research on a Random Mask Infection Countermeasure against Double Fault Attacks

The infection countermeasure, in which the main idea is to prevent adversaries from exploiting faulty ciphertexts to break the key by spreading the induced fault, is a very effective countermeasure against fault attacks. However, most existing infection countermeasures struggle to defend against double-fault attacks effectively due to the single-fault assumption. By analyzing the principle of infection mechanism and adding different random Boolean masks in the two encryption paths, this paper proposes a measure called a random mask infection countermeasure to defend against double-fault attacks. In addition, the multiplication mask is used to randomize the fault diffusion to further resist single-byte fault attacks. The experimental results indicate that the random mask infection countermeasure proposed can perform fault diffusion effectively when the cryptographic circuit suffers double-fault attacks, and the fault diffusion shows randomness, and can effectively defend against these fault attacks.

Empirical analysis of power side-channel leakage of high-level synthesis designed AES circuits

<span>Many internet of things (IoT) devices and integrated circuit (IC) cards have been compromised by side-channel attacks. Power-analysis attacks, which identify the secret key of a cryptographic circuit by analyzing the power traces, are among the most dangerous side-channel attacks. Gen-erally, there is a trade-off between execution time and circuit area. However, the correlation between security and performance has yet to be determined. In this study, we investigate the cor-relation between side-channel attack resistance and performance (execution time and circuit area) of advanced encryption standard (AES) circuits. Eleven AES circuits with different performances are designed by high-level synthesis and logic synthesis. Of the eleven AES circuits, six are circuits with no side-channel attack countermeasures and five are circuits with masking countermeasures. We employ four metrics based on a T-test to evaluate the side-channel attack resistance. The results based on the correlation coefficient show the correlation between side-channel attack resistance and performance. The correlation varies according to four metrics or masking countermeasure. We argue that designers should change their attitudes towards circuit design when considering security.</span>

Laser Voltage Probing Attack Detection With 100% Area/Time Coverage at Above/Below the Bandgap Wavelength and Fully-Automated Design

In this work, a detection scheme signaling the occurrence of laser voltage probing (LVP) attacks in digital designs (e.g., cryptographic circuits) is introduced. The scheme comprises a standard cell-based photosensor fabric and distributed detectors. By construction, the scheme conforms the standard cell design discipline, restricted layout design rules, and commercial place and route tools. This allows seamless integration with automated design flows, and immediate adoption in a design-agnostic fashion. Hundred percentage time and area coverage is achieved for full protection against LVP attacks, while not requiring any calibration. Extensive attacks with <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\sim $</tex-math> </inline-formula> 150 h of characterization with a state-of-the-art LVP equipment on a 28-nm testchip demonstrate laser detection at both above-and below-bandgap wavelengths and, hence, even at the very low electron-hole pair generation rate of the former ones. Attacks to an advanced encryption standard (AES) core are shown to be flagged at any practical laser intensity and best-in-class true 220-nm laser spot. Low circuit activity confines its power to leakage, amounting to <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$&lt;$</tex-math> </inline-formula> 0.1% of the AES power. At the worst case, 150% area overhead is substantially lower in practical cases where the information-sensitive blocks are a portion of it (e.g., <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$&lt;$</tex-math> </inline-formula> 20% in an advanced reduced instruction set computer machines (ARM) Cortex-M4 processor with a secure AES accelerator). To the best of the authors’ knowledge, this is the first demonstration of a design-agnostic on-chip protection against LVP attacks with full-area coverage under unmodified manufacturing/packaging process.

Correlation between 1064 nm laser attack and thermal behavior in STT-MRAM

In this paper, the impact of a 1064 nm laser attack on an STT-MRAM cell is experimentally studied in real-time, for the first time, during reading and writing operations, in order to understand the behavior of a sensing circuit under a temperature variation from 25 °C to 105 °C. This must be considered for the implementation of a hybrid CMOS/MRAM Light-Weight Cryptography circuit, to overcome a laser attack. We highlight a reading current variation during the laser shots, that can impact the sensing circuits. The switching probability between the two states has been measured as well as the impact of the irradiation time, laser power, and cell size. We correlate the results with electrical characterizations in a wide range of temperatures, demonstrating the 1064 nm laser attack thermally affects the STT-MRAM behavior. In conclusion, suitable countermeasures can be adopted.

A novel on-chip linear and switching mixed regulation against power analysis attacks

On-chip voltage converters such as low drop-out (LDO) regulators are capable of generating fast and scaled voltage levels against power analysis attacks (PAAs) due to the high bandwidths of feedback loops. Unfortunately, LDO regulators suffer from much power loss when they are utilized for outputting scaled voltage levels. In contrast, buck converters may achieve high power conversion efficiencies but are unable to generate output voltage with fast scaling patterns. In this paper, a novel hybrid voltage regulator that is consist of an LDO regulator and a buck converter connected in parallel is proposed to address the issues related with security against PAAs and power loss. The LDO regulator offers fast scaled voltage levels while the buck converter provides major load current. The result shows that the measurement-to-disclosure (MTD) value of a cryptographic circuit (CC) with the proposed hybrid voltage regulator maintains over 2 million with a 4.3% power loss.

New Approaches of Side-Channel Attacks Based on Chip Testing Methods

The state-of-the-art test infrastructure security is based on the assumption of preventing access to the sensitive information and the (publicly) accessible outputs or test infrastructure subset are supposed to not leak any secret information. In addition, for achieving functional safety requirements, the on-chip test infrastructure is re-used in-field and cannot be completely disabled after manufacturing test phase. Therefore, the access to the scan chains or similar test access ports which can lead to sensitive information needs to be restricted or encrypted to guarantee the security of the test infrastructure. However, in this work we show that having access to (small delay) test results on insensitive (public) outputs can in fact reveal secret data. Using real hardware, we have performed template attacks using the results of delay testing on the output of cryptographic circuits and were able to retrieve the key with very few test inputs. This template attack requires only a few random patterns on the victim device, which could be different from the device used for template building. In addition, the attack is also resilient against runtime variation and noise, as well as inaccuracies and down-sampling of delay testing measurements.

A machine learning low‐dropout regulator‐assisted differential power analysis attack countermeasure with voltage scaling

SummaryFalse key‐controlled aggressive voltage scaling (FKCAVS) technique is a lightweight and effective leakage power analysis (LPA) attack countermeasure. However, the regular FKCAVS technique may not be utilized as a countermeasure against differential power analysis (DPA) attacks unconditionally. The primary reason is that the working frequency of DPA attacks is significantly higher than the corresponding frequency of LPA attacks. Thus, it is difficult to make the speed of voltage scaling keep pace with the speed of DPA attacks by employing the regular FKCAVS technique. In this paper, a fast FKCAVS technique is proposed to maximize the security of a cryptographic circuit (CC) against DPA attacks while minimizing the corresponding overhead by embedding a machine learning low‐dropout (LDO) regulator (MLLR). As shown in the result, by deploying the proposed FKCAVS technique, the measurement‐to‐disclose (MTD) value against DPA attacks is maintained over 1 million with less than 17.4% power/area overhead.

On Side-Channel Analysis of Memristive Cryptographic Circuits

Memristive technologies offer fascinating opportunities for unconventional computing architectures and emerging applications. While memristive devices have received substantial attention as sources of entropy for security applications, security vulnerabilities of memristive technologies for implementing cryptographic circuits have been largely neglected so far. In this article, we provide the first in-depth analysis of power side-channel analysis against memristive cryptographic implementations based on both: physical experiments and simulations. We show that power consumption models developed for CMOS are not fully adequate for memristive circuits. In particular, the memory effect makes even input-independent initialization cycles vulnerable to attacks that would be fundamentally impossible in CMOS technologies. We propose a memristive-oriented Power Estimation Model (mPEM) integrated into the Stochastic Approach (StA) framework and demonstrate its effectiveness against larger-scale circuits. Finally, we demonstrate that attack countermeasures that were effective for CMOS fail for fundamental reasons in the memristive case.

A Comprehensive Evaluation of Integrated Circuits Side-Channel Resilience Utilizing Three-Independent-Gate Silicon Nanowire Field Effect Transistors-Based Current Mode Logic

Side-channel attack (SCA) is one of the physical attacks, which will reveal the confidential information from cryptographic circuits by statistically analyzing physical manifestations. Various circuit-level countermeasures have been proposed as fundamental solutions to eliminate the correlations between side-channel information and circuit’s internal operations. The existing solutions, however, will introduce nonnegligible power and area overheads, making them difficult to be deployed in resource-constrained applications. In this article, a novel three-independent-gate silicon nanowire field effect transistor (TIGFET) with the intrinsic SCA-resilience characteristics is introduced to balance the tradeoffs among cost, performance, and security of cryptographic implementations. We construct six TIGFET-based current mode logic (CML) gates that can retain lower power variation under all possible transitions compared to the CMOS counterparts. As a proof of concept, advanced encryption standard (AES), SM4 block cipher algorithm (SM4), and lightweight cryptographic algorithm PRESENT are implemented utilizing the TIGFET-based CML gates. Correlation power attack is performed to evaluate the improvement of SCA resilience. Simulation results verify that the TIGFET-based cryptographic implementations decrease 42.37% area usage, lower 61.16% energy efficiency, reduce <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$5.35\times $ </tex-math></inline-formula> power variation, and achieve a similar level of SCA resistance compared to the CMOS counterpart, which is applicable for the resource-constrained applications.

TSCL: A time–space crossing location for side-channel leakage detection

Cryptographic algorithms on devices are vulnerable to the so-called side-channel attacks(SCAs). The security evaluation of the cryptographic circuits is necessary to provide earlier leakage detection before manufacture. However, the complexity of locating leakage points is high because of the long execution time and the large scale of the circuit. To overcome this limitation, we propose an efficient leakage location method named time–space crossing location(TSCL) to locate the leakage in the hardware design, which combines the dynamic and static analysis. Unlike the traditional detection methods, we analyze the design features and power consumption characteristics of implementation to construct the candidate set on dynamic detection while further verifying candidate leakage points in the static detection stage. The t -test is known as a dynamic detection method to decrease the time of formal verification based on label propagation. The design features decrease the complexity of dynamic detection while the results of power consumption analysis promote static detection. We confirm the efficiency of the proposed method on unprotected and masking implementation of AES. Moreover, TSCL can be regarded as a third-party tool in the existing EDA tools of hardware design.

Time- and Amplitude-Controlled Power Noise Generator against SPA Attacks for FPGA-Based IoT Devices

Power noise generation for masking power traces is a powerful countermeasure against Simple Power Analysis (SPA), and it has also been used against Differential Power Analysis (DPA) or Correlation Power Analysis (CPA) in the case of cryptographic circuits. This technique makes use of power consumption generators as basic modules, which are usually based on ring oscillators when implemented on FPGAs. These modules can be used to generate power noise and to also extract digital signatures through the power side channel for Intellectual Property (IP) protection purposes. In this paper, a new power consumption generator, named Xored High Consuming Module (XHCM), is proposed. XHCM improves, when compared to others proposals in the literature, the amount of current consumption per LUT when implemented on FPGAs. Experimental results show that these modules can achieve current increments in the range from 2.4 mA (with only 16 LUTs on Artix-7 devices with a power consumption density of 0.75 mW/LUT when using a single HCM) to 11.1 mA (with 67 LUTs when using 8 XHCMs, with a power consumption density of 0.83 mW/LUT). Moreover, a version controlled by Pulse-Width Modulation (PWM) has been developed, named PWM-XHCM, which is, as XHCM, suitable for power watermarking. In order to build countermeasures against SPA attacks, a multi-level XHCM (ML-XHCM) is also presented, which is capable of generating different power consumption levels with minimal area overhead (27 six-input LUTS for generating 16 different amplitude levels on Artix-7 devices). Finally, a randomized version, named RML-XHCM, has also been developed using two True Random Number Generators (TRNGs) to generate current consumption peaks with random amplitudes at random times. RML-XHCM requires less than 150 LUTs on Artix-7 devices. Taking into account these characteristics, two main contributions have been carried out in this article: first, XHCM and PWM-XHCM provide an efficient power consumption generator for extracting digital signatures through the power side channel, and on the other hand, ML-XHCM and RML-XHCM are powerful tools for the protection of processing units against SPA attacks in IoT devices implemented on FPGAs.