Cryptographic Circuits Research Articles

Evaluation of Power Constant Dual-Rail Logics Countermeasures against DPA with Design Time Security Metrics

Cryptographic circuits are nowadays subject to attacks that no longer focus on the algorithm but rather on its physical implementation. Attacks exploiting information leaked by the hardware implementation are called side-channel attacks (SCAs). Among these attacks, the differential power analysis (DPA) established by Paul Kocher et al. in 1998 represents a serious threat for CMOS VLSI implementations. Different countermeasures that aim at reducing the information leaked by the power consumption have been published. Some of these countermeasures use sophisticated back-end-level constraints to increase their strength. As suggested by some preliminary works (e.g., by Li from Cambridge University), the prediction of the actual security level of such countermeasures remains an open research area. This paper tackles this issue on the example of the AES SubBytes primitive. Thirteen implementations of SubBytes, in unprotected, WDDL, and SecLib logic styles with various back-end-level arrangements are studied. Based on simulation and experimental results, we observe that static evaluations on extracted netlists are not relevant to classify variants of a countermeasure. Instead, we conclude that the fine-grained timing behavior is the main reason for security weaknesses. In this respect, we prove that SecLib, immune to early-evaluation problems, is much more resistant against DPA than WDDL.

On the Duality of Probing and Fault Attacks

In this work we investigate the problem of simultaneous privacy and integrity protection in cryptographic circuits. We consider a white-box scenario with a powerful, yet limited attacker. A concise metric for the level of probing and fault security is introduced, which is directly related to the capabilities of a realistic attacker. In order to investigate the interrelation of probing and fault security we introduce a common mathematical framework based on the formalism of information and coding theory. The framework unifies the known linear masking schemes. We proof a central theorem about the properties of linear codes which leads to optimal secret sharing schemes. These schemes provide the lower bound for the number of masks needed to counteract an attacker with a given strength. The new formalism reveals an intriguing duality principle between the problems of probing and fault security, and provides a unified view on privacy and integrity protection using error detecting codes. Finally, we introduce a new class of linear tamper-resistant codes. These are eligible to preserve security against an attacker mounting simultaneous probing and fault attacks.

A General Power Model of Differential Power Analysis Attacks to Static Logic Circuits

This paper discusses a general model of differential power analysis (DPA) attacks to static logic circuits. Focusing on symmetric-key cryptographic algorithms, the proposed analysis provides a deeper insight into the vulnerability of cryptographic circuits. The main parameters that are of interest in practical DPA attacks are derived under suitable approximations, and a new figure of merit to measure the DPA effectiveness is proposed. Worst case conditions under which a cryptographic circuit should be tested to evaluate its robustness against DPA attacks are identified and analyzed. Several interesting properties of DPA attacks are also derived from the proposed model, whose fundamental expressions are compared with the counterparts of correlation power analysis attacks. The model was validated by means of DPA attacks on an FPGA implementation of the advanced encryption standard algorithm. Experimental results show that the model has a good accuracy, as its error is always lower than 2%.

Leakage Power Analysis Attacks: A Novel Class of Attacks to Nanometer Cryptographic Circuits

In this paper, a novel class of power analysis attacks to cryptographic circuits is presented. These attacks aim at recovering the secret key of a cryptographic core from measurements of its static (leakage) power. These attacks exploit the dependence of the leakage current of CMOS integrated circuits on their inputs (including the secret key of the cryptographic algorithm that they implement), as opposite to traditional power analysis attacks that are focused on the dynamic power. For this reason, this novel class of attacks is named ¿leakage power analysis¿ (LPA). Since the leakage power increases much faster than the dynamic power at each new technology generation, LPA attacks are a serious threat to the information security of cryptographic circuits in sub-100-nm technologies. For the first time in the literature, a well-defined procedure to perform LPA attacks that is based on a solid theoretical background is presented. Advantages and measurement issues are also analyzed in comparison with traditional power analysis attacks based on dynamic power measurements. Examples are provided for various circuits, and an experimental attack to a register is performed for the first time. An analytical model of the LPA attack result is also provided to better understand the effectiveness of this technique. The impact of technology scaling is explicitly addressed by means of a simple analytical model and Monte Carlo simulations. Simulations on a 65- and 90-nm technology and experimental results are presented to justify the assumptions and validate the leakage power models that are adopted.

Scan-Based Side-Channel Attack against RSA Cryptosystems Using Scan Signatures

Scan-based side-channel attacks retrieve a secret key in a cryptography circuit by analyzing scanned data. Since they must be considerable threats to a cryptosystem LSI, we have to protect cryptography circuits from them. RSA is one of the most important cryptography algorithms because it effectively realizes a public-key cryptography system. RSA is extensively used but conventional scan-based side-channel attacks cannot be applied to it because it has a complicated algorithm. This paper proposes a scan-based side-channel attack which enables us to retrieve a secret key in an RSA circuit. The proposed method is based on detecting intermediate values calculated in an RSA circuit. We focus on a 1-bit time-sequence which is specific to some intermediate values. By monitoring the 1-bit time-sequence in the scan path, we can find out the register position specific to the intermediate value and we can know whether this intermediate value is calculated or not in the target RSA circuit. We can retrieve a secret key one-bit by one-bit from MSB to LSB. The experimental results demonstrate that a 1,024-bit secret key used in the target RSA circuit can be retrieved using 30.2 input messages within 98.3 seconds and its 2,048-bit secret key can be retrieved using 34.4 input within 634.0 seconds.

SYNCHRONOUS-TO-ASYNCHRONOUS CONVERSION OF CRYPTOGRAPHIC CIRCUITS

This paper introduces a novel method for the conversion of synchronous cryptographic circuits into equivalent asynchronous ones. The new method is based on ASERT (Asynchronous Scheduling by Edge Reversal Timing), a fully decentralized timing signaling and synchronization algorithm. From a synthesizable HDL code, an asynchronous timing network, made from standard cells libraries, is generated in order to replace the clock tree of the target circuit. ASERT works with matched delays, local clocks or any equivalent way of determining, statically or dynamically, the operating time of each functional unit. Synchronous to asynchronous conversion of three different cryptographic circuits, including the fully synthesized netlists of AES, Reed-Solomon decoder, and RSA cipher cores, are presented.

A Scan-Based Attack Based on Discriminators for AES Cryptosystems

A scan chain is one of the most important testing techniques, but it can be used as side-channel attacks against a cryptography LSI. We focus on scan-based attacks, in which scan chains are targeted for side-channel attacks. The conventional scan-based attacks only consider the scan chain composed of only the registers in a cryptography circuit. However, a cryptography LSI usually uses many circuits such as memories, micro processors and other circuits. This means that the conventional attacks cannot be applied to the practical scan chain composed of various types of registers. In this paper, a scan-based attack which enables to decipher the secret key in an AES cryptography LSI composed of an AES circuit and other circuits is proposed. By focusing on bit pattern of the specific register and monitoring its change, our scan-based attack eliminates the influence of registers included in other circuits than AES. Our attack does not depend on scan chain architecture, and it can decipher practical AES cryptography LSIs.

Sequential Circuit Design for Embedded Cryptographic Applications Resilient to Adversarial Faults

In the relatively young field of fault tolerant cryptography the main research effort has focused exclusively on the protection of the data-path of cryptographic circuits. To date, however, we have not found any work that aims at protecting the control logic of these circuits against fault attacks, which thus remained as Achilles' proverbial heel. Motivated by an example of a hypothetical attack on an otherwise protected modular exponentiation engine we set out to close this remaining gap. In this paper we present guidelines for the design of t-fault resilient sequential control logic based on Error Detecting Codes (EDC). Our method allows to trade area overhead against fault resilience, and has the added benefit that the detection circuit does not add to the critical path.

SECURITY ANALYSIS OF AES USING FUNCTIONALITY FAULT MODEL

Security of cryptographic circuits is a major concern. Smartcards are targeted by sophisticated attacks like fault attacks that combine physical disturbance and cryptanalysis. We propose a methodology and a tool (PAFI) to analyze the robustness of circuits under fault attacks using fault injection in simulation. The number of injections is reduced by taking into account the function of the latches in the whole circuit. We tested a circuit implementing the cryptosystem AES and showed that our approach reduces the number of fault injections to be performed (- 80%). Moreover, most of the selected injection points are the ones that lead to known fault attacks (95%).

Secure evolvable hardware for public-key cryptosystems

In this paper genetic programming is used as an alternative means to automatically generate secure and minimal hardware designs of public-key cryptosystems such as the RSA cryptosystem. We evolve optimal hardware circuits for modular exponentiation, which is a cornerstone operation in many public-key cryptographic system. The evolved circuits minimize both space(i.e. required gate number) and time (i.e. encryption and decryption time). The evolved designs are shielded against side-channel leakage and hence secure. The structure of the cryptographic circuit is random and so the private key cannot be deduced using known attacks. We compare our results against existing well-known designs, which were produced by human designers based on the binary method.

On-demand design service innovations

Offering design services for manufacturers of embedded devices has become a very important business, one in which the three leading customer requirements are time to market, integration of leading-edge technologies, and cost reduction; in short, on-demand design services. In this paper, we discuss on-demand design service innovations of several types. First, we discuss our unique field-programmable gate array (FPGA)-based system emulation tool. Although embedded systems comprise a wide range of technologies and components, some important technologies and components are common to most embedded systems. Security and communications are two of these, and we have developed offerings in these areas as well. For security, we developed scalable intellectual property macros to meet the requirements for many kinds of cryptographic circuits. These macros can satisfy specific requirements—performance, size of the silicon area, and power dissipation—for many kinds of embedded systems. For communications, we developed an autonomic network configuration tool which allows an end user to avoid the potential frustration of setting up a network connection and which also automatically performs network security tasks.

A security method for passive double star optical access systems

AbstractIn a passive double star optical access system, an optical line terminal and multiple subscriber units are connected in a Point to Multi‐Point (P‐MP) configuration. In this case, the downstream signals from the optical line terminal are broadcast and delivered to all of the subscribers. Therefore, security is necessary for the communication of each subscriber to be protected from the other subscribers. In this paper, of the previously proposed encryption methods, we focus on stream ciphers that feature a compact cryptography circuit and are affected slightly by the bit errors generated in the transmission path, define the unique conditions of this system, and propose an encryption method for downstream signals that satisfies these system conditions. This new proposed encryption method features strengthening resistance to attack by using the upstream signal as the key and can be implemented in a small‐scale circuit. © 2002 Wiley Periodicals, Inc. Electron Comm Jpn Pt 1, 86(4): 42–49, 2003; Published online in Wiley InterScience (www.interscience.wiley.com). DOI 10.1002/ecja.10068

A Method of Formal Verification of Cryptographic Circuits

In this letter we report the formal verification of encryption and decryption circuits. After we describe algebraically a simple modular arithmetic circuit at both function and logic levels, we apply the symbolic manipulation of Mathematica.