S-box Circuit Research Articles

Toward Finding S-Box Circuits With Optimal Multiplicative Complexity

Toward Finding S-Box Circuits With Optimal Multiplicative Complexity

A Local Optimization Method for Single Flux Quantum Logic Circuits Design Utilizing Synchronizer IPs

In the post-Moore era, slow-growing operating frequency and massive power dissipation make researchers seek new developing directions in integration circuits (ICs). The single flux quantum (SFQ) circuit, a type of superconducting digital circuit, is regarded as an alternative circuit for future computing technology. SFQ circuits are natural gate-level-pipelining synchronous sequential circuits requiring path balancing. However, path balancing may consume enormous resources, as the logic levels of fan-in gates of most gates are different, with the consumption originating from the extra gates (D-Flip-Flops, DFFs) for path balancing and the routing with a much larger clock tree. Hence, in this article, we propose a local optimization method to address the vast consumption problem of the clock tree caused by path balancing in SFQ circuits, primarily relying on self-developed electronic design automation tools for the JSICcomplier for SFQ circuits and using the SIMIT Nb03 cell library. Moreover, we design synchronizer IPs called Dsyn series to replace DFFs in path balancing. The clock nodes and the clocking path consumption are highly reduced by utilizing the proposed strategy, while the new series can be recognized as IPs and easily added to our library, affording scalability. Experiments in a demo S-box circuit demonstrated a percentage of Josephson junctions reduction in clock tree up to 36.48%, while on a few benchmark circuits, the corresponding results are up to 50.69%, demonstrating our method's effectiveness.

New record in the number of qubits for a quantum implementation of AES

Optimizing the quantum circuit for implementing Advanced Encryption Standard (AES) is crucial for estimating the necessary resources in attacking AES by the Grover algorithm. Previous studies have reduced the number of qubits required for the quantum circuits of AES-128/-192/-256 from 984/1112/1336 to 270/334/398, which is close to the optimal value of 256/320/384. It becomes a challenging task to further optimize them. AimTaking aim at this task, we find a method for how the quantum circuit of AES S-box can be designed with the help of the automation tool LIGHTER-R. Particularly, the multiplicative inversion in F28, which is the main part of the S-box, is converted into the multiplicative inversion (and multiplication) in F24, then the latter can be implemented by LIGHTER-R because its search space is small enough. By this method, we construct the quantum circuits of S-box for mapping |a⟩|0⟩ to |a⟩|S(a)⟩ and |a⟩|b⟩ to |a⟩|b ⊕ S(a)⟩ with 20 qubits instead of 22 in the previous studies. In addition, we introduce new techniques to reduce the number of qubits required by the S-box circuit for mapping |a⟩ to |S(a)⟩ from 22 in the previous studies to 16. Accordingly, we synthesize the quantum circuits of AES-128/-192/-256 with 264/328/392 qubits, which implies a new record.

Riding the Waves Towards Generic Single-Cycle Masking in Hardware

Research on the design of masked cryptographic hardware circuits in the past has mostly focused on reducing area and randomness requirements. However, many embedded devices like smart cards and IoT nodes also need to meet certain performance criteria, which is why the latency of masked hardware circuits also represents an important metric for many practical applications.The root cause of latency in masked hardware circuits is the need for additional register stages that synchronize the propagation of shares. Otherwise, glitches would violate the basic assumptions of the used masking scheme. This issue can be addressed to some extent, e.g., by using lightweight cryptographic algorithms with low-degree Sboxes, however, many applications still require the usage of schemes with higher-degree S-boxes like AES. Several recent works have already proposed solutions that help reduce this latency yet they either come with noticeably increased area/randomness requirements, limitations on masking orders, or specific assumptions on the general architecture of the crypto core.In this work, we introduce a generic and efficient method for designing single-cycle glitch-resistant (higher-order) masked hardware of cryptographic S-boxes. We refer to this technique as (generic) Self-Synchronized Masking (“SESYM”). The main idea of our approach is to replace register stages with a partial dual-rail encoding of masked signals that ensures synchronization within the circuit. More concretely, we show that WDDL gates and Muller C-elements can be used in combination with standard masking schemes to design single-cycle S-box circuits that, especially in case of higher-degree S-boxes, have noticeably lower requirements in terms of area and online randomness. We apply our method to DOM-based S-boxes of Ascon and AES and compare the resulting circuits to existing latency optimized circuits based on TI, GLM, and LMDPL. The latency of all three designs is reduced to single-cycle operation and are dth-order secure. Compared to GLM-masked Ascon, our approach comes with a 6.4 times reduction in online randomness for all protection orders. Compared to 1st-order LMDPL-masked AES, our approach achieves comparable results, while it is more generic, amongst others, by also supporting higher-order designs. We also underline the practical protection of our constructions against power analysis attacks via empirical and formal verification approaches.

Implementation of an 8-bit bit-slice AES S-box with rapid single flux quantum circuits

Rapid single flux quantum (RSFQ) circuits are a kind of superconducting digital circuits, having properties of a natural gate-level pipelining synchronous sequential circuit, which demonstrates high energy efficiency and high throughput advantage. We find that the high-throughput and high-speed performance of RSFQ circuits can take the advantage of a hardware implementation of the encryption algorithm, whereas these are rarely applied to this field. Among the available encryption algorithms, the advanced encryption standard (AES) algorithm is an advanced encryption standard algorithm. It is currently the most widely used symmetric cryptography algorithm. In this work, we aim to demonstrate the SubByte operation of an AES-128 algorithm using RSFQ circuits based on the SIMIT Nb03 process. We design an AES S-box circuit in the RSFQ logic, and compare its operational frequency, power dissipation, and throughput with those of the CMOS-based circuit post-simulated in the same structure. The complete RSFQ S-box circuit costs a total of 42237 Josephson junctions with nearly 130 Gbps throughput under the maximum simulated frequency of 16.28 GHz. Our analysis shows that the frequency and throughput of the RSFQ-based S-box are about four times higher than those of the CMOS-based S-box. Further, we design and fabricate a few typical modules of the S-box. Subsequent measurements demonstrate the correct functioning of the modules in both low and high frequencies up to 28.8 GHz.

Circuit-Variant Moving Target Defense for Side-Channel Attacks

The security of cryptosystems involves preventing an attacker's ability to obtain information about plaintext. Traditionally, this has been done by prioritizing secrecy of the key through complex key selection and secure key exchange. With the emergence of side-channel analysis (SCA) attacks, bits of a secret key may be derived by correlating key values with physical properties of cryptographic process execution. Information such as power consumption and electromagnetic (EM) radiation side-channel properties can be observed during encryption or decryption. These signals reflect data-dependent system behaviours that may reveal secret key information. Power and EM SCA attacks require several measurements of the target process to amplify the signal of interest, filter out noise, and derive the secret key through statistical analysis methods. Differential power and EM analysis attacks rely on correlating actual side-channel measurements to hypothetical models. The goal of this research is to increase the complexity of both power and EM SCA by introducing structural and spatial randomization of the target hardware. We propose a System-on-a-Chip (SOC) countermeasure that will periodically reconfigure an AES scheme using randomly located S-box circuit variants. We hypothesize that changing the location of the target modules between encryption runs will result in a nonconstant EM signal strength for any given point on the chip, increasing the number of traces needed to perform a localized EM SCA attack. Further, each of the S-box circuit variants will consist of functionally equivalent, structurally diverse hardware. By diversifying the implementations at the gate-level, we aim to vary the power behaviour observed by the attacker and disrupt the correlation between the hypothetical and actual power consumption, increasing the complexity of power SCA. This moving target defense aims to disrupt side-channel collection and correlation needed to successfully implement an attack.

Performance and Security Evaluation of S-Box Using Current-Pass Optimized Symmetric Pass Gate Adiabatic Logic

Secure adiabatic logics are identified as the optimal solution for cryptographic modules. We previously proposed an adiabatic logic called Current-Pass Optimized Symmetric Pass Gate Adiabatic Logic (CPO-SPGAL). The proposed CPO-SPGAL realizes a flat current waveform by considering the current path compared with conventional adiabatic logics. In this paper, to confirm more details about countermeasure against power analysis attacks, we compare S-box circuits based on the conventional and proposed adiabatic logics which are implemented using 0.18 upmu m standard CMOS. From the SPICE simulation for correlation power analysis (CPA), 409,600 power consumption traces are obtained, and the hamming distance/weight are calculated. The simulation results show that the proposed S-box is more resistant to CPA attacks than the existing adiabatic S-boxes.

Exploration of Non-Volatile MTJ/CMOS Circuits for DPA-Resistant Embedded Hardware

Magnetic tunnel junction (MTJ/CMOS-based Logic-in-Memory (LiM) circuits have nearly zero leakage power dissipation, and they are very appropriate to design low-power hardware. However, the differences in power consumption between the switching of MTJ devices increase the vulnerability of differential power analysis (DPA)-based side-channel attacks. Furthermore, the MTJ/CMOS hybrid logic circuits that require frequent switching of MTJs are not very energy efficient due to the significant energy required to switch the MTJ devices. MTJ/CMOS circuits consume uniform power if there is no switching of MTJs. In this article, we have investigated the novel approach of building cryptographic hardware in MTJ/CMOS circuits using a lookup table (LUT)-based method where the data stored in MTJs are constant during the entire encryption/decryption operation. As a case study, we have designed a non-linear bijective function of the PRESENT-80 lightweight cryptographic algorithm called substitution box or S-box and one round of PRESENT-80 cryptographic hardware using MTJ/CMOS circuits. The designs are simulated using 45 nm CMOS technology with perpendicular anisotropy CoFeB/MgO MTJ model using Cadence Spectre simulator. From our simulations, we found that the PRESENT-80 S-box circuit and one round of PRESENT-80 cryptographic hardware implemented using MTJ/CMOS circuits save up to 26% and 29% of energy, respectively, compared to the conventional CMOS-based designs at 50 MHz. Furthermore, the security of the MTJ/CMOS circuits has been evaluated by performing a simulation-based DPA attack. From our simulations, we found that the PRESENT-80 cryptographic hardware implemented using MTJ/CMOS circuits is resistant against DPA attack. Low-energy and DPA-resistant property along with high density and low leakage make MTJ/CMOS circuits suitable to implement in low-energy and secure embedded cryptographic hardware.

EE-SPFAL: A Novel Energy-Efficient Secure Positive Feedback Adiabatic Logic for DPA Resistant RFID and Smart Card

The emergence of Internet of Things (IoT) have increased the need of Radio Frequency Identification (RFID) and smart cards that are energy-efficient and secure against Differential Power Analysis (DPA) attacks. Adiabatic logic is one of the circuit design techniques that can be used to design energy-efficient and secure hardware. However, the existing DPA resistant adiabatic logic families suffer from non-adiabatic energy loss. Therefore, this work presents a novel adiabatic logic family called Energy-Efficient Secure Positive Feedback Adiabatic Logic (EE-SPFAL) family that reduces the non-adiabatic energy loss and also is secure against DPA attacks. The proposed EE-SPFAL is used to design logic gates such as buffers, XOR, and NAND. Further, the logic gates based on EE-SPFAL are used to implement a Positive Polarity Reed Muller (PPRM) architecture based S-box circuit. SPICE simulations at 12.5 MHz show that EE-SPFAL based S-box circuit saves up to 65 percent of energy and 90 percent of energy per cycle as compared to the S-box circuit implemented using existing Secured Quasi-Adiabatic Logic (SQAL) and conventional CMOS logic, respectively. Further, the security of EE-SPFAL based S-box circuit has been evaluated by performing the DPA attack through SPICE simulations. We proved that the EE-SPFAL based S-box circuit is resistant to a DPA attack through a developed DPA attack flow applicable to SPICE simulations. Further, we have implemented the one round of Advanced Standard Encryption (AES) algorithm and we found that one round of EE-SPFAL logic based AES consumes uniform current with different input plain texts. Low energy consumption and security against DPA attacks makes EE-SPFAL logic a suitable candidate to implement in IoT devices such as RFID and smart cards.

An Optimized S-Box Circuit for High Speed AES Design with Enhanced PPRM Architecture to Secure Mammographic Images.

In AES, the total time taken by the architecture while implementing in low power and high-speed circuit is the most important thing that to be considered. Also in AES, implementing S-Boxes consumes the major part of the total time consumed by the entire architecture. In this research paper, we propose a very low-power and high efficient S-Box circuit architecture: a multi-stage modified version of PPRM architecture over composite fields. In this modified S box design, only AND and Hazard transparent XOR gates are used. Because of this architecture dynamic hazards which form the main aspect of power consumption in S box gets eliminated. A low propagation delay of 4.58ns and occupies 120 slices in the xilinx FPGA device xc6vlx75t-3ff784, while the low propagation delay and slice area is 5.552ns and 120 respectively for the conventional PPRM architecture. This new proposed architecture is used to protect the mammographic images from being unauthorized access.

Ultralow-Power and Secure S-Box Circuit Using FinFET Based ECRL Adiabatic Logic

Advanced Encryption Standard (AES) is the widely used technique in critical cyber security applications. In AES architecture S-box is the most important block. However, the power consumed by S-box is 75% of the total AES design. The S-box is also prone to Differential Power Analysis (DPA) attack which is one of the most threatening types of attacks in cryptographic systems. In this paper, a three-stage positive polarity Reed-Muller (PPRM) S-box is implemented with 45nm FinFET using Efficient Charge Recovery Logic (ECRL) to reduce power consumption. The simulation results indicate up to 66% power savings for FinFET based S-box as compared to CMOS design. Further, the FinFET ECRL 8-bit S-box circuit is evaluated for transitional energy fluctuations and peak current traces to compare its resistance against side-channel attacks. The lower energy variations and uniform current trace exhibit the improved security performance of the circuit to withstand DPA and Differential Electromagnetic Radiation Attacks (DEMA).

Power Analysis Attack Based on FCM Clustering Algorithm

With the development of information technology over the world for decades, information security is called an important issue in today's society. As a hardware carrier for information security, cryptographic chips have become an important issue in academia. In this paper, we propose a power analysis attack based on FCM(Fuzzy C-Means) clustering algorithm. Our method clusters the energy traces according to their intrinsic similarity, and classifies the energy traces according to the Hamming distance energy model. The correct key is found by comparing the similarity between the clustering result and the classification result. In order to eliminate noises, ICA (Independent Component Analysis) is involved. The simulation experiment uses AES cipher algorithm as the attack object. HSPICE simulation is performed on the first round of 8-bit s-box circuit under 40nm process. Experimental results show that our method is effective.

Smashing the Implementation Records of AES S-box

Canright S-box has been known as the most compact S-box design since its introduction back in CHES’05. Boyar-Peralta proposed logic-minimization heuristics that could reduce the gate count of Canright S-box from 120 gates to 113 gates, however synthesis results did not reflect much improvement. In CHES’15, Ueno et al. proposed an S-box that has a slightly higher area, but significantly faster than the previous designs, hence it was the most efficient (measured by area×delay) S-box implementation to date. In this paper, we propose two new designs for the AES S-box. One design has a smaller implementation area than both Canright and the 113-gate S-boxes. Hence, our first design is the smallest AES S-box to date, breaking the 13 years implementation record of Canright. The second design is faster and smaller than the Ueno S-box. Hence, our second design is both the fastest and the most efficient S-box design to date. While doing so, we also propose new logicminimization heuristics that outperform the previous algorithms of Boyar-Peralta. Finally, we conduct an exhaustive evaluation of each and every block in the S-box circuit, using both structural and behavioral HDL modeling, to reach the optimum synergy between theoretical algorithms and technology-supported optimization tools. We show that involving the technology-supported CAD tools in the analysis results in several counter-intuitive results.

FinSAL: FinFET-Based Secure Adiabatic Logic for Energy-Efficient and DPA Resistant IoT Devices

With the emergence of Internet of Things (IoT), there is an urgent need to design energy-efficient and secure IoT devices. For example, IoT devices such as radio frequency identification tags and wireless sensor nodes employ AES cryptographic module that are susceptible to differential power analysis (DPA) attacks. With the scaling of technology, leakage power in the cryptographic device increases, which increases their vulnerability to DPA attack. This paper presents a novel FinFET-based secure adiabatic logic (FinSAL), that is energy-efficient and DPA-immune. The proposed adiabatic FinSAL is used to design logic gates such as buffers, XOR, and NAND. Further, the logic gates based on adiabatic FinSAL are used to implement a positive polarity Reed Muller architecture-based S-box circuit. SPICE simulations at 12.5 MHz show that adiabatic FinSAL (20-nm FinFET technology) S-box circuit saves up to 81% of energy per cycle as compared to the conventional S-box circuit implemented using FinFET (20-nm FinFET technology). Further, the security of adiabatic FinSAL S-box circuit has been evaluated by performing the DPA attack through SPICE simulations. We proved that the FinSAL S-box circuit is resistant to a DPA attack through a developed DPA attack flow applicable to SPICE simulations. Further, the impact of FinSAL on hardware security at different technology nodes of FinFETs (7, 10, 14, and 16 nm) are evaluated. From the simulation results, FinSAL gates at 14-nm FinFET offer superior security with optimum power consumption, therefore is the best candidate to design low-power secure IoT devices.

Low‐power secure S‐box circuit using charge‐sharing symmetric adiabatic logic for advanced encryption standard hardware design

The previously proposed charge-sharing symmetric adiabatic logic (CSSAL) in an 8-bit S-box circuit is implemented in this paper using a multi-stage positive polarity Reed–Muller representation with a composite field technique. The CSSAL and other conventional dual-rail adiabatic logics are evaluated from the view point of the transitional power fluctuation and the peak current traces in the 8-bit S-box in order to compare their resistance against side-channel attacks. A method to eliminate unwanted glitch current, the triple power clock supplies are applied to each inversion block; thus, the CSSAL S-box circuit performs uniform peak current traces and it has significant power reduction, which is applicable for high security demand and low power devices, such as smart cards, radio frequency identity tags or wireless sensors. The results are obtained from the SPICE simulation with a 0.18-μm 1.8-V standard complementary metal–oxide semiconductor technology at an operating frequency band of 1.25 KHz–70 MHz.

340 mV–1.1 V, 289 Gbps/W, 2090-Gate NanoAES Hardware Accelerator With Area-Optimized Encrypt/Decrypt GF(2 4 ) 2 Polynomials in 22 nm Tri-Gate CMOS

This paper describes an on-die lightweight nanoAES hardware accelerator, fabricated in 22 nm tri-gate high-k/metal-gate CMOS, targeted for ultra-low power symmetric-key encryption and decryption on mobile SOCs. Compared to conventional 128 bit AES implementations, this design uses a single 8 bit Sbox circuit along with ShiftRows byte-order data processing to compute all AES rounds in native ${\rm GF}(2^{4})^{2}$ composite-field. This approach along with a serial-accumulating MixColumns circuit, area-optimized encrypt and decrypt Galois-field polynomials and integrated on-the-fly key generation circuit results in a compact encrypt/decrypt layout occupying 2200/2736 $\mu$ m $^{2}$ and lowest-reported gate count of 1947/2090 respectively, while achieving: (i) maximum operating frequency of 1.133 GHz and total power consumption of 13 mW with leakage component of 500 $\mu$ W, measured at 0.9 V, 25 $^{\circ}$ C, (ii) nominal AES-128 encrypt/decrypt throughput of 432/671 Mbps respectively, with peak energy-efficiency of 289 Gbps/W measured at near-threshold operation of 430 mV (11 $\times$ higher than previously reported implementations), (iii) encrypt/decrypt latencies of 336/216 cycles and total energy consumption of 3.9/2.5 nJ respectively, (iv) wide operating supply voltage range with robust sub-threshold voltage performance of 45 Mbps, 170 $\mu$ W, measured at 340 mV, 25 $^{\circ}$ C and (v) first-reported Galois-field polynomial-based micro-architectural co-optimization, resulting in distinct area-optimized encrypt and decrypt polynomials with up to 9% area reduction at iso-performance.

Power‐aware hiding method for S‐box protection

A power analysis attack countermeasure, called power-awareness-based hiding, is proposed. It is effective in implementing nonlinear operations, S-boxes, in cryptographic algorithms. An advanced encryption standard (AES) S-box circuit has been implemented in this approach using the Domino logic array style. The post-layout simulation results show that the power-aware hiding AES S-box achieves a delay of 1.56 ns and a mean power consumption of 3.57 mW. The proposed method improves the power delay product by 65%, the normalised energy deviation by 43% and the normalised standard deviation by 30% compared to other secure methods.

A Very Compact AES-SPIHT Selective Encryption Computer Architecture Design with Improved S-Box

The “S-box” algorithm is a key component in the Advanced Encryption Standard (AES) due to its nonlinear property. Various implementation approaches have been researched and discussed meeting stringent application goals (such as low power, high throughput, low area), but the ultimate goal for many researchers is to find a compact and small hardware footprint for the S-box circuit. In this paper, we present our version of minimized S-box with two separate proposals and improvements in the overall gate count. The compact S-box is adopted with a compact and optimum processor architecture specifically tailored for the AES, namely, the compact instruction set architecture (CISA). To further justify and strengthen the purpose of the compact crypto-processor’s application, we have also presented a selective encryption architecture (SEA) which incorporates the CISA as a part of the encryption core, accompanied by the set partitioning in hierarchical trees (SPIHT) algorithm as a complete selective encryption system.

HDRL: Homogeneous Dual-Rail Logic for DPA Attack Resistive Secure Circuit Design

Differential power analysis (DPA) attacks find the correlation between power consumption and secret data in crypto-hardware. This letter proposes homogeneous dual-rail logic (HDRL), a standard cell DPA attack countermeasure that theoretically guarantees fully balanced power consumption and significantly improves DPA attack resistivity. Our experimental results on the AES S-Box circuit show that HDRL successfully prevents DPA attacks in all cases.

Effect of glitches against masked AES S-box implementation and countermeasure

Masking of gates is one of the most popular techniques to prevent differential power analysis (DPA) of AES algorithm. It has been shown that the logic circuits used in the implementation of cryptographic algorithms leak side-channel information inspite of masking, which can be exploited, in differential power attacks. The phenomenon in CMOS circuits responsible for the leakage of masked circuits is known as glitching. Motivated by this fact, the authors analyse the effect of glitches in CMOS circuits against masked implementation of the AES S-box. The authors explicitly demonstrate that glitches do not affect always. There exists a relation between combinational path delay of the circuit and timing difference of input vectors to the circuit, which has a bearance on the amount of information leaked by the masked gates. A balanced masked S-box circuit is proposed where the inputs are synchronised by sequential components. Detailed SPICE results are shown to support the claim that the modifications indeed reduce the vulnerability of the masked AES S-box against DPA attacks.