Side-channel Attack Countermeasures Research Articles

Side-channel and Fault-injection attacks over Lattice-based Post-quantum Schemes (Kyber, Dilithium): Survey and New Results

In this work, we present a systematic study of Side-Channel Attacks (SCA) and Fault Injection Attacks (FIA) on structured lattice-based schemes, with main focus on Kyber Key Encapsulation Mechanism (KEM) and Dilithium signature scheme, which are leading candidates in the NIST standardization process for Post-Quantum Cryptography (PQC). Through our study, we attempt to understand the underlying similarities and differences between the existing attacks while classifying them into different categories. Given the wide variety of reported attacks, simultaneous protection against all the attacks requires to implement customized protections/countermeasures for both Kyber and Dilithium. We therefore present a range of customized countermeasures, capable of providing defenses/mitigations against existing SCA/FIA, and incorporate several SCA and FIA countermeasures within a single design of Kyber and Dilithium. Among the several countermeasures discussed in this work, we present novel countermeasures that offer simultaneous protection against several SCA- and FIA-based chosen-ciphertext attacks for Kyber KEM. We implement the presented countermeasures within two well-known public software libraries for PQC: (1) pqm4 library for the ARM Cortex-M4-based microcontroller and (2) liboqs library for the Raspberry Pi 3 Model B Plus based on the ARM Cortex-A53 processor. Our performance evaluation reveals that the presented custom countermeasures incur reasonable performance overheads on both the evaluated embedded platforms. We therefore believe our work argues for usage of custom countermeasures within real-world implementations of lattice-based schemes, either in a standalone manner or as reinforcements to generic countermeasures such as masking.

Empirical analysis of power side-channel leakage of high-level synthesis designed AES circuits

<span>Many internet of things (IoT) devices and integrated circuit (IC) cards have been compromised by side-channel attacks. Power-analysis attacks, which identify the secret key of a cryptographic circuit by analyzing the power traces, are among the most dangerous side-channel attacks. Gen-erally, there is a trade-off between execution time and circuit area. However, the correlation between security and performance has yet to be determined. In this study, we investigate the cor-relation between side-channel attack resistance and performance (execution time and circuit area) of advanced encryption standard (AES) circuits. Eleven AES circuits with different performances are designed by high-level synthesis and logic synthesis. Of the eleven AES circuits, six are circuits with no side-channel attack countermeasures and five are circuits with masking countermeasures. We employ four metrics based on a T-test to evaluate the side-channel attack resistance. The results based on the correlation coefficient show the correlation between side-channel attack resistance and performance. The correlation varies according to four metrics or masking countermeasure. We argue that designers should change their attitudes towards circuit design when considering security.</span>

Toward an Optimal Countermeasure for Cache Side-Channel Attacks

In the last 15 years, we have witnessed a never ending arm’s race between the attacker and the defender with respect to cache-based side-channel attacks. We have seen a slew of attacks, countermeasures (CMs), counterattacks, counter-countermeasures and so on. We analyze the evolution of this area, propose three necessary conditions for designing a successful CM, and then analyze timing and address-based CMs for popular algorithms such as AES and PRESENT. We show that an optimal yet trivial solution for timing-based CMs is possible. Furthermore, address-based CMs are inferior to timing-based CMs, and they can be broken in O(nlog(log(n))) time.

A comprehensive evaluation approach for efficient countermeasure techniques against timing side-channel attack on MPSoC-based IoT using multi-criteria decision-making methods

ContextTiming side-channel attack countermeasure techniques (TSCA-CTs) evaluation is a multi-criteria decision-making (MCDM) problem based on different MPSoCs of IoT platform architectures, performance, and design overhead. Therefore, the Fermatean by fuzzy decision opinion score method (F-FDOSM) for prioritizing the powerful countermeasure technique against timing side-channel attack is the best approach because it employs the most efficient MCDM ranking technique. Nonetheless, the FDOSM method needs to weigh the criteria before being submitted for the ranking process. In order to address this theoretical challenge, the Criteria-importance through inter-criteria correlation (CRITIC) technique can be applied as an effective MCDM weighting technique to offer an explicit weight for a set of criteria with no inconsistency based on the standard deviation, which uses correlation analysis to determine the relevance of each criterion. ObjectivesThis research proposes a Fermatean-FDOSM framework for evaluating TSCA-CTs in the context of MPSoCs-based IoT and CRITIC techniques to weight the criteria. MethodsThe methodology is presented in three phases. Firstly, a proposed countermeasure techniques dataset was collected that included seven defense approaches (e.g., Gossip and SER router) based on ten criteria (e.g., number of malicious IP cores, number of routers, power, latency… etc.). Then, the decision matrix was built based on an intersection of the countermeasure techniques as an alternative and MPSoC design and performance criteria. Then, the multi-criteria decision-making methods were integrated. The CRITIC method for criteria weighting was followed by the development of the Fermatean-FDOSM method for ranking. Results(1) CRITIC weighting shows that MPSoC NoC throughput (packet/clock) is the highest weight criterion, whereas latency (clock/cycle) is the less weight criterion. (2) The Fermatean-FDOSM-based group ranking shows that the Adaptive routing countermeasure technique is the highest score alternative compared to the Combined with separate interface hybrid approach. (3) The TSCA-CTs priority ranks were subjected to a systematic ranking that was confirmed by strong correlation results throughout ten criterion weight values. A comparison with recent studies confirmed the feasibility of the proposed framework. ConclusionThe outcomes of this study are anticipated to give particular knowledge and direction to those who want to do decision theory-based MPSoCs-based IoT and NoC communication security research.

Practical aspects on non-profiled deep-learning side-channel attacks against AES software implementation with two types of masking countermeasures including RSM

Deep-learning side-channel attacks, applying deep neural networks to side-channel attacks, are known that can easily attack some existing side-channel attack countermeasures such as masking and random jitter. While there have been many studies on profiled deep-learning side-channel attacks, a new approach that involves applying deep learning to non-profiled attacks was proposed in 2018. In our study, we investigate the structure of multi-layer perceptrons and points of interest for non-profiled deep-learning side-channel attacks using the ANSSI database with a masking countermeasure. The results of investigations indicate that it is better to use a simple network model, apply regularization to prevent over-fitting, and select a wide range of power traces that contain side-channel information as the points of interest. We also implemented AES-128 software implementation protected with the Rotating Sboxes Masking countermeasure, which has never been attacked by non-profiled deep-learning side-channel attacks, on the Xmega128 microcontroller and carried out non-profiled deep-learning side-channel attacks against it. Non-profiled deep-learning side-channel attacks successfully recovered all partial keys while the conventional power analysis could not. The attack results also showed that the least significant bit is the adequate selection for successful non-profiled deep-learning side-channel attacks, but the best labeling method may vary depending on the implementation of the countermeasure algorithm. We conducted two experimental analyses to clarify that deep-learning side-channel attacks learn mask values used in the masking countermeasure. One is the gradient visualization used in previous studies, and the other is a new analysis method using partial removal of power traces.

On the performance of non‐profiled side channel attacks based on deep learning techniques

AbstractIn modern embedded systems, security issues including side‐channel attacks (SCAs) are becoming of paramount importance since the embedded devices are ubiquitous in many categories of consumer electronics. Recently, deep learning (DL) has been introduced as a new promising approach for profiled and non‐profiled SCAs. This paper proposes and evaluates the applications of different DL techniques including the Convolutional Neural Network and the multilayer perceptron models for non‐profiled attacks on the AES‐128 encryption implementation. Especially, the proposed network is fine‐tuned with different number of hidden layers, labelling techniques and activation functions. Along with the designed models, a dataset reconstruction and labelling technique for the proposed model has also been performed for solving the high dimension data and imbalanced dataset problem. As a result, the DL based SCA with our reconstructed dataset for different targets of ASCAD, RISC‐V microcontroller, and ChipWhisperer boards has achieved a higher performance of non‐profiled attacks. Specifically, necessary investigations to evaluate the efficiency of the proposed techniques against different SCA countermeasures, such as masking and hiding, have been performed. In addition, the effect of the activation function on the proposed DL models was investigated. The experimental results have clarified that the exponential linear unit function is better than the rectified linear unit in fighting against noise generation‐based hiding countermeasure.

Neural Network-Based Entropy: A New Metric for Evaluating Side-Channel Attacks

Side-channel attacks (SCAs) are powerful noninvasive attacks that can be used for leaking the secret key of integrated circuits (ICs). Numerous countermeasures were proposed to elevate the security level of ICs against SCAs. Unfortunately, it is quite inconvenient to predict the security levels of these countermeasures since no solid mathematical model exists in the literature. In this paper, neural network (NN)-based entropy is proposed to model the resilience of a system against SCAs. The NN-based entropy model well links the side-channel leakages and probabilities with the neurons and weights of NNs, respectively. In such a circumstance, the NN-based entropy can be used for modeling the robustness of countermeasures since a one-to-one relationship is established between the NN-based entropy and the measurement-to-disclose (MTD) enhancement ratio related with the countermeasures. As demonstrated in the result, the proposed NN-based entropy metric shows 100% consistency with the MTD enhancement ratio if multiple SCA countermeasures are employed into a system.

On Correlation Immune Boolean Functions With Minimum Hamming Weight Power of 2

The notion of correlation immune functions has been introduced by Siegenthaler (1984) in symmetric cryptography in the framework of stream ciphers. At the conference CRYPTO’91 by Camion et al., it has been pointed out that this notion existed in statistics and combinatorics. It has recently been highlighted that such functions also play an important role in a new framework related to side-channel attack counter-measures. Since then, the interest in correlation immune Boolean functions has been renewed, and new challenges regarding these functions have appeared. Specifically, low Hamming weight correlation immune functions have been selected as useful for counter-measures to side-channel attacks. Despite their importance, the literature is not abundant in this research direction. Two very interesting articles in which such correlation immune functions were nicely explored, given this novel use of them. Carlet initiated the first one in 2013, and the second one is due to Carlet and Chen (2018). This paper deals with correlation immune Boolean functions aiming to produce more candidates of those processing low Hamming weights. We shall focus on correlation immune Boolean functions with Hamming weights power of 2 (which offer a flexibility to control the correlation immunity aspects) and present several methods of designing them. Some design methods are efficient and could be employed to derive such functions. Consequently, given two positive integers $n$ and $m$ , we derive new effective constructions of correlation immune Boolean functions with Hamming weight power of 2. Furthermore, an upper bound on the correlation immunity of the newly constructed $n$ -variable Boolean functions with Hamming weight $2^{m}$ was determined for $n-m\ge 0$ . Besides, exact values and lower bounds on the maximum correlation immunity of those functions are explored and discussed, mainly when the values of $n$ and $m$ are very close. This paper also exhibits explicit examples of those correlation immune functions that illustrate our methods.

Higher-Order Lookup Table Masking in Essentially Constant Memory

Masking using randomised lookup tables is a popular countermeasure for side-channel attacks, particularly at small masking orders. An advantage of this class of countermeasures for masking S-boxes compared to ISW-based masking is that it supports pre-processing and thus significantly reducing the amount of computation to be done after the unmasked inputs are available. Indeed, the “online” computation can be as fast as just a table lookup. But the size of the randomised lookup table increases linearly with the masking order, and hence the RAM memory required to store pre-processed tables becomes infeasible for higher masking orders. Hence demonstrating the feasibility of full pre-processing of higher-order lookup table-based masking schemes on resource-constrained devices has remained an open problem.
 In this work, we solve the above problem by implementing a higher-order lookup table-based scheme using an amount of RAM memory that is essentially independent of the masking order. More concretely, we reduce the amount of RAM memory needed for the table-based scheme of Coron et al. (TCHES 2018) approximately by a factor equal to the number of shares. Our technique is based upon the use of pseudorandom number generator (PRG) to minimise the randomness complexity of ISW-based masking schemes proposed by Ishai et al. (ICALP 2013) and Coron et al. (Eurocrypt 2020). Hence we show that for lookup table-based masking schemes, the use of a PRG not only reduces the randomness complexity (now logarithmic in the size of the S-box) but also the memory complexity, and without any significant increase in the overall running time. We have implemented in software the higher-order table-based masking scheme of Coron et al. (TCHES 2018) at tenth order with full pre-processing of a single execution of all the AES S-boxes on a ARM Cortex-M4 device that has 256 KB RAM memory. Our technique requires only 41.2 KB of RAM memory, whereas the original scheme would have needed 440 KB. Moreover, our 8-bit implementation results demonstrate that the online execution time of our variant is about 1.5 times faster compared to the 8-bit bitsliced masked implementation of AES-128.

An efficient methodology for hardware Trojan detection based on canonical correlation analysis

Side-channel (SC) analyses are extensively used for achieving hardware Trojan detection (TD) by analyzing the anomalies of SC leakages of the suspicious integrated circuits (ICs). However, when a suspicious IC is employed with an SC attack countermeasure (SCAC) to resist against SC attacks, the SC leakages of the IC may become random. Under such a circumstance, the conventional SC analyses are not efficient in detecting the potential embedded Trojans within the suspicious IC since the random SC leakages may mask the critical features of the Trojans. To address this issue, a novel SC analysis based on canonical correlation analysis (CCA) is proposed in this paper. The possible correlations among the random SC leakages are efficiently extracted and processed to distinguish the different features between the SCAC and the embedded Trojans under the assistance of CCA. Result shows that the proposed SC analysis is able to enhance the TD accuracy by 11.3% as compared to the previous SC analyses.

Dual-Hiding Side-Channel-Attack Resistant FPGA-Based Asynchronous-Logic AES: Design, Countermeasures and Evaluation

We present a side-channel-attack (SCA) resistant asynchronous-logic (async-logic) Advanced Encryption Standard (AES) accelerator with dual-hiding SCA countermeasures, i.e. the amplitude moderation (vertical dimension) and the time moderation (horizontal dimension). There are five contributions in this paper. First, we propose an async-logic design flow with relative timing to simplify the AES realization in Field-Programmable-Gate-Array (FPGA). Second, we optimize completion detection circuits therein to achieve a low power/overhead solution. Third, we propose a randomized delay-line control and a data-propagation control to amplify the dual-hiding SCA countermeasures for our async-logic AES accelerator. Fourth, we validate the async-logic design flow based on two commercially-available Sakura-X and Arty-A7 FPGA boards. Fifth, we comprehensively evaluate 74 SCA attacking models for our async-logic AES accelerator on these two boards, and compare the results against a benchmarking AES based on synchronous-logic (sync-logic). We show that our async-logic AES accelerator is unbreakable within 1 million electromagnetic (EM) traces where the sync-logic counterpart is breakable within <; 30K EM traces. To our best knowledge, our async-logic AES accelerator is the first async-logic AES design evaluated comprehensively at the first/last round, at various attacking locations (i.e. before/after Substitute-Box), and with various Hamming weight/distance, bit model, and zero-model of SCAs.

CONFISCA: An SIMD-Based Concurrent FI and SCA Countermeasure with Switchable Performance and Security Modes

CONFISCA is the first generic SIMD-based software countermeasure that can concurrently resist against Side-Channel Attack (SCA) and Fault Injection (FI). Its promising strength is presented in a PRESENT cipher case study and compared to software-based Dual-rail with Pre-charge Logic concurrent countermeasure. It has lower overhead, wider usability, and higher protection. Its protection has been compared using Correlation Power Analysis, Welch’s T-Test, Signal-to-Noise Ratio and Normalized Inter-Class Variance testing methods. CONFISCA can on-the-fly switch between its two modes of operation: The High-Performance and High-Security by having only one instance of the cipher. This gives us the flexibility to trade performance/energy with security, based on the actual critical needs.

Survey on performance and security problems of countermeasures for passive side-channel attacks on ECC

This paper presents an analysis on the state of the art of several proposals for algorithmic countermeasures to prevent passive side-channel attacks (SCA) on elliptic curve cryptography (ECC) defined over prime fields. One of the main applications of ECC is in the field of Internet of Things, where the interconnection of devices requires public-key technology with small key sizes and high security levels. Since the secure implementation of ECC on embedded devices involves many challenges for security and efficiency, this work evaluates the trade-offs between security and performance of side-channel attack countermeasures for scalar multiplication algorithms without precomputation. The main contribution is to present a panorama of explicit solutions that may be used for the implementation of ECC mechanisms suitable for embedded devices. In addition to the security problems, some countermeasures are also analyzed.

LM-DAE: Low-Memory Deterministic Authenticated Encryption for 128-bit Security

This paper proposes a new lightweight deterministic authenticated encryption (DAE) scheme providing 128-bit security. Lightweight DAE schemes are practically important because resource-restricted devices sometimes cannot afford to manage a nonce properly. For this purpose, we first design a new mode LM-DAE that has a minimal state size and uses a tweakable block cipher (TBC). The design can be implemented with low memory and is advantageous in threshold implementations (TI) as a side-channel attack countermeasure. LM-DAE further reduces the implementation cost by eliminating the inverse tweak schedule needed in the previous TBC-based DAE modes. LM-DAE is proven to be indistinguishable from an ideal DAE up to the O(2n) query complexity for the block size n. To achieve 128-bit security, an underlying TBC must handle a 128-bit block, 128-bit key, and 128+4-bit tweak, where the 4-bit tweak comes from the domain separation. To satisfy this requirement, we extend SKINNY-128-256 with an additional 4-bit tweak, by applying the elastic-tweak proposed by Chakraborti et al. We evaluate the hardware performances of the proposed scheme with and without TI. Our LM-DAE implementation achieves 3,717 gates, roughly 15% fewer than state-of-the-art nonce-based schemes, thanks to removing the inverse tweak schedule.

Hardware Performance Evaluation of Authenticated Encryption SAEAES with Threshold Implementation

SAEAES is the authenticated encryption algorithm instantiated by combining the SAEB mode of operation with AES, and a candidate of the NIST’s lightweight cryptography competition. Using AES gives the advantage of backward compatibility with the existing accelerators and coprocessors that the industry has invested in so far. Still, the newer lightweight block cipher (e.g., GIFT) outperforms AES in compact implementation, especially with the side-channel attack countermeasure such as threshold implementation. This paper aims to implement the first threshold implementation of SAEAES and evaluate the cost we are trading with the backward compatibility. We design a new circuit architecture using the column-oriented serialization based on the recent 3-share and uniform threshold implementation (TI) of the AES S-box based on the generalized changing of the guards. Our design uses 18,288 GE with AES’s occupation reaching 97% of the total area. Meanwhile, the circuit area is roughly three times the conventional SAEB-GIFT implementation (6229 GE) because of a large memory size needed for the AES’s non-linear key schedule and the extended states for satisfying uniformity in TI.

Side-channel countermeasures utilizing dynamic logic reconfiguration: Protecting AES/Rijndael and Serpent encryption in hardware

Dynamic logic reconfiguration is a concept that allows for efficient on-the-fly modifications of combinational circuit behavior in both ASIC and FPGA devices. The reconfiguration of Boolean functions is achieved by modification of their generators (e.g., shift register-based look-up tables) and it can be controlled from within the chip, without the necessity of any external intervention. This hardware polymorphism can be utilized for the implementation of side-channel attack countermeasures, as demonstrated by Sasdrich et al. for the lightweight cipher PRESENT.In this work, we adapt these countermeasures to two of the AES finalists, namely Rijndael and Serpent. Just like PRESENT, both Rijndael and Serpent are block ciphers based on a substitution–permutation network. We describe the countermeasures and adjustments necessary to protect these ciphers using the resources available in modern Xilinx FPGAs. We describe our implementations and evaluate the side-channel leakage and effectiveness of different countermeasures combinations using a methodology based on Welch’s t-test. Furthermore, we attempt to break the protected AES/Rijndael implementation using second-order DPA/CPA attacks.We did not detect any significant first-order leakage from the fully protected versions of our implementations. Using one million power traces, we detect second-order leakage from Serpent encryption, while AES encryption second-order leakage is barely detectable. We show that the countermeasures proposed by Sasdrich et al.are, with some modifications, successfully applicable to AES and Serpent.

Key Update Countermeasure for Correlation-Based Side-Channel Attacks

Side-channel analysis is a non-invasive form of attack that reveals the secret key of the cryptographic circuit by analyzing the leaked physical information. The traditional brute-force and cryptanalysis attacks target the weakness in the encryption algorithm, whereas side-channel attacks use statistical models such as differential analysis and correlation analysis on the leaked information gained from the cryptographic device during the run-time. As a non-invasive and passive attack, the side-channel attack brings a lot of difficulties for detection and defense. In this work, we propose a key update scheme as a countermeasure for power and electromagnetic analysis-based attacks on the cryptographic device. The proposed countermeasure utilizes a secure coprocessor to provide secure key generation and storage in a trusted environment. The experimental results show that the proposed key update scheme can mitigate side-channel attacks significantly.

Search space reduction of asynchrony immune cellular automata

We continue the study of asynchrony immunity in cellular automata (CA), which can be considered as a generalization of correlation immunity in the case of vectorial Boolean functions. The property could have applications as a countermeasure for side-channel attacks in CA-based cryptographic primitives, such as S-boxes and pseudorandom number generators. We first give some theoretical results on the properties that a CA rule must satisfy in order to meet asynchrony immunity, like central permutivity. Next, we perform an exhaustive search of all asynchrony immune CA rules of neighborhood size up to 5, leveraging on the discovered theoretical properties to greatly reduce the size of the search space.

Threshold Implementations of $\mathtt{GIFT}$ : A Trade-Off Analysis

Threshold Implementation ( TI ) is one of the most widely used countermeasure for side channel attacks. Over the years several TI techniques have been proposed for randomizing cipher execution using different variations of secret-sharing and implementation techniques. For instance, sharing without decomposition ( 4-shares ) is the most straightforward implementation of the threshold countermeasure. However, its usage is limited due to its high area requirements. On the other hand, sharing using decomposition ( 3-shares ) countermeasure for cubic non-linear functions significantly reduces area and complexity in comparison to 4-shares . Nowadays, security of ciphers using a side channel countermeasure is of utmost importance. This is due to the wide range of security critical applications from smart cards, battery operated IoT devices, to accelerated crypto-processors. Such applications have different requirements (higher speed, energy efficiency, low latency, small area etc.) and hence need different implementation techniques. Although, many TI strategies and implementation techniques are known for different ciphers, there is no single study comparing these on a single cipher. Such a study would allow a fair comparison of the various methodologies. In this work, we present an in-depth analysis of the various ways in which TI can be implemented for a lightweight cipher. We chose GIFT for our analysis as it is currently one of the most energy-efficient lightweight ciphers. The experimental results show that different implementation techniques have distinct applications. For example, the 4-shares technique is good for applications demanding high throughput whereas 3-shares is suitable for constrained environments with less area and moderate throughput requirements. The techniques presented in the paper are also applicable to other blockciphers. For security evaluation, we performed TVLA (test vector leakage assessment) on all the design strategies. Experiments using up to 50 million traces show that the designs are protected against first-order attacks.

On Non-Completeness and G-Equivariance

With the growing threat of the side-channel attack (SCA) to the cryptographic algorithm’s implementations, the masking method has become one of the most promising SCA countermeasures for securely implementing, for example, block ciphers. The basic principle of the masking method is that if the sensitive variable (which, by definition, depends on sensitive information) is split into some random variables and they are manipulated in a secure manner, then the relationship between the random variables and the corresponding side-channel information may look independent from the outside world. However, after the introduction of the glitch attack, there has been a lot of concern about the security of the masking method itself. And, to mitigate the threat of the glitch attack, the threshold implementation (TI) and G-equivariant gates were independently introduced as countermeasures. In this paper, we consider the main notions of two such independent glitch attack’s countermeasures, say, non-completeness and G-equivariance, and investigate their relationship. The contribution of this paper is three-fold. First, we show that the widely-circulated proof that the non-complete TI with uniform inputs guarantees the security against the 1st order DPA even in the presence of glitches is not satisfactory. Next, using the extended notion of G-equivariance to the higher-order setting, we prove that non-completeness implies G-equivariance, which, in turn, means that the non-complete TI with uniform inputs has resistance against the glitch attack. Thirdly, we prove that the set of non-complete gates is a proper subset of the set of G-equivariant gates by showing there is a gate that is G-equivariant but not non-complete.