Side-channel Attack Resistance Research Articles

Empirical analysis of power side-channel leakage of high-level synthesis designed AES circuits

<span>Many internet of things (IoT) devices and integrated circuit (IC) cards have been compromised by side-channel attacks. Power-analysis attacks, which identify the secret key of a cryptographic circuit by analyzing the power traces, are among the most dangerous side-channel attacks. Gen-erally, there is a trade-off between execution time and circuit area. However, the correlation between security and performance has yet to be determined. In this study, we investigate the cor-relation between side-channel attack resistance and performance (execution time and circuit area) of advanced encryption standard (AES) circuits. Eleven AES circuits with different performances are designed by high-level synthesis and logic synthesis. Of the eleven AES circuits, six are circuits with no side-channel attack countermeasures and five are circuits with masking countermeasures. We employ four metrics based on a T-test to evaluate the side-channel attack resistance. The results based on the correlation coefficient show the correlation between side-channel attack resistance and performance. The correlation varies according to four metrics or masking countermeasure. We argue that designers should change their attitudes towards circuit design when considering security.</span>

A Comprehensive Evaluation of Integrated Circuits Side-Channel Resilience Utilizing Three-Independent-Gate Silicon Nanowire Field Effect Transistors-Based Current Mode Logic

Side-channel attack (SCA) is one of the physical attacks, which will reveal the confidential information from cryptographic circuits by statistically analyzing physical manifestations. Various circuit-level countermeasures have been proposed as fundamental solutions to eliminate the correlations between side-channel information and circuit’s internal operations. The existing solutions, however, will introduce nonnegligible power and area overheads, making them difficult to be deployed in resource-constrained applications. In this article, a novel three-independent-gate silicon nanowire field effect transistor (TIGFET) with the intrinsic SCA-resilience characteristics is introduced to balance the tradeoffs among cost, performance, and security of cryptographic implementations. We construct six TIGFET-based current mode logic (CML) gates that can retain lower power variation under all possible transitions compared to the CMOS counterparts. As a proof of concept, advanced encryption standard (AES), SM4 block cipher algorithm (SM4), and lightweight cryptographic algorithm PRESENT are implemented utilizing the TIGFET-based CML gates. Correlation power attack is performed to evaluate the improvement of SCA resilience. Simulation results verify that the TIGFET-based cryptographic implementations decrease 42.37% area usage, lower 61.16% energy efficiency, reduce <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$5.35\times $ </tex-math></inline-formula> power variation, and achieve a similar level of SCA resistance compared to the CMOS counterpart, which is applicable for the resource-constrained applications.

A Highly Secure FPGA-Based Dual-Hiding Asynchronous-Logic AES Accelerator Against Side-Channel Attacks

Encryption in field-programmable gate array (FPGA) often provides a good security solution to protect data privacy in Internet-of-Things systems, but this security solution can be compromised by side-channel attacks (SCAs). In this article, we present an FPGA-based dual-hiding asynchronous-logic (async-logic) advanced encryption standard (AES) accelerator, which is highly resistant against SCAs and yet low area/energy overheads. The proposed AES accelerator achieves vertical (amplitude) SCA hiding via an area-efficient dual-rail mapping approach and a zero-value (ZV) compensated substitution-box (S-Box), while enhancing the horizontal (temporal) SCA hiding of async-logic operations via a timing-boundary-free input arrival-time randomizer and a skewed-delay controller. A comprehensive SCA evaluation is performed with 11 SCA models, and we show that our proposed design can offer a strong SCA resistance with measurement-to-disclosure (MTD) of >20 million traces. To our best knowledge, our design is the most secure AES design evaluated with the largest number of traces in FPGA. To compare the design overheads for security, we quantify the figure of merit as normalized (Area <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\times $ </tex-math></inline-formula> Energy/MTD(All) <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\times 10^{6}$ </tex-math></inline-formula> ). The figure of merit of our proposed design is <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$403\times $ </tex-math></inline-formula> smaller than the benchmark dual-rail synchronous-logic design and <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$95\times $ </tex-math></inline-formula> smaller than a reported async-logic design.

28nm asynchronous area-saving AES processor with high Common and Machine learning side-channel attack resistance

28nm asynchronous area-saving AES processor with high Common and Machine learning side-channel attack resistance

A Time-/Frequency-Domain Side-Channel Attack Resistant AES-128 and RSA-4K Crypto-Processor in 14-nm CMOS

A side-channel attack (SCA) hardened AES-128 and RSA crypto-processor in 14-nm CMOS with measured resistance to correlation power/electromagnetic analysis (CPA/CEMA) in both time and frequency domains is demonstrated. While previously reported linear low-dropout regulators (LDOs) offer improvements in minimum-time-to-disclose (MTD) of extracted key bytes in the time domain, their transformations are less effective against frequency-domain attacks. This article describes a non-linear digital LDO (NL-DLDO) with control loop randomizations that bolster SCA resistance in the frequency domain. The NL-DLDO cascaded with an AES engine augmented with arithmetic countermeasures enables > 250K× improvement in MTD, with no CPA/CEMA/DNN attacks detected after 1-B encryptions, with 8% power and 10% area overheads incurred by arithmetic techniques. The RSA-4K crypto-processor implements exponent magnitude and timing randomizations along with dynamic memory addressing to mitigate time- and frequency-domain attacks. The countermeasures enable 711× suppression in means separation in current/EM magnitudes from 3.1 mV to 4.35 μV, reducing attacker's accuracy to an ineffective random guess classification, while limiting area and performance overheads to <; 0.05% and 3.25%, respectively.

Metis: An Integrated Morphing Engine CPU to Protect Against Side Channel Attacks

Power consumption and electromagnetic emissions analyses are well established attack avenues for secret values extraction in a large range of embedded devices. Countermeasures against these attacks are approached at different levels, from modified logic styles, to changes in the software implementations. In this work, we propose a microarchitectural modification to a compact RISC-V SoC, the OpenTitan open source silicon root of trust, providing a code morphing countermeasure against power and electromagnetic emissions side channel attacks. Our approach allows the countermeasure to be applied transparently, without the need for any software modification to the cryptographic primitive running on OpenTitan. Our microarchitecture integration of a morphing engine also allows us to provide transparent protection to memory operations. We validate our approach through measurements on an actual FPGA prototype on a Xilinx Artix-7. Our integrated morphing engine increases the FPGA resource consumption by less than 8%, plus the resources required by an RNG of choice, with respect to the original OpenTitan SoC. Our design shows a side channel attack resistance improvement of at least $250\times $ in the Measurements-To-Disclose metric with respect to the unprotected design. We benchmark the performance of our proposed architecture on all the ISO/IEC standard symmetric block ciphers, including, among the other AES, reducing the execution time overhead by $21\times $ to $141\times $ with respect to a continuously morphing software solution.

Second-Order Masked Lookup Table Compression Scheme

Masking by lookup table randomisation is a well-known technique used to achieve side-channel attack resistance for software implementations, particularly, against DPA attacks. The randomised table technique for first- and second-order security requires about m•2n bits of RAM to store an (n,m)-bit masked S-box lookup table. Table compression helps in reducing the amount of memory required, and this is useful for highly resource-constrained IoT devices. Recently, Vadnala (CT-RSA 2017) proposed a randomised table compression scheme for first- and second-order security in the probing leakage model. This scheme reduces the RAM memory required by about a factor of 2l, where l is a compression parameter. Vivek (Indocrypt 2017) demonstrated an attack against the second-order scheme of Vadnala. Hence achieving table compression at second and higher orders is an open problem.In this work, we propose a second-order secure randomised table compression scheme which works for any (n,m)-bit S-box. Our proposal is a variant of Vadnala’s scheme that is not only secure but also significantly improves the time-memory trade-off. Specifically, we improve the online execution time by a factor of 2n−l. Our proposed scheme is proved 2-SNI secure in the probing leakage model. We have implemented our method for AES-128 on a 32-bit ARM Cortex processor. We are able to reduce the memory required to store a randomised S-box table for second-order AES-128 implementation to 59 bytes.

IPM-RED: combining higher-order masking with robust error detection

Cryptographic hardware becomes increasingly vulnerable to physical attacks—both passive side-channel analysis and active fault injections—performed by skillful and well-equipped adversaries. In this paper, we introduce a technique that provides very high security against both types of attacks. It combines inner product masking (IPM), which offers higher-order side-channel attack resistance on word level and on bit level, with nonlinear security-oriented error-detection codes that provide robustness, i.e., strong detection guarantees for arbitrary faults. We prove that our scheme has the same security against side-channel attacks that an earlier, non-robust IPM-based solution has and in addition preserves robustness during addition and multiplication (and therefore arbitrary computations). Moreover, we prove that the information leakage from the checker is small and that the attack will be detected far before the attacker will gain significant information.

Enhancing Side Channel Attack-Resistance of the STTL Combining Multi-Vt Transistors with Capacitance and Current Paths Counterbalancing

Differential power analysis (DPA) exploits the difference between the instantaneous power of the circuit arches transitions to stole the state as information aiming to unveil the cryptographic key. Secure triple track logic (STTL) is a circuit-level countermeasure to DPA attacks based on dual-rail precharge logic (DPL). STTL is robust to attacks due to the delay in an insensitive feature that mitigates the logic glitches generated by the different path delays that lead to the logic gate inputs until they stabilize. The main STTL drawback, however, is the asymmetry of the transistor topology. Asymmetry causes unbalanced internal capacitances and different internal paths for the current flow, and DPA exploits it as a source of information leakage. Our work proposes three circuit topologies, combining multi-Vt transistors with a circuit counterbalancing strategy, aiming to improve the STTL DPA attack-resistance. Data encryption standard substitution-box circuit, designed in a TSMC 40 nm CMOS process, is our application case study to evaluate the DPA attack-resistance. Results gathered at the application-level show that our proposals outperform DPA attack-resistance of the prior work.

FPGA Implementation of the ECC Over GF(2 m ) for Small Embedded Applications

In this article, we propose a compact elliptic curve cryptographic core over GF(2 m ). The proposed architecture is based on the Lopez-Dahab projective point arithmetic operations. To achieve efficiency in resources usage, an iterative method that uses a ROM-based state machine is developed for the elliptic curve cryptography (ECC) point doubling and addition operations. The compact ECC core has been implemented using Virtex FPGA devices. The number of the required slices is 2,102 at 321MHz and 6,738 slices at 262MHz for different GF(2 m ). Extensive experiments were conducted to compare our solution to existing methods in the literature. Our compact core consumes less area than all previously proposed methods. It also provides an excellent performance for scalar multiplication. In addition, the ECC core is implemented in ASIC 0.18μm CMOS technology, and the results show excellent performance. Therefore, our proposed ECC core method provides a balance in terms of speed, area, and power consumption. This makes the proposed design the right choice for cryptosystems in limited-resource devices such as cell phones, IP cores of SoCs, and smart cards. Moreover, side-channel attack resistance is implemented to prevent power analysis.

Improved Power/EM Side-Channel Attack Resistance of 128-Bit AES Engines With Random Fast Voltage Dithering

This paper demonstrates the improved power and electromagnetic (EM) side-channel attack (SCA) resistance of 128-bit Advanced Encryption Standard (AES) engines in 130-nm CMOS using random fast voltage dithering (RFVD) enabled by integrated voltage regulator (IVR) with the bond-wire inductors and an on-chip all-digital clock modulation (ADCM) circuit. RFVD scheme transforms the current signatures with random variations in AES input supply while adding random shifts in the clock edges in the presence of global and local supply noises. The measured power signatures at the supply node of the AES engines show upto 37× reduction in peak for higher order test vector leakage assessment (TVLA) metric and upto 692× increase in minimum traces required to disclose (MTD) the secret encryption key with correlation power analysis (CPA). Similarly, SCA on the measured EM signatures from the chip demonstrates a reduction of upto 11.3× in TVLA peak and upto 37× increase in correlation EM analysis (CEMA) MTD.

Practical Evaluation of Protected Residue Number System Scalar Multiplication

The Residue Number System (RNS) arithmetic is gaining grounds in public key cryptography, because it offers fast, efficient and secure implementations over large prime fields or rings of integers. In this paper, we propose a generic, thorough and analytic evaluation approach for protected scalar multiplication implementations with RNS and traditional Side Channel Attack (SCA) countermeasures in an effort to assess the SCA resistance of RNS. This paper constitutes the first robust evaluation of RNS software for Elliptic Curve Cryptography against electromagnetic (EM) side-channel attacks. Four different countermeasures, namely scalar and point randomization, random base permutations and random moduli operation sequence, are implemented and evaluated using the Test Vector Leakage Assessment (TVLA) and template attacks. More specifically, variations of RNS-based Montgomery Powering Ladder scalar multiplication algorithms are evaluated on an ARM Cortex A8 processor using an EM probe for acquisition of the traces. We show experimentally and theoretically that new bounds should be put forward when TVLA evaluations on public key algorithms are performed. On the security of RNS, our data and location dependent template attacks show that even protected implementations are vulnerable to these attacks. A combination of RNS-based countermeasures is the best way to protect against side-channel leakage.

Design and leakage assessment of side channel attack resistant binary edwards Elliptic Curve digital signature algorithm architectures

Considering that Elliptic Curve Digital Signature Algorithm (ECDSA) implementations need to be efficient, flexible and Side Channel Attack (SCA) resistant, in this paper, a design approach and architecture for ECDSA and the underlined scalar multiplication operation is proposed for GF(2k), satisfying the above three directives. To achieve that, in the paper, Binary Edwards Curves (BECs) are adopted as an alternative to traditional Weierstrass Elliptic Curves (ECs) for GF(2k) since they offer intrinsic SCA resistance against simple attacks due to their uniformity, operation regularity and completeness. To achieve high performance and flexibility, we propose a hardware/software ECDSA codesign approach where scalar multiplication is implemented in hardware and integrated in the ECDSA functionality through appropriate drivers of an ECDSA software stack. To increase BEC scalar multiplier performance and introduce SCA resistance we adopt and expand a parallelism design strategy/methodology where GF(2k) operations of a scalar multiplier round for both point operations performed in this round are reordered and assigned into parallelism layer in order to be executed concurrently. Within this strategy we include hardware and software based SCA countermeasures that rely on masking/randomization and hiding. While scalar randomization is realized by the ECDSA software stack in an easy way, in order to achieve resistance using hardware means, we propose and introduce in every scalar multiplier round, within the parallelism layers, projective coordinates randomization of all the round’s output points. So, in our approach, considering that with the proposed parallelism plan in every scalar multiplier round BEC point operations are performed in parallel and that the round’s output points are randomized with a different number in each round, we manage to achieve maximum SCA resistance. To validate this resistance, we introduce and realize a leakage assessment process on BEC scalar multipliers for the first time in research literature. This process is based on real measurements collected from a controlled SAKURA X environment with a GF(2233) based scalar multiplier implementation. Using Welch’s t-test we investigate possible information leakage of the multiplier’s input point and scalar and after an extended analysis we find trivial leakage. Finally, we validate the ECDSA architecture and its scalar multiplier efficiency by implementing it on a Zynq 7000 series FPGA Avnet Zedboard and collecting very promising, well balanced, results on speed and hardware resources in comparison with other works.

ASNI: Attenuated Signature Noise Injection for Low-Overhead Power Side-Channel Attack Immunity

Computationally-secure cryptographic algorithms implemented on a physical platform leak significant “ side-channel ” information through their power supplies. Correlational power attack is an efficient power side-channel attack (SCA) technique, which analyzes the statistical correlation between the estimated and the measured supply current traces to extract the secret key. The existing power SCA countermeasures are mainly based on reducing the SNR of the leaked information, power balancing, or gate-level masking, each of which introduces significant power, area or performance overheads, which calls for an efficient generic countermeasure. This paper presents ASNI: Attenuated Signature Noise Injection , which is an energy-efficient generic countermeasure, and shows SCA resistance on the AES-128 encryption as an application. ASNI uses a shunt low-drop-out (LDO) regulator to suppress the AES current signature by ${>}200 \times $ in the supply current traces. The shunt LDO has been fabricated and validated in 130 nm CMOS technology. System-level implementation of the ASNI, with the AES-128 core operating at 40 MHz, shows that the system remains secure even after 1 M encryptions, with $\sim 25 \times $ reduction in power overhead compared to that of noise addition alone.

Design and Implementation of a Reconfigurable Cryptographic Coprocessor with Multiple Side-Channel Attacks Countermeasures

Nowadays, countermeasures against side-channel attack (SCA) have become necessary in hardware security. And the need for supporting multiple crypto algorithms on a chip is increasing. We propose a reconfigurable crypto coprocessor, which not only supports multiple crypto algorithms, but also provides multiple effective SCA countermeasures of SPA, DPA and EMA, by making use of its own reconfigurable features other than using extra resources. The countermeasure methods include several global and encryption flow related countermeasures, which can also be reconfigured along with the circuit function. This coprocessor is a coarse-grained reconfigurable architecture composed of several reconfigurable modules, such as logic arithmetic, shift, modular ADD/Substrate, permutation, S-box and modular multiplication units, all of which are reconfigurable. This reconfigurable cryptographic coprocessor is integrated into a system-on chip with a 32-bit CPU and fabricated in 0.18 m CMOS process with 1.8[Formula: see text]V supply and 100 MHz maximum frequency. Experimental results show that it can successfully resist SPA and DPA with one million power traces. As for EMA, if we use full countermeasures, it can resist EMA with up to 1.2 million electromagnetic traces without revealing the right subkey. Thus, this reconfigurable coprocessor can provide a good solution for both supporting multiple algorithms and providing SCA resistance, with no frequency influence, neglectable area overhead and small power overhead.

A DFA-Resistant and Masked PRESENT with Area Optimization for RFID Applications

Radio-Frequency Identification (RFID) tag-based applications are usually resource constrained and security sensitive. However, only about 2,000 gate equivalents in a tag can be budgeted for implementing security components [27]. This requires not only lightweight cryptographic algorithms such as PRESENT (around 1,000 gate equivalents) but also lightweight protections against modern Side Channel Attacks (SCAs). With this budget, the first-order masking and fault detection are two suitable countermeasures to be developed for PRESENT. However, if both countermeasures are applied without any optimization, it will significantly exceed the given area budget. In this work, we optimize area to include both countermeasures to maximize the security for PRESENT within this RFID area budget. The most area-consuming parts of the proposed design are the masked S-boxes and the inverse masked S-boxes. To optimize the area, we have deduced a computational relationship between these two parts, which enables us to reuse the hardware resource of the masked S-boxes to implement the inverse masked S-boxes. The proposed design takes up only 2,376 gates with UMC 65nm CMOS technology. Compared with the unoptimized design, our implementation reduces the overall area by 28.45%. We have tested the effectiveness of the first-order Differential Power Analysis (DPA) and Differential Fault Analysis (DFA) -resistant countermeasures. Experimental results show that we have enhanced the SCA resistance of our PRESENT implementation.

Comparing design approaches for elliptic curve point multiplication over [formula omitted] with polynomial basis representation

Point Multiplication (PM) is considered the most computationally complex and resource hungry Elliptic Curve Cryptography (ECC) mathematical operation. PM hardware accelerator design can follow several approaches that lead to a fast, small or flexible implementation, meeting related application specifications. However, each PM design decision has certain outcomes in utilized hardware resources and computation speed. Such a key design decision is related to the structure of the GF(2k) multipliers to be employed in the PM accelerator. In this paper, we highlight the GF(2k) multiplication role in the overall PM performance and investigate what are the trade-offs on a PM accelerator when using bit serial or bit parallel multiplication approach in terms of speed, chip covered area and flexibility. To achieve this goal, we estimate these tradeoffs for a single point operation and specify realistic design cases for bit serial and bit parallel multiplier based PM design approaches. To evaluate the theoretical modeling, a point operation design methodology based on the parallelism and rescheduling of GF(2k) operations is proposed. This design approach is adapted to two characteristic PM algorithm realizations, the traditional double & add algorithm and the side channel attack resistant Montgomery power ladder algorithm. Our goal is to assess the resulting PM accelerator overall performance so as to achieve high speed with an acceptable cost on chip covered area (hardware resources). Using this methodology, PM is performed in series of GF(2k) parallelism stages. To test the proposed methodology, 8 PM accelerator use cases are identified that can offer high speed, flexibility, side channel attack resistance or small chip covered area. To provide fair comparisons and results, a common PM architecture is devised and the use case PM accelerators are implemented in FPGA technology. Depending on the designers goal, the proposed architectures and 8 implementations can offer the benefit of either high speed (the proposed work is currently one of the fastest known GF(2k) bit parallel multiplier based PM realization) or flexibility with reasonable compromises in chip covered area.

Asynchronous Advanced Encryption Standard Hardware with Random Noise Injection for Improved Side-Channel Attack Resistance

This work presents the design, hardware implementation, and performance analysis of novel asynchronous AES (advanced encryption standard) Key Expander and Round Function, which offer increased side-channel attack (SCA) resistance. These designs are based on a delay-insensitive (DI) logic paradigm known as null convention logic (NCL), which supports useful properties for resisting SCAs including dual-rail encoding, clock-free operation, and monotonic transitions. Potential benefits include reduced and more uniform switching activities and reduced signal-to-noise (SNR) ratio. A novel method to further augment NCL AES hardware with random voltage scaling technique is also presented for additional security. Thereby, the proposed components leak significantly less side-channel information than conventional clocked approaches. To quantitatively verify such improvements, functional verification and WASSO (weighted average simultaneous switching output) analysis have been carried out on both conventional synchronous approach and the proposed NCL based approach using Mentor Graphics ModelSim and Xilinx simulation tools. Hardware implementation has been carried out on both designs exploiting a specified side-channel attack standard evaluation FPGA board, called SASEBO-GII, and the corresponding power waveforms for both designs have been collected. Along with the results of software simulations, we have analyzed the collected waveforms to validate the claims related to benefits of the proposed cryptohardware design approach.