Side-channel Information Leakage Research Articles

JitSCA: Jitter-based Side-Channel Analysis in Picoscale Resolution

In safety and security conscious environments, isolated communication channels are often deemed necessary. Galvanically isolated communication channels are typically expected not to allow physical side-channel attacks through that channel. However, in this paper, we show that they can inadvertently leak side channel information in the form of minuscule jitter on the communication signal. We observe worst-case signal jitter within 54 ± 45 ps using an FPGA-based receiver employing a time-to-digital converter (TDC), which is a higher time resolution than a typical oscilloscope can measure, while in many other systems such measurements are also possible. A transmitter device runs a cryptographic accelerator, while we connect an FPGA on the receiver side and measure the signal jitter using a TDC. We can indeed show sufficient side-channel leakage in the jitter of the signal by performing a key recovery of an AES accelerator running on the transmitter. Furthermore, we compare this leakage to a power side channel also measured with a TDC and prove that the timing jitter alone contains sufficient side-channel information. While for an on-chip power analysis attack about 27k traces are needed for key recovery, our cross-device jitter-based attack only needs as few as 47k traces, depending on the setup. Galvanic isolation does not change that significantly. That is an increase by only 1.7x, showing that fine-grained jitter timing information can be a very potent attack vector even under galvanic isolation. In summary, we introduce a new side-channel attack vector that can leak information in many presumably secure systems. Communication channels can inadvertently leak information through tiny timing variations, known as signal jitter. This could affect millions of devices and needs to be considered.

Sending-or-Not-Sending Twin-Field Quantum Key Distribution with a Passive Decoy-State Method

Twin-field quantum key distribution (TF-QKD) has attracted considerable attention because it can exceed the basic rate-distance limit without quantum repeaters. Its variant protocol, sending or not-sending quantum key distribution (SNS-QKD), not only fixes the security vulnerability of TF-QKD, but also can tolerate large misalignment errors. However, the current SNS-QKD protocol is based on the active decoy-state method, which may lead to side channel information leakage when multiple light intensities are modulated in practice. In this work, we propose a passive decoy-state SNS-QKD protocol to further enhance the security of SNS-QKD. Numerical simulation results show that the protocol not only improves the security in source, but also retains the advantages of tolerating large misalignment errors. Therefore, it may provide further guidance for the practical application of SNS-QKD.

Performance of passive decoy-state quantum key distribution with mismatched local detectors

In quantum key distribution (QKD), the passive decoy-state method can simplify the intensity modulation and reduce some of side-channel information leakage and modulation errors. It is usually implemented with a heralded single-photon source. In Wang et al 2016 (Phys. Rev. A 96 032312), a novel passive decoy-state method is proposed by Wang et al, which uses two local detectors to generate more detection events for tightly estimating channel parameters. However, in the original scheme, the two local detectors are assumed to be identical, including the same detection efficiency and dark count rate, which is often not satisfied in the realistic experiment. In this paper, we construct a model for this passive decoy-state QKD scheme with two mismatched detectors and explore the effect on QKD performance with certain parameters. We also take the finite-size effect into consideration, showing the performance with statistical fluctuations. The results show that the efficiencies of local detectors affect the key rate more obviously than dark count rates.

Analysis of Electromagnetic Information Leakage Based on Cryptographic Integrated Circuits.

Cryptographic algorithm is the most commonly used method of information security protection for many devices. The secret key of cryptographic algorithm is usually stored in these devices’ registers. In this paper, we propose an electromagnetic information leakage model to investigate the relationship between the electromagnetic leakage signal and the secret key. The registers are considered as electric dipole models to illustrate the source of the electromagnetic leakage. The equivalent circuit of the magnetic field probe is developed to bridge the output voltage and the electromagnetic leakage signal. Combining them, the electromagnetic information leakage model’s function relationship can be established. Besides, an electromagnetic leakage model based on multiple linear regression is proposed to recover the secret key and the model’s effectiveness is evaluated by guess entropy. Near field tests are conducted in an unshielded ordinary indoor environment to investigate the electromagnetic side-channel information leakage. The experiment result shows the correctness of the proposed electromagnetic leakage model and it can be used to recover the secret key of the cryptographic algorithm.

Side-channel information leakage analysis and countermeasures in an embedded CPU microarchitecture

Side-channel attacks (SCAs) have become a significant threat nowadays to cryptographic devices, especially central processing units (CPUs). Based on the implementation of AES-128, the side-channel information leakage analysis is carried out in a 32-bit CPU microarchitecture in this work. Correlation power analysis (CPA) results show that it is obvious to reveal the secret key by using only 30 power traces based on the net-list simulation. Three flexibly configurable hardware-based countermeasures are proposed to prevent information leakage in the arithmetic and logic unit (ALU), register file (RF) and load/store unit (LSU), respectively, which are the most sensitive components according to our analysis. The proposed countermeasures have different protection effects on the CPU since the required trace number to reveal the secret key has increased from 30 to 100∼120,000. Moreover, the anti-attack capability of the CPU is improved by 4000 times using the three countermeasures simultaneously. The proposed countermeasures can be freely combined while considering the CPU security and implementation overhead. In practice, the anti-attack capability of the CPU can be further improved when the proposed countermeasures are implemented in real-world measurements, because additional noise will be introduced during the measurements.

Bounding passive light-source side channels in quantum key distribution via Hong-Ou-Mandel interference

Passive side-channel attacks in quantum key distribution (QKD) aim at obtaining information about the quantum signals without disturbing them and hence compromise real-world QKD security. Currently, there are no reliable tools for the assessment of QKD signal generation imperfections. In this work we propose a generic experimental method which allows to upper-bound QKD light-source imperfections and directly integrate them into the modern security proofs. The method relies on Hong-Ou-Mandel interference between different emitted signals: the maximum interference visibility reveals overall signal distinguishability that could lead to passive side-channel information leakage. We apply it for the standard decoy-state BB84 protocol and calculate a lower bound on the secret key rate for realistic values of interference visibility. The method can be readily implemented in practical QKD setups and is especially relevant for multiple-laser QKD systems such as the one installed on the Micius satellite.

Direct phase modulation via optical injection: theoretical study.

Direct phase modulation via optical injection is a newly developed method for coding the phase of a gain-switched laser, which meets high requirements placed on transmitters for quantum key distribution: compactness, low losses, compatibility with CMOS technologies, and the absence of undesirable effects leading to the side-channel information leakage. Despite the successful implementation and good prospects for the further development of this system, there is still a lack of theoretical investigations of this scheme in the literature. Here, for the first time, we perform its theoretical analysis. We study the influence of the spontaneous emission noise, examine the role of the gain non-linearity, and consider the temperature drift effect. The results obtained reveal that these phenomena significantly affect system performance. We have tried to formulate here practical instructions, which will help to take these features into account when elaborating and employing the optical-injection-based phase modulator.

3-D CMOS Chip Stacking for Security ICs Featuring Backside Buried Metal Power Delivery Networks With Distributed Capacitance

3-D stacks of complimentary metal-oxide-semiconductor (CMOS) integrated circuit (IC) chips for security applications monolithically embed backside buried metal (BBM) routing with low series impedance and high decoupling capability in a power delivery network (PDN), thanks to distributed capacitances over a full-chip backside area. The 3-D Si demonstrator integrating cryptographic engines was fabricated in a 0.13-μm CMOS technology with post-Si wafer-level BBM Cu processing with 10, 15, and 10 μm of thickness, linewidth, and space, respectively, along with through Si vias (TSVs) with 10 and 40 μm of diameter and depth, respectively. The capacitance of 0.18 nF/mm <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> in the effective backside area of 71 mm <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> suppressed dynamic IR drops in 10% and 59% for the single chip and four chip stack samples, respectively, during the operation of a 3.9 M-gate crypto core at 30 MHz. On-chip power noise monitoring (OCM) was applied in these measurements. The 3-D BBM PDN also effectively reduces power side channel information leakage, which is evaluated by 14× increase in the number of externally observed electromagnetic (EM) noise waveforms to attain the t-test value of larger than 4.5.

Lightning-fast and privacy-preserving outsourced computation in the cloud

In this paper, we propose a framework for lightning-fast privacy-preserving outsourced computation framework in the cloud, which we refer to as LightCom. Using LightCom, a user can securely achieve the outsource data storage and fast, secure data processing in a single cloud server different from the existing multi-server outsourced computation model. Specifically, we first present a general secure computation framework for LightCom under the cloud server equipped with multiple Trusted Processing Units (TPUs), which face the side-channel attack. Under the LightCom, we design two specified fast processing toolkits, which allow the user to achieve the commonly-used secure integer computation and secure floating-point computation against the side-channel information leakage of TPUs, respectively. Furthermore, our LightCom can also guarantee access pattern protection during the data processing and achieve private user information retrieve after the computation. We prove that the proposed LightCom can successfully achieve the goal of single cloud outsourced data processing to avoid the extra computation server and trusted computation server, and demonstrate the utility and the efficiency of LightCom using simulations.

Ask Less, Get More: Side-Channel Signal Hiding, Revisited

Signal hiding countermeasures have been extensively investigated in the early side-channel attacks’ literature. Due to design and physical imperfections, their stand-alone use only leads to a limited reduction of the attacks’ complexity. As a result, more algorithmic countermeasures providing a more formal cost vs. security tradeoff (e.g., shuffling and masking) have gained more attention. Yet, since the cost associated with these is high, designers aim at combining countermeasures, leveraging the strength of each. In this manuscript, we demonstrate that by asking less to both signal hiding and algorithmic countermeasures (as stand-alone), we can develop combined countermeasures that indeed provide higher security at lower cost. For this purpose, we show how we can stack signal reduction and amplitude randomization techniques with ultra low cost automatic design flows and standard tools, and reach attractive security levels in combination with masking. Concretely, we examine two natural strategies for signal hiding and their combination: namely WDDL and a simple, local, scalable and easy-to-implement noise generation engine. A 65nm technology ASIC is evaluated with multiple isolated AES cores, leveraging recent information theoretic bounds which are connected to masking security proofs, significantly reducing the side-channel information leakage. We further quantify performance gains for masked designs.

WiFi Data Leakage Detection

The applications that we install on smart phones generates multitude of network traffic patterns, background activities, periodic updates etc. This application data leak side channel information like packet size, transfer timing, volume etc. This information can be used and exploited by an intruder to steal confidential user information. This paper focuses on various threats to the user’s private activities with the increase in commercial interest in tracing publicly broadcasted wireless data. The paper demonstrates mechanisms for inferring the user behavior from encrypted wireless network activity. It also shows how an absolutely inert eavesdropper can detect the information that is being transmitted over the network.

Bucketing and information flow analysis for provable timing attack mitigation

This paper investigates the effect of bucketing in security against timing-channel attacks. Bucketing is a technique proposed to mitigate timing-channel attacks by restricting a system’s outputs to only occur at designated time intervals, and has the effect of reducing the possible timing-channel observations to a small number of possibilities. However, there is little formal analysis on when and to what degree bucketing is effective against timing-channel attacks. In this paper, we show that bucketing is in general insufficient to ensure security. Then, we present two conditions that can be used to ensure security of systems against adaptive timing-channel attacks. The first is a general condition that ensures that the security of a system decreases only by a limited degree by allowing timing-channel observations, whereas the second condition ensures that the system would satisfy the first condition when bucketing is applied and hence becomes secure against timing-channel attacks. A main benefit of the conditions is that they allow separation of concerns whereby the security of the regular channel can be proven independently of concerns of side-channel information leakage, and certain conditions are placed on the side channel to guarantee the security of the whole system. Further, we show that the bucketing technique can be applied compositionally in conjunction with the constant-time-implementation technique to increase their applicability. While we instantiate our contributions to timing channel and bucketing, many of the results are actually quite general and are applicable to any side channels and techniques that reduce the number of possible observations on the channel. It is interesting to note that our results make non-trivial (and somewhat unconventional) uses of ideas from information flow research such as channel capacity and refinement order relation.

Electromagnetic Side Channel Information Leakage Created by Execution of Series of Instructions in a Computer Processor

The side-channel leakage is a consequence of program execution in a computer processor, and understanding relationship between code execution and information leakage is a necessary step in estimating information leakage and its capacity limits. This paper proposes a methodology to relate program execution to electromagnetic side-channel emanations and estimates side-channel information capacity created by execution of series of instructions (e.g., a function, a procedure, or a program) in a processor. To model dependence among program instructions in a code, we propose to use Markov source model, which includes the dependencies among sequence of instructions as well as dependencies among instructions as they pass through a pipeline of the processor. The emitted electromagnetic (EM) signals during instruction executions are natural choice for the inputs into the model. To obtain the channel inputs for the proposed model, we derive a mathematical relationship between the emanated instruction signal power (ESP) and total emanated signal power while running a program. Then, we derive the leakage capacity of EM side channels created by execution of series of instructions in a processor. Finally, we provide experimental results to demonstrate that leakages could be severe and that a dedicated attacker could obtain important information.

Verifying and Quantifying Side-channel Resistance of Masked Software Implementations

Power side-channel attacks, capable of deducing secret data using statistical analysis, have become a serious threat. Random masking is a widely used countermeasure for removing the statistical dependence between secret data and side-channel information. Although there are techniques for verifying whether a piece of software code is perfectly masked, they are limited in accuracy and scalability. To bridge this gap, we propose a refinement-based method for verifying masking countermeasures. Our method is more accurate than prior type-inference-based approaches and more scalable than prior model-counting-based approaches using SAT or SMT solvers. Indeed, our method can be viewed as a gradual refinement of a set of type-inference rules for reasoning about distribution types. These rules are kept abstract initially to allow fast deduction and then made concrete when the abstract version is not able to resolve the verification problem. We also propose algorithms for quantifying the amount of side-channel information leakage from a software implementation using the notion of quantitative masking strength. We have implemented our method in a software tool and evaluated it on cryptographic benchmarks including AES and MAC-Keccak. The experimental results show that our method significantly outperforms state-of-the-art techniques in terms of accuracy and scalability.

Leaking your engine speed by spectrum analysis of real-Time scheduling sequences

Abstract This paper identifies and studies a new security/privacy issue for automobile vehicles. Specifically, attackers can infer the engine speed of a vehicle by observing and analyzing the real-time scheduling sequences on the Engine Control Unit (ECU). First, we present the problem model of engine-triggered task executed on ECU. And then, we introduce two Engine-triggered Task Period Tracing methods (DFT-based ETPT and FRSP-based ETPT) to infer the period variation of engine-triggered task. Finally, simulation experiments are conducted to demonstrate the effect of this new timing side-channel information leakage with our proposed methods.

A 286 F2/Cell Distributed Bulk-Current Sensor and Secure Flush Code Eraser Against Laser Fault Injection Attack on Cryptographic Processor

Laser fault injection (LFI) attack on cryptographic processors is a serious threat to information security. This paper proposes a sense-and-react countermeasure against LFI. A distributed bulk-current sensor monitors the abnormal current conduction caused by laser irradiation to a silicon substrate. The single sensor occupies only 286 F2/Cell and it is distributed across the entire cryptographic core for 100% attack detection coverage. Upon detection of LFI attack, a flush code eraser prevents a leakage of faulty ciphertext by immediately shunting the core supply path within nano-second order. In addition, the core supply during the shunting is electrically isolated from the global supply line to prevent side-channel information leakage of intermediate faulty codes. A test chip was designed and fabricated in 0.18- $\mu \text{m}$ standard CMOS, integrating a 128-bit Advanced Encryption Standard (AES) cryptographic processor with the proposed countermeasures. A protected AES processor can disable LFI attack with only +28% layout area penalty compared to an unprotected core.

A Comprehensive Side-Channel Information Leakage Analysis of an In-Order RISC CPU Microarchitecture

Side-channel attacks are a prominent threat to the security of embedded systems. To perform them, an adversary evaluates the goodness of fit of a set of key-dependent power consumption models to a collection of side-channel measurements taken from an actual device, identifying the secret key value as the one yielding the best-fitting model. In this work, we analyze for the first time the microarchitectural components of a 32-bit in-order RISC CPU, showing which one of them is accountable for unexpected side-channel information leakage. We classify the leakage sources, identifying the data serialization points in the microarchitecture and providing a set of hints that can be fruitfully exploited to generate implementations resistant against side-channel attacks, either writing or generating proper assembly code.

Reducing Power Side-Channel Information Leakage of AES Engines Using Fully Integrated Inductive Voltage Regulator

This paper demonstrates an integrated inductive voltage regulator (IVR) for improving power side-channel-attack (PSCA) resistance of 128-bit Advanced Encryption Standard (AES-128) engines. An inductive IVR is shown to transform the current signatures generated by an encryption engine. Furthermore, an all-digital circuit block, referred to as the loop-randomizer, is introduced to randomize the IVR transformations. A 130-nm test-chip with an inductive IVR with 11.6-nH inductance, 3.2-nF capacitance, and 125-MHz switching frequency is used to drive two different architectures of AES-128 engine: high performance and low power. The measurements demonstrate that the IVR with loop randomizer eliminates information leakage while incurring only 3% overhead in performance and 5% overhead in power over a baseline IVR-AES system. Moreover, while a key-byte can be extracted for the standalone high-performance and low-power AES (LP-AES) with only 5000 and 1000 measurements, respectively, the proposed IVR inhibits key extraction even with 500 000 measurements.

Capacity of the EM Covert/Side-Channel Created by the Execution of Instructions in a Processor

The goal of this paper is to answer how much information is “transmitted” by the execution of particular sequence of instructions in a processor. Introducing such a measure would provide quantitative guidance for designing programs and computer hardware that minimizes inadvertent (side channel) information leakage, and would also help detect parts of a program or hardware design that have unusually high leakage (i.e., were designed to function as covert channel “transmitters”). To answer this question, we propose a new method to estimate the maximum information leakage through EM signals generated by the execution of instructions in a processor. We start by deriving a mathematical relationship between electromagnetic side-channel energy of individual instructions and the measured pairwise side-channel signal power. Then, we use this measure to calculate the transition probabilities needed for estimating capacity. Finally, we propose a new method to estimate side/covert channel capacity created by the execution of instructions in a processor and illustrate our results in several computer systems.

From Electromyogram to Password

With the increasing popularity of augmented reality (AR) services, providing seamless human-computer interactions in the AR setting has received notable attention in the industry. Gesture control devices have recently emerged to be the next great gadgets for AR due to their unique ability to enable computer interaction with day-to-day gestures. While these AR devices are bringing revolutions to our interaction with the cyber world, it is also important to consider potential privacy leakages from these always-on wearable devices. Specifically, the coarse access control on current AR systems could lead to possible abuse of sensor data. Although the always-on gesture sensors are frequently quoted as a privacy concern, there has not been any study on information leakage of these devices. In this article, we present our study on side-channel information leakage of the most popular gesture control device, Myo. Using signals recorded from the electromyography (EMG) sensor and accelerometers on Myo, we can recover sensitive information such as passwords typed on a keyboard and PIN sequence entered through a touchscreen. EMG signal records subtle electric currents of muscle contractions. We design novel algorithms based on dynamic cumulative sum and wavelet transform to determine the exact time of finger movements. Furthermore, we adopt the Hudgins feature set in a support vector machine to classify recorded signal segments into individual fingers or numbers. We also apply coordinate transformation techniques to recover fine-grained spatial information with low-fidelity outputs from the sensor in keystroke recovery. We evaluated the information leakage using data collected from a group of volunteers. Our results show that there is severe privacy leakage from these commodity wearable sensors. Our system recovers complex passwords constructed with lowercase letters, uppercase letters, numbers, and symbols with a mean success rate of 91%.