A proper security analysis method for CMOS cryptographic circuits

In recent years, some countermeasures have been proposed against differential power analysis (DPA) at the basic composition element level of logic circuits. We propose a countermeasure named random switching logic (RSL). RSL involves computation with data masking using a single logic gate and suppression of transient transitions using ENABLE signals generated independently of input data. Recently, some countermeasures that were proposed against DPA, such as MRSL and DRSL, adopted the concept of RSL. Although MRSL is based on RSL, it uses a different method to suppress the transient transitions. DRSL uses RSL to avoid the possibility of leakage caused by a difference in delays occurring in MDPL that combines dual-rail circuits with random masking. The important difference between these countermeasures and RSL is that they can vary the output transition timing depending on the input data patterns. In this paper, we focus on this feature to evaluate the DPA resistance of MRSL and DRSL. Experiments are also conducted on DPA resistance by using an FPGA to verify the evaluation results. It is confirmed that in both MRSL and DRSL, there is a possibility of leakage if a sufficient difference in delays exists in input signals.

SEED, the Korean standard block cipher algorithm, is a 128-bit symmetric key block cipher algorithm. Although SEED is theoretically safe, cryptographic devices with SEED modules are vulnerable to differential power analysis due to leakage information. Recently, differential power analysis has been widely researched, and various countermeasure techniques against differential power analysis have been proposed. In this paper, we embodied SEED hardware modules with differential power analysis countermeasure techniques using masking methods, and we generated random number using simple PRNG module. We embodied the SEED hardware modules using VHDL, and analyzed the result of simulation and synthesis. ??2010 IEEE.

Security of cryptographic devices (secure ICs) like smart cards has come under threat from powerful side channel attacks like Differential Power Analysis (DPA). DPA uses power consumption information leaked from the secure IC in conjunction with statistical correlation techniques to retrieve the secret key stored in the secure IC. The most effective countermeasure to resist DPA attacks is to make the power consumption of the secure IC invariant, hence uncorrelated to the input data (secret key). In hardware implementations, this can be achieved by designing the secure IC using Dynamic and Differential Logic (DDL) style. In this paper, we present a novel methodology to design DPA-resistant power invariant secure ICs using Reduced Complementary Dynamic and Differential Logic (RCDDL). The proposed methodology involves strategies to design: 1) RCDDL gates, and 2) secure circuits using RCDDL gates. Experiments show significant improvements in security strength, average power consumption and area, when compared with a similar secure DDL and non-secure static-CMOS logic design styles.

Random switching logic (RSL) has been proposed as an efficient countermeasure to mitigate power analysis. The logic style equalizes the output transition probabilities using a random mask-bit. This manuscript, however, will show a successful attack against RSL. The single mask-bit can only add one bit of entropy to the information content of the overall power consumption variations and can very easily be deduced from the power consumption. Once the mask-bit is known, the a posteriori probabilities of the output transitions are not equal anymore and a power analysis can be mounted. A threshold filter suffices to remove the additional bit of information.

Cryptographic devices with the Advanced Encryption Standard (AES) encryption algorithm are vulnerable to side channel attack, in particular, differential power analysis (DPA). Differential power analysis can be used to reveal the secret key in AES by monitoring the power consumption of the internal circuit and applying statistical processing. In this paper, an evaluation of power analysis attacks of six different AES Sbox designs, namely sum of product (SOP), product of sum (POS), table lookup (TBL), composite field (CF), positive polarity Reed-Miller (PPRM) and 3 stages PPRM, is presented. Comparison of the different AES Sbox implementations in terms of size, performance and SNR analysis is also performed. The results show that the composite field Sbox design is more resistant to attack and smaller than other Sbox designs but operates at a slower speed. This paper also presents a Random Clock mechanism that can be used to increase the resistance of the AES composite field Sbox design to power analysis attack by reducing the overall SNR by 78%.

The 128-bit SM4[1] cipher is the first commercial cipher algorithm published by China in 2012, which is mainly used in WLAN. Comparing with conventional approaches, additive masking is adopted to resist the DPA (Differential Power Analysis) attack, and PPRM circuit structure is adopted to reduce the power consumption for SM4 S-box. Simulation results show that the design has a 50% reduction in power consumption and a 44% reduction in delay at the cost of area 20% increased using SMIC 0.18μm technology. Two sets of 2000 plaintext inputs are used in the DPA attack. Simulation results show the resistance of S-box to DPA is reliable. Additionally, 4-stage-pipelined SM4 cipher circuit is realized with an area of 18609 gates. The throughput rate of it can reach 2Gbps with a power consumption of 3.65mW@10Mhz.

Side channel analysis(SCA) focuses on attacking cryptographic algorithm implementations by collecting leaked information and analyzing the correlation between the leaked and key information in the cryptographic system. Currently, SCA is the main threat to cryptographic implementations, with DPA (differential power analysis) and DFA (differential fault analysis) being two of the most threatening types of SCA. However, the existing countermeasures against DPA and DFA have shortcomings and can hardly protect cipher designs perfectly. Based on a comprehensive analysis of DPA and DFA, this paper proposes a new idea of using an evolutionary cipher (EVOC) against DPAs based on the model proposed by Kocher, and several different new types of DFAs. In fact, an EVOC is a kind of dynamic cipher designing method. Moreover, combined with intelligent searching algorithms and cryptography design policies, EVOCs utilize the dynamic and unpredictable properties of TRNG (a truly random number generator) to ensure cipher design at a high level of security. Therefore, with an EVOC we could design cryptography algorithms with high security to resist mathematical analysis as well as DPAs and DFAs. This paper analyzes and proves the security, efficiency, cost, and original features of EVOCs against DPA and DFA both theoretically and experimentally. Compared with existing countermeasures against SCAs, EVOCs use dynamic non-linear operations to destroy the bases of DPA and DFA. At the algorithm level, EVOCs are more efficient than other resistance methods. Based on the theory and experiments, this paper proposes certain modifications to the EVOC in the AES (advanced encryption standard) algorithm, which can be referenced by other dynamic designs of cryptographic algorithms.

Security at low cost is an important factor for cryptographic hardware implementations. Unfortunately, the security of cryptographic implementations is threatened by Side Channel Analysis (SCA). SCA attempts to discover the secret key of a device by exploiting implementation characteristics and bypassing the algorithm's mathematical security. Differential Power Analysis (DPA) is a type of SCA, which exploits the device's power consumption characteristics. Several countermeasures to DPA have been proposed, however, all of them increase security at the cost of increased area which in-turn leads to increased power consumption and reduced throughput. FPGAs are popular due to their reconfigurability, lower development cost, off-the-shelf availability and shorter time to market. Block RAMs (BRAM) are large memories in FPGAs that are commonly used as ROM, FIFO, Look-up tables, etc. In this paper we explore the DPA resistance of BRAMs in Xilinx FPGAs and verify if their usage can improve the security. The results of our Advanced Encryption Standard (AES) implementations show that using BRAMs alone can improve the security over a look-up table (LUT) only design 9 times. Applying Separated Dynamic Differential Logic (SDDL) for FPGAs, a countermeasure against DPA, to this design doubles the security again leading to an 18 fold increase over the unprotected LUT design.

Differential power analysis (DPA) has been shown to be an effective attack on cryptographic systems capable of releaving secret data by measuring power consumption. DPA resistant circuits currently experience severe problems in terms of performance, area, and power. Although different countermeasures to reduce DPA attacks have been proposed and implemented in general, such protections do not make attacks infeasible. Additionally, most are dual rail logic families, Delay Based Dual Rail Precharge Logic (DDPL) with high resistance is presented and significantly lower overheads in performance, area, and power than other DPA resistant logic styles. The Delay Based Dual Rail Precharge Logic (DDPL) shows a certain improvement in Normalized Energy Deviation(NED) with respect to other dual rail logics.

The LSI design methodology against Differential Power Analysis (DPA) is important to realize a tamper-resistant cryptographic circuit. In order to verify the DPA resistance before ASIC fabrication, the DPA verification using FPGA is commonly used. However, power traces of ASIC differ from that of FPGA, so the DPA verification on FPGA cannot guarantee the DPA resistance on ASIC. On the other hand, it takes extremely long time to collect the simulated power traces using post-layout netlists of ASIC. Hence, the DPA-resistance verification method using smaller number of power traces is demanded. In this paper, we propose Equivalent Byte Method (EBM) which synchronizes the operation on all Substitution Boxes (S-Boxes) at the attacking round by controlling the plaintexts and the keys. In EBM, the power-consumption profiles of S-Boxes are emphasized by each other, and then the DPA analysis for a correct key is easily distinguished with smaller number of traces. In order to demonstrate the effectiveness of the proposed EBM, AES circuits using DPA-resistant techniques of WDDL and MDPL are implemented on FPGA. As a result, EBM revealed DPA-leak with 1/1000 ~ 1/50 power traces required for the general statistical method.

Encryption chips are specialized integrated circuits that incorporate encryption algorithms for data encryption and decryption, ensuring data confidentiality and security. In China, the domestic SM4 algorithm is commonly utilized, as opposed to the international AES encryption algorithm. These widely implemented encryption standards have been proven to be difficult to crack through crypt analysis methods Currently, power consumption side-channel attacks are the most prevalent method. They involve capturing power consumption data during the encryption process and subsequently recovering the encryption key from this data. The two leading methods are Differential Power Analysis (DPA) and machine learning techniques. DPA does not necessitate prior knowledge but relies heavily on the number of power consumption curves. With only 50 power consumption data points, the accuracy is a mere 80%. Machine learning methods require prior knowledge, achieving an accuracy rate above 95% with only 30 power traces, albeit with training times typically exceeding 15 min. In this paper, a distributed energy analysis attack approach was presented based on Correlation Power Analysis (CPA). The power consumption data was divided into 16 subsets, with each subset corresponding to 8 bytes of the key. By training each subset separately, the 8-byte key’s corresponding power consumption data is reduced to only 100 dimensions, resulting in a 76% decrease in cracking time and a 3% improvement in cracking accuracy rate.This article also trains a more complex 256 classification model to directly crack the final key, achieving a success rate of 28% in cracking 128-bit passwords with only 1 power trace

Since the vulnerability of cryptosystems to differential power analysis (DPA) was reported in 1999, various power analysis attacks and corresponding countermeasures have been studied. With the scaling down of supply voltage and CMOS technology below 90 nm, leakage power plays an increasing role in the overall power dissipation. Future cryptosystems need to address this trend, though it has not been of concern yet in low- cost cryptosystems such as smartcards and RFED tags which currently use older technologies and low performance transistors. In this paper, we explore the impact of leakage power on conventional DPA and the feasibility of a novel leakage-based DPA (LDPA). We first use SPICE simulations to explore the leakage dependence on input patterns of logic gates implemented in 90 nm, 65 nm, and 45 nm CMOS technologies. Then we simulate a successful LDPA on a subset of a DES cryptosystem with only 120 rounds, in contrast to the 200 rounds reported for a conventional DPA in 180 nm technology. Furthermore, we demonstrate how even a DES implementation using a DPA-resistant logic style can be broken with LDPA in 2000 rounds, compared with the conventional DPA using more than 5000 rounds.

A microprocessor is as secure as its weakest module. Depending on the application, the weakest module may be present in the hardware, micro-architecture, or a vulnerability in the software. For instance in a web-server, the biggest threats occur due to software vulnerabilities and due to information leakage in shared micro-architecture components. On the other hand, in an end-point IoT device, invasive and non-invasive hardware attacks such as Differential Power Analysis (DPA), are arguably the biggest threats. In this paper we highlight some aspects of the development of a secure processor called Shakti-S. The processor is configurable and can cater to vulnerabilities in multiple layers. To protect against memory vulnerabilities that are common in applications, hardware enabled memory protection schemes are implemented. Fine-grained compartment capabilities permit the secure least-privilege software design methodology. In the micro-architecture, shared modules like cache memories are protected by moving target randomization mechanisms which can prevent most variants of cache timing attacks. In the hard-ware, critical information is masked to break correlation with the device’s power consumption, thus hardening the processor against strong side-channel attacks like the Differential Power Analysis.

Providing a secure hardware infrastructure is the main issue to implement secure cryptographic algorithms. Just a robust algorithm with suitable key lengths is not effective against differential analysis attacks and can cause the cryptographic key to be discovered. Today, credit cards and electronic identification cards, due to the greater scope of applications are subjected to differential power analysis (DPA) attacks. As a result, a good design can help maintain the confidentiality of information. Providing a design method that balances the power consumption of the outputs and inputs of chips results a DPA secure designs. Moreover, reduction of power consumption by recovering the charge stored in nodes can make the tracing power will be more difficult. On the other hand, designing a uniform pattern in the transistor surface shape for all logic gates will make them resilient against advanced imaging techniques. In this paper a DPA resilient design method is proposed which is also robust against some other attacks such as timing attacks and advanced image processing techniques. The presented designs are simulated and compared with the state of the art designs using Synopsis HSPICE with 22nm technology node. Simulation results shows that the proposed method has the lowest and most balanced power consumption compared to the other designs.

A design methodology of Random Switching Logic (RSL) using CMOS standard cell libraries is proposed to counter power analysis attacks against cryptographic hardware modules. The original RSL proposed in 2004 requires a unique RSL-gate for random data masking and glitch suppression to prevent secret information leakage through power traces. In contrast, our new methodology enables to use general logic gates supported by standard cell libraries. In order to evaluate its practical performance in hardware size and speed as well as resistance against power analysis attacks, an AES circuit with the RSL technique was implemented as a cryptographic LSI using 130-nm and 90-nm CMOS standard cell library. From the results of attack experiments that used a million traces, we confirmed that the RSL-AES circuit has very high DPA and CPA resistance thanks to the contributions of both the masking function and the glitch suppressing function.