An Open-Source Framework for Efficient Side-Channel Analysis on Cryptographic Implementations

Emerging technologies such as Spin-transfer torque magnetic random-access memory (STT-MRAM) are considered potential candidates for implementing low-power, high density storage systems. The vulnerability of such nonvolatile memory (NVM) based cryptosystems to standard side-channel attacks must be thoroughly assessed before deploying them in practice. In this paper, we outline a generic Correlation Power Analysis (CPA) attack strategy against STT-MRAM based cryptographic designs using a new power model. In our proposed attack methodology, an adversary exploits the power consumption patterns during the write operation of an STT-MRAM based cryptographic implementation to successfully retrieve the secret key. In order to validate our proposed attack technique, we mounted a CPA attack on MICKEY-128 2.0 stream cipher design consisting of STT-MRAM cells with Magnetic Tunnel Junctions (MTJs) as storage elements. The results of the experiments show that the STT-MRAM based implementation of the cipher circuit is susceptible to standard differential power analysis attack strategy provided a suitable hypothetical power model (such as the one proposed in this paper) is selected. In addition, we also investigated the effectiveness of state-of-the-art side-channel attack countermeasures for MRAMs and found that our proposed scheme is able to break such protected implementations as well.

Three-dimensional (3D) integration is envisioned as a natural defense to thwart side-channel analysis (SCA) attacks. However, there lack extensive studies on the unique feature of 3D power distribution network (PDN) noise and its impact on the efficiency of SCA attacks in 3D chips. This work fills the gap. Our experiments based on the real PDN and through-silicon via (TSV) models indicate that the noise from the other 3D planes is additive, which can significantly change the power profile of the crytpo unit in a 3D chip. We exploit the cross-plane PDN noise to develop a new counter-measure against the correlation power analysis (CPA) attacks in 3D integrated circuits (ICs). Simulation results show that the proposed method successfully improves the system resilience against CPA attacks and enhances the correlation difference by 29.1% and 18.7% over 2D and 3D baseline, respectively.

Cryptographic System-on-Chips (SoCs) are becoming more and more popular. In these systems, cryptographic accelerators are integrated with processor cores to provide users with the software’s flexibility and hardware’s high performance. First, this work aimed to confirm the vulnerability of cryptographic SoCs against several types of power analysis attacks. Then, the novel Random Dynamic Frequency Scaling (RDFS) countermeasure is proposed to improve the resistance of such systems. The proposed RDFS countermeasure improved the power analysis resistance while maintaining low-performance overhead and hardware costs by generating more than 219,000 distinct frequencies for driving only the cryptographic accelerators. The effectiveness of the proposed RDFS countermeasure is demonstrated by conducting realistic Correlation Power Analysis (CPA) attacks, Deep-Learning-based Side-Channel Analysis (DL-SCA) attacks, and Test Vector Leakage Assessment (TVLA) testing methodology. The experimental results show that the RISC-V SoC protected by RDFS countermeasure can withstand CPA attacks and TVLA test with more than five million power traces, which is the best result compared to other related works. The proposed RDFS countermeasure also harden the targeted RISC-V SoC’s resistance against DL-SCA attacks.

The rapid advancement of cloud computing has facilitated the widespread integration of field-programmable gate arrays (FPGAs) into cloud servers to accelerate computing processes. To reduce costs, cloud service providers aim to promote multi-tenant sharing of a single FPGA. In multi-tenant environments, tenants share the power distribution network (PDN), which introduces potential security vulnerabilities. Malicious tenants can conduct remote power analysis attacks by deploying on-chip voltage sensors to detect voltage fluctuations in the PDN. Previous research has focused on enhancing the flexibility and stealthiness of sensors, while insufficient attention has been paid to optimizing sensor parameters for accurate power measurement. This work introduces a phase tuning method for voltage sensors in remote power analysis attacks on AES. The experimental results demonstrate that adjusting the sampling phase enhances the performance of correlation power analysis (CPA) attacks. On average, this method reduces the number of power traces required for CPA attacks by 43.1% and improves the average ranking of correct subkeys by 1.968×. The work reveals novel security threats in multi-tenant FPGAs and contributes to advancing cloud FPGA security research.

Correlation power analysis (CPA) is the most popular and powerful type of power analysis attacks against cryptographic modules. An attacker exploits the correlation between the power consumed by the device and the data generated during computation. In this paper, we present a correlation power analysis attack carried out on AES encryption algorithm implemented on a Xilinx FPGA on SASEBO (Side-channel Attack Standard Evaluation Board) using customized communication interface protocol and we also optimize number of power traces in CPA Attacks on FPGA as compared to other related works.

Cryptographic systems can potentially suffer from various attacks which are a consequence of vulnearability of side channel information to analysis attacks. The nature of digital circuits is prone to electromagnetic and power analysis (EMA and PA) attacks. Interconnects in cryptographic circuits emanate information through electromagnetic signals which can be exploited using EMA. Complementary Metal Oxide Semiconductor (CMOS) circuits are vulnearable to leak of computational information through leakage and dynamic power consumption. Dynamic power consumption of cryptographic engines is a rich source to sink in the data under process. The hardware implementation of cryptographic algorithms undermine the security of encrypted system against non brute-force-attacks. The attackers collect and analyse the leakage information of cryptographic circuits to detect the secrete key. The parameters sensitivity of the device and circuits make the cryptographic engines vulnearable to fault injection and inherent inconsistency of the circuits. Dynamic and static power comprise two major components of power consumption of digital circuits. Both power components vary with data under process. This exhibits power consumption has data dependency in digital circuits. To make noisy power profile, various countermeasures have been proposed against Differential Power Analysis (DPA) attacks. In this research, false glitch cells is proposed to work as a countermeasure to generate random transitions and power spikes to scramble power profile. The mathematical foundation of security implications of false glitch cells against Correlation Power Analysis (CPA) attacks is investigated. Moreoever, the security efficiency of utilizing false glitch cells is verified with different metrics.

Most cryptographic systems are secure in theory; however, the implementation of cryptographic system on embedded devices can be attacked by analyzing the power consumption of specific operation to reveal the key. The classic vertical correlation power analysis (CPA) attack requires a large number of power traces for analysis. Using transient secret-key scheme significantly weakens such an attack as insufficient data could be obtained. On the other hand, the horizontal CPA requires at least a single power trace and can make full use of multiple intermediate values to analyze the correlation of power consumption. In this work, we devised a horizontal CPA attack on schoolbook polynomial multiplication of hardware-implemented lattice-based cryptosystem without precise location. The accuracy of correctly recovering any one sub secret-key using only a single trace is 99.90%, and the accuracy of correctly recovering the secret-key is 76.41%. The powerful attack capability of horizontal CPA exposes the vulnerability of unprotected schoolbook polynomial multiplication against the attack of side-channel analysis (SCA).

In current countermeasure design trends against differential power analysis (DPA), security at gate level is required in addition to the security algorithm. Several dual-rail pre-charge logics (DPL) have been proposed to achieve this goal. Designs using ASIC can attain this goal owing to its backend design restrictions on placement and routing. However, implementing these designs on field programmable gate arrays (FPGA) without information leakage is still a problem because of the difficulty involved in the restrictions on placement and routing on FPGA. This article describes our novel masked dual-rail pre-charged memory approach, called “intra-masking dual-rail memory (IMDRM) on LUT”, and its implementation on FPGA for Side-Channel Attack-resistant (SCA-resistant) AES. In the proposed design, all unsafe nodes, such as unmasking and masking, and parts of dual-rail memory with unsafe buses (buses that are not masked) are packed into a single LUT. This makes them balanced and independent of the placement and routing tools. Inputs and outputs of all LUTs are masked, and so can be considered safe signals. Several LUTs can be combined to create a safe SBox. The design is independent of the cryptographic algorithm, and hence, it can be applied to available cryptographic standards such as DES or AES as well as future standards. It requires no special placement or route constraints in its implementation. A correlation power analysis (CPA) attack on 1,000,000 traces of AES implementation on FPGA showed that the secret information is well protected against first-order side-channel attacks. Even though the number of LUTs used for memory in this implementation is seven times greater than that of the conventional unprotected single-rail memory table-lookup AES and three times greater than the implementation based on a composite field, it requires a smaller number of LUTs than all other advanced SCA-resistant implementations such as the wave dynamic differential logic, masked dual-rail pre-charge logic, and threshold.

Aimed at improving the resistance against power analysis attacks, a systematic and architectural design approach for multicore processors is proposed in this article and is demonstrated in an eight-core prototype platform with low performance overhead and hardware cost. In order to introduce randomness in both the time dimension and the amplitude dimension and make realignment extremely difficult, the proposed multicore platform leverages several methods together, such as random task scheduling (RTS), random insertion of operations (RIO), and frequency and phase randomization (FPR). Moreover, a power state monitoring and control (PSMC) scheme is proposed to defend against power analysis attacks by keeping enough background noises. A test chip of the proposed multicore processor is fabricated in Taiwan Semiconductor Manufacturing Company (TSMC) 65-nm CMOS LP technology and can operate at up to 800 MHz with a 1.2-V supply. The Advanced Encryption Standard (AES) algorithm with these randomization methods is implemented on the processor. Measurement results show that the correlation power analysis (CPA) attacks and the power analysis attacks based on convolutional neural networks (CNNs) are unsuccessful even with 2 000 000 power traces when all the countermeasures are used.

In this article, we present a compact implementation of the Salsa20 stream cipher that is targeted towards lightweight cryptographic devices such as radio-frequency identification (RFID) tags. The Salsa20 stream cipher, ann addition-rotation-XOR (ARX) cipher, is used for high-security cryptography in NEON instruction sets embedded in ARM Cortex A8 CPU core-based tablets and smartphones. The existing literature shows that although classical cryptanalysis has been effective on reduced rounds of Salsa20, the stream cipher is immune to software side-channel attacks such as branch timing and cache timing attacks. To the best of our knowledge, this work is the first to perform hardware power analysis attacks, where we evaluate the resistance of all eight keywords in the proposed compact implementation of Salsa20. Our technique targets the three subrounds of the first round of the implemented Salsa20. The correlation power analysis (CPA) attack has an attack complexity of 2 19 . Based on extensive experiments on a compact implementation of Salsa20, we demonstrate that all these keywords can be recovered within 20,000 queries on Salsa20. The attacks show a varying resilience of the key words against CPA that has not yet been observed in any stream or block cipher in the present literature. This makes the architecture of this stream cipher interesting from the side-channel analysis perspective. Also, we propose a lightweight countermeasure that mitigates the leakage in the power traces as shown in the results of Welch’s t -test statistics. The hardware area overhead of the proposed countermeasure is only 14% and is designed with compact implementation in mind.

IoT devices have very strong requirements on all the resources such as memory, randomness, energy and execution time. This paper proposes a number of scalable shuffling techniques as countermeasures against side channel analysis. Some extensions of an existing technique called Random Start Index (RSI) are suggested in this paper. Moreover, two new shuffling techniques Reverse Shuffle (RS) and Sweep Swap Shuffle (SSS) are described within their possible extensions. Extensions of RSI, RS and SSS might be implemented in a constrained environment with a small data and time overhead. Each of them might be implemented using different amount of randomness and thus, might be fine-tuned according to requirements and constraints of a cryptographic system such as time, memory, available number of random bits, etc. RSI, RS, SSS and their extensions are described using SubBytes operation of AES-128 block cipher as an example, but they might be used with different operations of AES as well as with other algorithms. This paper also analyses RSI, RS and SSS by comparing their properties such as number of total permutations that might be generated using a fixed number of random bits, data complexity, time overhead and evaluates their resistance against some known side-channel attacks such as correlation power analysis and template attack. Several of proposed shuffling schemes are implemented on a 8-bit microcontroller that uses them to shuffle the first and the last rounds of AES-128.

Correlation Power Analysis (CPA) is one of effective means of power analysis in side channel analysis. The noisy power traces can affect the power of CPA. It is significant to select the helpful power traces to improve the efficiency of analysis. In this paper, we present a new pre-processing method that is based on Improved Singular Value Decomposition (ISVD) for selecting the traces when using CPA to attack. The ISVD is a combination of SVD and Z-score. Experimental results show that our method is effective to improve the efficiency when analyzing both the unprotected implementation and the masked implementation.

In this paper, we propose a novel cell-level side channel countermeasure fluctuating power logic (FPL), which diffuses the correlation between the real power consumption and the fixed data transitions by employing a cascade voltage logic. The countermeasure further acts as a cell-level V <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">DD</inf> randomizer, making it a strong candidate for implementing algorithmic countermeasure and exploiting its noise generation capabilities. This proposed scheme is illustrated by a standard flip-flop. HSPICE based simulation results show that the modified flip-flop is resistant against power analysis at the cost of doubled power dissipation. Two illustrative case studies of PRESENT and AES substitutions have been explored. The resistance against Side-Channel Analysis(SCA) is evaluated by the correlation power analysis. The new logic outperforms other counterparts in consideration of both security and cost, which renders it as a practical solution for resource-constrained systems. The proposed cell-level countermeasure can naturally mitigate other SCA such as electromagnetic analysis.

We propose a Multiplexer Look-Up-Table (MLUT) based Substitution-Box (S-Box) implementation for the Advanced Encryption Standard (AES) algorithm. There are two key features in the proposed MLUT based S-Box. First, it is implemented based on 256-byte to 1-byte multiplexer with a 256-byte memory instead of the conventional implementation of employing multiplication inversion in GF(28) and affine transformation. Thus, our proposed S-Box is simpler in circuit implementation and lower in power dissipation. Second, our S-Box is 30× more secured against the Side Channel Attack (SCA) based on Correlation Power Analysis (CPA), as our proposed S-Box exhibits smaller variance in its power dissipation profile for different processed data. Based on the measurement results of AES-128 implemented on the Sakura-X FPGA board, our proposed S-Box dissipates only 1.9mW and features 5.5× lower power than the conventional S-Box implementation. Our proposed MLUT S-Box design is also highly secured as the CPA attack on the AES with our proposed S-Box implementation requires 13540 power traces. This is significantly higher than the conventional S-Box which requires only 445 power traces to uncover the same secrete key.

Correlation Power Analysis (CPA) introduced by Brier et al. in 2004 is an important method in the side-channel attack and it enables the attacker to use less cost to derive secret or private keys with efficiency over the last decade. In this paper, we propose R-squared fitting model analysis (RFA) which is more appropriate for nonlinear correlation analysis. This model can also be applied to other side-channel methods such as second-order CPA and collision-correlation power attack. Our experiments show that the RFA-based attacks bring significant advantages in both time complexity and success rate.