Correlation power analysis attack against STT-MRAM based cyptosystems

Cryptographic systems can potentially suffer from various attacks which are a consequence of vulnearability of side channel information to analysis attacks. The nature of digital circuits is prone to electromagnetic and power analysis (EMA and PA) attacks. Interconnects in cryptographic circuits emanate information through electromagnetic signals which can be exploited using EMA. Complementary Metal Oxide Semiconductor (CMOS) circuits are vulnearable to leak of computational information through leakage and dynamic power consumption. Dynamic power consumption of cryptographic engines is a rich source to sink in the data under process. The hardware implementation of cryptographic algorithms undermine the security of encrypted system against non brute-force-attacks. The attackers collect and analyse the leakage information of cryptographic circuits to detect the secrete key. The parameters sensitivity of the device and circuits make the cryptographic engines vulnearable to fault injection and inherent inconsistency of the circuits. Dynamic and static power comprise two major components of power consumption of digital circuits. Both power components vary with data under process. This exhibits power consumption has data dependency in digital circuits. To make noisy power profile, various countermeasures have been proposed against Differential Power Analysis (DPA) attacks. In this research, false glitch cells is proposed to work as a countermeasure to generate random transitions and power spikes to scramble power profile. The mathematical foundation of security implications of false glitch cells against Correlation Power Analysis (CPA) attacks is investigated. Moreoever, the security efficiency of utilizing false glitch cells is verified with different metrics.

Aimed at improving the resistance against power analysis attacks, a systematic and architectural design approach for multicore processors is proposed in this article and is demonstrated in an eight-core prototype platform with low performance overhead and hardware cost. In order to introduce randomness in both the time dimension and the amplitude dimension and make realignment extremely difficult, the proposed multicore platform leverages several methods together, such as random task scheduling (RTS), random insertion of operations (RIO), and frequency and phase randomization (FPR). Moreover, a power state monitoring and control (PSMC) scheme is proposed to defend against power analysis attacks by keeping enough background noises. A test chip of the proposed multicore processor is fabricated in Taiwan Semiconductor Manufacturing Company (TSMC) 65-nm CMOS LP technology and can operate at up to 800 MHz with a 1.2-V supply. The Advanced Encryption Standard (AES) algorithm with these randomization methods is implemented on the processor. Measurement results show that the correlation power analysis (CPA) attacks and the power analysis attacks based on convolutional neural networks (CNNs) are unsuccessful even with 2 000 000 power traces when all the countermeasures are used.

Cryptographic System-on-Chips (SoCs) are becoming more and more popular. In these systems, cryptographic accelerators are integrated with processor cores to provide users with the software’s flexibility and hardware’s high performance. First, this work aimed to confirm the vulnerability of cryptographic SoCs against several types of power analysis attacks. Then, the novel Random Dynamic Frequency Scaling (RDFS) countermeasure is proposed to improve the resistance of such systems. The proposed RDFS countermeasure improved the power analysis resistance while maintaining low-performance overhead and hardware costs by generating more than 219,000 distinct frequencies for driving only the cryptographic accelerators. The effectiveness of the proposed RDFS countermeasure is demonstrated by conducting realistic Correlation Power Analysis (CPA) attacks, Deep-Learning-based Side-Channel Analysis (DL-SCA) attacks, and Test Vector Leakage Assessment (TVLA) testing methodology. The experimental results show that the RISC-V SoC protected by RDFS countermeasure can withstand CPA attacks and TVLA test with more than five million power traces, which is the best result compared to other related works. The proposed RDFS countermeasure also harden the targeted RISC-V SoC’s resistance against DL-SCA attacks.

Three-dimensional (3D) integration is envisioned as a natural defense to thwart side-channel analysis (SCA) attacks. However, there lack extensive studies on the unique feature of 3D power distribution network (PDN) noise and its impact on the efficiency of SCA attacks in 3D chips. This work fills the gap. Our experiments based on the real PDN and through-silicon via (TSV) models indicate that the noise from the other 3D planes is additive, which can significantly change the power profile of the crytpo unit in a 3D chip. We exploit the cross-plane PDN noise to develop a new counter-measure against the correlation power analysis (CPA) attacks in 3D integrated circuits (ICs). Simulation results show that the proposed method successfully improves the system resilience against CPA attacks and enhances the correlation difference by 29.1% and 18.7% over 2D and 3D baseline, respectively.

Correlation power analysis (CPA) is the most popular and powerful type of power analysis attacks against cryptographic modules. An attacker exploits the correlation between the power consumed by the device and the data generated during computation. In this paper, we present a correlation power analysis attack carried out on AES encryption algorithm implemented on a Xilinx FPGA on SASEBO (Side-channel Attack Standard Evaluation Board) using customized communication interface protocol and we also optimize number of power traces in CPA Attacks on FPGA as compared to other related works.

In this article, we present a compact implementation of the Salsa20 stream cipher that is targeted towards lightweight cryptographic devices such as radio-frequency identification (RFID) tags. The Salsa20 stream cipher, ann addition-rotation-XOR (ARX) cipher, is used for high-security cryptography in NEON instruction sets embedded in ARM Cortex A8 CPU core-based tablets and smartphones. The existing literature shows that although classical cryptanalysis has been effective on reduced rounds of Salsa20, the stream cipher is immune to software side-channel attacks such as branch timing and cache timing attacks. To the best of our knowledge, this work is the first to perform hardware power analysis attacks, where we evaluate the resistance of all eight keywords in the proposed compact implementation of Salsa20. Our technique targets the three subrounds of the first round of the implemented Salsa20. The correlation power analysis (CPA) attack has an attack complexity of 2 19 . Based on extensive experiments on a compact implementation of Salsa20, we demonstrate that all these keywords can be recovered within 20,000 queries on Salsa20. The attacks show a varying resilience of the key words against CPA that has not yet been observed in any stream or block cipher in the present literature. This makes the architecture of this stream cipher interesting from the side-channel analysis perspective. Also, we propose a lightweight countermeasure that mitigates the leakage in the power traces as shown in the results of Welch’s t -test statistics. The hardware area overhead of the proposed countermeasure is only 14% and is designed with compact implementation in mind.

The rapid advancement of cloud computing has facilitated the widespread integration of field-programmable gate arrays (FPGAs) into cloud servers to accelerate computing processes. To reduce costs, cloud service providers aim to promote multi-tenant sharing of a single FPGA. In multi-tenant environments, tenants share the power distribution network (PDN), which introduces potential security vulnerabilities. Malicious tenants can conduct remote power analysis attacks by deploying on-chip voltage sensors to detect voltage fluctuations in the PDN. Previous research has focused on enhancing the flexibility and stealthiness of sensors, while insufficient attention has been paid to optimizing sensor parameters for accurate power measurement. This work introduces a phase tuning method for voltage sensors in remote power analysis attacks on AES. The experimental results demonstrate that adjusting the sampling phase enhances the performance of correlation power analysis (CPA) attacks. On average, this method reduces the number of power traces required for CPA attacks by 43.1% and improves the average ranking of correct subkeys by 1.968×. The work reveals novel security threats in multi-tenant FPGAs and contributes to advancing cloud FPGA security research.

Spin-transfer torque magnetic random access memory (STT-MRAM) is a promising nonvolatile memory technology for various applications from low power to high-density memory. However, STT-MRAM is prone to power analysis attacks due to its asymmetric resistive states and switching behavior. This noninvasive class of attacks is a serious threat to system security. To reduce the correlation between the data and the power consumption of the memory, a countermeasure based on a resilient cell design with a symmetrical structure is proposed in this article. The standard cell and the proposed cell have been attacked and their resiliencies are compared. When attacked with a correlation power analysis (CPA), the proposed bit cell attacked with the hamming weight (HW) model is 100 times more resilient compared to the standard STT-MRAM cell. The proposed bit cell attacked with the hamming distance (HD) or the STT power models is more than 500 times more resilient compared to the standard STT-MRAM cell.

The chosen-message method is used to be employed in conducting Simple Power Analysis (SPA) attack by means of selecting special input messages. However, it is difficult to make distinction by visual observation i.e., SPA in practical IoT hardware environment. In this paper, we proposed a practical chosen-message correlation power analysis (CPA) attack which combines the chosen-message method with CPA for side channel attack. Then, we adopt other two practical chosen-messages, 1 and n + 1, to attack Boscher’s right-to-left binary exponentiation algorithm which is wildly considered as an efficient side channel resistant algorithm. Finally, this paper presents a countermeasure to resist the chosen-message CPA attack over Boscher’s algorithm without nullifying its countermeasure features to Differential Power Analysis (DPA) and Differential Fault Analysis (DFA). To validate the proposed attack method and countermeasure, a 1024-bit RSA coprocessor is constructed on the Xilinx Virtex-5 with the Side-channel Attack Standard Evaluation Board (SASEBO) to implement Boscher’s algorithm as well as our proposed algorithm and launched the proposed attack on it separately. The experiment results show that the proposed attack and countermeasure are feasible and efficient.

Side-channel attacks are increasingly recognized as a significant threat to hardware roots of trust. As a result, cryptographic module designers must ensure that their modules are resilient to such attacks before deployment. However, efficient evaluation of side-channel vulnerabilities in cryptographic implementations remains challenging. This paper introduces an open-source framework integrating FPGA designs, power measurement tools, and high-performance side-channel analysis libraries to streamline the evaluation process. The framework provides design templates for two widely used FPGA boards in the side-channel analysis community, enabling Shell-Role architecture, a modern FPGA design pattern. This shell abstraction allows designers to focus on developing cryptographic modules while utilizing standardized software tools for hardware control and power trace acquisition. Additionally, the framework includes acceleration plugins for ChipWhisperer, the leading open-source side-channel analysis platform, to enhance the performance of correlation power analysis (CPA) attacks. These plugins exploit modern many-core processors and graphics processing units (GPUs) to speed up analysis significantly. To showcase the capabilities of the proposed framework, we conducted multiple case studies and highlighted significant findings that advance side-channel research. Furthermore, we compare our CPA plugins with existing tools and show that our plugins achieve up to 8.60x speedup over the state-of-the-art CPA tools.

This paper explores new power analysis attacks on cryptographic circuits based on the PRESENT cipher, and discloses an unreported vulnerability of this cipher. For the first time, an attack to the last round is introduced to identify the secret key based on the knowledge of ciphertext, as opposed to conventional attacks based on the first round (i.e., knowledge of plaintext). This attack is enabled by the analysis of the bit-permutation structure in the last round, and by introducing a suitable bit regrouping strategy. As further contribution, a more powerful attack combining first/last-round Correlation Power Analysis attacks with Top-N guess strategy is demonstrated. The analysis and the attack results show that the optimal choice of Top-N key guesses makes the proposed attack more powerful than a conventional single-round attack, reducing the number of power traces required by 34%.

Spin transfer torque magnetic random access memory (STT-MRAM) is an emerging memory technology which exhibits nonvolatility, high density, high endurance, and nano-second read and write times. These characteristics make STT-MRAM suitable for last-level cache and other embedded applications. The STT-MRAM bit-cell consists of a magnetic tunnel junction (MTJ) which is composed of two ferromagnetic layers (free and fixed layers) and one insulating layer in between. As STT-MRAM arrays become denser to meet cost and requirements of high performance computing, the distance between adjacent MTJ bits reduces. This aggravates the magnetic coupling from free and fixed layer of one MTJ bit to its neighbors. Even though magnetic coupling is expected to become stronger as MTJ scales down, its impacts on static and dynamic properties on MTJ is relatively unexplored. In this paper, we present a model of the magnetic field coupling in high-density MTJ arrays for three different types of MTJ stacks and evaluate the effect of magnetic field induced coupling on static and dynamic properties. Lastly, we show how process induced variations in MTJ characteristics affect the magnitude of magnetic coupling and their effect on the electrical characteristics of the STT-RAM arrays.

We propose a Multiplexer Look-Up-Table (MLUT) based Substitution-Box (S-Box) implementation for the Advanced Encryption Standard (AES) algorithm. There are two key features in the proposed MLUT based S-Box. First, it is implemented based on 256-byte to 1-byte multiplexer with a 256-byte memory instead of the conventional implementation of employing multiplication inversion in GF(28) and affine transformation. Thus, our proposed S-Box is simpler in circuit implementation and lower in power dissipation. Second, our S-Box is 30× more secured against the Side Channel Attack (SCA) based on Correlation Power Analysis (CPA), as our proposed S-Box exhibits smaller variance in its power dissipation profile for different processed data. Based on the measurement results of AES-128 implemented on the Sakura-X FPGA board, our proposed S-Box dissipates only 1.9mW and features 5.5× lower power than the conventional S-Box implementation. Our proposed MLUT S-Box design is also highly secured as the CPA attack on the AES with our proposed S-Box implementation requires 13540 power traces. This is significantly higher than the conventional S-Box which requires only 445 power traces to uncover the same secrete key.

Most cryptographic systems are secure in theory; however, the implementation of cryptographic system on embedded devices can be attacked by analyzing the power consumption of specific operation to reveal the key. The classic vertical correlation power analysis (CPA) attack requires a large number of power traces for analysis. Using transient secret-key scheme significantly weakens such an attack as insufficient data could be obtained. On the other hand, the horizontal CPA requires at least a single power trace and can make full use of multiple intermediate values to analyze the correlation of power consumption. In this work, we devised a horizontal CPA attack on schoolbook polynomial multiplication of hardware-implemented lattice-based cryptosystem without precise location. The accuracy of correctly recovering any one sub secret-key using only a single trace is 99.90%, and the accuracy of correctly recovering the secret-key is 76.41%. The powerful attack capability of horizontal CPA exposes the vulnerability of unprotected schoolbook polynomial multiplication against the attack of side-channel analysis (SCA).

In current countermeasure design trends against differential power analysis (DPA), security at gate level is required in addition to the security algorithm. Several dual-rail pre-charge logics (DPL) have been proposed to achieve this goal. Designs using ASIC can attain this goal owing to its backend design restrictions on placement and routing. However, implementing these designs on field programmable gate arrays (FPGA) without information leakage is still a problem because of the difficulty involved in the restrictions on placement and routing on FPGA. This article describes our novel masked dual-rail pre-charged memory approach, called “intra-masking dual-rail memory (IMDRM) on LUT”, and its implementation on FPGA for Side-Channel Attack-resistant (SCA-resistant) AES. In the proposed design, all unsafe nodes, such as unmasking and masking, and parts of dual-rail memory with unsafe buses (buses that are not masked) are packed into a single LUT. This makes them balanced and independent of the placement and routing tools. Inputs and outputs of all LUTs are masked, and so can be considered safe signals. Several LUTs can be combined to create a safe SBox. The design is independent of the cryptographic algorithm, and hence, it can be applied to available cryptographic standards such as DES or AES as well as future standards. It requires no special placement or route constraints in its implementation. A correlation power analysis (CPA) attack on 1,000,000 traces of AES implementation on FPGA showed that the secret information is well protected against first-order side-channel attacks. Even though the number of LUTs used for memory in this implementation is seven times greater than that of the conventional unprotected single-rail memory table-lookup AES and three times greater than the implementation based on a composite field, it requires a smaller number of LUTs than all other advanced SCA-resistant implementations such as the wave dynamic differential logic, masked dual-rail pre-charge logic, and threshold.