Distributed power analysis attack on SM4 encryption chip

PRESENT, proposed by A. Bogdanov et al. in CHES 2007, is an ultra-lightweight symmetric cipher for extremely constrained environments such as RFID tags and sensor networks. In this article, a representative platform, 0.25 µm 1.8 V standard cell circuit is proposed to complement the PRESENT, the simulation-based ASIC experimental environment is built to acquire power data. According to the fact that the power consumption of a digital circuit implemented in the CMOS technology depends on the data that the circuit is processing, we create the hypothetical circuit model for differential power analysis (DPA) against the special block cipher, PRESENT. Two Different statistical methods, multi-bit DPA and correlation power analysis (CPA), are conducted in this paper to analyze the power data sampled from the power traces. We can attack all secret key bits after first two rounds DPA attack. Our results present the vulnerability to power analysis attack against the hardware implementations of PRESENT.

Cryptographic devices are vulnerable to the nowadays well known side channel leakage analysis. Secret data can be revealed by power analysis attacks such as Simple Power Analysis (SPA), Differential Power Analysis (DPA) and Correlation Power Analysis (CPA). First, we give an overview of DPA in mono-bit and multi-bit cases. Next, the existing multi-bit DPA methods are generalized into the proposed Partitioning Power Analysis (PPA) method. Finally, we focus on the CPA technique, showing that this attack is a case of PPA with special coefficients and a normalization factor. We also propose a method that allows us to improve the performance of CPA by restricting the normalization factor.Keywordsside channelpower analysisDPAmulti-bit DPAPPACPAcorrelationDESAES

Cryptographic systems can potentially suffer from various attacks which are a consequence of vulnearability of side channel information to analysis attacks. The nature of digital circuits is prone to electromagnetic and power analysis (EMA and PA) attacks. Interconnects in cryptographic circuits emanate information through electromagnetic signals which can be exploited using EMA. Complementary Metal Oxide Semiconductor (CMOS) circuits are vulnearable to leak of computational information through leakage and dynamic power consumption. Dynamic power consumption of cryptographic engines is a rich source to sink in the data under process. The hardware implementation of cryptographic algorithms undermine the security of encrypted system against non brute-force-attacks. The attackers collect and analyse the leakage information of cryptographic circuits to detect the secrete key. The parameters sensitivity of the device and circuits make the cryptographic engines vulnearable to fault injection and inherent inconsistency of the circuits. Dynamic and static power comprise two major components of power consumption of digital circuits. Both power components vary with data under process. This exhibits power consumption has data dependency in digital circuits. To make noisy power profile, various countermeasures have been proposed against Differential Power Analysis (DPA) attacks. In this research, false glitch cells is proposed to work as a countermeasure to generate random transitions and power spikes to scramble power profile. The mathematical foundation of security implications of false glitch cells against Correlation Power Analysis (CPA) attacks is investigated. Moreoever, the security efficiency of utilizing false glitch cells is verified with different metrics.

Cryptography is securing information using mathematical techniques like encryption and decryption. Cryptanalysis uses side-channel attacks to undermine security. The efficient type of power analysis of the side channel and Differential Power Analysis (DPA) statistically assesses the power use of the cryptographic method and provides private details. This paper proposes the design of a Compact PRESENT S-box (CPSB), using Three-Phase Dual Rail Pre-Charge Logic (TDPL) combined with Charge Balancing Symmetric Pre-Resolve Adiabatic Logic (CBSPAL). The primary contribution of this research lies in the development of a power-efficient logic style that improves the performance of the S-box while maintaining conflict against DPA attacks. By employing TDPL, the design achieves consistent power consumption across various input configurations, thereby mitigating the risk of side-channel attacks. The focus of this work is to propose an innovative implementation approach rather than the security aspects of cryptography itself. The proposed methodology proves a substantial reduction in power overhead and area, making it suitable for resource-constrained environments, like Internet of Things (IoT) applications. A correlation study is carried out to calculate the Compact Present S-box implementation's DPA resistance characteristic. The power traces are examined. The proposed design makes power consumption consistent and decreases area and power overhead by 15.3% and 13.6%, respectively. Performance indicators for the security are NED, NSD, and Pearson correlation coefficient. The connection is the same for all conceivable input and key pairings. When compared with other designs, the NED and NSD were determined to be 0.02% and 0.01%, respectively.

International audience

SUMMARY Recently, side-channel attacks have become a serious problem. These attacks estimate the secret keys of cryptography circuits embedded in hardware. In particular, the most threatening side-channel attacks are differential power analysis and correlation power analysis, which use the correlation between information processing and power consumption, which are related to secret keys in cryptography circuits. Therefore, new measures are required to prevent confidential information in cryptography circuits from being leaked to side-channel information, such as power consumption. When designing preventive measures, resistance to side-channel attacks, for instance tamper resistance, must be evaluated. This study proposes a new simulation method by which tamper resistance can be verified in the algorithm and architecture design phases. Experimental results show the validity of the proposed simulation method. © 2013 Wiley Periodicals, Inc. Electr Eng Jpn, 186(2): 40–51, 2014; Published online in Wiley Online Library (wileyonlinelibrary.com). DOI 10.1002/eej.22342

The LSI design methodology against Differential Power Analysis (DPA) is important to realize a tamper-resistant cryptographic circuit. In order to verify the DPA resistance before ASIC fabrication, the DPA verification using FPGA is commonly used. However, power traces of ASIC differ from that of FPGA, so the DPA verification on FPGA cannot guarantee the DPA resistance on ASIC. On the other hand, it takes extremely long time to collect the simulated power traces using post-layout netlists of ASIC. Hence, the DPA-resistance verification method using smaller number of power traces is demanded. In this paper, we propose Equivalent Byte Method (EBM) which synchronizes the operation on all Substitution Boxes (S-Boxes) at the attacking round by controlling the plaintexts and the keys. In EBM, the power-consumption profiles of S-Boxes are emphasized by each other, and then the DPA analysis for a correct key is easily distinguished with smaller number of traces. In order to demonstrate the effectiveness of the proposed EBM, AES circuits using DPA-resistant techniques of WDDL and MDPL are implemented on FPGA. As a result, EBM revealed DPA-leak with 1/1000 ~ 1/50 power traces required for the general statistical method.

Power analysis attacks are types of side channel attacks that are based on analyzing the power consumption of the cryptographic devices. Correlation power analysis is a powerful and efficient cryptanalytic technique. It exploits the linear relation between the predicted power consumption and the real power consumption of cryptographic devices in order to recover the correct key. The predicted power consumption is determined by using the appropriate consumption model. Until now, only a few models have been proposed and used. In this paper, we describe the process to conduct the CPA attack against AES on SASEBO-GII board. We present a comparison between the Hamming Distance model and the Switching Distance model, in terms of number of power traces needed to recover the correct key using these models. The global successful rate achieves 100% at 11100 power traces. The power traces needed to recover the correct key have been decreased by 12.6% using a CPA attack with Switching Distance model.

Cryptographic devices with the Advanced Encryption Standard (AES) encryption algorithm are vulnerable to side channel attack, in particular, differential power analysis (DPA). Differential power analysis can be used to reveal the secret key in AES by monitoring the power consumption of the internal circuit and applying statistical processing. In this paper, an evaluation of power analysis attacks of six different AES Sbox designs, namely sum of product (SOP), product of sum (POS), table lookup (TBL), composite field (CF), positive polarity Reed-Miller (PPRM) and 3 stages PPRM, is presented. Comparison of the different AES Sbox implementations in terms of size, performance and SNR analysis is also performed. The results show that the composite field Sbox design is more resistant to attack and smaller than other Sbox designs but operates at a slower speed. This paper also presents a Random Clock mechanism that can be used to increase the resistance of the AES composite field Sbox design to power analysis attack by reducing the overall SNR by 78%.

In this paper a method for adding a watermark to the power consumption of intellectual property is presented. The signature can be detected by using Differential Power Analysis, a cryptographic side channel attack that uses statistical techniques to detect register transitions in power consumption data. Details are given on how to calculate the probability of correctly determining whether the watermark is there. The number of samples that will be required to detect the watermark with a given accuracy can also be calculated based on how much of a price the designer is willing to pay in terms of area.

Recent events have indicated that attackers are banking on side-channel attacks, such as differential power analysis (DPA) and correlation power analysis (CPA), to exploit information leaks from physical devices. Random dynamic voltage frequency scaling (RDVFS) has been proposed to prevent such attacks and has very little area, power, and performance overheads. But due to the one-to-one mapping present between voltage and frequency of DVFS voltage-frequency pairs, RDVFS cannot prevent power attacks. In this paper, we propose a novel countermeasure that uses reliable and aggressive designs to break this one-to-one mapping. Our experiments show that our technique significantly reduces the correlation for the actual key and also reduces the risk of power attacks by increasing the probability for incorrect keys to exhibit maximum correlation. Moreover, our scheme also enables systems to operate beyond the worst-case estimates to offer improved power and performance benefits. For the experiments conducted on AES S-box implemented using 45 nm CMOS technology, our approach has increased performance by 22 percent over the worst-case estimates. Also, it has decreased the correlation for the correct key by an order and has increased the probability by almost 3.5X times for wrong keys when compared with the original key to exhibit maximum correlation.

Differential Power Analysis (DPA) is often preceded by various noise reduction techniques. Digital Signal Processing (DSP) and Principal Component Analysis (PCA) have found their numerous applications in this area. However, most of them either require explicit profiling/semi-profiling step or depend on some heuristically chosen parameters. In this paper, we propose optimal pre-processing of power traces in non-profiling setup using an optimum linear filter and an approximate optimum linear filter. We have also empirically evaluated the proposed filters in several noisy scenarios which show significant improvements in the results of Correlation Power Analysis (CPA) over the existing pre-processing techniques. We have further investigated the optimality of the one proposed pre-processing technique by comparing it with a profiling attack.

In 1999, Kocher et al. demonstrated the differential power analysis (DPA) attacks on secured cryptographic implementation of AES. Later, this attack along with correlation power analysis (CPA) posed a critical challenge from cryptographers' perspective that not only mathematical security of a cryptographic algorithm, the physical security of its implementation (be it software or hardware) must be proven to call the system "secured".

In current countermeasure design trends against differential power analysis (DPA), security at gate level is required in addition to the security algorithm. Several dual-rail pre-charge logics (DPL) have been proposed to achieve this goal. Designs using ASIC can attain this goal owing to its backend design restrictions on placement and routing. However, implementing these designs on field programmable gate arrays (FPGA) without information leakage is still a problem because of the difficulty involved in the restrictions on placement and routing on FPGA. This article describes our novel masked dual-rail pre-charged memory approach, called “intra-masking dual-rail memory (IMDRM) on LUT”, and its implementation on FPGA for Side-Channel Attack-resistant (SCA-resistant) AES. In the proposed design, all unsafe nodes, such as unmasking and masking, and parts of dual-rail memory with unsafe buses (buses that are not masked) are packed into a single LUT. This makes them balanced and independent of the placement and routing tools. Inputs and outputs of all LUTs are masked, and so can be considered safe signals. Several LUTs can be combined to create a safe SBox. The design is independent of the cryptographic algorithm, and hence, it can be applied to available cryptographic standards such as DES or AES as well as future standards. It requires no special placement or route constraints in its implementation. A correlation power analysis (CPA) attack on 1,000,000 traces of AES implementation on FPGA showed that the secret information is well protected against first-order side-channel attacks. Even though the number of LUTs used for memory in this implementation is seven times greater than that of the conventional unprotected single-rail memory table-lookup AES and three times greater than the implementation based on a composite field, it requires a smaller number of LUTs than all other advanced SCA-resistant implementations such as the wave dynamic differential logic, masked dual-rail pre-charge logic, and threshold.

Security in embedded systems is of critical importance since most of our secure transactions are currently made via credit cards or mobile phones. Power analysis-based side channel attacks have been proved as the most successful attacks on embedded systems to retrieve secret keys, allowing impersonation and theft. State-of-the-art solutions for such attacks on public key cryptographic algorithms, such as elliptic curve cryptography, mostly in software, hinder performance and repeatedly attacked using improved techniques. To protect these public key ciphers from both simple power analysis and differential power analysis, as a hardware solution, we propose to take advantage of the inherent parallelisation capability in multi-modulo residue number systems (RNS) architectures to obfuscate the secure information. Random selection of moduli is proposed to randomly choose the moduli sets for each key bit operation. This solution allows us to prevent power analysis, although still providing all the benefits of RNS. In this study, the authors show that differential power analysis, cross correlation analysis and correlation power analysis for a simple binary double-and-add operation are thwarted using their solution.