Generic Side-Channel Distinguishers: Improvements and Limitations

Researchers are exploring the use of convolutional neural networks (CNNs) in side-channel attacks to understand the weaknesses in cryptographic implementation. CNNs can learn hierarchical characteristics automatically from electromagnetic radiation or power usage during cryptographic processes. Researchers train CNNs on side-channel data to extract meaningful representations and deduce secret keys. Deep learning algorithms are helpful in evaluating the security of embedded systems, and CNNs are a feasible paradigm for profiling side-channel analysis attacks. In this paper, it has been introduced a VGG (Visual Geometry Group)-Net architecture, which is a typical deep convolutional neural network design with numerous layers. It uses the ASCAD dataset to conduct experiments. They found that VGG-Net architecture Side Channel Attacks (SCA) provides better results than the previously optimized CNN model by significantly reducing the number of side-channel traces required for successful attacks on desynchronized datasets. The researchers also discovered that synchronous traces serve as the pre-training source for VGG-Net architecture, functioning successfully in terms of jittering with minimal fine-adjusting after training

Side Channel Analysis (SCA) has become a new threat to the hardware implementations of encryption algorithms. The reverse engineering has been adopted to explore the unknown part of the encryption algorithms. The existing SCAs for reverse engineering depend on the leakage models in a large extent and mainly focus on the single component of the algorithms while the other parts of the target algorithm are known. In this paper, we present a more general and feasible reverse analysis by combining the mathematical methods and the SCA methods. We use the strict avalanche criterion for the non-linear operations of block ciphers and apply the power analysis to reverse the structure parameters. We propose a new reverse analysis method to reduce the dependency on the leakage models, which can be combined with the structure cryptanalysis to reverse the internal parameters of the linear and non-linear operations. We finally achieve the reverse analysis on the unknown round function of block ciphers.

Cryptographic implementations are prune to Side Channel Analysis (SCA) attacks and Fault Injection (FI) attacks at the same time. Therefore, countermeasures protecting an implementation need to be evaluated against both attacks. The main contribution of this work is twofold. First, we propose an evaluation platform capable to perform emulated fault injection campaigns against modern MCUs and at the same time able to acquire experimental electromagnetic EM emissions and power traces of cryptographic computations to be used for SCA attacks. Second, we perform experimental evaluations of countermeasures protecting against both SCA and FI attacks which show that the injections of faults can dramatically reduce the effectiveness of SCA countermeasures. We evaluate two cryptographic algorithms, an AES and a PRESENT-Sbox implementation, which are protected employing different countermeasures protecting in parallel against FI and SCA attacks. The AES secure implementation is protected by hiding-based SCA countermeasures, while it uses a redundancy-based technique against FI attacks. On the other hand, the PRESENT Sbox is protected by a software implementation of a Dual-rail with Precharge Logic (DPL) countermeasure including fault detection capabilities. We present extensive experimental evaluations for the AES implementation and first results for PRESENT-Sbox showing that for both implementations the fault injections increase the efficiency of the SCA attacks and lead to very fast recoveries of the secret keys.

Side-channel attacks (SCAs) using deep learning techniques have been mainly reported as profiled attacks, but in TCHES 2019, differential deep learning analysis (DDLA) was proposed by Timon as a non-profiled attack. In this attack method, deep learning models for all candidate keys are trained, and the key corresponding to the most suitable learning metrics such as loss and accuracy is assumed to be the correct key. Timon focused on a single bit (least significant bit (LSB) or most significant bit (MSB)) of the intermediate value during the operation of the cryptographic circuit and successfully revealed the correct key against the software implementation of the advanced encryption standard (AES). However, when we applied this method to our hardware implementation, we could not reveal all partial keys due to the existence of registers whose Hamming distance (HD) leakage is difficult to observe. In this paper, we propose a multi-bit DDLA that focuses on all bits to solve this problem. When a DDLA was performed on the hardware implemented AES without SCA countermeasures, the HD-ID labels, which had been used as a conventional profiled type DL-SCA method focusing on 8 bits, cannot reveal the 0, 4, 8, and 12th byte keys, but the proposed multi-bit method succeeds in revealing all key bytes. On the other hand, compared to correlated power analysis (CPA) which is a typical non-profiled attack that does not use deep learning, the number of waveforms required to reveal all keys is 1.6 times higher, so the DDLA with our proposed method is not so useful to the target without SCA countermeasures. Thus, we also evaluated the proposed method against FPGA-implemented RSM-AES and WDDL-AES, which have some resistance to SCA, and successfully revealed all keys against RSM and WDDL with 100,000 and 50,000 waveforms, respectively. This is a significant improvement over conventional CPA, which reveals less than half of the key bytes despite using twice as many waveforms as the proposed method. These results suggest that multi-bit DDLA is effective on non-profiled attacks against hardware-implemented AES circuit with SCA countermeasures.

Computers are complicated, and the security of modern software often depends on programmers anticipating and mitigating a dizzying assortment of vulnerability classes. Both researchers and adversaries continue to add additional complications based on hardware behavior to this mix, such as data-dependant power consumption, fault injection, cache timing attacks and transient execution - adding new attack surface which needs to be taken into account when building secure systems. In this dissertation, we look beyond the traditional attack surface, and find that many mitigations - across a variety of layers, from hardware to software - are compromised by faulty assumptions about the actual behavior of hardware. We begin close to the hardware, discovering that the relationship between two different forms of hardware attack - Fault Injection and Side-Channel Analysis - is so strong that we can find ways to apply power side-channel attack techniques directly to the results of voltage fault injection campaigns, without the need for an attacker to obtain power measurements. Next, we move to microarchitectural attacks - which rely on hardware behavior, but can be performed by software. By combining transient execution with unexpected - and unintended - CPU pipeline behavior, we show that the scope of software side-channel attacks can be expanded far beyond previous work, allowing both in-flight and 'stale' data to be stolen from the pipeline by an attacker, bypassing software mitigations by ignoring security domains entirely. Such attacks can be mitigated by isolating workloads on different cores - which do not share a pipeline. Unfortunately, we find that even this level of isolation can fail to prevent attackers from being able to leak critical data using side-channel attacks - such as random numbers used when generating cryptographic keys. Hence, these attacks must be mitigated in hardware. Finally, we investigate defenses against transient execution attacks such as Spectre which depend only on well-understood hardware behavior, but require software mitigations. We show that we can build efficient and practical software-based defenses which not only mitigate many Spectre attacks, but even harden software against architectural information leaks.

In this paper the effect of high-performance techniques for high speed applications in secure cryptographic implementations is studied. The use of dual pre charge logic styles with fine-grained pipelining with an overlapping three-phase clock scheme is studied, also including a correct distribution of the clock signal in the cryptographic implementation. To make this study, four different implementations of the Sbox-9 of the Kasumi algorithm have been implemented using an 90nm TSMC technology. Simulation-based DPA attacks have been carried out, showing how the proper synchronization of data signals gives better results in terms of power consumption and operating frequency, but affects negatively the security against side channel attacks, decreasing the number of input patterns needed to disclosure the secret key.

Since the introduction of the first side-channel analyses in academia about 15 years ago, several physical attacks have been presented that exploit side-channel leakages to break implementations of cryptographic algorithms. This article deals with the same physical property of electronic devices, but focuses on the art of tailoring it for constructive uses. More precisely, two scenarios, i.e., hardware Trojans and IP watermarking, are illustrated in which the designer of an electronic circuit can add functionality by considering side channels as part of the available design space. Both applications use the same concept, i.e., deliberately leaking a secret through a side channel while keeping the introduced side channel hidden from adversaries and attackers. This article provides a broad overview of the existing works for both applications and should serve as a comprehensible introduction to the underlying field of research. This includes many subtle details that have not been discussed in literature yet, including existing shortcomings and possible improvements to the existing works. The solutions summarized in this article provide general guidelines for theorists and practitioners to use side channels constructively to achieve designs that are robust against detection and removal. Furthermore, we present an entirely new design of a Trojan side-channel. This architecture demonstrates the potential of a Trojan side-channel that is neatly tailored to the targeted implementation. The new design removes all non-invasive starting points a third party could use to analyze or get access to the secret-channel.

Security at low cost is an important factor for cryptographic hardware implementations. Unfortunately, the security of cryptographic implementations is threatened by Side Channel Analysis (SCA). SCA attempts to discover the secret key of a device by exploiting implementation characteristics and bypassing the algorithm's mathematical security. Differential Power Analysis (DPA) is a type of SCA, which exploits the device's power consumption characteristics. Several countermeasures to DPA have been proposed, however, all of them increase security at the cost of increased area which in-turn leads to increased power consumption and reduced throughput. FPGAs are popular due to their reconfigurability, lower development cost, off-the-shelf availability and shorter time to market. Block RAMs (BRAM) are large memories in FPGAs that are commonly used as ROM, FIFO, Look-up tables, etc. In this paper we explore the DPA resistance of BRAMs in Xilinx FPGAs and verify if their usage can improve the security. The results of our Advanced Encryption Standard (AES) implementations show that using BRAMs alone can improve the security over a look-up table (LUT) only design 9 times. Applying Separated Dynamic Differential Logic (SDDL) for FPGAs, a countermeasure against DPA, to this design doubles the security again leading to an 18 fold increase over the unprotected LUT design.

Most previousside-channel analysis-based reverse engineering (SCARE) methods were based on collision attack. However, the collision-based methods generally need noise-free traces and can hardly be verified by realistic implementations. This paper proposes a novel SCARE, which is named as OSHDG-SCARE, targeting on secret S-box. We define a graph as OSHDG (one-step HD graph) to recover the parameters of any secret S-box. Due to the redundancy of OSHDG, the multiple paths can filter the correct results and improve the success rate of the reverse method even when the samples deviate from leakage model. We classify the deviation of side channel signal as two types, which are the gap between real leakage and leakage model, and measurement noise. Experiments are performed on real power traces satisfying the inaccurate HW (Hamming Weight) leakage model from a software implementation of AES-like cipher. OSHDG-SCARE recovers the secret S-box when the deviation rate of traces is 1.45%.

Recently, as deep learning has been applied to various fields, deep-learning-based side-channel analysis (SCA) has been widely investigated. Unlike traditional SCA, it can perform well independently of the attacker’s ability. In this paper, we propose deep-learning-based profiled and non-profiled SCA of PIPO, (Plug-In Plug-Out), which is a bitslice block cipher that can effectively apply a countermeasure for SCA. Our datasets were captured from three different boards (XMEGA128D4, MSP430F2618, STM32F303) running PIPO-64/128. For profiled SCA, the identity (ID) labeling method exhibited better performance than the most significant bit (MSB) and hamming weight (HW) labeling methods. That is, even if each bit of the S-Box output was distributed in the power traces by the bitslice implementation, the neural network trained well each bit of the S-Box output by itself. For non-profiled SCA, we proposed a novel labeling technique that considers bitslice characteristics. We compared our proposed labeling method to MSB and HW labeling by analyzing the three aforementioned datasets. For non-profiled SCA, the proposed labeling method was more effective than the MSB and HW labeling methods on all datasets.

Embedded systems are increasingly providing secure functionalities, which often rely on some dedicated hardware for symmetric and public-key cryptography. When resources are limited, elliptic curve cryptography (ECC) may be chosen instead of the more widely known RSA, which needs much longer keys for the same security level. However, ECC may be vulnerable, as any other cryptographic implementation, to side channel analysis, which may reveal secret information by analyzing collateral sources of information, such as power consumption. Countermeasures must be thus adopted at the design level, in order to ensure robust and secure operation of the device. We propose here a new scalar multiplication algorithm on an elliptic curve, based on a novel randomized window method. This design is protected against side channel attacks (Timing, Simple and Differential Power Analysis) and it is implemented over prime fields, but it can be applied to binary fields as well. In order to evaluate this countermeasure, we provide its costs, and an estimation of the additional entropy added to the computation against side channels attacks.

There is a theoretically strong relationship between chaos and cryptology. In practice, one of the most successful applications of this relationship is chaos-based s-box structures. However, the performance metrics of chaos-based s-box designs are worse compared to those for s-box structure based on algebraic techniques used in modern encryption algorithms, such as the AES algorithm. What is the reason for using chaos-based s-box structures, even though they have worse cryptographic characteristics? Researchers claim that they may be an alternative defense against implementation attacks, especially side-channel analyses. However, no studies have supported or refuted this claim so far. In this paper, side-channel analyses have been performed for two different chaos-based s-box structures. These two s-box structures have been selected for having with the best and worst performance measurements for s-box structures previously proposed in the literature. The results were compared with the AES s-box structure. Analysis of the results showed that chaos-based s-box structures are more resistant against side-channel attacks. Therefore, chaos-based designs may be an alternative defense against implementation attacks, as alleged. However, both algebraic and chaos-based s-box designs have been observed to be insecure if the attacker has more than 30 plaintexts in the side channel analyses. These results show that implementation analysis studies are required in the chaos-based cryptology literature.

Algebraic side-channel attack (ASCA) is a powerful cryptanalysis technique different from conventional side-channel attacks. This paper studies ASCA from three aspects: enhancement, analysis and application. To enhance ASCA, we propose a generic method, called Multiple Deductions-based ASCA (MDASCA), to cope the multiple deductions caused by inaccurate measurements or interferences. For the first time, we show that ASCA can exploit cache leakage models. We analyze the attacks and estimate the minimal amount of leakages required for a successful ASCA on AES under different leakage models. In addition, we apply MDASCA to attack AES on an 8-bit microcontroller under Hamming weight leakage model, on two typical microprocessors under access driven cache leakage model, and on a 32-bit ARM microprocessor under trace driven cache leakage model. Many better results are achieved compared to the previous work. The results are also consistent with the theoretical analysis. Our work shows that MDASCA poses great threats with its excellence in error tolerance and new leakage model exploitation.

Spiking neural networks (SNNs) are quickly gaining traction as a viable alternative to deep neural networks (DNNs). Compared to DNNs, SNNs are computationally more powerful and energy efficient. The design metrics (synaptic weights, membrane threshold, etc.) chosen for such SNN architectures are often proprietary and constitute confidential intellectual property (IP). Our study indicates that SNN architectures implemented using conventional analog neurons are susceptible to side channel attack (SCA). Unlike the conventional SCAs that are aimed to leak private keys from cryptographic implementations, SCANN (SCA̲ of spiking n̲eural n̲etworks) can reveal the sensitive IP implemented within the SNN through the power side channel. We demonstrate eight unique SCANN attacks by taking a common analog neuron (axon hillock neuron) as the test case. We chose this particular model since it is biologically plausible and is hence a good fit for SNNs. Simulation results indicate that different synaptic weights, neurons/layer, neuron membrane thresholds, and neuron capacitor sizes (which are the building blocks of SNN) yield distinct power and spike timing signatures, making them vulnerable to SCA. We show that an adversary can use templates (using foundry-calibrated simulations or fabricating known design parameters in test chips) and analysis to identify the specifications of the implemented SNN.

Side-channel attacks are a prominent threat to the security of cryptographic implementations. Differently from the traditional black-box attacks, which exploit the inputs and outputs of cryptographic schemes, side-channel attacks partially access the inner working of the scheme as well, by observing the physical leakage emitted by the device executing cryptographic algorithms. A notable example is the class of power-analysis attacks, which exploits the power consumption of the underlying device to recover the secret keys of the implemented cryptosystem. Since their first presentation in the late 1990s, the problem of securing cryptographic systems in the presence of side-channel leakages received significant attention by the cryptographic community. In particular, the theory community has concentrated its research efforts on formally modeling the side-channel leakages and on designing cryptographic schemes \textit{provably} secure in such leakage models. However, conceiving a formal model that realistically captures possible physical leakages and constructing primitives sufficiently efficient to be deployed in practice are still challenging research objectives. This research area is usually referred to as leakage-resilient cryptography. In this dissertation, we examine three main research directions. The first one focuses on the technique of masking, which is the most popular approach to counteract power-analysis attacks. In this context, our work analyzes possible methods to improve the efficiency of masked implementations, with the goal of overcoming the decrease in performance, which is a common drawback of masking. In particular, we provide new and more efficient algorithms for the computation of basic operations in two kinds of masking schemes: the Boolean masking and the Inner Product masking. The second research direction of this work addresses the problem of formalizing security requirements for hardware implementations. While provable security of software-oriented masking has been studied since the origin of leakage resilient cryptography, the more complex task of formally proving the security of hardware-oriented masking is receiving attention by the community only recently. We discuss the different challenges of this field, and we introduce a new theoretical model, the robust probing model, capturing the conditions required for securely implementing complex algorithms in practice, providing a guide to practical implementers. Finally, the last part of this work is concerned with the protection of algorithms employed in lattice-based constructions, which are studied in the field of post-quantum cryptography. While several works investigate the application of masking schemes to standard cryptosystems, for most post-quantum schemes this is still an ongoing research. We contribute to this research area, by applying the masking countermeasure to a binomial sampler which is at the base of many lattice-based cryptosystems.