On two DES implementations secure against differential power analysis in smart-cards

In recent years, power analysis attacks have caused increasingly serious security threats on cryptographicalgorithm, to solve this problem different researcher has put forward many solutions, and among them the fixed value masking technology is one of the mostly used due to its lower cost and faster speed. Both theoretical and practical results have shown that the masking method has a good resistance to differential power analysis (DPA) attack. So based on the in-depth study of fixed masking technology, this paper proposed a second order DPA attack (SODPA) with the help of a pre-processing treatment. In the end, we implemented this attack on a fixed value masked AES encryption algorithm running in Mega16. The experimental result shows that, if the mask value is unknown, ordinary DPA cannot recover the right key, while the second order DPA only needs about 500 power curves to get the correct key. In the meantime, the differences between right and wrong keys are very obvious, which strongly proved the validity and practicability of our method.

Side-channel attacks, particularly differential power analysis (DPA) attacks, are efficient ways to extract secret keys of the attacked devices by leaked physical information. To resist DPA attacks, hiding and masking methods are commonly used, but it usually resulted in high area overhead and performance degradation. In this brief, a DPA countermeasure circuit based on digital controlled ring oscillators is presented to efficiently resist the first-order DPA attack. The implementation of the critical S-box of the advanced encryption standard (AES) algorithm shows that the area overhead of a single S-box is about 19% without any extra delay in the critical path. Moreover, the countermeasure circuit can be mounted onto different S-box implementations based on composite field or look-up table (LUT). Based on our approach, a DPA-resistant AES chip can be proposed to maintain the same throughput with less than 2K extra gates.

Exchange of private information over a public medium must incorporate a method for data protection against unauthorized access. To enhance the data security against the DPA attack in network communication, a dual field ECC processor supporting all finite field operations is proposed. The ECC processor performs hardware designs in terms of functionality, scalability, performance and power consumption. A unified scheme is introduced to accelerate EC arithmetic functions. The hardware is optimized by a very compact Galois field arithmetic unit with fully pipelined technique. A key-blinded technique is designed against power analysis attacks.

A Differential Power Analysis (DPA) attack is an exploit which overcomes the hardware and software security by analyzing the correlation between electricity usage of a chip in a device and the encryption key. These attacks are non-invasive, leading an intruder to crack a system without leaving any trace. CMOS Technology is prone to DPA attack because of higher power dissipation. A DPA resistant adiabatic technique has been analyzed which has lower power dissipation when compared to the CMOS technology. The conventional Positive Feedback Adiabatic Logic (PFAL) suffers from certain non-adiabatic energy loss. Hence, Energy Efficient Secure Positive Feedback Adiabatic Logic (EE-SPFAL) is proposed which reduces the non-uniform power consumption, preventing information leakage thus securing the system from DPA attacks. Thus the proposed EE-SPFAL is used to design logical circuits such as buffer, OR-XNOR and AND-NAND gate. It is proved that the information leakage in the form of current consumption takes place in PFAL buffer whereas current consumption traces in EE-SPFAL circuits are uniform, depicting the ability of the proposed logic family to resist DPA attack. The simulation was done using Cadence virtuoso 180 nm technologies.

In order to protect a cryptographic algorithm against Power Analysis attacks, a well-known method consists in hiding all the internal data with randomly chosen masks.Following this idea, an AES implementation can be protected against Differential Power Analysis (DPA) by the “Transformed Masking Method”, proposed by Akkar and Giraud at CHES’2001, requiring two distinct masks. At CHES’2002, Trichina, De Seta and Germani suggested the use of a single mask to improve the performances of the protected implementation. We show here that their countermeasure can still be defeated by usual first-order DPA techniques.In another direction, Akkar and Goubin introduced at FSE’2003 a new countermeasure for protecting secret-key cryptographic algorithms against high-order differential power analysis (HO-DPA). As particular case, the “Unique Masking Method” is particularly well suited to the protection of DES implementations. However, we prove in this paper that this method is not sufficient, by exhibiting a (first-order) enhanced differential power analysis attack. We also show how to avoid this new attack.KeywordsTamper-resistant devicesSide-Channel attacksPower AnalysisDPATransformed Masking MethodUnique Masking MethodDESAES

Charge-sharing symmetric adiabatic logic in countermeasure against power analysis attacks at cell level

ABSTRACTIn this paper, a high‐speed, low‐latency, and high‐security hardware‐implemented triple data encryption standard (3DES) cryptographic algorithm is proposed for securing data privacy. In order to achieve a high throughput for the 3DES architecture, the whole circuit is optimized with a 24‐stage pipelined design at first. For breaking the correlation between the processed data and power dissipation of the 3DES circuit against differential power analysis (DPA) attacks, two pseudo‐random number generators (PRNGs) are embedded to randomly alter the number of pipelined stages and data substitution locations within the 3DES circuit, respectively. Under such a circumstance, the proposed 3DES circuit is able to achieve high performance and strong robustness against DPA attacks without causing much overhead. As shown in the results, under the synthesis of SMIC 14‐nm process design kits (PDK), the clock frequency, area, power dissipation, and throughput of the proposed 3DES circuit, respectively, are achieved as 1.2 GHz, 26,435 m2, 21.05 mW, and 64 Gbps. Furthermore, when DPA attacks are executed on the proposed 3DES circuit, the corresponding secret key cannot be revealed even if 2 million plaintexts are enabled. In contrast, only 40,000 plaintexts are adequate to disclose the secret key of a regular pipelined 3DES circuit.

The 128-bit SM4[1] cipher is the first commercial cipher algorithm published by China in 2012, which is mainly used in WLAN. Comparing with conventional approaches, additive masking is adopted to resist the DPA (Differential Power Analysis) attack, and PPRM circuit structure is adopted to reduce the power consumption for SM4 S-box. Simulation results show that the design has a 50% reduction in power consumption and a 44% reduction in delay at the cost of area 20% increased using SMIC 0.18μm technology. Two sets of 2000 plaintext inputs are used in the DPA attack. Simulation results show the resistance of S-box to DPA is reliable. Additionally, 4-stage-pipelined SM4 cipher circuit is realized with an area of 18609 gates. The throughput rate of it can reach 2Gbps with a power consumption of 3.65mW@10Mhz.

Since the vulnerability of cryptosystems to differential power analysis (DPA) was reported in 1999, various power analysis attacks and corresponding countermeasures have been studied. With the scaling down of supply voltage and CMOS technology below 90 nm, leakage power plays an increasing role in the overall power dissipation. Future cryptosystems need to address this trend, though it has not been of concern yet in low- cost cryptosystems such as smartcards and RFED tags which currently use older technologies and low performance transistors. In this paper, we explore the impact of leakage power on conventional DPA and the feasibility of a novel leakage-based DPA (LDPA). We first use SPICE simulations to explore the leakage dependence on input patterns of logic gates implemented in 90 nm, 65 nm, and 45 nm CMOS technologies. Then we simulate a successful LDPA on a subset of a DES cryptosystem with only 120 rounds, in contrast to the 200 rounds reported for a conventional DPA in 180 nm technology. Furthermore, we demonstrate how even a DES implementation using a DPA-resistant logic style can be broken with LDPA in 2000 rounds, compared with the conventional DPA using more than 5000 rounds.

Fully depleted silicon-on-insulator (FD-SOI) technology is renowned for its back-gate bias voltage controllability. It allows devices fabricated with FD-SOI technology to be optimized for low power consumption or high performance with proper back-gate biases, depending on the required application. This article proposes using the back-gate biasing technique in novel countermeasures against power analysis attacks. Theoretical explanations are discussed, and realistic differential power analysis (DPA) attacks, targeting AES-128 encryption on a 65-nm STOB 32-bit RISC-V microcontroller, are conducted to justify the proposed idea. The experimental results show that when compared with applying no bias, applying our first proposal, which involves using forward back-gate bias, not only improves the test device performance but also enhances its resistance to DPA attacks. Moreover, vulnerability to DPA attacks is kept unchanged when a reverse back-gate bias is applied to achieve low power consumption. The DPA resistance is even more vital when combining the back-gate bias technique with a lower supply voltage. The number of power traces required to retrieve the secret key successfully increases by 14.5 times in the best case. Even better DPA resistance can be obtained when the back-gate bias of the targeted microcontroller is dynamically randomized, as suggested by our second proposal of a random dynamic back-gate bias (RDBB). When RDBB is applied, the number of power traces required to retrieve the secret key successfully significantly increases by 33.4 times.

Under a simple power leakage model based on Hamming weight, a software implementation of a data-whitening routine is shown to be vulnerable to a first-order Differential Power Analysis (DPA) attack. This routine is modified to resist the first-order DPA attack, but is subsequently shown to be vulnerable to a second-order DPA attack. A second-order DPA attack that is optimal under certain assumptions is also proposed. Experimental results in an ST16 smartcard confirm the practicality of the first and second-order DPA attacks.

Cryptographic implementation is one of the vital applications for FPGAs with security as its major standpoint. But it still requires a lot of efforts to keep it aloof from attacks like Side Channel Attacks (SCA). One of the major attacks that threaten the security of FPGA implementation of cryptographic algorithm is Differential Power Analysis (DPA). In this paper, we have discussed various approaches to defend against DPAs. These new programs suggested in the different approaches with some results aid in evenly distributing the power consumption in FPGAs making it less prone to DPAs.

Providing a secure hardware infrastructure is the main issue to implement secure cryptographic algorithms. Just a robust algorithm with suitable key lengths is not effective against differential analysis attacks and can cause the cryptographic key to be discovered. Today, credit cards and electronic identification cards, due to the greater scope of applications are subjected to differential power analysis (DPA) attacks. As a result, a good design can help maintain the confidentiality of information. Providing a design method that balances the power consumption of the outputs and inputs of chips results a DPA secure designs. Moreover, reduction of power consumption by recovering the charge stored in nodes can make the tracing power will be more difficult. On the other hand, designing a uniform pattern in the transistor surface shape for all logic gates will make them resilient against advanced imaging techniques. In this paper a DPA resilient design method is proposed which is also robust against some other attacks such as timing attacks and advanced image processing techniques. The presented designs are simulated and compared with the state of the art designs using Synopsis HSPICE with 22nm technology node. Simulation results shows that the proposed method has the lowest and most balanced power consumption compared to the other designs.

Security devices are vulnerable to Differential Power Analysis (DPA) that reveals the key by monitoring the power consumption of the circuits. In this paper, we present the first DPA attack against an FPGA implementation of the Camellia encryption algorithm with all key sizes and evaluate the DPA resistance of the algorithm. The Camellia cryptographic algorithm involves several different key-dependent intermediate operations including S-Box operations. In previous research, it was believed that the Camellia is stronger than AES due to the additional Whitening phase protecting the S-Box operation. However, we propose an attack that bypasses the Whitening phase and targets the S-Box. In this paper, we also discuss a low-cost countermeasure strategy to protect the Pre-whitening / Post-whitening and FL function of Camellia using Dual-rail Precharged Logic and to protect against attacks of the S-Box using Random Delay Insertion.

ABSTRACTIn this paper, we propose an improved differential power analysis (DPA) attack method for use against the 128-bit Advanced Encryption Standard (AES-128) with random process interrupt (RPI) protection applied on a field-programmable gate array (FPGA). The misalignment caused by RPIs is undermined by the new signals processed by our proposed method. Our method uses compressed energy entropy and the sliding window technique to process the power consumption curves (PCCs). The results of our experiments show that by gathering the scattered information, our method has excellent performance on the DPA attacks. Compared with existing methods, our proposed method shows better performance in increasing the amplitude of the maximum spike of the correlation curve. While achieving the same success rates, the number of PCCs applied in our method has decreased by 35%.