Power Analysis Based Reverse Engineering on the Secret Round Function of Block Ciphers

In this paper, we demonstrate how the Scanning Electron Microscope (SEM) becomes a powerful tool for Side Channel Analysis (SCA) and Hardware Reverse Engineering. We locate the AES hardware circuit of a XMEGA microprocessor with Capacitive-Coupled Voltage Contrast (CCVC) images and use them in a powerful Voltage Contrast Side Channel Analysis (VCSCA). This enables an attacker to locate AES bit-wires in the top metal-layer and thus, to recover valuable netlist information. An attacker gets a valuable entry-point to look for weaknesses or Intellectual Property (IP) in the AES circuit. Additionally we show the great potential of the VCSCA in a non-invasive Side Channel Analysis for Reverse Engineering (SCARE) approach. Finally, we recover the full key of the AES hardware-engine in a practical template-based VCSCA and a no-plaintext, no-ciphertext and no-key Simple Side Channel Analysis (SSCA). We show that future VCSCA attacks present a big hardware security-risk that IC vendors need to consider.

Reverse Engineering (RE) has been historically considered as a powerful approach to understand electronic hardware in order to gain competitive intelligence or accomplish piracy. In recent years, it has also been looked at as a way to authenticate hardware intellectual properties in the court of law. In this paper, we propose a beneficial role of RE in post-silicon validation of integrated circuits (IC) with respect to IC functionality, reliability and integrity. Unlike traditional destructive RE approaches, we propose a fast non-destructive side-channel analysis approach that can hierarchically extract structural information from an IC through its transient current signature. Such a top-down side-channel analysis approach is capable of reliably identifying pipeline stages and functional blocks. It is also suitable to distinguish sequential elements from combinational gates. For extraction of random logic structures (e.g. control blocks and finite state machines) we combine side-channel analysis with logic testing based Boolean function extraction. The proposed approach is amenable to automation, scalable, and can be applied as part of post-silicon validation process to verify that each IC implements exclusively the functionality described in the specification and is free from malicious modification or Trojan attacks. Simulation results on a pipelined DLX processor demonstrate the effectiveness of the proposed approach.

Side-channel analysis has become a well-established topic in the scientific community and industry over the last one and a half decade. Somewhat surprisingly, the vast majority of work on side-channel analysis has been restricted to the case of attacking cryptographic implementations through the recovery of keys. In this contribution, we show how side-channel analysis can be used for extracting code from embedded systems based on a CPU's electromagnetic emanation. There are many applications within and outside the security community where this is desirable. In cryptography, it can, e.g., be used for recovering proprietary ciphers and security protocols. Another broad application field is general security and reverse engineering, e.g., for detecting IP violations of firmware or for debugging embedded systems when there is no debug interface or it is proprietary.A core feature of our approach is that we take localized electromagnetic measurements that are spatially distributed over the IC being analyzed. Given these multiple inputs, we model code extraction as a classification problem that we solve with supervised learning algorithms. We apply a variant of linear discriminant analysis to distinguish between the multiple classes. In contrast to previous approaches, which reported instruction recognition rates between 40--70%, our approach detects more than 95% of all instructions for test code, and close to 90% for real-world code. The methods are thus very relevant for use in practice. Our method performs dynamic code recognition, which has both advantages (only the program parts that are actually executed are observed) but also limitations (rare code executions are difficult to observe).

Side channel analysis(SCA) focuses on attacking cryptographic algorithm implementations by collecting leaked information and analyzing the correlation between the leaked and key information in the cryptographic system. Currently, SCA is the main threat to cryptographic implementations, with DPA (differential power analysis) and DFA (differential fault analysis) being two of the most threatening types of SCA. However, the existing countermeasures against DPA and DFA have shortcomings and can hardly protect cipher designs perfectly. Based on a comprehensive analysis of DPA and DFA, this paper proposes a new idea of using an evolutionary cipher (EVOC) against DPAs based on the model proposed by Kocher, and several different new types of DFAs. In fact, an EVOC is a kind of dynamic cipher designing method. Moreover, combined with intelligent searching algorithms and cryptography design policies, EVOCs utilize the dynamic and unpredictable properties of TRNG (a truly random number generator) to ensure cipher design at a high level of security. Therefore, with an EVOC we could design cryptography algorithms with high security to resist mathematical analysis as well as DPAs and DFAs. This paper analyzes and proves the security, efficiency, cost, and original features of EVOCs against DPA and DFA both theoretically and experimentally. Compared with existing countermeasures against SCAs, EVOCs use dynamic non-linear operations to destroy the bases of DPA and DFA. At the algorithm level, EVOCs are more efficient than other resistance methods. Based on the theory and experiments, this paper proposes certain modifications to the EVOC in the AES (advanced encryption standard) algorithm, which can be referenced by other dynamic designs of cryptographic algorithms.

Side-channel analysis (SCA) is launched by exploiting the information leaking from the implementation a cryptographic algorithm, e.g., power consumption information. Recently, deep learning-based SCA techniques have also facilitated SCA against software and hardware implementations of various cryptographic algorithms. In this work, we perform SCA using various deep learning (DL) techniques such as Multi-layered Perceptron (MLP), Convolutional Neural Network (CNN), and Recurrent Neural Network (RNN) on the datasets collected from hardware and software platforms. The objective of this work is to identify the performance of DL techniques in performing SCA for secret key recovery and finding out the best settings for the model to optimize the attack performance in terms of on computation time and SCA efficiency. In our study, we have focused on two open-source AES-128 encryption algorithm databases, ASCAD and DPA contest v2 (DPAv2), where ASCAD database consists of the power traces captured from a software implementation of the AES and DPAv2 database consists of the power traces captured a hardware implementation of the AES. For the first time, we applied hyperparameter tuning with Bayesian Optimization and distributed computing on ASCAD database and we investigated the impact of MLP and RNN along with the distributed computing and hyperparameter tuning with Bayesian optimization on DPAv2 database. Our results show that the CNNs are the best models for performing the attack on software implementation while MLPs are the best for attacking hardware implementation of cryptographic algorithms.

Existing power analysis techniques rely on strong adversary models with prior knowledge of the leakage or training data. We introduce side-channel analysis with unsupervised learning (SCAUL) that can recover the secret key without requiring prior knowledge or profiling (training). We employ an LSTM auto-encoder to extract features from power traces with high mutual information with the data-dependent samples of the measurements. We demonstrate that by replacing the raw measurements with the auto-encoder features in a classical DPA attack, the efficiency, in terms of required number of measurements for key recovery, improves by 10X. Further, we employ these features to identify a leakage model with sensitivity analysis and multi-layer perceptron (MLP) networks. SCAUL uses the auto-encoder features and the leakage model, obtained in an unsupervised approach, to find the correct key. On a lightweight implementation of AES on Artix-7 FPGA, we show that SCAUL is able to recover the correct key with 3,700 power measurements with random plaintexts, while a DPA attack requires at least 17,400 measurements. Using misaligned traces, with an uncertainty equal to 20 percent of the hardware clock cycle, SCAUL is able to recover the secret key with 12,300 measurements while the DPA attack fails to detect the key.

While modern masking schemes provide provable security against passive side-channel analysis (SCA), such as power analysis, single faults can be employed to recover the secret key of ciphers even in masked implementations. In this paper, we propose random space masking (RS-Mask) as a countermeasure against both power analysis and statistical fault analysis (SFA) techniques. In the RS-Mask scheme, the distribution of all sensitive variables, faulty and/or correct values is uniform, and it therefore protects the implementations against any SFA technique that exploits the distribution of intermediate variables, including fault sensitivity analysis (FSA), statistical ineffective fault analysis (SIFA) and fault intensity map analysis (FIMA). We implement RS-Mask on AES, and show that a SIFA attack is not able to identify the correct key. We additionally show that an FPGA implementation of AES, protected with RS-Mask, is resistant to power analysis SCA using Welch's t-test. The area of the RSMasked AES is about 3.5 times that of an unprotected AES implementation of similar architecture, and about 2 times that of a known FPGA SCA-resistant AES implementation. Finally, we introduce infective RS-Mask that provides security against differential techniques, such as differential fault analysis (DFA) and differential fault intensity analysis (DFIA), with a slight increase in overhead.

Side-channel analysis (SCA) attacks - especially power analysis - are powerful ways to extract the secrets stored in and processed by cryptographic devices. In recent years, researchers have shown interest in utilizing on-chip measurement facilities to perform such SCA attacks remotely. It was shown that simple voltage-monitoring sensors can be constructed from digital elements and put on multi-tenant FPGAs to perform remote attacks on neighbouring cryptographic co-processors. A similar threat is the unsuspecting integration of third-party IP-Cores into an IC design. Even if the function of an acquired IP-Core is not security critical by itself, it may contain an on-chip sensor as a Trojan that can eavesdrop on cryptographic operations across the whole device. In contrast to all FPGA-based investigations reported in the literature so far, we examine the efficiency of such on-chip sensors as a source of information leakage in an ASIC-based case study for the first time. To this end, in addition to a cryptographic core (lightweight block cipher PRESENT) we designed and implemented a voltage-monitoring sensor on an ASIC fabricated by a 40 nm commercial standard cell library. Despite the physical distance between the sensor and the PRESENT core, we show the possibility of fully recovering the secret key of the PRESENT core by processing the sensor's output. Our results imply that the hidden insertion of such a sensor - for example by a malicious third party IP-Core vendor - can endanger the security of embedded systems which deal with sensitive information, even if the device cannot be physically accessed by the adversary.

The goal of generic side-channel distinguishers is to allow key recoveries against any type of implementation, under minimum assumptions on the underlying hardware. Such distinguishers are particularly interesting in view of recent technological advances. Indeed, the traditional leakage models used in side-channel attacks, based on the Hamming weight or distance of the data contained in an implementation, are progressively invalidated by the increased variability in nanoscale electronic devices. In this paper, we consequently provide two contributions related to the application of side-channel analysis against emerging cryptographic implementations. First, we describe a new statistical test that is aimed to be generic and efficient when exploiting high-dimensional leakages. The proposed distinguisher is fully non-parametric. It formulates the leakage distributions using a copula and discriminates keys based on the detection of an outlier behavior. Next, we provide experiments putting forward the limitations of generic side-channel analysis in advanced scenarios, where leaking devices are protected with countermeasures. Our results exhibit that all non-profiled attacks published so far can sometimes give a false sense of security, due to incorrect leakage models. That is, there exists settings in which an implementation is secure against such non-profiled attacks and can be defeated with profiling. This confirms that the evaluations of cryptographic implementations should always consider profiling, as a worst case scenario.

Today, the deep learning-based side-channel analysis represents a widely researched topic, with numerous results indicating the advantages of such an approach. Indeed, breaking protected implementations while not requiring complex feature selection made deep learning a preferred option for profiling side-channel analysis. Still, this does not mean it is trivial to mount a successful deep learning-based side-channel analysis. One of the biggest challenges is to find optimal hyperparameters for neural networks resulting in powerful side-channel attacks. This work proposes an automated way for deep learning hyperparameter tuning based on Bayesian optimization. We build a custom framework denoted AutoSCA supporting machine learning and side-channel metrics. Our experimental analysis shows that our framework performs well regardless of the dataset, leakage model, or neural network type. We find several neural network architectures outperforming state-of-the-art attacks. Finally, while not considered a powerful option, we observe that neural networks obtained via random search can perform well, indicating that the publicly available datasets are relatively easy to break.

In this paper, we propose a novel cell-level side channel countermeasure fluctuating power logic (FPL), which diffuses the correlation between the real power consumption and the fixed data transitions by employing a cascade voltage logic. The countermeasure further acts as a cell-level V <inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">DD</inf> randomizer, making it a strong candidate for implementing algorithmic countermeasure and exploiting its noise generation capabilities. This proposed scheme is illustrated by a standard flip-flop. HSPICE based simulation results show that the modified flip-flop is resistant against power analysis at the cost of doubled power dissipation. Two illustrative case studies of PRESENT and AES substitutions have been explored. The resistance against Side-Channel Analysis(SCA) is evaluated by the correlation power analysis. The new logic outperforms other counterparts in consideration of both security and cost, which renders it as a practical solution for resource-constrained systems. The proposed cell-level countermeasure can naturally mitigate other SCA such as electromagnetic analysis.

This article demonstrates enhanced power (P) and electromagnetic (EM) side-channel analysis (SCA) attack resistance of standard (unprotected) 128-bit advanced encryption standard (AES) engines with parallel (P-AES, 128-bit) and serial (S-AES, 8-bit) datapaths and a 128-bit SIMON engine with the bit-serial (1-bit) datapath by an on-die security-aware all-digital low-dropout (DLDO) regulator. The proposed DLDO improves SCA resistance using control-loop-induced perturbations in a nominal DLDO, enhanced by a random switching noise injector (SNI) by power-stage control and a randomized reference voltage (R-VREF) generator coupled with all-digital clock modulation (ADCM). SCA performed on the measured power/EM signatures acquired from a 130-nm CMOS testchip demonstrates up to 25 $\times $ reduction in test vector leakage assessment (TVLA) leakage for P-AES and 3579 $\times $ , 2182 $\times $ , and 500 $\times $ increase in minimum-traces-to-disclose (MTD) 80% of the subkeys for P-AES, S-AES, and SIMON cores, respectively, with respect to correlation power analysis (CPA) and correlation EM analysis (CEMA).

FPGA is widely used in the cryptographic devices, such as security co-processor and crypto engine, due to its high speed and customizability. Side-channel analysis is the state-of-the-art method which could recover the secret information in the FPGA through measuring and analysing the power consumption or the electromagnetic radiation. Therefore, side-channel analysis may lead to a potential threat of the security of FPGA. We find that an excessively high operating frequency could cause a pretty serious security vulnerability in the FPGA implementation of a cryptographic algorithm with side-channel countermeasures. And then, how to evaluate the security of the implementation at different operating frequencies is an important question in the practical application. After investigating the physical reason of the information leakage of the FPGA, we propose a generic evaluation methodology derived from CPA and MIA that can be utilized to analyze the security of FPGA implementation of a cryptographic algorithm with side-channel countermeasures at different operating frequencies. By this methodology, the evaluator only needs to collect the measurements when the FPGA operates at an arbitrary frequency rather than collecting the measurement of all possible frequencies exhaustively. Finally, several experiments in an FPGA with AES cryptographic algorithm protected with a masking countermeasure are conducted to illustrate the feasibility of this methodology.

Considering the dependency between the power consumption of implemented cryptographic algorithms and the data being processed, side-channel analysis methods can reveal the secret information of these systems. It was previously thought that data acquisition of dynamic power needs physical access to these systems, but recent studies show, it is possible to gather information about power consumption from FPGAs without any physical access. High flexibilities of modern FPGAs cause that they are used for cloud accelerator in Platform as a Service (PaaS) system; however, new serious vulnerabilities emerged for these platforms. Although there are some reports about how switching activities from one region of FPGA affect other regions, details of this technique are not analyzed. In this paper, we analyzed the strength of this kind of attack and examined the impact of geometrical and electrical parameters of the victim/attacker modules on the efficiency of this attack. Experimental results and analyses show that the relational location, and the distance of victim/attacker modules, have considerable impacts on the quality of attack. Results of this analysis can help the FPGA manufacturer and IP developers to protect their systems against this serious attack.

Cryptographic System-on-Chips (SoCs) are becoming more and more popular. In these systems, cryptographic accelerators are integrated with processor cores to provide users with the software&#x2019;s flexibility and hardware&#x2019;s high performance. First, this work aimed to confirm the vulnerability of cryptographic SoCs against several types of power analysis attacks. Then, the novel Random Dynamic Frequency Scaling (RDFS) countermeasure is proposed to improve the resistance of such systems. The proposed RDFS countermeasure improved the power analysis resistance while maintaining low-performance overhead and hardware costs by generating more than 219,000 distinct frequencies for driving only the cryptographic accelerators. The effectiveness of the proposed RDFS countermeasure is demonstrated by conducting realistic Correlation Power Analysis (CPA) attacks, Deep-Learning-based Side-Channel Analysis (DL-SCA) attacks, and Test Vector Leakage Assessment (TVLA) testing methodology. The experimental results show that the RISC-V SoC protected by RDFS countermeasure can withstand CPA attacks and TVLA test with more than five million power traces, which is the best result compared to other related works. The proposed RDFS countermeasure also harden the targeted RISC-V SoC&#x2019;s resistance against DL-SCA attacks.