SCAUL: Power Side-Channel Analysis With Unsupervised Learning

DPA attacks usually exhibit a “divide-and-conquer” property: the adversary needs to enumerate only a small space of the key (a key sub-space) when performing the DPA attack. This is achieved trivially in the outer rounds of a cryptographic implementation since intermediates depend on only few key bits. In the inner rounds, however, intermediates depend on too many key bits to make DPA practical or even to pose an advantage over cryptanalysis. For this reason, DPA countermeasures may be deployed only to outer rounds if performance or efficiency are critical. This paper shows a DPA attack exploiting leakage from the third round of a Feistel cipher, such as DES. We require the ability of fixing inputs, but we do not place any special restriction on the leakage model. The complexity of the attack is that of two to three DPA attacks on the first round of DES plus some minimal differential cryptanalysis.

Power side-channel analysis (SCA) has been of immense interest to most embedded designers to evaluate the physical security of the system. This work presents profiling-based cross-device power SCA attacks using deep learning techniques on 8-bit AVR microcontroller devices running AES-128. Firstly, we show the practical issues that arise in these profiling-based cross-device attacks due to significant device-to-device variations. Secondly, we show that utilizing Principal Component Analysis (PCA) based pre-processing and multi-device training, a Multi-Layer Perceptron (MLP) based 256-class classifier can achieve an average accuracy of 99.43% in recovering the first key byte from all the 30 devices in our data set, even in the presence of significant inter-device variations. Results show that the designed MLP with PCA-based pre-processing outperforms a Convolutional Neural Network (CNN) with 4-device training by ~20%in terms of the average test accuracy of cross-device attack for the aligned traces captured using the ChipWhisperer hardware.Finally, to extend the practicality of these cross-device attacks, another pre-processing step, namely, Dynamic Time Warping (DTW) has been utilized to remove any misalignment among the traces, before performing PCA. DTW along with PCA followed by the 256-class MLP classifier provides >=10.97% higher accuracy than the CNN based approach for cross-device attack even in the presence of up to 50 time-sample misalignments between the traces.

This paper presents the employment of a DPA attack on the NIST (National Institute of Standards and Technology) standardized AES (advance encryption standard) protocol for key retrieval and prevention. Towards key retrieval, we applied the DPA attack on AES to obtain a 128-bit secret key by measuring the power traces of the computations involved in the algorithm. In resistance to the DPA attack, we proposed a countermeasure, or a new modified masking scheme, comprising (i) Boolean and (ii) multiplicative masking, for linear and non-linear operations of AES, respectively. Furthermore, we improved the complexity involved in Boolean masking by introducing Rebecca’s approximation. Moreover, we provide a novel solution to tackle the zero mask problem in multiplicative masking. To evaluate the power traces, we propose our custom correlation technique, which results in a decrease in the calculation time. The synthesis results for original implementation (without countermeasure) and inclusion of countermeasure are given on a Zynq 7020 FPGA (Artix-7 device). It takes 424 FPGA slices when implemented without considering the countermeasure, whereas 714 slices are required to implement AES with the inclusion of the proposed countermeasure. Consequently, the implementation results provide the acceptability of this work for area-constrained applications that require prevention against DPA attacks.

Cryptography is securing information using mathematical techniques like encryption and decryption. Cryptanalysis uses side-channel attacks to undermine security. The efficient type of power analysis of the side channel and Differential Power Analysis (DPA) statistically assesses the power use of the cryptographic method and provides private details. This paper proposes the design of a Compact PRESENT S-box (CPSB), using Three-Phase Dual Rail Pre-Charge Logic (TDPL) combined with Charge Balancing Symmetric Pre-Resolve Adiabatic Logic (CBSPAL). The primary contribution of this research lies in the development of a power-efficient logic style that improves the performance of the S-box while maintaining conflict against DPA attacks. By employing TDPL, the design achieves consistent power consumption across various input configurations, thereby mitigating the risk of side-channel attacks. The focus of this work is to propose an innovative implementation approach rather than the security aspects of cryptography itself. The proposed methodology proves a substantial reduction in power overhead and area, making it suitable for resource-constrained environments, like Internet of Things (IoT) applications. A correlation study is carried out to calculate the Compact Present S-box implementation's DPA resistance characteristic. The power traces are examined. The proposed design makes power consumption consistent and decreases area and power overhead by 15.3% and 13.6%, respectively. Performance indicators for the security are NED, NSD, and Pearson correlation coefficient. The connection is the same for all conceivable input and key pairings. When compared with other designs, the NED and NSD were determined to be 0.02% and 0.01%, respectively.

These days, hardware devices and its associated activities are greatly impacted by threats amidst of various technologies. Hardware trojans are malicious modifications made to the circuitry of an integrated circuit, Exploiting such alterations and accessing the level of damage to devices is considered in this work. These trojans, when present in sensitive hardware system deployment, tends to have potential damage and infection to the system. This research builds a hardware trojan detector using machine learning techniques. The work uses a combination of logic testing and power side-channel analysis (SCA) coupled with machine learning for power traces. The model was trained, validated and tested using the acquired data, for 5 epochs. Preliminary logic tests were conducted on target hardware device as well as power SCA. The designed machine learning model was implemented using Arduino microcontroller and result showed that the hardware trojan detector identifies trojan chips with a reliable accuracy. The power consumption readings of the hardware characteristically start at 1035-1040mW and the power time-series data were simulated using DC power measurements mixed with additive white Gaussian noise (AWGN) with different standard deviations. The model achieves accuracy, precision and accurate recall values. Setting the threshold proba¬bility for the trojan class less than 0.5 however increases the recall, which is the most important metric for overall accuracy acheivement of over 95 percent after several epochs of training.

Over the past few years, there has been a large volume of work on both attacking elliptic curve cryptosystems (ECC) using side-channel analysis and the development of related defence methods. Lenstra and Verheul recently introduced XTR, a cryptosystem that can compete with ECC in terms of processing and bandwidth requirements. These properties make XTR ideal for use on smart-cards, the devices that suffer most from vulnerability to side-channel attack. However, there are relatively few papers investigating the side-channel security of XTR and although some ECC techniques can be re-used, there are also notable differences. We aim to fill this gap in the literature. We present the first known SPA attack against XTR double exponentiation and two defence methods against such an attack. We also investigate methods of defending XTR against DPA attack.

One of the most common algorithms in a digital signature is the RSA-CRT. Several side channel attacks have been presented on the RSA-CRT’s embedded design. Such attacks are divided into two categories: attack in the modular reduction step and attack in the recombination step. The former are plaintext attacks and based on the modular reduction on equidistant data attack, which is introduced in [B. den Boer, et al., “A DPA attack against the modular reduction within a CRT implementation of RSA,” in CHES 2002]. In these attacks, instead of using random plaintext, an equidistant series of input data is used. In a chosen and equidistant plaintext attack, the attacker needs a higher level of accessibility, and it is more difficult than a nonchosen plaintext attack. In this paper, we present a nonequidistant plaintext (but chosen plaintext) differential power analysis attack on the modular reduction in RSA-CRT, named NEMR (nonequidistant plaintext on modular reduction). We also present a new countermeasure on NEMR attack, which is resistant against equidistant and nonequidistant data attack on reduction step in RSA-CRT. In order to prove the idea, the NEMR attack is applied on the RSA-CRT 2048-bit implementation on SAKURA-G board, and the result is evaluated. Then, the presented countermeasure on NEMR attack is tested, and practical results demonstrate the validity of the proposed approach.

Side Channel Analysis (SCA) has become a new threat to the hardware implementations of encryption algorithms. The reverse engineering has been adopted to explore the unknown part of the encryption algorithms. The existing SCAs for reverse engineering depend on the leakage models in a large extent and mainly focus on the single component of the algorithms while the other parts of the target algorithm are known. In this paper, we present a more general and feasible reverse analysis by combining the mathematical methods and the SCA methods. We use the strict avalanche criterion for the non-linear operations of block ciphers and apply the power analysis to reverse the structure parameters. We propose a new reverse analysis method to reduce the dependency on the leakage models, which can be combined with the structure cryptanalysis to reverse the internal parameters of the linear and non-linear operations. We finally achieve the reverse analysis on the unknown round function of block ciphers.

Side-channel analysis (SCA) is launched by exploiting the information leaking from the implementation a cryptographic algorithm, e.g., power consumption information. Recently, deep learning-based SCA techniques have also facilitated SCA against software and hardware implementations of various cryptographic algorithms. In this work, we perform SCA using various deep learning (DL) techniques such as Multi-layered Perceptron (MLP), Convolutional Neural Network (CNN), and Recurrent Neural Network (RNN) on the datasets collected from hardware and software platforms. The objective of this work is to identify the performance of DL techniques in performing SCA for secret key recovery and finding out the best settings for the model to optimize the attack performance in terms of on computation time and SCA efficiency. In our study, we have focused on two open-source AES-128 encryption algorithm databases, ASCAD and DPA contest v2 (DPAv2), where ASCAD database consists of the power traces captured from a software implementation of the AES and DPAv2 database consists of the power traces captured a hardware implementation of the AES. For the first time, we applied hyperparameter tuning with Bayesian Optimization and distributed computing on ASCAD database and we investigated the impact of MLP and RNN along with the distributed computing and hyperparameter tuning with Bayesian optimization on DPAv2 database. Our results show that the CNNs are the best models for performing the attack on software implementation while MLPs are the best for attacking hardware implementation of cryptographic algorithms.

Recently, as deep learning has been applied to various fields, deep-learning-based side-channel analysis (SCA) has been widely investigated. Unlike traditional SCA, it can perform well independently of the attacker’s ability. In this paper, we propose deep-learning-based profiled and non-profiled SCA of PIPO, (Plug-In Plug-Out), which is a bitslice block cipher that can effectively apply a countermeasure for SCA. Our datasets were captured from three different boards (XMEGA128D4, MSP430F2618, STM32F303) running PIPO-64/128. For profiled SCA, the identity (ID) labeling method exhibited better performance than the most significant bit (MSB) and hamming weight (HW) labeling methods. That is, even if each bit of the S-Box output was distributed in the power traces by the bitslice implementation, the neural network trained well each bit of the S-Box output by itself. For non-profiled SCA, we proposed a novel labeling technique that considers bitslice characteristics. We compared our proposed labeling method to MSB and HW labeling by analyzing the three aforementioned datasets. For non-profiled SCA, the proposed labeling method was more effective than the MSB and HW labeling methods on all datasets.

Graphics Processing Units (GPUs) have been used to run a range of cryptographic algorithms. The main reason to choose a GPU is to accelerate the encryption/decryption speed. Since GPUs are mainly used for graphics rendering, and only recently have they become a fully-programmable parallel computing device, there has been little attention paid to their vulnerability to side-channel attacks. In this paper we present a study of side-channel vulnerability on a state-of-the-art graphics processor. To the best of our knowledge, this is the first work that attempts to extract the secret key of a block cipher implemented to run on a GPU. We present a side-channel power analysis methodology to extract all of the last round key bytes of a CUDA AES (Advanced Encryption Standard) implementation run on an NVIDIA TESLA GPU. We describe how we capture power traces and evaluate the power consumption of a GPU. We then construct an appropriate power model for the GPU. We propose effective methods to sample and process the GPU power traces so that we can recover the secret key of AES. Our results show that parallel computing hardware systems such as a GPU are highly vulnerable targets to power-based side-channel attacks, and need to be hardened against side-channel threats.

In the IEEE S&P 2017, Ronen et al. exploited side-channel power analysis (SCPA) and approximately 5 000 power traces to recover the global AES-CCM key that Philip Hue lamps use to decrypt and authenticate new firmware. Based on the recovered key, the attacker could create a malicious firmware update and load it to Philip Hue lamps to cause Internet of Things (IoT) security issues. Inspired by the work of Ronen et al., we propose an AES-CCM-based firmware update scheme against SCPA and denial of service (DoS) attacks. The proposed scheme applied in IoT terminal devices includes two aspects of design (i.e., bootloader and application layer). Firstly, in the bootloader, the number of updates per unit time is limited to prevent the attacker from acquiring a sufficient number of useful traces in a short time, which can effectively counter an SCPA attack. Secondly, in the application layer, using the proposed handshake protocol, the IoT device can access the IoT server to regain update permission, which can defend against DoS attacks. Moreover, on the STM32F405+M25P40 hardware platform, we implement Philips’ and the proposed modified schemes. Experimental results show that compared with the firmware update scheme of Philips Hue smart lamps, the proposed scheme additionally requires only 2.35 KB of Flash memory and a maximum of 0.32 s update time to effectively enhance the security of the AES-CCM-based firmware update process.

As cryptographic implementations are increasingly subsumed as functional blocks within larger systems on chip, it becomes more difficult to identify the power consumption signatures of cryptographic operations amongst other unrelated processing activities. In addition, at higher clock frequencies, the current decay between successive processing rounds is only partial, making it more difficult to apply existing pattern matching techniques in side-channel analysis. We show however, through the use of a phase-sensitive detector, that power traces can be pre-processed to generate a filtered output which exhibits an enhanced round pattern, enabling the identification of locations on a device where encryption operations are occurring and also assisting with the re-alignment of power traces for side-channel attacks.

A feature learning task involves training models that are capable of inferring good representations (transformations of the original space) from input data alone. When working with limited or unlabelled data, and also when multiple visual domains are considered, methods that rely on large annotated datasets, such as Convolutional Neural Networks (CNNs), cannot be employed. In this paper we investigate different auto-encoder (AE) architectures, which require no labels, and explore training strategies to learn representations from images. The models are evaluated considering both the reconstruction error of the images and the feature spaces in terms of their discriminative power. We study the role of dense and convolutional layers on the results, as well as the depth and capacity of the networks, since those are shown to affect both the dimensionality reduction and the capability of generalising for different visual domains. Classification results with AE features were as discriminative as pre-trained CNN features. Our findings can be used as guidelines for the design of unsupervised representation learning methods within and across domains.

The deep learning-based side-channel analysis gave some of the most prominent side-channel attacks against protected targets in the past few years. To this end, the research community’s focus has been on creating the following: (1) powerful multilayer perceptron or convolutional neural network architectures and (2) (if possible) minimal multilayer perceptron or convolutional neural network architectures. Currently, we see that, computationally intensive hyperparameter tuning methods (e.g., Bayesian optimization or reinforcement learning) provide the best results. However, as targets with more complex countermeasures become available, these minimal architectures may be insufficient, and we will require novel deep learning approaches.This work explores how residual neural networks (ResNets) perform in side-channel analysis and how to construct deeper ResNets capable of working with larger input sizes and requiring minimal tuning. The resulting architectures, obtained by following our guidelines, are significantly deeper than commonly seen in side-channel analysis, require minimal hyperparameter tuning for specific datasets, and offer competitive performance with state-of-the-art methods across several datasets. Additionally, the results indicate that ResNets work especially well when the number of profiling traces and features in a trace is large.