Security Evaluation Against Electromagnetic Analysis at Design Time

The additional information (side effects) in Elliptic Curve Cryptography (ECC) hardware can be used to attack cryptographic systems. Additional information related to time, power consumption and electromagnetic radiation. Side channel attacks have been done with SPA (Simple Power Analysis), DPA (Differential Power Analysis), SEMA (Simple Electromagnetic Analysis) and DEMA (Differential Electromagnetic Analysis). Some scalar multiplication algorithm can be used to countermeasure SPA attack on elliptic curve cryptography. In this study, conducted experiments side-channel attacks ECC hardware implementations use binary algorithms by observing power consumption of ECC processor on FPGA. Experimental of side-channel attack is conducted to guess the secret key for data encryption and decryption by looking at the physical differences on hardware side effects. In this study, side-channel attack experimental is successful 100% get the key by analyzing of power consumption ECC processor.

For computationally-intensive tasks like cryptographic applications, GPU is thought to be an ideal platform due to its parallel computing power. However, some vulnerabilities of GPU have been published due to overflow attacks, covert-channel attacks and side-channel attacks. In this work, for the first time, we investigate cache-collision attacks on GPU-based AES implementation utilizing Electro-Magnetic (EM) leakages. We construct a much efficient leakage model based on generalized simultaneous cache-collision in multi-threads scenarios, and we mount a key-recovery attack with Differential Electro-Magnetic Analysis (DEMA). Our evaluation results show that the 16-byte secret key of GPU-based AES implementation can be recovered with only 5,000 EM traces, and 600 EM traces are enough when assisted with appropriate key enumeration algorithm (KEA). This work suggests that cache-collision on GPU does give rise to leakages via EM side-channels and it should be considered in the design of secure GPU-based cryptographic implementations.

Side channel analysis(SCA) focuses on attacking cryptographic algorithm implementations by collecting leaked information and analyzing the correlation between the leaked and key information in the cryptographic system. Currently, SCA is the main threat to cryptographic implementations, with DPA (differential power analysis) and DFA (differential fault analysis) being two of the most threatening types of SCA. However, the existing countermeasures against DPA and DFA have shortcomings and can hardly protect cipher designs perfectly. Based on a comprehensive analysis of DPA and DFA, this paper proposes a new idea of using an evolutionary cipher (EVOC) against DPAs based on the model proposed by Kocher, and several different new types of DFAs. In fact, an EVOC is a kind of dynamic cipher designing method. Moreover, combined with intelligent searching algorithms and cryptography design policies, EVOCs utilize the dynamic and unpredictable properties of TRNG (a truly random number generator) to ensure cipher design at a high level of security. Therefore, with an EVOC we could design cryptography algorithms with high security to resist mathematical analysis as well as DPAs and DFAs. This paper analyzes and proves the security, efficiency, cost, and original features of EVOCs against DPA and DFA both theoretically and experimentally. Compared with existing countermeasures against SCAs, EVOCs use dynamic non-linear operations to destroy the bases of DPA and DFA. At the algorithm level, EVOCs are more efficient than other resistance methods. Based on the theory and experiments, this paper proposes certain modifications to the EVOC in the AES (advanced encryption standard) algorithm, which can be referenced by other dynamic designs of cryptographic algorithms.

A significant number of cryptographic architectures rely on the efficient and resilient implementation of the Montgomery modular multiplier. One of the most used attacks on cryptographic implementations is based on Differential Power Analysis (DPA) or one of its variants. In this paper, a specially adjusted Latch-less Asynchronous Charge Sharing Logic (LACSL) is developed to inherently defend such architecture against DPA attacks. The proposed logic provides input data independent low-power/energy consumption which is attributed to interleaved charge sharing stages with non-static elements involved in the data path. A 32-bit LACSL Montgomery Multiplier (case study) is extensively tested through HSPICE simulations and great consistency in power/energy consumption is achieved. The normalized energy deviation and normalized standard deviation are only 0.048 and 0.011, respectively. Compared with the original ACSL implementation, besides the impressive energy coherence, 42% energy saving is demonstrated plus that the leakage power is 3.5 times smaller. Furthermore, the scalability of the proposed multiplier is explored where 64-bit, 128-bit and 256-bit designs are implemented. Again, great energy consistency is found with the highest deviation being 0.5%. The proposed techniques can be easily migrated to other low-power circuits for which accurate power/energy models can be built, independent of the input data profile.

Security at low cost is an important factor for cryptographic hardware implementations. Unfortunately, the security of cryptographic implementations is threatened by Side Channel Analysis (SCA). SCA attempts to discover the secret key of a device by exploiting implementation characteristics and bypassing the algorithm's mathematical security. Differential Power Analysis (DPA) is a type of SCA, which exploits the device's power consumption characteristics. Several countermeasures to DPA have been proposed, however, all of them increase security at the cost of increased area which in-turn leads to increased power consumption and reduced throughput. FPGAs are popular due to their reconfigurability, lower development cost, off-the-shelf availability and shorter time to market. Block RAMs (BRAM) are large memories in FPGAs that are commonly used as ROM, FIFO, Look-up tables, etc. In this paper we explore the DPA resistance of BRAMs in Xilinx FPGAs and verify if their usage can improve the security. The results of our Advanced Encryption Standard (AES) implementations show that using BRAMs alone can improve the security over a look-up table (LUT) only design 9 times. Applying Separated Dynamic Differential Logic (SDDL) for FPGAs, a countermeasure against DPA, to this design doubles the security again leading to an 18 fold increase over the unprotected LUT design.

SEED, the Korean standard block cipher algorithm, is a 128-bit symmetric key block cipher algorithm. Although SEED is theoretically safe, cryptographic devices with SEED modules are vulnerable to differential power analysis due to leakage information. Recently, differential power analysis has been widely researched, and various countermeasure techniques against differential power analysis have been proposed. In this paper, we embodied SEED hardware modules with differential power analysis countermeasure techniques using masking methods, and we generated random number using simple PRNG module. We embodied the SEED hardware modules using VHDL, and analyzed the result of simulation and synthesis. ??2010 IEEE.

In this paper we study what happens to sets when we iteratively apply lossy (round) mappings to them. We describe the information loss as imbalances of parities of intermediate distributions and show that their evolution is governed by the correlation matrices of the mappings. At the macroscopic level we show that iterating lossy mappings results in an increase of a quantity we call total imbalance. We quantify the increase in total imbalance as a function of the number of iterations and of round mapping characteristics. At the microscopic level we show that the imbalance of a parity located in some round, dubbed final, is the sum of distinct terms. Each of these terms consists of the imbalance of a parity located at the output of a round, multiplied by the sum of the correlation contributions of all linear trails between that parity and the final parity. We illustrate our theory with experimental data. The developed theory can be applied whenever lossy mappings are repeatedly applied to a state. This is the case in many modes of block ciphers and permutations for, e.g., iterated hashing or self-synchronizing stream encryption. The main reason why we have developed it however, is for applying it to study the security implications of using non-uniform threshold schemes as countermeasure against differential power and electromagnetic analysis.

Since the vulnerability of cryptosystems to differential power analysis (DPA) was reported in 1999, various power analysis attacks and corresponding countermeasures have been studied. With the scaling down of supply voltage and CMOS technology below 90 nm, leakage power plays an increasing role in the overall power dissipation. Future cryptosystems need to address this trend, though it has not been of concern yet in low- cost cryptosystems such as smartcards and RFED tags which currently use older technologies and low performance transistors. In this paper, we explore the impact of leakage power on conventional DPA and the feasibility of a novel leakage-based DPA (LDPA). We first use SPICE simulations to explore the leakage dependence on input patterns of logic gates implemented in 90 nm, 65 nm, and 45 nm CMOS technologies. Then we simulate a successful LDPA on a subset of a DES cryptosystem with only 120 rounds, in contrast to the 200 rounds reported for a conventional DPA in 180 nm technology. Furthermore, we demonstrate how even a DES implementation using a DPA-resistant logic style can be broken with LDPA in 2000 rounds, compared with the conventional DPA using more than 5000 rounds.

The LSI design methodology against Differential Power Analysis (DPA) is important to realize a tamper-resistant cryptographic circuit. In order to verify the DPA resistance before ASIC fabrication, the DPA verification using FPGA is commonly used. However, power traces of ASIC differ from that of FPGA, so the DPA verification on FPGA cannot guarantee the DPA resistance on ASIC. On the other hand, it takes extremely long time to collect the simulated power traces using post-layout netlists of ASIC. Hence, the DPA-resistance verification method using smaller number of power traces is demanded. In this paper, we propose Equivalent Byte Method (EBM) which synchronizes the operation on all Substitution Boxes (S-Boxes) at the attacking round by controlling the plaintexts and the keys. In EBM, the power-consumption profiles of S-Boxes are emphasized by each other, and then the DPA analysis for a correct key is easily distinguished with smaller number of traces. In order to demonstrate the effectiveness of the proposed EBM, AES circuits using DPA-resistant techniques of WDDL and MDPL are implemented on FPGA. As a result, EBM revealed DPA-leak with 1/1000 ~ 1/50 power traces required for the general statistical method.

Differential power analysis (DPA) has been shown to be an effective attack on cryptographic systems capable of releaving secret data by measuring power consumption. DPA resistant circuits currently experience severe problems in terms of performance, area, and power. Although different countermeasures to reduce DPA attacks have been proposed and implemented in general, such protections do not make attacks infeasible. Additionally, most are dual rail logic families, Delay Based Dual Rail Precharge Logic (DDPL) with high resistance is presented and significantly lower overheads in performance, area, and power than other DPA resistant logic styles. The Delay Based Dual Rail Precharge Logic (DDPL) shows a certain improvement in Normalized Energy Deviation(NED) with respect to other dual rail logics.

In recent years, power analysis attacks have caused increasingly serious security threats on cryptographicalgorithm, to solve this problem different researcher has put forward many solutions, and among them the fixed value masking technology is one of the mostly used due to its lower cost and faster speed. Both theoretical and practical results have shown that the masking method has a good resistance to differential power analysis (DPA) attack. So based on the in-depth study of fixed masking technology, this paper proposed a second order DPA attack (SODPA) with the help of a pre-processing treatment. In the end, we implemented this attack on a fixed value masked AES encryption algorithm running in Mega16. The experimental result shows that, if the mask value is unknown, ordinary DPA cannot recover the right key, while the second order DPA only needs about 500 power curves to get the correct key. In the meantime, the differences between right and wrong keys are very obvious, which strongly proved the validity and practicability of our method.

Cryptographic implementation is one of the vital applications for FPGAs with security as its major standpoint. But it still requires a lot of efforts to keep it aloof from attacks like Side Channel Attacks (SCA). One of the major attacks that threaten the security of FPGA implementation of cryptographic algorithm is Differential Power Analysis (DPA). In this paper, we have discussed various approaches to defend against DPAs. These new programs suggested in the different approaches with some results aid in evenly distributing the power consumption in FPGAs making it less prone to DPAs.

Cryptographic systems can potentially suffer from various attacks which are a consequence of vulnearability of side channel information to analysis attacks. The nature of digital circuits is prone to electromagnetic and power analysis (EMA and PA) attacks. Interconnects in cryptographic circuits emanate information through electromagnetic signals which can be exploited using EMA. Complementary Metal Oxide Semiconductor (CMOS) circuits are vulnearable to leak of computational information through leakage and dynamic power consumption. Dynamic power consumption of cryptographic engines is a rich source to sink in the data under process. The hardware implementation of cryptographic algorithms undermine the security of encrypted system against non brute-force-attacks. The attackers collect and analyse the leakage information of cryptographic circuits to detect the secrete key. The parameters sensitivity of the device and circuits make the cryptographic engines vulnearable to fault injection and inherent inconsistency of the circuits. Dynamic and static power comprise two major components of power consumption of digital circuits. Both power components vary with data under process. This exhibits power consumption has data dependency in digital circuits. To make noisy power profile, various countermeasures have been proposed against Differential Power Analysis (DPA) attacks. In this research, false glitch cells is proposed to work as a countermeasure to generate random transitions and power spikes to scramble power profile. The mathematical foundation of security implications of false glitch cells against Correlation Power Analysis (CPA) attacks is investigated. Moreoever, the security efficiency of utilizing false glitch cells is verified with different metrics.

On two DES implementations secure against differential power analysis in smart-cards

Method of measuring the amounts of electromagnetic radiation absorbed and controlled by metamaterials in anechoic chamber