Side channels as building blocks

Physical attacks on cryptographic circuits were first identified in the late 1990s. These types of attacks, which are still considered very powerful, are generally classified into two main categories: “fault attacks” and “side-channel attacks.” To secure circuits against such attacks, it is crucial to develop appropriate methods and tools that enable accurate estimates of the protection mechanism’s effectiveness. Numerous studies have described such methods and tools but, to the best of our knowledge, these previous investigations have considered side-channel attacks or fault attacks but not the combination of the two types. The present article proposes a combined investigation of both main types of attack by describing them with the same terminology and the same algorithm. This approach is made possible by introducing the concept of “physical functions” as an extension of the concept of “leakage functions,” which are widely used in the side-channel community. The paper represents a first step toward applying the strong theoretical background developed for side-channel attacks to the investigation of fault attacks. Besides, the proposed approach could potentially make it easier to combine side-channel attacks with fault attacks, which could certainly facilitate the discovery of new attack paths.

Digital security practitioners are facing enormous challenge in face of the growing repertoire of physical attacks, e.g., Side Channel Attack (SCA) and Fault Injection Attack (FIA). Countermeasures to such threats are usually very different in nature and come with a significant performance penalty. While the FIA countermeasures rely on fault-detecting sensors or concurrent error detection schemes, SCA countermeasures are based on data masking or dual-rail logic circuits. Recently, a low-overhead FIA countermeasure has been proposed that utilises a ring oscillator circuit with Phase-Locked Loop (PLL). In this paper, we extend that countermeasure to further provide protection against SCA, thereby proposing PLL based Protection Against Physical attacks (PPAP). We demonstrate the PPAP on an FPGA prototype under rigorous SCA and FIA testing. We evaluate SCA resistance using the TVLA metric and observe a 2000x increase in SCA protection (in terms of number of traces) with PPAP. We further improve the security of PPAP using statistical analysis through an improved PPAP design (iPPAP) with an increase in SCA resistance of at least 5000x compared to the unprotected implementation with a minimal area overhead.

With the globalization of the manufacturing supply chain, the malicious modification existing in the middle of distrust is becoming an important security issue on the chip. These modifications are called hardware Trojan (HT). HT is difficult to detect due to its high concealment and diversity of implementation. HT detection based on the side channel is a relatively effective detection method because it does not need to trigger the Trojan or destroy the chip. However, detection based on the side channel faces two major challenges. Firstly, the side channel detection is quite dependent on the golden model. The second one relates to the accuracy of the samples. Side channel information of the chip comes from the hardware manufacturing process and implementation, so it is obviously affected by process variation. In the existing work, many self-reference detection methods have been proposed to solve the problem of missing golden models. However, the existing methods often have special requirements for the circuit structure (such as the need for self-similar structures in the circuit). And, they can hardly resist process variation. This paper combines design and detection. We select the power consumption generated at different times and construct two self-reference ‘knapsack’ to detect HT. The solution proposed in this article is a kind of self-reference method, but we need neither self-similar structures nor the same state of some clocks in the circuit. Meanwhile, by constructing the ‘knapsack,’ we reduce the impact of process variation on detection accuracy because the process variation in the two sets of power consumption is balanced.

In recent years, Hardware Trojans (HT)have become an increasing concern due to outsourcing the manufacturing of Implantable Medical Devices (IMDs). Power Analysis based Side-Channel Attack (SCA)is one of the main methods of detecting HT in IMDs. However, using SCA in detecting trojans is limited by the large process variation effects in IC technology which has reduced detection sensitivity of ultra-small trojans. Along with the safety of IMDs against HTs, the need for power management has also risen in parallel with the increasing complexity of IMDs. In this paper, we are analyzing the usefulness of Differential Power Analysis (DPA)resistant adiabatic logic gates to detect smaller trojans. DPA resistant adiabatic logic gates consume uniform power irrespective of input data transition and also consume lower power compared to conventional CMOS logic gates. When the HT is triggered in the DPA resistant circuits, the circuit will have non-uniform power consumption which will help us to easily identify HTs. In order to validate our proposed methodology, we have implemented a C17 and a carry save adder using a recently proposed DPA resistant adiabatic logic family called Energy-Efficient Secure Positive Feedback Adiabatic Logic Family (EE-SPFAL). Further, in order to calculate the true energy-efficiency of the EE-SPFAL logic, we have proposed a four phase Power Clock Generator (PCG)and integrated with the EE-SPFAL logic circuits. Simulations are performed in Cadence Spectre using 180nm CMOS technology. From our simulations, we have observed the non-uniform power consumption, during the activation of HT, in EE-SPFAL based C17 and carry save adder circuit. Further, EE-SPFAL based C17 and carry save adder along with its PCG consume 25.8% and 31.4% of less power as compared to the conventional CMOS based C17 and carry save adder respectively.

Researchers are exploring the use of convolutional neural networks (CNNs) in side-channel attacks to understand the weaknesses in cryptographic implementation. CNNs can learn hierarchical characteristics automatically from electromagnetic radiation or power usage during cryptographic processes. Researchers train CNNs on side-channel data to extract meaningful representations and deduce secret keys. Deep learning algorithms are helpful in evaluating the security of embedded systems, and CNNs are a feasible paradigm for profiling side-channel analysis attacks. In this paper, it has been introduced a VGG (Visual Geometry Group)-Net architecture, which is a typical deep convolutional neural network design with numerous layers. It uses the ASCAD dataset to conduct experiments. They found that VGG-Net architecture Side Channel Attacks (SCA) provides better results than the previously optimized CNN model by significantly reducing the number of side-channel traces required for successful attacks on desynchronized datasets. The researchers also discovered that synchronous traces serve as the pre-training source for VGG-Net architecture, functioning successfully in terms of jittering with minimal fine-adjusting after training

Computers are complicated, and the security of modern software often depends on programmers anticipating and mitigating a dizzying assortment of vulnerability classes. Both researchers and adversaries continue to add additional complications based on hardware behavior to this mix, such as data-dependant power consumption, fault injection, cache timing attacks and transient execution - adding new attack surface which needs to be taken into account when building secure systems. In this dissertation, we look beyond the traditional attack surface, and find that many mitigations - across a variety of layers, from hardware to software - are compromised by faulty assumptions about the actual behavior of hardware. We begin close to the hardware, discovering that the relationship between two different forms of hardware attack - Fault Injection and Side-Channel Analysis - is so strong that we can find ways to apply power side-channel attack techniques directly to the results of voltage fault injection campaigns, without the need for an attacker to obtain power measurements. Next, we move to microarchitectural attacks - which rely on hardware behavior, but can be performed by software. By combining transient execution with unexpected - and unintended - CPU pipeline behavior, we show that the scope of software side-channel attacks can be expanded far beyond previous work, allowing both in-flight and 'stale' data to be stolen from the pipeline by an attacker, bypassing software mitigations by ignoring security domains entirely. Such attacks can be mitigated by isolating workloads on different cores - which do not share a pipeline. Unfortunately, we find that even this level of isolation can fail to prevent attackers from being able to leak critical data using side-channel attacks - such as random numbers used when generating cryptographic keys. Hence, these attacks must be mitigated in hardware. Finally, we investigate defenses against transient execution attacks such as Spectre which depend only on well-understood hardware behavior, but require software mitigations. We show that we can build efficient and practical software-based defenses which not only mitigate many Spectre attacks, but even harden software against architectural information leaks.

Integrated Circuits (ICs) are suffering severer threats caused by Hardware Trojans (HTs), some of which hide in routine operations by coercing firmware or hardware. Along with conventional side-channel detection not always getting golden-chip, HTs become more difficult to detect. An improved Support Vector Machine (SVM) machine learning frameworks for this is proposed using system-level side-channel analysis. Cross validation experimental results on Field Programmable Gate Array (FPGA) show that in the condition of golden-chip, supervised SVM achieves 85.8% test accuracy in average. After grouping, outlier-removing and normalization, it rises by 4%. Even if golden-chip is out of hand, semi-supervised SVM has accuracy to judge HTs existence, averaging in 52.9%-79.5% under different test modes. Comparing with existing researches, this work verifies the efficiency of SVM for HT detection in instruction level, and points out the relationship between diversified learning conditions with detection performance.

Side Channel Attack (SCA) recovers secret information from an embedded device with implementation of cryptographic algorithm by exploiting its physical leakages. For most SCA methods to achieve good performance, the measured leakages are often desired to be well aligned. However, due to some specific reasons such as inaccurate measurements or carefully designed countermeasures, misalignment of leakages frequently occurs in practice. Misalignment significantly reduces the efficiency of SCA methods, or even makes them fail. To address this issue, two alignment approaches are proposed: a local alignment based on shotgun distance and a global alignment based on weighted edit distance . Compared with previous methods, the proposed methods are capable of keeping the secret dependant leakages, while not introducing any redundant information. In addition, the proposed methods could also reduce the negative effects of noise, which is another factor seriously decreasing the efficiency of SCA methods. Interestingly, it is pretty easy to set appropriate parameters for these two methods. Practical experiments show that the proposed methods outperform previous methods in three different circumstances and different noise levels.

The SASEBO-GIII board equipped with a 28-nm FPGA was developed for security evaluation against side-channel attacks (SCAs) and various other threats. SCAs are performed to extract a secret key inside a cryptographic module by analyzing its power consumption, electromagnetic radiation and other physical parameters. Since an increasing number of current consumer electronic devices provide hardware-accelerated cryptographic functionality for data encryption, device authentication, and so forth, SCAs are considered to be a serious problem in the electronics market. While previous SASEBO models mainly target SCA evaluation of a single cryptographic core, they are nevertheless insufficient for testing the security of integrated systems that consist of any combination of cryptographic, network, control and other modules. Providing high processing power with the latest Kintex-7 FPGA and considerable expandability with ANSI-standard FMC connectors, SASEBO-GIII is suitable for prototyping a wide variety of systems, such as home information appliances, content distribution systems and dynamic partial reconfiguration (DPR) systems, and offers a convenient environment for studying security issues in such integrated systems, for example, hardware trojans and counterfeit electronics. The configuration of the Kintex-7 FPGA is controlled by the other FPGA (Spartan-6), and therefore a user can verify the security of various types of device configuration processes, for example, DPR through ICAP or SelectMAP interfaces as well as though standard configuration interfaces such as BPI and JTAG. This paper presents the detailed architecture and features of SASEBO-GIII, and shows the results of an electromagnetic SCA attack against the standard AES block cipher implemented on the Kintex-7 FPGA.

Nowadays, an integrated circuit can carry many functions which make them more challenging to design and manufacture. The involvement of the third party is not unusual which can open the possibilities for unauthorized modification by inserting illegal block called hardware trojan to perform some malicious functions. This issue raises attention in the field of hardware security to prevent the insertion of the hardware trojan and to detect its presence in a chip. Side channel analysis is considered as a prospective method, although there are several difficulties encountered. In this paper, we will implement cryptographic hardware that can encrypt information using Advanced Encryption Standards (AES) in a Field Programmable Gate Arrays (FPGA). Then, this reference model is subjected to the implantation of hardware trojan designed to leak the AES key. By using the side channel analysis and by adjusting the behavior of the hardware trojan, we will try to detect its presence using conventional instruments available in our labs. In the end, we can conclude the possibility for the end customer to detect the existence of hardware trojan and the design techniques of hardware trojan to evade the detection.

In side channel attack (SCA) studies, it is widely believed that unprotected implementations leak information about the intermediate states of the internal cryptographic process. However, directly recovering the intermediate states is not common practice in today’s SCA study. Instead, most SCAs exploit the leakages in a “guess-and-determine” way, where they take a partial key guess, compute the corresponding intermediate states, then try to identify which one fits the observed leakages better. In this paper, we ask whether it is possible to take the other way around—directly learning the intermediate states from the side channel leakages. Under certain circumstances, we find that the intermediate states can be efficiently recovered with the well-studied Independent Component Analysis (ICA). Specifically, we propose several methods to convert the side channel leakages into effective ICA observations. For more robust recovery, we also present a specialized ICA algorithm which exploits the specific features of circuit signals. Experiments confirm the validity of our analysis in various circumstances, where most intermediate states can be correctly recovered with only a few hundred traces. Our approach brings new possibilities to the current SCA study, including building an alternative SCA distinguisher, directly attacking the middle encryption rounds and reverse engineering with fewer restrictions. Considering its potential in more advanced applications, we believe our ICA-based SCA deserves more research attention in the future study.

Attacks on cryptosystems implemented via VLSI: A review

IoT devices have very strong requirements on all the resources such as memory, randomness, energy and execution time. This paper proposes a number of scalable shuffling techniques as countermeasures against side channel analysis. Some extensions of an existing technique called Random Start Index (RSI) are suggested in this paper. Moreover, two new shuffling techniques Reverse Shuffle (RS) and Sweep Swap Shuffle (SSS) are described within their possible extensions. Extensions of RSI, RS and SSS might be implemented in a constrained environment with a small data and time overhead. Each of them might be implemented using different amount of randomness and thus, might be fine-tuned according to requirements and constraints of a cryptographic system such as time, memory, available number of random bits, etc. RSI, RS, SSS and their extensions are described using SubBytes operation of AES-128 block cipher as an example, but they might be used with different operations of AES as well as with other algorithms. This paper also analyses RSI, RS and SSS by comparing their properties such as number of total permutations that might be generated using a fixed number of random bits, data complexity, time overhead and evaluates their resistance against some known side-channel attacks such as correlation power analysis and template attack. Several of proposed shuffling schemes are implemented on a 8-bit microcontroller that uses them to shuffle the first and the last rounds of AES-128.

Designing a cryptographic algorithm requires to take into account various cryptanalytic threats. Since the 90’s, Side Channel Analysis (SCA) has become a major threat against cryptographic algorithms embedded on physical devices. Protecting implementation of ciphers against such attacks is a very dynamic topic of research and many countermeasures have been proposed to thwart these attacks. The most common countermeasure for block cipher implementations is masking, which randomizes the variables by combining them with one or several random values. In this paper, we propose to investigate the impact of the size of the words processed by an algorithm on the security against SCA. For this matter we describe two AES-like algorithms operating respectively on 4 and 16-bit words. We then compare them with the regular AES (8 bits) both in terms of complexity and security with respect to various masking schemes. Our results show that SCA is a determinant criterion for algorithms design and that cryptographers may have various possibilities depending on their security and complexity requirements.

The RSA cryptographic algorithm is a security tool that has achieved long cryptographic and market maturity. However, after the discovery and wide spread of Side Channel Attacks (SCA), RSA implementations are susceptible to a variety of different attacks that target the hardware structure rather than the algorithm itself. While there are a wide range of countermeasures that can be applied on the RSA structure in order to protect the algorithm from specific SCA categories, combining several such measures to produce an "all in one" SCA resistant RSA structure is not an easy endeavor. Several incompatibility issues between combined SCA protection methods lead to new SCA vulnerabilities. In this paper, we evaluate some very popular and potent SCAs against RSA, like Fault attacks (FA), Simple Power attacks (SPA), Doubling attacks (DA) and Differential Power attacks (DPA), and propose an SCA protection scheme for RSA based on Chinese Remainder Theorem (CRT) that can thwart them. The proposed scheme uses a square and always multiply approach in combination with the message blinding technique in such a way that possible vulnerabilities that may rise from this combination can no longer apply. The proposed scheme is evaluated against specific SCAs and is found to be very secure. From performance point of view, the proposed scheme favors parallelism and can calculate an RSA result with small time delay.