Tamper Resistance Verification Method for Consumer Security Products

Aimed at improving the resistance against power analysis attacks, a systematic and architectural design approach for multicore processors is proposed in this article and is demonstrated in an eight-core prototype platform with low performance overhead and hardware cost. In order to introduce randomness in both the time dimension and the amplitude dimension and make realignment extremely difficult, the proposed multicore platform leverages several methods together, such as random task scheduling (RTS), random insertion of operations (RIO), and frequency and phase randomization (FPR). Moreover, a power state monitoring and control (PSMC) scheme is proposed to defend against power analysis attacks by keeping enough background noises. A test chip of the proposed multicore processor is fabricated in Taiwan Semiconductor Manufacturing Company (TSMC) 65-nm CMOS LP technology and can operate at up to 800 MHz with a 1.2-V supply. The Advanced Encryption Standard (AES) algorithm with these randomization methods is implemented on the processor. Measurement results show that the correlation power analysis (CPA) attacks and the power analysis attacks based on convolutional neural networks (CNNs) are unsuccessful even with 2 000 000 power traces when all the countermeasures are used.

Cryptographic devices with the Advanced Encryption Standard (AES) encryption algorithm are vulnerable to side channel attack, in particular, differential power analysis (DPA). Differential power analysis can be used to reveal the secret key in AES by monitoring the power consumption of the internal circuit and applying statistical processing. In this paper, an evaluation of power analysis attacks of six different AES Sbox designs, namely sum of product (SOP), product of sum (POS), table lookup (TBL), composite field (CF), positive polarity Reed-Miller (PPRM) and 3 stages PPRM, is presented. Comparison of the different AES Sbox implementations in terms of size, performance and SNR analysis is also performed. The results show that the composite field Sbox design is more resistant to attack and smaller than other Sbox designs but operates at a slower speed. This paper also presents a Random Clock mechanism that can be used to increase the resistance of the AES composite field Sbox design to power analysis attack by reducing the overall SNR by 78%.

Cryptographic systems can potentially suffer from various attacks which are a consequence of vulnearability of side channel information to analysis attacks. The nature of digital circuits is prone to electromagnetic and power analysis (EMA and PA) attacks. Interconnects in cryptographic circuits emanate information through electromagnetic signals which can be exploited using EMA. Complementary Metal Oxide Semiconductor (CMOS) circuits are vulnearable to leak of computational information through leakage and dynamic power consumption. Dynamic power consumption of cryptographic engines is a rich source to sink in the data under process. The hardware implementation of cryptographic algorithms undermine the security of encrypted system against non brute-force-attacks. The attackers collect and analyse the leakage information of cryptographic circuits to detect the secrete key. The parameters sensitivity of the device and circuits make the cryptographic engines vulnearable to fault injection and inherent inconsistency of the circuits. Dynamic and static power comprise two major components of power consumption of digital circuits. Both power components vary with data under process. This exhibits power consumption has data dependency in digital circuits. To make noisy power profile, various countermeasures have been proposed against Differential Power Analysis (DPA) attacks. In this research, false glitch cells is proposed to work as a countermeasure to generate random transitions and power spikes to scramble power profile. The mathematical foundation of security implications of false glitch cells against Correlation Power Analysis (CPA) attacks is investigated. Moreoever, the security efficiency of utilizing false glitch cells is verified with different metrics.

Smart cards, such as credit cards and cash cards, protect confidential information using cryptographic circuits. Since cryptographic circuits protect confidential information, various attacks often target cryptographic circuits. To attack cryptographic circuits, a method called side-channel attacks has been reported. Side-channel attacks reveal cipher keys by intentionally mixing faults in a cryptographic circuit or by measuring the power consumption of a cryptographic circuit during its operation. A method using a back-check system was reported as a typical countermeasure of the advanced encryption standard (AES) against a fault analysis attack which uses a cryptogram with faults and a correct cryptogram. This study proposes a new power analysis method against a countermeasure with the back-check system. The proposed method utilizes the circuit structure of back-check system for the analysis. To our knowledge, this is the first power analysis attack against countermeasure of fault analysis attack. Experiments using a LSI prove the validity of the proposed method.

Power analysis attacks pose a significant threat to the security of cryptographic devices as they can reveal a secret key. Performing cryptographic operations based on a randomly varying clock (RVC) is a practical countermeasure against such attacks. The countermeasure makes it difficult to align power traces, which is a prerequisite for power analysis attacks to succeed. This paper introduces a synchronous real-time sampling (SRTS) technique as an advanced hardware-implemented approach to collect traces for a power analysis attack that negates countermeasures involving practical RVCs. By recovering the RVC, the leakage signal corresponding to the recovered clock edge is synchronously sampled in real time. We propose an analog-based hardware system implemented with two circuit blocks for SRTS operations, namely, a clock recovery block and an analog signal-processing block. The target of the power analysis attack is an Advanced Encryption Standard (AES)-128 software-implemented smart card operated at 20 MHz, which is varied in the range of 30% by the RVC countermeasure. The traces captured by the SRTS show that the suboperations of the AES encryption are distinct in contrast to the indistinguishable waveforms captured at a fixed sample rate. The results of the power analysis attack demonstrate that the correct key is successfully extracted with a high correlation coefficient at the S-box output of the AES. The proposed SRTS method improves the relative distinguishing margin by 191.4% and reduces the required number of traces to 2.75% compared with the conventional correlation power analysis attack with a fixed sample clock.

Fully depleted silicon-on-insulator (FD-SOI) technology is renowned for its back-gate bias voltage controllability. It allows devices fabricated with FD-SOI technology to be optimized for low power consumption or high performance with proper back-gate biases, depending on the required application. This article proposes using the back-gate biasing technique in novel countermeasures against power analysis attacks. Theoretical explanations are discussed, and realistic differential power analysis (DPA) attacks, targeting AES-128 encryption on a 65-nm STOB 32-bit RISC-V microcontroller, are conducted to justify the proposed idea. The experimental results show that when compared with applying no bias, applying our first proposal, which involves using forward back-gate bias, not only improves the test device performance but also enhances its resistance to DPA attacks. Moreover, vulnerability to DPA attacks is kept unchanged when a reverse back-gate bias is applied to achieve low power consumption. The DPA resistance is even more vital when combining the back-gate bias technique with a lower supply voltage. The number of power traces required to retrieve the secret key successfully increases by 14.5 times in the best case. Even better DPA resistance can be obtained when the back-gate bias of the targeted microcontroller is dynamically randomized, as suggested by our second proposal of a random dynamic back-gate bias (RDBB). When RDBB is applied, the number of power traces required to retrieve the secret key successfully significantly increases by 33.4 times.

In modern society, cryptographic algorithms that guarantee the integrity of data have been used in various fields while being secured through various research. However, since the encryption algorithms are mostly used in the computer environment, there is a difference in the amount of leakage current depending on all calculation results. A power analysis attack is a method that utilizes a difference in leakage current and is effective in attack of a cryptographic algorithm. Therefore, we propose the structure of AES encryption algorithm to cope with power analysis attack by randomizing input using scrambler so that attacker cannot input arbitrary initial value and secret key.

Encryption chips are specialized integrated circuits that incorporate encryption algorithms for data encryption and decryption, ensuring data confidentiality and security. In China, the domestic SM4 algorithm is commonly utilized, as opposed to the international AES encryption algorithm. These widely implemented encryption standards have been proven to be difficult to crack through crypt analysis methods Currently, power consumption side-channel attacks are the most prevalent method. They involve capturing power consumption data during the encryption process and subsequently recovering the encryption key from this data. The two leading methods are Differential Power Analysis (DPA) and machine learning techniques. DPA does not necessitate prior knowledge but relies heavily on the number of power consumption curves. With only 50 power consumption data points, the accuracy is a mere 80%. Machine learning methods require prior knowledge, achieving an accuracy rate above 95% with only 30 power traces, albeit with training times typically exceeding 15 min. In this paper, a distributed energy analysis attack approach was presented based on Correlation Power Analysis (CPA). The power consumption data was divided into 16 subsets, with each subset corresponding to 8 bytes of the key. By training each subset separately, the 8-byte key’s corresponding power consumption data is reduced to only 100 dimensions, resulting in a 76% decrease in cracking time and a 3% improvement in cracking accuracy rate.This article also trains a more complex 256 classification model to directly crack the final key, achieving a success rate of 28% in cracking 128-bit passwords with only 1 power trace

Advanced Encryption Standard (AES) is the most popular symmetric encryption method, which encrypts streams of data by using symmetric keys. The current preferable AES architectures employ effective methods to achieve two important goals: protection against power analysis attacks and high-throughput. Based on a different architectural point of view, we implement a particular parallel architecture for the latter goal, which is capable of implementing a more efficient pipelining in field-programmable gate array (FPGA). In this regard, all intermediate registers which have a role for unrolling the main loop will be removed. Also, instead of unrolling the main loop of AES algorithm, we implement pipelining structure by replicating nonpipelined AES architectures and using an auto-assigner mechanism for each AES block. By implementing the new pipelined architecture, we achieve two valuable advantages: (a) solving single point of failure problem when one of the replicated parts is faulty and (b) deploying the proposed design as a fault tolerant AES architecture. In addition, we put emphasis on area optimization for all four AES main functions to reduce the overhead associated with AES block replication. The simulation results show that the maximum frequency of our proposed AES architecture is 675.62[Formula: see text]MHz, and for AES128 the throughput is 86.5[Formula: see text]Gbps which is 30.9% better than its closest existing competitor.

Power analysis attacks (PAAs), a class of side-channel attacks based on power consumption measurements, are a major concern in the protection of secret data stored in cryptographic devices. In this paper, we introduce the secure double rate registers (SDRRs) as a register-transfer level (RTL) countermeasure to increase the security of cryptographic devices against PAAs. We exploit the SDRR in a conventional advanced encryption standard (AES)-128 architecture, improving the immunity of the cryptographic hardware to the state-of-the-art PAAs. In the AES-128 exploiting SDRR, the combinational path evaluates random data throughout the entire clock cycle, and the interleaved processing of random and real data ensures the protection of both combinational and sequential logics. Our technique does not require the duplication of the combinational path to process the random data, thus limiting area overhead, unlike previous RTL countermeasures. The proposed approach is validated by means of PAAs based on real measurements on a field-programmable gate array implementation and on a 65-nm CMOS prototype chip. The protected implementation shows a strongly reduced correlation coefficient for the correct key, and more than three orders of magnitude increase in the measurements to disclosure with respect to the unprotected AES-128.

This paper presents UCloD, a novel random clock delay-based robust and scalable countermeasure against recently discovered remote power analysis (RPA) attacks. UCloD deploys very small clock delays (in the picosecond range) generated using the tapped delays lines (TDLs) to mitigate RPA attacks. UCloD provides the most robust countermeasures demonstrated thus far against RPA attacks. RPA attacks use delay sensors, such as Time to Digital Converters (TDC) or Ring Oscillators (ROs) to measure voltage fluctuations occurring in power delivery networks (PDNs) of Field Programmable Gate Arrays (FPGAs). These voltage fluctuations reveal secret information, such as secret keys of cryptographic circuits. The only countermeasure proposed thus far activates ROs to consume significant power and has managed to secure Advanced Encryption Standard (AES) circuits for up to 300,000 encryptions. Using TDLs available in FPGAs, UCloD randomly varies the clock to the cryptographic circuits under attack to induce noise in the adversary’s delay sensor(s). We demonstrate correlation power analysis (referred to as CPA) attack resistance of UCloD AES implementations for up to one million encryptions. Compared to an unprotected AES circuit, UCloD implementations have minimal overheads (0.2% Slice LUT overhead and 4.8% Slice register overhead for Xilinx implementations and 0.5% LogicCells overhead for Lattice Semiconductor implementations).

Side channel attack (SCA) requires millions of dynamic power current waveforms in cryptographic VLSI circuits. The capacitor charging modeling captures the time evolution of logical activities in the cryptographic operation of an Advanced Encryption Standard (AES) core and efficiently represents the amount of charges consumed during operation. This approach significantly reduces the complexity of power current simulation, and accomplishes acceleration by a factor of 220 or larger over the traditional transistor-level circuit simulation. The correlated power analysis (CPA) attack against AES cores is successfully simulated with a conventional SPICE simulator, with the models individually derived for 10,000 different cipher texts. The simulation-based SCA efficiently evaluates the vulnerability of AES cores in a variety of logical realizations as well as in different technology nodes.

In recent years, power analysis attacks have caused increasingly serious security threats on cryptographicalgorithm, to solve this problem different researcher has put forward many solutions, and among them the fixed value masking technology is one of the mostly used due to its lower cost and faster speed. Both theoretical and practical results have shown that the masking method has a good resistance to differential power analysis (DPA) attack. So based on the in-depth study of fixed masking technology, this paper proposed a second order DPA attack (SODPA) with the help of a pre-processing treatment. In the end, we implemented this attack on a fixed value masked AES encryption algorithm running in Mega16. The experimental result shows that, if the mask value is unknown, ordinary DPA cannot recover the right key, while the second order DPA only needs about 500 power curves to get the correct key. In the meantime, the differences between right and wrong keys are very obvious, which strongly proved the validity and practicability of our method.

With the advancement of IoT edge devices, the threat to sensitive data processed at these devices is increasing. This research aims to enhance processor’s built-in resilience against power analysis attacks (PAA) by expanding pipeline stages, employing diverse pipeline techniques, and integrating additional features. The paper proposes 32-bit RISC-V core micro-architectures with inbuilt cryptographic capabilities, extending the RISC-V ISA with custom AES instructions to reduce energy consumption, code size, and encryption time compared to software AES solutions. An area-efficient 128-bit, 12-clock AES based on the Masoleh S-box is integrated into the RISC-V core, resulting in low area and power overheads. Two cores are presented: Core1, a 3-stage pipelined core with a software pause, and Core2, a 4-stage pipelined core with a hardware pause for securing data with AES instructions. Despite their vulnerabilities, the integration of AES with RISC-V architecture significantly improves their intrinsic resilience against PAA. This work analyses the vulnerability and improvement in intrinsic resilience of these cores to side-channel attacks, the impact of hardware versus software pause and the effect of pipeline stages on security metrics. The proposed designs are validated on a Xilinx Basys3 FPGA and developed in UMC 65 nm technology node. Power traces generated during AES encryption are extracted using Synopsys PrimeTime PX and analyzed with a MATLAB power attack model to successfully recover all key bytes. Core1 and Core2 achieved higher throughput of <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$2.02\times $ </tex-math></inline-formula> and <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$2.83\times $ </tex-math></inline-formula>, respectively, than the Arm CryptoCell312. Core2’s added circuits for hardware pause and increased number of pipeline stages significantly boost performance and enhance security against power attacks, with only a modest increase in area and power consumption.

Emerging technologies such as Spin-transfer torque magnetic random-access memory (STT-MRAM) are considered potential candidates for implementing low-power, high density storage systems. The vulnerability of such nonvolatile memory (NVM) based cryptosystems to standard side-channel attacks must be thoroughly assessed before deploying them in practice. In this paper, we outline a generic Correlation Power Analysis (CPA) attack strategy against STT-MRAM based cryptographic designs using a new power model. In our proposed attack methodology, an adversary exploits the power consumption patterns during the write operation of an STT-MRAM based cryptographic implementation to successfully retrieve the secret key. In order to validate our proposed attack technique, we mounted a CPA attack on MICKEY-128 2.0 stream cipher design consisting of STT-MRAM cells with Magnetic Tunnel Junctions (MTJs) as storage elements. The results of the experiments show that the STT-MRAM based implementation of the cipher circuit is susceptible to standard differential power analysis attack strategy provided a suitable hypothetical power model (such as the one proposed in this paper) is selected. In addition, we also investigated the effectiveness of state-of-the-art side-channel attack countermeasures for MRAMs and found that our proposed scheme is able to break such protected implementations as well.