Uncertainty Analysis in Cryptographic Key Recovery for Machine Learning-Based Power Measurements Attacks

Side-channel attacks (SCAs) using deep learning techniques have been mainly reported as profiled attacks, but in TCHES 2019, differential deep learning analysis (DDLA) was proposed by Timon as a non-profiled attack. In this attack method, deep learning models for all candidate keys are trained, and the key corresponding to the most suitable learning metrics such as loss and accuracy is assumed to be the correct key. Timon focused on a single bit (least significant bit (LSB) or most significant bit (MSB)) of the intermediate value during the operation of the cryptographic circuit and successfully revealed the correct key against the software implementation of the advanced encryption standard (AES). However, when we applied this method to our hardware implementation, we could not reveal all partial keys due to the existence of registers whose Hamming distance (HD) leakage is difficult to observe. In this paper, we propose a multi-bit DDLA that focuses on all bits to solve this problem. When a DDLA was performed on the hardware implemented AES without SCA countermeasures, the HD-ID labels, which had been used as a conventional profiled type DL-SCA method focusing on 8 bits, cannot reveal the 0, 4, 8, and 12th byte keys, but the proposed multi-bit method succeeds in revealing all key bytes. On the other hand, compared to correlated power analysis (CPA) which is a typical non-profiled attack that does not use deep learning, the number of waveforms required to reveal all keys is 1.6 times higher, so the DDLA with our proposed method is not so useful to the target without SCA countermeasures. Thus, we also evaluated the proposed method against FPGA-implemented RSM-AES and WDDL-AES, which have some resistance to SCA, and successfully revealed all keys against RSM and WDDL with 100,000 and 50,000 waveforms, respectively. This is a significant improvement over conventional CPA, which reveals less than half of the key bytes despite using twice as many waveforms as the proposed method. These results suggest that multi-bit DDLA is effective on non-profiled attacks against hardware-implemented AES circuit with SCA countermeasures.

We evaluate the vulnerability of a pipelined Advanced Encryption Standard (AES) against Correlation Power Analysis (CPA) Side-Channel Attack (SCA). We identify that the registers in pipelined AES are most vulnerable against CPA SCA and propose a new power model targeting the switching activities of the registers. The proposed power model is constructed based on the Hamming Distance (HD) between the intermediate values stored in the registers in two consecutive clock cycles. Then, we analyze the vulnerability of pipelined AES under two scenarios. First, during regular pipeline operation where the device is performing AES pipeline operation. Second, in non-pipeline operation where we assume the adversaries can insert delay to the input of the device to increase the signal to noise ratio of the physical leakage information. The simulation results show that under regular pipelined operation, our proposed power model can reveal all the 16 key bytes in less than 4,900 traces, resulting in 4.7× more effective than the conventional power models. Under non-pipelined operation, our proposed power model requires only 590 traces to reveal all the 16 key bytes, which is 5.9× more effective than other power models.

Graphics Processing Units (GPUs) have been used to run a range of cryptographic algorithms. The main reason to choose a GPU is to accelerate the encryption/decryption speed. Since GPUs are mainly used for graphics rendering, and only recently have they become a fully-programmable parallel computing device, there has been little attention paid to their vulnerability to side-channel attacks. In this paper we present a study of side-channel vulnerability on a state-of-the-art graphics processor. To the best of our knowledge, this is the first work that attempts to extract the secret key of a block cipher implemented to run on a GPU. We present a side-channel power analysis methodology to extract all of the last round key bytes of a CUDA AES (Advanced Encryption Standard) implementation run on an NVIDIA TESLA GPU. We describe how we capture power traces and evaluate the power consumption of a GPU. We then construct an appropriate power model for the GPU. We propose effective methods to sample and process the GPU power traces so that we can recover the secret key of AES. Our results show that parallel computing hardware systems such as a GPU are highly vulnerable targets to power-based side-channel attacks, and need to be hardened against side-channel threats.

With the advancement of IoT edge devices, the threat to sensitive data processed at these devices is increasing. This research aims to enhance processor’s built-in resilience against power analysis attacks (PAA) by expanding pipeline stages, employing diverse pipeline techniques, and integrating additional features. The paper proposes 32-bit RISC-V core micro-architectures with inbuilt cryptographic capabilities, extending the RISC-V ISA with custom AES instructions to reduce energy consumption, code size, and encryption time compared to software AES solutions. An area-efficient 128-bit, 12-clock AES based on the Masoleh S-box is integrated into the RISC-V core, resulting in low area and power overheads. Two cores are presented: Core1, a 3-stage pipelined core with a software pause, and Core2, a 4-stage pipelined core with a hardware pause for securing data with AES instructions. Despite their vulnerabilities, the integration of AES with RISC-V architecture significantly improves their intrinsic resilience against PAA. This work analyses the vulnerability and improvement in intrinsic resilience of these cores to side-channel attacks, the impact of hardware versus software pause and the effect of pipeline stages on security metrics. The proposed designs are validated on a Xilinx Basys3 FPGA and developed in UMC 65 nm technology node. Power traces generated during AES encryption are extracted using Synopsys PrimeTime PX and analyzed with a MATLAB power attack model to successfully recover all key bytes. Core1 and Core2 achieved higher throughput of <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$2.02\times $ </tex-math></inline-formula> and <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$2.83\times $ </tex-math></inline-formula>, respectively, than the Arm CryptoCell312. Core2’s added circuits for hardware pause and increased number of pipeline stages significantly boost performance and enhance security against power attacks, with only a modest increase in area and power consumption.

Side channel attack (SCA) requires millions of dynamic power current waveforms in cryptographic VLSI circuits. The capacitor charging modeling captures the time evolution of logical activities in the cryptographic operation of an Advanced Encryption Standard (AES) core and efficiently represents the amount of charges consumed during operation. This approach significantly reduces the complexity of power current simulation, and accomplishes acceleration by a factor of 220 or larger over the traditional transistor-level circuit simulation. The correlated power analysis (CPA) attack against AES cores is successfully simulated with a conventional SPICE simulator, with the models individually derived for 10,000 different cipher texts. The simulation-based SCA efficiently evaluates the vulnerability of AES cores in a variety of logical realizations as well as in different technology nodes.

In this work, we first present a low-cost, anomaly-based semi-supervised approach, which is instrumental in detecting the presence of ongoing side-channel attacks at runtime. We are, in particular, concerned with attacks that are carried out by creating intentional contentions in shared resources with cryptographic applications using a “spy” process. At a very high level, the approach quantifies contentions in shared resources, associates these contentions with processes, such as with a victim process, and issues a warning at runtime whenever the contentions reach a “suspicious” level. We then adapt this approach to detect the presence of four different types of cache-based side-channel attacks, namely prime-and-probe attacks on advanced encryption standard (AES), flush-and-reload attacks on AES and elliptic curve digital signature algorithm with Montgomery ladder algorithm, and Flush + Flush attacks on AES. To this end, we vary the shared resources monitored, the level of granularity at which the contentions in these resources are quantified, and the way the suspicious levels of contentions are detected. We evaluate the proposed approach also in cross-virtual machine setups (when applicable). The results of our experiments support our basic hypothesis that spy processes, which leverage information leaked by cryptographic applications through some shared resources, ironically leak information by themselves through the same or related channels, which can be analyzed to detect the presence of ongoing attacks at runtime.

Cryptographic algorithm implementations need to be secured against side-channel attacks. Correlation Power Analysis (CPA) is an efficient technique for recovering secret key bytes of a cryptographic algorithm implementation by analyzing the power traces of its execution. Although CPA usually does not require a lot of traces to recover secret key bytes, it is no longer true in a noisy environment, for which the required number of traces can be very high. Computation time can then become a major concern for performing this attack and assessing the robustness of an implementation against it.This article introduces FastCPA, which is a correlation computation targeting the same goal as regular CPA, but based on power consumption vectors indexed by plaintext values. The main advantage of FastCPA is its fast execution time compared to the regular CPA computation, especially when the number of traces is high: for 100,000 traces, the speedup factor varies from 70 to almost 200 depending on the number of samples.An analysis of FastCPA accuracy is made, based on the number of correct key bytes found with an increasing noise. This analysis shows that FastCPA performs similarly as the regular CPA for a high number of traces. The minimum required number of traces to get the correct key guess is also computed for 100,000 noisy traces and shows that FastCPA obtains similar results to those of regular CPA. Finally, although FastCPA is more sensitive to plaintext values than the regular CPA, it is shown that this aspect can be neglected for a high number of traces.

We propose a Multiplexer Look-Up-Table (MLUT) based Substitution-Box (S-Box) implementation for the Advanced Encryption Standard (AES) algorithm. There are two key features in the proposed MLUT based S-Box. First, it is implemented based on 256-byte to 1-byte multiplexer with a 256-byte memory instead of the conventional implementation of employing multiplication inversion in GF(28) and affine transformation. Thus, our proposed S-Box is simpler in circuit implementation and lower in power dissipation. Second, our S-Box is 30× more secured against the Side Channel Attack (SCA) based on Correlation Power Analysis (CPA), as our proposed S-Box exhibits smaller variance in its power dissipation profile for different processed data. Based on the measurement results of AES-128 implemented on the Sakura-X FPGA board, our proposed S-Box dissipates only 1.9mW and features 5.5× lower power than the conventional S-Box implementation. Our proposed MLUT S-Box design is also highly secured as the CPA attack on the AES with our proposed S-Box implementation requires 13540 power traces. This is significantly higher than the conventional S-Box which requires only 445 power traces to uncover the same secrete key.

The Advanced Encryption Standard (AES) remains a foundational component of modern cryptography, securing vast volumes of digital communication and data storage. Despite its robust design and widespread adoption, AES continues to be the subject of intensive cryptanalytic research. This paper presents a review of recent advances in attacks against AES, categorizing them into four domains: side-channel attacks, fault injection attacks, machine learning and AI-based attacks, and quantum computing threats. For each category, representative studies published between 2021 and 2025 are analyzed with respect to methodology, data requirements, attack complexity, and practical applicability. The review highlights both vulnerabilities exposed in specific AES implementations and the evolution of attack methodologies, thereby providing a comprehensive perspective on the contemporary threat landscape. The findings underscore the need for continuous evaluation and adaptation of AES-based systems to ensure cryptographic resilience in the face of advancing adversarial capabilities.

Security has been a primary concern for each type of network to provide secure communication among the users of different types of network. Presently, many techniques are present for providing security in networks but Advanced Encryption Standard (AES) has been proved to be the most prominent, keeping the data security as the major factor in data transmission. In the presented exposition, a modified variant of AES algorithm named as Modified Advanced Encryption Standard (MAES) has been introduced for secure data transmission in wired and various wireless networks namely, MANET, VANET, and FANET. The proposed technique focuses on both prevention and detection of the security attacks on the network. Theoretically, it is difficult to break the security or crack the key in the assumed network. The proposed protocol takes 2256 computations as compared to the basic AES standard which take 232 in case of differential fault analysis. The simulation results show that the proposed MAES outperformed AES in terms of security against attacks such as side channel attacks.

This paper introduces an efficient technique to speed up the higher-order masking scheme of the advanced encryption standard (AES), in which the S-box computation is based on the composite field, using Intel's Supplemental Streaming SIMD Extensions 3 (SSSE 3) instruction set. Different side-channel attack (SCA) countermeasures are combined to mitigate more than one type of SCA. The proposed technique solves the problem of higher-order masking's negative impact on performance and removes the need for lookup tables by applying parallel processing at the data level using single instruction multiple data (SIMD) technology. We implemented the technique on a Linux machine with an Intel processor that supports SSSE3 instructions. The technique performed nine times faster than the second order masking scheme and was seven times faster than the third order masking scheme reported in the literature. The results that we achieved through applying SIMD technology make our proposed technique practical and attractive.

Fault-based side channel cryptanalysis is a very effective cryptanalytic technique against symmetric and asymmetric encryption algorithms. Attackers can induce errors during the encryption or decryption process in order to collect information concerning secret information, such as cryptographic keys. In recent years, the security of the Advanced Encryption Standard (AES) against fault analysis attacks has received considerable attention. While FPGAs are becoming increasingly popular for cryptographic applications, there are only few articles that assess their vulnerability to such attacks only a small number of experiments can be found in the literature on the actual possibility to apply such attacks to FPGAs. The purpose of this paper is to describe a practical and successful implementation of the attack and to provide strong evidence that fault induction is a serious threat against realizations of the AESon FPGAs without effective countermeasure. The results obtained in this paper can serve to design a more secure FPGA implementation of the AES.

Side-channel attacks (SCAs) pose a threat to cryptographic security by potentially recovering secret keys through the analysis of radio-frequency switching noise emitted from cryptographic integrated circuits (ICs). Predicting tolerance for SCAs enables the implementation of countermeasures in the short term. To enable fast prediction, we model the switching current transferred from the IC to the power distribution network (PDN) as a triangular pulse, subsequently applying multiple regression analysis to this pulse. As in our previous paper, we approximate the triangular pulse using register transfer level (RTL) logic simulations, which facilitate a faster prediction of the current. By applying multiple regression analysis, we can predict the SCA tolerance using a few current waveforms. To validate our model, we predicted the switching current for a field programmable gate array (FPGA) implementing the advanced encryption standard (AES) circuit, converted this into PDN noise, and then performed a primary SCA method called correlation power analysis (CPA). The results show that our method can predict PDN noise and SCA tolerance with more than a 90 <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\%$</tex-math></inline-formula> reduction in analysis time compared to the previous method.

A masked advanced encryption standard (AES) physical unclonable function (PUF) architecture is proposed for hardware authentication against hybrid side‐channel (SCA) and machine‐learning attacks (MLAs). The random mismatches of the load capacitance of the masked substitution‐boxes in the AES cryptographic circuit induced by the fabrication process are utilised for generating the critical‐authentication data against SCAs. Moreover, a mask data is added to the input challenge data to mask the actual input data of the proposed PUF against MLAs. As demonstrated in the results, the masked AES PUF proposed shows a nearly 51.1% uniformity, 50.7% inter‐Hamming distance, and 98.1% reliability. Furthermore, if a hybrid SCA/MLA is performed on the proposed PUF by combining the corresponding side‐channel leakage with the deep neural network algorithm, the prediction rate of the output responses of the masked AES PUF is only 55.2% after 100,000 number of challenge‐to‐response pairs are used for training.

The adoption of deep neural networks for profiled side-channel attacks provides powerful options for leakage detection and key retrieval of secure products. Although deep learning is being widely adopted for computer vision, less research has been prominent in template-based profiling power SCA attacks. In addition, most of the existing works fall into a one-dimensional (1-D) CNN technique rather than two-dimensional (2-D) CNN methods. Training a deep 2-D CNN from scratch is computationally expensive and requires a large amount of training data. To overcome these challenges, we adopt deep 2-D CNNs, GoogLeNet, InceptionV3, VGG16, and MobileNetV2 pre-trained to identify all possible AES key bytes. In order to use 2-D CNN and transfer learning, we also propose a novel multi-scale continuous wavelet transform of the power traces and generate scalograms from the wavelet coefficients. Moreover, we propose ResNet 1-D CNN architecture using power traces signal to break AES-128 implementation. To evaluate our proposed work, a key rank metric with the ASCAD dataset is utilized. Our proposed deep CNN framework achieves ≥ 99 accuracy when key rank is less than 10.