XDIVINSA: eXtended DIVersifying INStruction Agent to Mitigate Power Side-Channel Leakage

Cryptographic implementations are prune to Side Channel Analysis (SCA) attacks and Fault Injection (FI) attacks at the same time. Therefore, countermeasures protecting an implementation need to be evaluated against both attacks. The main contribution of this work is twofold. First, we propose an evaluation platform capable to perform emulated fault injection campaigns against modern MCUs and at the same time able to acquire experimental electromagnetic EM emissions and power traces of cryptographic computations to be used for SCA attacks. Second, we perform experimental evaluations of countermeasures protecting against both SCA and FI attacks which show that the injections of faults can dramatically reduce the effectiveness of SCA countermeasures. We evaluate two cryptographic algorithms, an AES and a PRESENT-Sbox implementation, which are protected employing different countermeasures protecting in parallel against FI and SCA attacks. The AES secure implementation is protected by hiding-based SCA countermeasures, while it uses a redundancy-based technique against FI attacks. On the other hand, the PRESENT Sbox is protected by a software implementation of a Dual-rail with Precharge Logic (DPL) countermeasure including fault detection capabilities. We present extensive experimental evaluations for the AES implementation and first results for PRESENT-Sbox showing that for both implementations the fault injections increase the efficiency of the SCA attacks and lead to very fast recoveries of the secret keys.

Modern-day embedded systems such as IoT and other smart electronic devices are vulnerable to side-channel analysis (SCA) attacks due to their ease of physical access to devices. Hardware implementation should be secured with SCA countermeasures to protect data from such attacks. This dissertation proposes a residue number system (RNS)-based logic to protect against power side-channel attacks. By converting the different input binary values into similar bit encodings for the shares, the RNS logic enables side-channel privacy and cryptographic privacy. In the study, this trait is also recorded as a symmetry measure. The side-channel resistance of RNS secure logic is assessed both conceptually and practically. An analytical metric is developed to quantify the conditional probability of the input bit state given the residue state visible to the adversary but derived from hidden cryptographic secrets. Transition probability, normalized variance, and Kullback–Leibler (KL) divergence serve as side-channel metrics in this study. The results show that our RNS secure logic provides better resistance against high-order side-channel attacks regarding power distribution uniformity and success rates of machine learning (ML)-based power side-channel attacks. We performed SPICE simulations on Montgomery modular multiplication and Arithmetic-style multiplication using the FreePDK 45nm technology library. Another significant and developing issue is the need for security analysis on the EDA tool flow. In this work, the values and topologies of the decoupling capacitance included in an on-chip power distribution network for side-channel resistance are investigated. We demonstrate that an on-chip power distribution network with decoupling capacitance prevents power side-channel attacks. The proposed architecture distributes multiple decoupling capacitances along the power lines to avoid data leakage from sensitive logic blocks. The impact of decoupling capacitance on power side-channel resistance is studied using grid-style and tree-style power distribution networks. Research employs a unique, approximate approach for extracting the feature vector from the switching current of the internal logic blocks. The side-channel resistance is quantified by the success rates of machine learning classifiers such as Naive Bayes (NB), Linear Discriminant Analysis (LDA), Quadratic Discriminant Analysis (QDA), and Support Vector Machine (SVM).

The modular exponentiation operation used in popular public key encryption schemes such as RSA, has been the focus of many side channel analysis (SCA) attacks in recent years. Current SCA attack countermeasures are largely static. Given sufficient signal to noise ratio and a number of power traces, static countermeasures can be defeated as they merely attempt to mask or hide the power consumption of the system under attack. This paper introduces a dynamic countermeasure which constantly varies the timing and power consumption of each operation, making correlation between traces more difficult than for static countermeasures.

Side-channel analysis (SCA) attacks - especially power analysis - are powerful ways to extract the secrets stored in and processed by cryptographic devices. In recent years, researchers have shown interest in utilizing on-chip measurement facilities to perform such SCA attacks remotely. It was shown that simple voltage-monitoring sensors can be constructed from digital elements and put on multi-tenant FPGAs to perform remote attacks on neighbouring cryptographic co-processors. A similar threat is the unsuspecting integration of third-party IP-Cores into an IC design. Even if the function of an acquired IP-Core is not security critical by itself, it may contain an on-chip sensor as a Trojan that can eavesdrop on cryptographic operations across the whole device. In contrast to all FPGA-based investigations reported in the literature so far, we examine the efficiency of such on-chip sensors as a source of information leakage in an ASIC-based case study for the first time. To this end, in addition to a cryptographic core (lightweight block cipher PRESENT) we designed and implemented a voltage-monitoring sensor on an ASIC fabricated by a 40 nm commercial standard cell library. Despite the physical distance between the sensor and the PRESENT core, we show the possibility of fully recovering the secret key of the PRESENT core by processing the sensor's output. Our results imply that the hidden insertion of such a sensor - for example by a malicious third party IP-Core vendor - can endanger the security of embedded systems which deal with sensitive information, even if the device cannot be physically accessed by the adversary.

In this paper, we first investigate the side channel analysis attack resistance of various FPGA hardware implementations of the ARIA block cipher. The analysis is performed on an FPGA test board dedicated to side channel attacks. Our results show that an unprotected implementation of ARIA allows one to recover the secret key with a low number of power or electromagnetic measurements. We also present a masking countermeasure and analyze its second-order side channel resistance by using various suitable preprocessing functions. Our experimental results clearly confirm that second-order differential side channel analysis attacks also remain a practical threat for masked hardware implementations of ARIA.

Three-dimensional (3D) integration is envisioned as a natural defense to thwart side-channel analysis (SCA) attacks. However, there lack extensive studies on the unique feature of 3D power distribution network (PDN) noise and its impact on the efficiency of SCA attacks in 3D chips. This work fills the gap. Our experiments based on the real PDN and through-silicon via (TSV) models indicate that the noise from the other 3D planes is additive, which can significantly change the power profile of the crytpo unit in a 3D chip. We exploit the cross-plane PDN noise to develop a new counter-measure against the correlation power analysis (CPA) attacks in 3D integrated circuits (ICs). Simulation results show that the proposed method successfully improves the system resilience against CPA attacks and enhances the correlation difference by 29.1% and 18.7% over 2D and 3D baseline, respectively.

Side channel attack (SCA) requires millions of dynamic power current waveforms in cryptographic VLSI circuits. The capacitor charging modeling captures the time evolution of logical activities in the cryptographic operation of an Advanced Encryption Standard (AES) core and efficiently represents the amount of charges consumed during operation. This approach significantly reduces the complexity of power current simulation, and accomplishes acceleration by a factor of 220 or larger over the traditional transistor-level circuit simulation. The correlated power analysis (CPA) attack against AES cores is successfully simulated with a conventional SPICE simulator, with the models individually derived for 10,000 different cipher texts. The simulation-based SCA efficiently evaluates the vulnerability of AES cores in a variety of logical realizations as well as in different technology nodes.

RSA cryptosystem is one of the most widely used algorithms nowadays. However when it is implemented in embedded devices such as smart cards, it can be vulnerable to power analysis attacks and fault attacks. To defeat all known side channel attacks and fault attacks, several countermeasures should be used together. However due to the low computation capability of the embedded devices, we have to find the best solution or combination among countermeasures. Furthermore, we should be careful since a countermeasure may produce another new vulnerability such as Yen et. al.'s safe-error attack in a simple power analysis (SPA) countermeasure. In 2005, Giraud proposed a scheme secure against simple power analysis as well as fault attack (FA). Afterwards, Fumaroli and Vigilant proposed an exponentiation algorithm secure against differential power analysis (DPA) as well as simple power analysis and fault attack with almost 1.5 times increase in time complexity compared to Giraud's. To the authors' best knowledge, it was a first trial to prevent SPA, DPA, and FA simultaneously on exponentiation with one solution. In this paper we show Fumaroli and Vigilant's scheme can be broken by fault attacks and propose a direction to construct efficient countermeasures secure against all known side channel analyses and fault attacks on RSA-CRT with low time complexity.

In this paper, we demonstrate how the Scanning Electron Microscope (SEM) becomes a powerful tool for Side Channel Analysis (SCA) and Hardware Reverse Engineering. We locate the AES hardware circuit of a XMEGA microprocessor with Capacitive-Coupled Voltage Contrast (CCVC) images and use them in a powerful Voltage Contrast Side Channel Analysis (VCSCA). This enables an attacker to locate AES bit-wires in the top metal-layer and thus, to recover valuable netlist information. An attacker gets a valuable entry-point to look for weaknesses or Intellectual Property (IP) in the AES circuit. Additionally we show the great potential of the VCSCA in a non-invasive Side Channel Analysis for Reverse Engineering (SCARE) approach. Finally, we recover the full key of the AES hardware-engine in a practical template-based VCSCA and a no-plaintext, no-ciphertext and no-key Simple Side Channel Analysis (SSCA). We show that future VCSCA attacks present a big hardware security-risk that IC vendors need to consider.

This article demonstrates enhanced power (P) and electromagnetic (EM) side-channel analysis (SCA) attack resistance of standard (unprotected) 128-bit advanced encryption standard (AES) engines with parallel (P-AES, 128-bit) and serial (S-AES, 8-bit) datapaths and a 128-bit SIMON engine with the bit-serial (1-bit) datapath by an on-die security-aware all-digital low-dropout (DLDO) regulator. The proposed DLDO improves SCA resistance using control-loop-induced perturbations in a nominal DLDO, enhanced by a random switching noise injector (SNI) by power-stage control and a randomized reference voltage (R-VREF) generator coupled with all-digital clock modulation (ADCM). SCA performed on the measured power/EM signatures acquired from a 130-nm CMOS testchip demonstrates up to 25 $\times $ reduction in test vector leakage assessment (TVLA) leakage for P-AES and 3579 $\times $ , 2182 $\times $ , and 500 $\times $ increase in minimum-traces-to-disclose (MTD) 80% of the subkeys for P-AES, S-AES, and SIMON cores, respectively, with respect to correlation power analysis (CPA) and correlation EM analysis (CEMA).

A key derivation function is a function that generate one or more arbitrary length of cryptographic keys from a private string together with some public information. The generated cryptographic key(s) from this key derivation function proposals are generally indistinguishable from random binary strings of the same length based on formal mathematically proof. To date, there are designed of key derivation function proposals using cryptographic primitives such as hash functions, block ciphers and stream ciphers. However, there are limited security analysis of side channel attacks for the key derivation function proposals. This paper is to investigate the timing side channel attacks towards these three types of cryptographic primitives based key derivation function. Key derivation functions based on stream ciphers and block ciphers are input-dependent execution, the experiment results have shown that both key derivation functions proposals are vulnerable against timing side channel.

Side-channel analysis (SCA) is usually used for analyzing the side-channel resistance of a crypto device. However, it does not mean “practical secure” when a SCA attack fails since SCA only provides a success or failure conclusion. On the basis of the SCA data about scores and ranks of all candidates for each subkey, it is still possible to apply key enumeration (KE) algorithms to search the correct master key at an affordable overhead. Nevertheless, the efficiency of KE is limited by the SCA data in essence. To address the issue, we proposed two methods to exploit the SCA data and Riemann integral of the rank curves of all subkey candidates to update each correct sub key rank before carrying out KE. We applied the proposed methods for different crypto implementations running on different devices to verify their performance. Experimental studies for both mono-channel and multi-channel leakages verified that the proposed methods were effective in improving the efficiency of KE to recover the correct key. The proposed methods are designed for processing the SCA data and can be deemed as a preliminary before executing KE. The work of this paper bridges the gap between SCA and KE.

One of PI/EMC design techniques, on-board decoupling, was proved its possibility to be used as a countermeasure against cryptographic side-channel analysis attack. The on-board decoupling was applied to a side-channel attack standard evaluation board (SASEBO-G) involving a cryptographic FPGA that operated an AES-128 encryption process. Two decoupling conditions were examined. Radio frequency (RF) power current was detected with a current probe that was placed on a power cable connected to SASEBO-G for the cryptographic FPGA. Traces of the RF power current were recorded repeatedly with a digital oscilloscope until 30,000 traces were acquired in each decoupling condition. The traces were analyzed statistically by using the correlation power analysis (CPA). Results of CPA show that necessary number of traces to reveal the secret key significantly increased when the RF power current was attenuated by decoupling over the dominant frequency range in spectra of the RF power current. The decoupling technique can be useful as a countermeasure of side-channel analysis attacks to cryptographic modules.

The Internet of Things (IoT) offers a more advanced service than a single device or an isolated system, as IoT connects diverse components, such as sensors, actuators, and embedded devices through the internet. As predicted by Cisco, there will be 50 billion IoT connected devices by 2020. Integration of such a tremendous number of devices into IoT potentially brings in a new concern, system security. In this work, we review two typical hardware attacks that can harm the emerging IoT applications. As IoT devices typically have limited computation power and need to be energy efficient, sophisticated cryptographic algorithms and authentication protocols are not suitable for every IoT device. To simultaneously thwart hardware Trojan and side-channel analysis attacks, we propose a low-cost dynamic permutation method for IoT devices. Experimental results show that the proposed method achieves 5.8X higher accumulated partial guessing entropy than the baseline, thus strengthening the IoT processing unit against hardware attacks.

There is a theoretically strong relationship between chaos and cryptology. In practice, one of the most successful applications of this relationship is chaos-based s-box structures. However, the performance metrics of chaos-based s-box designs are worse compared to those for s-box structure based on algebraic techniques used in modern encryption algorithms, such as the AES algorithm. What is the reason for using chaos-based s-box structures, even though they have worse cryptographic characteristics? Researchers claim that they may be an alternative defense against implementation attacks, especially side-channel analyses. However, no studies have supported or refuted this claim so far. In this paper, side-channel analyses have been performed for two different chaos-based s-box structures. These two s-box structures have been selected for having with the best and worst performance measurements for s-box structures previously proposed in the literature. The results were compared with the AES s-box structure. Analysis of the results showed that chaos-based s-box structures are more resistant against side-channel attacks. Therefore, chaos-based designs may be an alternative defense against implementation attacks, as alleged. However, both algebraic and chaos-based s-box designs have been observed to be insecure if the attacker has more than 30 plaintexts in the side channel analyses. These results show that implementation analysis studies are required in the chaos-based cryptology literature.