Secure implementation of Post-Quantum Cryptosystems (PQC) is becoming critical as the world migrates towards quantum-safe cryptography. Fault attacks (FA) are practical threats affecting cryptographic implementations on both embedded and native, multi-user systems. Although research on FAs targeting PQC algorithms is well-paced for embedded systems (typically with physical adversarial access), exploration of such threats for native systems (typically with remote adversarial access) requires further attention. The type of faults and, consequently, the attack algorithms differ significantly between embedded and native systems.In this paper, we present a systematic approach to evaluate PQC algorithms against Rowhammer – a remote, software-controlled fault injection vector in native and cloud-based systems. Unlike conventional ways in cryptography, where an attack is first developed in theory and then demonstrated on target platform(s), we take a system-specific approach by first characterizing the fault model of a target platform and then exploiting these faults to devise a suitable theoretical attack. This approach helps the attacker quickly converge to an attack optimized for the target system. Also, if exercised successfully for targets with low fault susceptibility, it finds attacks potentially affecting a large number of targets. Our approach is demonstrated for SPHINCS+, the NIST standard for stateless hash-based digital signatures. We discovered a novel Rowhammer-based forgery attack and demonstrated it for DDR3 and DDR4 DRAMs. The attacks were carried out on the standard implementation of SPHINCS+ and for the liboqs library. To the best of our knowledge, this is the first work proposing a forgery attack using Rowhammer on SPHINCS+.

Power side-channels give rise to several potent attack vectors for leaking information in digital circuits. While a plethora of (mathematically robust) solutions exist to tackle such side-channels, their deployment through existing VLSI design-flows remains an important engineering issue. Besides, most existing solutions result in significant hardware overhead hindering their practical usage for resource-constrained settings, such as Internet-of-Things (IoT) or embedded devices. In this paper, we address both of these issues through an integrated electronic design automation (EDA) tool-flow operating on gate-level designs. Based on an interesting observation that not every net in a design is equally susceptible to side-channel leakage, we devise a generic testing mechanism and lightweight albeit customizable protection strategy for a given trace count. We first analytically establish the observation based on certain physical properties of VLSI circuits and also validate it on ISCAS benchmark circuits. Next, we present a tool calledVALIANT, which can identify the leaking nets for a given number of traces from the gate-level netlist of a cipher.VALIANTworks alongside state-of-the-art design automation tools and, therefore, can be directly incorporated in existing design flows. After identifying the leaky subset of nets in a design, we propose a lightweight variant of an existing masking scheme to eliminate the leakage concerning a given trace count. The main feature of our protection scheme is that it takes into account subset of nets are not “leaky” and optimizes the usage of randomness and extra gates according to this information to minimize the overhead. Experimental evaluation over state-of-the-art lightweight S-Boxes and the GIFT block cipher establishes the efficacy of the proposed idea for generating lightweight protected solutions in an automated manner.

In side-channel analysis (SCA), Points-of-Interest (PoIs), i.e., the informative sample points remain sparsely scattered across the whole side-channel trace. Several works in the SCA literature have demonstrated that the attack efficacy could be significantly improved by combining information from the sparsely occurring PoIs. In Deep Learning (DL), a common approach for combining the information from the sparsely occurring PoIs is softmax attention. This work studies the training instability of the softmax attention-based CNN models on long traces. We show that the softmax attention-based CNN model incurs an unstable training problem when applied to longer traces (e.g., traces having a length greater than$10K$sample points). We also explore the use of batch normalization and multi-head softmax attention to make the CNN models stable. Our results show that the use of a large number of batch normalization layers and/or multi-head softmax attention (replacing the vanilla softmax attention) can make the models significantly more stable, resulting in better attack efficacy. Moreover, we found our models to achieve similar or better results (up to 85% reduction in the minimum number of the required traces to reach the guessing entropy 1) than the state-of-the-art results on several synchronized and desynchronized datasets. Finally, by plotting the loss surface of the DL models, we demonstrate that using multi-head softmax attention instead of vanilla softmax attention in the CNN models can make the loss surface significantly smoother.

Physical attacks are well-known threats to cryptographic implementations. While countermeasures against passive Side-Channel Analysis (SCA) and active Fault Injection Analysis (FIA) exist individually, protecting against their combination remains a significant challenge. A recent attempt at achieving joint security has been published at CCS 2022 under the name CINI-MINIS. The authors introduce relevant security notions and aim to construct arbitrary-order gadgets that remain trivially composable in the presence of a combined adversary. Yet, we show that all CINI-MINIS gadgets at any order are susceptible to a devastating attack with only a single fault and probe due to a lack of error correction modules in the compression. We explain the details of the attack, pinpoint the underlying problem in the constructions, propose an additional design principle, and provide new (fixed) provably secure and composable gadgets for arbitrary order. Luckily, the changes in the compression stage help us to save correction modules and registers elsewhere, making the resulting Combined Private Circuits (CPC) more secure and more efficient than the original ones. We also explain why the discovered flaws have been missed by the associated formal verification tool VERICA (TCHES 2022) and propose fixes to remove its blind spot. Finally, we explore alternative avenues to repair the compression stage without additional corrections based on non-completeness, i.e. constructing a compression that never recombines any secret. Yet, while this approach could have merit for low-order gadgets, it is, for now, hard to generalize and scales poorly to higher orders. We conclude that our refurbished arbitrary order CINI gadgets provide a solid foundation for further research.

Exploitable fault models for block ciphers are typically cipher-specific, and their identification is essential for evaluating and certifying fault attack-protected implementations. However, identifying exploitable fault models has been a complex manual process. In this work, we utilize reinforcement learning (RL) to identify exploitable fault models generically and automatically. In contrast to the several weeks/months of tedious analyses required from experts, our RL-based approach identifies exploitable fault models for protected/unprotected AES and GIFT ciphers within 12 hours. Notably, in addition to all existing fault models, we identify/discover a novel fault model for GIFT, illustrating the power and promise of our approach in exploring new attack avenues.

Recent work has shown that Side-Channel Attacks (SCA) and Fault Attacks (FA) can be combined, forming an extremely powerful adversarial model, which can bypass even some strongest protections against both FA and SCA. However, such strongest form of combined attack comes with some practical challenges - 1) a profiled setting with multiple fault locations is needed; 2) fault models are restricted to single-bit set-reset/flips; 3) the input needs to be repeated several times. In this paper, we propose a new combined attack strategy called SCA-NFA that works in a non-profiled setting. Assuming knowledge of plaintexts/ciphertexts and exploiting bitsliced implementations of modern ciphers, we further relax the assumptions on the fault model, and the number of fault locations - random multi-bit fault at a single fault location is sufficient for recovering several secret bits. Furthermore, the inputs are allowed to be varied, which is required in several practical use cases. The attack is validated on a recently proposed countermeasure called DOMREP, which individually provides SCA and FA protection of arbitrary order. Practical validation for an open-source masked implementation of GIMLI with DOMREP extension on STM32F407G, using electromagnetic fault and electromagnetic SCA, shows that SCA- NFA succeeds in around 10000 measurements.

Cache based side-channel attacks exploit the fact that an adversary can setup the shared cache memory (the last level cache in modern systems) into a known state and detect any microarchitectural state changes made by the victim on the cache. Different mitigation techniques have been proposed in the literature that aims to mitigate these attacks by randomizing the address to cache location mappings. The security guarantees in these schemes are based on the degree of difficulty for an attacker to reliably determine the cache lines accessed by the victim within practical time settings. However, prior attacks have shown that newer and more improved algorithms can be envisaged that discover conflicting sets in the secured randomized caches. In this work, we first categorize different types of cache designs into four broad classes based on the extent of non-determinism and randomness of allocating an address in those caches. We then develop a mathematical framework to formally analyse the security implications of the randomized and partitioned cache designs in terms of collision probability, self-collision probability and size of the eviction set required to perform a successful eviction-based attack. We further empirically demonstrate set associative eviction on recently proposed randomization schemes called Mirage and Scattercache. Next, we propose two algorithms to generate efficient eviction set on these schemes and analytically evaluate the efficacy of our algorithms against the one proposed in the literature. Finally, we argue that mere randomization using a cryptographic primitive as used in popular schemes like Scattercache, CEASER-S, Mirage etc. does not provide the required randomness. Although the randomized-partitioned caches provide some resilience against eviction-set generation techniques, they are still vulnerable to eviction-based attacks.

Fault Attacks (FA) have gained a lot of attention from both industry and academia due to their practicality, and wide applicability to different domains of computing. In the context of symmetric-key cryptography, designing countermeasures against FA is still an open problem. Recently proposed attacks such as Statistical Ineffective Fault Analysis (SIFA) has shown that merely adding redundancy or infection-based countermeasure to detect the fault doesn't work and a proper combination of masking and error correction/detection is required. In this work, we show that masking which is mathematically established as a good countermeasure against a certain class of SIFA faults, in practice may fall short if low-level details during physical design layout development are not taken care of. We initiate this study by demonstrating a successful SIFA attack on a post placed-and-routed masked crypto design for ASIC platform. Eventually, we propose a fully automated approach along with a proper choice of placement constraints which can be realized easily for any commercial CAD tools to successfully get rid of this vulnerability during the physical layout development process. Our experimental validation of our tool flow over masked implementation on PRESENT cipher establishes our claim.

The prevalent usage and unparalleled recent success of Deep Neural Network (DNN) applications have raised the concern of protecting their Intellectual Property (IP) rights in different business models to prevent the theft of trade secrets. In this article, we propose a lightweight, generic, key-based DNN IP protection methodology, NN-Lock , to defend against unauthorized usage of stolen DNN models. NN-Lock utilizes SBox, a cryptographic primitive, with good security properties to encrypt each parameter of a trained DNN model with the secret keys derived from a master key through a key-scheduling algorithm. The method ensures that only an authorized user with a correct master key can accurately use the locked DNN model. Evaluation results of NN-Lock on a Google Coral edge device for various DNN architectures on several datasets show that for an incorrect master key, the accuracy of a locked model is that of a random classifier. The dense network of encrypted parameters makes the method robust against the model fine-tuning attack and a novel approximation attack using the Genetic Algorithm, which achieves reasonable success against another recent IP protection scheme called HPNN Chakraborty et al. 2020 . The security evaluation of NN-Lock against other families of attacks demonstrates its soundness in practical scenarios. NN-Lock does not modify any internal structure of a DNN model, making it scalable for all of the existing DNN implementations without adversely affecting their performance.

Homomorphic encryption (HE) is the ultimate tool for performing secure computations even in untrusted environments. Application of HE for deep learning (DL) inference is an active area of research, given the fact that DL models are often deployed in untrusted environments (e.g., third-party servers) yet inferring on private data. However, existing HE libraries [somewhat (SWHE), leveled (LHE) or fully homomorphic (FHE)] suffer from extensive computational and memory overhead. Few performance optimized high-speed homomorphic libraries are either suffering from certain approximation issues leading to decryption errors or proven to be insecure according to recent published attacks. In this article, we propose architectural tricks to achieve performance speedup for encrypted DL inference developed with exact HE schemes without any approximation or decryption error in homomorphic computations. The main idea is to apply quantization and suitable data packing in the form of bitslicing to reduce the costly noise handling operation, Bootstrapping while achieving a functionally correct and highly parallel DL pipeline with a moderate memory footprint. Experimental evaluation on the MNIST dataset shows a significant ( $37\times$ ) speedup over the nonbitsliced versions of the same architecture. Low memory bandwidths (700 MB) of our design pipelines further highlight their promise toward scaling over larger gamut of Edge-AI analytics use cases.

Implementing hardware secure against side-channel attacks (SCA) demands significant time and expertise in hardware design. In this paper, we propose a simple and fast approach for synthesizing masked block cipher hardware from a C-code exploiting High-Level-Synthesis (HLS), which allows a very short design time. Compared to previous approaches, our proposal provides a systematic and general flow based on state-of-the-art Domain-Oriented Masking (DOM). We also present a fast security-validation flow for the synthesized circuits at the early design stages using commercial-off-the-shelf CAD tools. Efficacy of the proposed design-flow has been established over a set of representative benchmarks including a masked S-Box and a lightweight block-cipher.

Block ciphers are widely regarded as concrete realizations of pseudorandom permutations with established security features. However, their applicability outside the domain of encryption has not been explored so far. In this paper, we open up, for the first time, an entirely novel application of them to logic hiding. We show that a combinational circuit can always be embedded within a block cipher having a bit-permutation based diffusion layer, preserving the cipher structure and security properties. The functionality of the embedded circuit becomes transparent only on the application of a secret key, whereas a wrong key will cause behaviour that is uncorrelated to that of the circuit. As an immediate application, we propose a combinational logic-locking scheme. The proposed locking scheme is also found to be robust against the state-of-the-art (SAT-assisted and other) attacks on logic locks.

Page Frame Cache (PFC) is a purely software cache, present in modern Linux based operating systems (OS), which stores the page frames that were recently released by the processes running on a particular CPU. In this paper, we show that the page frame cache can be maliciously exploited by an adversary to steer the pages of a victim process to some pre-decided attacker-chosen locations in the memory. We practically demonstrate an end-to-end attack, ExplFrame, where an attacker having only user-level privilege is able to force a victim process's memory pages to vulnerable locations in DRAM and deterministically conduct Rowhammer to induce faults. As a case study, we induce single bit faults in the T-tables on OpenSSL (v1.1.1) AES using our proposed attack ExplFrame. We also propose an improvised fault analysis technique which can exploit any Rowhammer-induced bit-flips in the AES T-tables.

Right from its introduction, fault attacks (FA) have been established to be one of the most practical threats to both public key and symmetric key based cryptosystems. Statistical Ineffective Fault Analysis (SIFA) is a recently proposed class of fault attacks introduced at CHES 2018. The fascinating feature of this attack is that it exploits the correct ciphertexts obtained during a fault injection campaign, instead of the faulty ciphertexts. SIFA has been shown to bypass almost all of the existing fault attack countermeasures even when they are combined with masking schemes for side-channel resistance. The goal of this work is to propose a countermeasure framework for SIFA. It has been observed that a randomized domain transformation of the intermediate computation combined with bit-level error correction can prevent SIFA attacks. The domain transformation (Transform) can be realized by standard masking schemes. In fact, we prove that if biased faults are injected at the state register of a block cipher at a certain target round, then masking is sufficient for SIFA protection, until all the shares for a specific bit are corrupted. However, masking alone cannot prevent SIFA if the faults are injected at certain specific locations inside the S-Boxes. To address this issue, we incorporate a bit-level error-correction mechanism (Encode). An instantiation of this Transform-and-Encode (TaE) framework, called AntiSIFA, has been proposed and realized for the block cipher PRESENT as a proof-of-concept. Practical evaluation of the countermeasure implementation in both hardware and software ensures our theoretical claims regarding SIFA security, as well as protection against Side-Channel-Attacks (SCA).

Assessment of the security provided by a fault attack countermeasure is challenging, given that a protected cipher may leak the key if the countermeasure is not designed correctly. This paper proposes, for the first time, a statistical framework to detect information leakage in fault attack countermeasures. Based on the concept of non-interference, we formalize the leakage for fault attacks and provide a t-test based methodology for leakage assessment. One major strength of the proposed framework is that leakage can be detected without the complete knowledge of the countermeasure algorithm, solely by observing the faulty ciphertext distributions. Experimental evaluation over a representative set of countermeasures establishes the efficacy of the proposed methodology.

Characterizing the fault space of a cipher to filter out a set of faults potentially exploitable for fault attacks (FA), is a problem with immense practical value. A quantitative knowledge of the exploitable fault space is desirable in several applications, such as security evaluation, cipher construction and implementation, design, testing of countermeasures, and so on. In this paper, we investigate this problem in the context of block ciphers. The formidable size of the fault space of a block cipher mandates the use of an automation strategy to solve this problem, which should be able to characterize each individual fault instance quickly. On the other hand, the automation strategy is expected to be applicable to most of the block cipher constructions. Existing techniques for automated fault attacks do not satisfy both of these goals simultaneously, and hence are not directly applicable in the context of exploitable fault characterization. In this paper, we present a supervised machine learning assisted automated framework, which successfully addresses both of the criteria mentioned. The key idea is to extrapolate the knowledge of some existing FAs on a cipher to rapidly figure out new attack instances. Experimental validation of this idea on two state-of-the-art block ciphers - PRESENT and LED - establishes that our approach is able to provide fairly good accuracy in identifying exploitable fault instances at a reasonable cost. Utilizing this observation, we propose a statistical framework for exploitable fault space characterization, which can provide an estimate of the success rate of an attacker corresponding to the given fault model and fault location. The framework also returns test vectors leading toward successful attacks. As a potential application, the effect of different S-Boxes on the fault space of a cipher is evaluated utilizing the framework.

Redundancy based countermeasures against fault attacks are a popular choice in security-critical commercial products, owing to its high fault coverage and applications to safety/reliability. In this paper, we propose a combined attack on such countermeasures. The attack assumes a random byte/nibble fault model with existence of side-channel leakage of the final comparison, and no knowledge of the faulty ciphertext. Unlike the previously proposed biased/multiple fault attack, we just need to corrupt one computation branch. Both analytical and experimental evaluation of this attack strategy is presented on software implementations of two state-of-the-art block ciphers, AES and PRESENT, on an ATmega328P microcontroller, via side-channel measurements and a laser-based fault injection. Moreover, this work establishes that even without the knowledge of the faulty ciphertexts, one can still perform differential fault analysis attacks, given the availability of side-channel information.

Current approaches for Hardware Trojan detection have varying degrees of computational and/or design overheads. In this paper, we develop a CAD methodology for a-priori estimation of Trojan vulnerability of a given circuit at the early stages of the design flow. We develop a security metric to estimate the testability of a circuit for HTHs, thus assessing its relative vulnerability. Our methodology overcomes several shortcomings of previously proposed testability metrics in the context of their applicability to the HTH detection problem in particular. We utilize the proposed metric to estimate the Trojan vulnerability of gate-level ISCAS benchmark circuits. The metric values show excellent correlation with the testability results obtained from previously proposed Trojan targeted ATPG techniques.