Side-channel attacks cause a significant threat to security implementations in embedded devices. Accordingly, an automated framework simulating side-channel behaviours can offer invaluable insights into leakage origins and characteristics, helping developers improve those devices during the design phase. While there has been a substantial effort towards crafting leakage simulators, earlier methods either necessitated significant manual work for reverse engineering the micro-architectural layer or depended on Deep Learning (DL) models where the neural network's complexity increased considerably with the addition of pipeline stages. This paper presents a novel modelling approach using Recurrent Neural Networks (RNNs) to construct instruction-level power models that exhibit enhanced performance in detecting pipeline leakage. Our findings indicate that with memory-based machine learning models, it becomes unnecessary to input data accounting for the pipeline effect. This strategy reduces feature dimensionality by at least one-third for a three-stage pipeline, albeit at a modest compromise in model performance. This reduced feature set underscores our model's scalability, making it a preferred choice for analyzing microprocessors with extended pipeline stages. Importantly, our methodology accelerates the micro-architectural profiling phase in side-channel simulator design. When evaluated on an expansive dataset, the performance of our memory-based model closely matches that of the Multilayer Perceptron (MLP) with an R2 value of 0.79. On a reduced dataset (removing the pipeline effect), our model achieves an R2 value of 0.65, outperforming the MLP, which reaches an R2 value of 0.39. Moreover, our model is designed with scalability in mind, making it suitable for profiling microcontrollers with advanced pipeline stages. For the practical realisation of our approach, we employed the open-source ABBY-CM0 dataset from the ARM Cortex-M0 microcontroller, which has three pipeline stages. To provide a detailed analysis, we also consider a Convolutional Neural Network (CNN) besides two RNN architectures (Long Short-Term Memory and Gated Recurrent Unit).

In this paper, we conduct a detailed power side-channel analysis of Xoodyak, a lightweight cryptographic algorithm, on an FPGA platform. We focus on the initialization phase of Xoodyak in the authenticated encryption with associated data (AEAD) mode. First, we introduce a new leakage model and perform a leakage assessment. Then, we perform non-profiled and profiled attacks to determine if the observed leakages can be exploited. For a non-profiled attack, we perform a correlation power analysis on all key bits, achieving a success rate of 91.4% with 50 000 traces. Our approach for a profiled attack involves a template attack and a deep learning-based attack. The former achieves a success rate of 99.2%, recovering almost all key bits with 20 000 traces in the attack phase. The latter reaches a guessing entropy of zero after 550 traces and adapts to the leakage model within 50 epochs.

The tremendous bandwidth available in the millimeter wave frequencies above 10 GHz have made these bands an attractive candidate for next-generation cellular systems. However, reliable communication at these frequencies depends critically on beamforming with very high-dimensional antenna arrays. Estimating the channel sufficiently accurately to perform beamforming can be challenging due to both low coherence time and a large number of antennas. Also, the measurements used for channel estimation may need to be made with analog beamforming, where the receiver can “look” in only one direction at a time. This paper presents a novel method for estimation of the receive-side spatial covariance matrix of a channel from a sequence of power measurements made in different angular directions. It is shown that maximum likelihood estimation of the covariance matrix reduces to a non-negative matrix completion problem. We show that the non-negative nature of the covariance matrix reduces the number of measurements required when the matrix is low-rank. The fast iterative methods are presented to solve the problem. Simulations are presented for both single-path and multi-path channels using models derived from real measurements in New York City at 28 GHz.