Physical Unclonable Functions (PUFs) leverage manufacturing variations to generate device-specific keys during runtime only, overcoming the need for protection after power-off as for Non-Volatile Memory. The main challenges of PUF-based key storage are reliability of the response and sensitivity to Side-Channel Analysis (SCA). Oscillator-based PUFs are particularly sensitive to frequency spectrum SCA. Existing countermeasures can protect sign-based bit derivation that requires error correction or discarding unreliable bits to achieve reliable key generation. Amplitude-based bit derivation enhances the reliability of oscillator-based PUFs without discarding unsteady response bits, keeping a high entropy. However, existing lightweight countermeasures against SCA are not applicable for this case. This raises the demand for an alternative solution. This work targets the protection of amplitude-based bit derivation combined with the Loop PUF, an oscillator-based PUF primitive well suited for key generation. It presents the Interleaved Challenge Loop PUF (ICLooPUF), a side-channel-hardened offspring of the Loop PUF that uses dynamic challenge interleaving. The SCA-protected PUF primitive is applicable to amplitude-based and sign-based bit derivation methods, and requires a low hardware overhead. Theoretical and experimental results show the efficiency of the protection mechanism.

Protection against physical attacks is a major requirement for cryptographic implementations on devices which can be accessed by attackers. Side-channel and fault injection attacks are the most common types of physical attacks. In this work we present a novel generic solution for simultaneous protection against side-channel and fault attacks with arbitrary order. We combine domain oriented masking and repetition codes in an orthogonal way and call this approach DOMREP. The resistance against side-channel attacks and fault attacks can be scaled independently of each other, for the protection against higher-order side-channel analysis and the injection of multiple faults including SIFA. We develop the generic concept of orthogonal protection, and implement the DOMREP concept on GIMLI, a round two NIST LWC competition candidate, on a Xilinx Artix-7 FPGA. Our implementation of GIMLI is verified to be resistant against univariate first-order side-channel attacks by TVLA. The resistance against SIFA is verified by means of fault emulation of single as well as multiple bit faults. Our implementation of GIMLI achieves the expected security level according to these measurements. We also provide numbers for the area overhead for our protected implementation of GIMLI.

For asymmetric ciphers, such as RSA and ECC, side-channel attacks on the underlying exponentiation are mitigated by countermeasures like constant-time implementation and blinding. This restricts an attacker to a single side-channel trace for an attack as a different representation of the private key is used for each exponentiation. In this work, we propose an unsupervised machine learning framework for side-channel attacks on asymmetric cryptography that analyzes leakage in multiple side-channel traces, identifying the best trace for key retrieval. We apply Principal Component Analysis (PCA) preprocessing followed by a classification step that assigns segments of traces to elementary operations of the Square and Multiply exponentiation of RSA. In order to estimate the attack complexity for each trace in terms of key enumeration effort, we introduce two new metrics: The Entropy-based Cost Function (EBCF) is used to select a trace for the attack as well as bits which have to be brute-forced if not all bits can be determined correctly from this single trace. To reduce brute-force complexity further, we introduce Illegal Sequence Detection (ISD) to remove brute-force candidates which do not fit to the Square-and-Multiply scheme. We first provide a proof of concept for 320-bit key length traces and, moving towards a more realistic scenario, retrieve the key from a 1024-bit RSA implementation protected by message and exponent blinding. We are able to select the trace with the least remaining brute-force complexity from 1000 power measurements of the signature generation with randomized inputs and blinding values on a 32-bit ARM Cortex-M4 microcontroller.