Gentry's breakthrough of Fully Homomorphic Encryption (FHE) in 2009 revolutionized the field of secure computation. Since then, most applications of homomorphic encryption have been oriented towards offloading computations to the cloud in a secure fashion. Indeed, the user usually does not have full confidence in the cloud provider and wants to keep its data secrecy. A similar situation appears in most embedded systems, where information leakages through hardware or software side-channel attacks might compromise data confidentiality. In this work, we attempt to leverage Homomorphic Encryption in a different threat model, adapted to CPS (Cyber-Physical Systems) use cases. The main challenge is that, even today's most promising FHE schemes remain orders of magnitude too big to fit in a constrained system. To address this issue, we show how a trade-off can be achieved by securing a noise reduction module against side-channel leakages. This approach is described and evaluated on FPGA using the BGV scheme, a very efficient homomorphic scheme based on Ring-LWE encryption. We conclude that such homomorphic encryption can fit in an embedded system, while offering reasonable performances with respect to the security provided.

Over the last 30 years, a number of secure processor architectures have been proposed to protect software integrity and confidentiality during its distribution and execution. In such architectures, encryption (together with integrity checking) is used extensively, on any data leaving a defined secure boundary. In this paper, we show how encryption can be achieved at the instruction level using a stream cipher. Thus encryption is more lightweight and efficient, and is maintained deeper in the memory hierarchy than the natural off-chip boundary considered in most research works. It requires the control flow graph to be used and modified as part of the off-line encryption process, but thanks to the LLVM framework, it can be integrated easily in a compiler pipeline, and be completely transparent to the programmer. We also describe hardware modifications needed to support this encryption method, the latter were added to a 32 bit MIPS soft core. The synthesis performed on a Altera Cyclone V FPGA shows that encryption requires 26% of extra logic, while slowing-down execution time by an average of 48% in the best setting.

International audience

Pairing based cryptography (PBC) is touted as an efficient approach to address usability and privacy issues in the cyberspace. Like most cryptographic algorithms, PBC must be robust not only against theoretical cryptanalysis but also against practical physical attacks such as fault injections. The computation of the Tate pairing can be divided into two parts, the Miller Algorithm and the Final Exponentiation. In this paper, we describe practical implementations of fault attacks against the Miller Algorithm validating common fault models used against pairings. In the light of the implemented fault attacks, we show that some blinding techniques proposed to protect the algorithm against Side-Channels Analyses cannot be used as countermeasures against the implemented fault attacks.

Since its invention in 1977, the celebrated RSA primitive has remained unbroken from a mathematical point of view, and has been widely used to build provably secure encryption or signature protocols. However, the introduction in 1996 of a new model of attacks - based on fault injections - by Boneh, deMillo and Lipton suggests the use of specific countermeasures to obtain a secure RSA implementation. In the special case of CRT implementations, many protections have been proposed and most of them have been proven insufficient to ensure resistance against DFA. In the present paper, we show that the Ciet-Joye method proposed in FDTC'2005 [10] does not completely prevent fault injection attacks: for a CRT-RSA with a 1024-bit modulus, we show that 13 faulty signatures are enough to recover the secret exponent with a probability greater than 50%, which can be improved to 99% with 83 faulty signatures.