Considering side-channel analysis (SCA) security for cryptographic devices, the mitigation of electromagnetic (EM) leakage and EM interference (EMI) between modules poses significant challenges. This article presents a comprehensive review and deep analysis of the utilization of EMI shielding materials, devised for reliability purposes and standards such as EMI/EMC, as a countermeasure to enhance EM-SCA security. We survey the current landscape of EMI shields materials, including conductive polymers, metal-foams, carbon-based materials, and meta-materials, evaluating their effectiveness in attenuating emissions and preventing information leakage, a task done with security-centric metrics for such materials for the first time. Through a systematic examination of existing literature, experimental studies and a construction of fully simulatable EM environment in ANSYS-solver, we identify key factors influencing the performance of EMI shield materials, such as shielding-effectiveness (SE), bandwidth, thickness, and material properties, on security characteristics. We devise a connection between SE and cryptographic-SNR, and we demonstrate from real hardware measurements how and in what conditions can such materials provide very high security levels. By synthesizing insights from multidisciplinary research domains, this article aims to provide valuable two-way benefit and guidance for researchers, engineers, and practitioners in the design and deployment of robust side-channel security measures leveraging EMI shields, already in utilization devised by reliability standards.

High-performance crypto-engines have become crucial components in modern System-On-Chip (SoC) architectures across platforms, from servers to edge-IoTs’. Alas, their secure operation faces a significant obstacle caused by information-leakage accessed through Side-Channel Analysis (SCA). Adversaries exploit statistical-analysis techniques on measured (e.g.,) power and timing signatures generated during (e.g.,) encryption, extracting secrets. Mathematical countermeasures against such attacks often impose substantial power-performance-area overheads. Dynamic Voltage and Frequency Scaling (DVFS) techniques provide power-efficiency by varying power consumption according to workload; these modulations are called power-states. Unintentionally, DVFS introduces new inherent weaknesses exploitable by malicious actors: power-states leak information in both power and timing side-channels, measurable in software and hardware. We introduce a method to increase side-channel resistance using integrated voltage regulators and DVFS: (1) Pushing known prior-art in the topic to Ultra Low Power (ULP) regime (2) For the first time introducing a mechanism to aid in counteracting the inherent weakness of DVFS in SCA (3) Providing measurements performed on 40 nm process ULP PLS15 test-chip down at 580 mV power-supply (4) Offering improved and parameterized resistance to remote -timing vulnerabilities inherent to DVFS. We present various results and perform a detailed analysis while comparing performance and security to prior-art. Importantly, our solution is configurable in terms of security, maintaining degrees-of-freedom for power-optimization of DVFS.

This article discusses the critical issue of the remote extraction of information from radio-enabled embedded systems, and focuses on sources emanating from micrometer wavelengths. These sources include intra-chip or inter-device buses and board-level routing traces, within tens of centimeters of the system’s transmission antenna or front end (FE). Traditionally, side-channel analysis (SCA) attacks center on micrometer-level signal that emanate direct near-field information detectable within centimeters. Simple power analysis (SPA) attacks focus similarly over stronger signals and fewer statistics. Here, however, we turn to typically larger elements corresponding to larger wavelengths than previously reported. Recent discoveries reveal that radio-enabled systems can transmit data over far-field distances, which can be analyzed via SCA-like methods. Studies have also described direct data extraction from centimeter to tens of centimeters-scale sources such as SATA, USB, and others. These sources act as substantial transmission antennas. This article differs considerably from these works, since it targets intermediate wavelengths which find their way to leak into the RF-FE. We document a significant security challenge: nearly all signals within embedded systems, even serial ports, DMA-controlled memory access, and others, leak what can be considered to practically be raw information with high-SNR over tens of centimeters to the RF-FE. This has strong implications for signal integrity, security, and standards related to electromagnetic compatibility (EMC), signal shielding, and interference (EMI, RFI). We show that onboard signals with galvanic connections to the RF-FE-chip and onboard signals without galvanic connections to the RF-FE-chip are coupled, amplified and transmitted with high SNR, which enables quasi-raw extraction. We further demonstrate how sophisticated adversaries can build code-injection gadgets that can carry sensitive data and modulate the stream to be optimally extracted by the RF-channel. Practical demonstrations using commercial and low-cost equipment reinforce our claims. Specifically, we show that without concrete interference and isolation standards designed with security in mind, mitigating these leakages remains a challenge.

Electromagnetic (EM) side channel analysis (SCA) attacks have evolved to a significant threat for integrated circuits (ICs). Radiation, emanated from devices which manipulate sensitive information, carries it with a sufficient signal-to-noise ratio. Security evaluation in design stages, from a model or from a simulation, is complicated and hard to argue for correctness. Extensive literature exist on attacks utilizing EM signals. However, both frontiers of simulatability and modeling of the radiation have shown rather little research effort in the past in the SCA context. On simulatability prior work investigated utilization of complete EM physical solvers, such as COMSOL, HFSS which require much effort from the user/engineer to model the electronic environment, or alternatively used simulated (SPICE) currents within IC’s design kits and from it provide analytical estimation. On the modeling side, efforts were mainly limited to either: a specific EM component (e.g., magnetic), very limited scope of the model, or a limited connection with real-life IC. The main contributions of this research are: 1) providing a fully analytical model of the radiated signal considering the ground plane of the substrate and the medium change from oxidation layers to other mediums, such as air or plastic, utilizing EM theory-of-images for both E and H fields; 2) providing methodologies to simulate EM signals on IC-technologies (by adapting Cadence EMX tool); and 3) demonstrating little error between the analytical and simulated models and linking cryptographic SCA security metrics to the analytical tools. The developed model provides significant added value for security architects, faster, premanufacturing evaluation and a verifiability framework through IC tool.

Masking is a systematic countermeasure to achieve side-channel security for cryptographic algorithms. However, its secure implementation relies on an independence assumption that can be violated by signal coupling. It has been established that coupling induced within a device can be detrimental. It was demonstrated on a$1^{st}$-order secure design (i.e., with two shares) that an adversary who can manipulate the design’s power-measurement setup can externally induce significant coupling. It can thus concretely reduce the “effective-security-order”, i.e., make$1^{st}$-order leakages as significant as$2^{nd}$-order ones with fewer measurements. This paper explores the impact of such external amplification phenomena on fabricated hardware test cases for the first time. We designed a dedicated ASIC to extend the empirical results for demonstrating impact up to the$4^{th}$order. We have systematically evaluate d factors related to adversarial control, e.g., the external measurement resistance. We also investigate d their relative influence compared to intra-design ones, i.e., internal power-grid resistance and transistors’ inherent resistance. Our study demonstrates that externally amplified coupling scale s up to concrete masked hardware designs with various amounts of shares and is not very sensitive to intra-design parameters. Therefore, providing experimental evidence that such coupling should be considered during masking validation.

The design of glitch-resistant higher-order masking schemes is an important challenge in cryptographic engineering. A recent work by Mooset al.(CHES 2019) showed that most published schemes (and all efficient ones) exhibit local or composability flaws at high security orders, leaving a critical gap in the literature on hardware masking. In this article, we first extend the simulatability framework of Belaïdet al.(EUROCRYPT 2016) and prove that a compositional strategy that is correct without glitches remains valid with glitches. We then use this extended framework to prove the first masked gadgets that enable trivial composition with glitches at arbitrary orders. We show that the resulting “Hardware Private Circuits” approach the implementation efficiency of previous (flawed) schemes. We finally investigate how trivial composition can serve as a basis for a tool that allows verifying full masked hardware implementations (e.g., of complete block ciphers) at any security order from their HDL code. As side products, we improve the randomness complexity of the best published refreshing gadgets, show that some S-box representations allow latency reductions and confirm practical claims based on implementation results.

Modern electronic systems become evermore complex, yet remain modular, with integrated circuits (ICs) acting as versatile hardware components at their heart. Electronic design automation (EDA) for ICs has focused traditionally on power, performance, and area. However, given the rise of hardware-centric security threats, we believe that EDA must also adopt related notions like secure by design and secure composition of hardware. Despite various promising studies, we argue that some aspects still require more efforts, for example: effective means for compilation of assumptions and constraints for security schemes, all the way from the system level down to the "bare metal"; modeling, evaluation, and consideration of security-relevant metrics; or automated and holistic synthesis of various countermeasures, without inducing negative cross-effects.In this paper, we first introduce hardware security for the EDA community. Next we review prior (academic) art for EDA-driven security evaluation and implementation of countermeasures. We then discuss strategies and challenges for advancing research and development toward secure composition of circuits and systems.

Side channel analysis attacks are considered an extreme hardware security hazard for cryptographic devices. There are numerous approaches to prevent attackers from extracting useful information from secured devices. Nonetheless the cost of implementing an effective countermeasure is usually very high in terms of area/performance. In this paper we propose a novel approach to the temporal redistribution of the power information. Specifically, we present a circuit level methodology that makes it possible to manipulate the three main parameters of the current profile during the clock period: the start time of the computation, the duration and the amplitude. The effectiveness of the proposed countermeasure was evaluated on a 4-bit cryptographic function in a 65nm TSMC process. The simulation results indicate that the number of secret bits that leaked from the protected design (i.e., the mutual information) was reduced dramatically from 4 bits to 0.85 bits. In addition, at least 1500 ideal noise-free power traces were required to extract these bits, whereas less than 150 traces were required to extract the whole 4 bits from the unprotected design. The sensitivity of the protected circuit to process and environmental variations are minimal, with measured standard deviation of 0.1bit. The area overhead is up to 32%.

The unique ability of dual mode logic (DML) to self-adapt to computational needs by providing high speed and/or low energy consumption is demonstrated for the first time by silicon measurements in 28nm FD-SOI. At the gate level, the DML design offers the possibility to operate either in the static mode to save energy, or in the dynamic mode to increase speed albeit with higher delay or energy consumption, respectively. In this demonstration, the two operational modes are dynamically managed by a self-adjustment mechanism to increase speed or reduce energy of the design at run-time. As a test case a two-stage pipelined multiply-accumulate (MAC) circuit was selected to assess the advantages of DML in terms of speed, energy and area as compared to a conventional CMOS design. We show that the self-adjusted DML MAC achieves both a performance boost of up to 92% and 16% less energy consumption than the equivalent standard CMOS implementation. The energy saved can be even greater (-35%) when the low-power (fully static) mode is enabled. In addition, the DML MAC occupies 25% less area.

Information leakage through physical channels is a major hurdle in embedded hardware security. This paper overviews the three key factors in the embedded hardware security space, focusing on gray-box (bounded resources) power analysis attacks: the adversary's knowledge and abilities, the security metrics used by adversaries' and security evaluators and gate-level countermeasures. A new design paradigm, dubbed pAsynch, that utilizes internal signals and random signals to uniformly spread the information-carrying energy within the clock period in a specific way with a resolution below the band-width and noise-filtering abilities of advanced measurement equipment is introduced. The advantages and design challenges introduced by the pAsynch paradigm are discussed.

Leakage of information through the power supply current has become a major factor in logic design. In this paper, a low cost and simple to employ design methodology dubbed pseudoasynchronous is presented. This design style combines the security advantages of asynchronous circuits with the ease of synchronous circuit design. Randomization and data-dependencies (DD) are utilized to hide information leakage from the current dissipation, and hence making the critical synchronization of power supply current traces hard to do. In addition, randomization and DD are utilized for both time-domain hiding of information leakage during the active region (dynamic currents) and for amplitude-domain hiding of information leakage during the static-region (leakage currents). The main advantages of this new approach are low area cost, reduced signal, and increased noise. Circuit-level analyses show that it is harder to exploit the information leakage from internal signals of the proposed design than from CMOS-based synchronous designs or other forms of time-domain hiding countermeasures.

For the first time, the Dual Mode Logic (DML) technique is evaluated in 28 nm UTBB FD-SOI technology, with the goal of improving energy efficiency for wide supply voltage operation range. By combining the operating characteristics of the DML and the extended body bias capability of the technology, energy efficient digital circuits that can effectively benefit from adaptive voltage and frequency scaling techniques can be defined. This manuscript reports evaluations of the DML against conventional static and dynamic CMOS logics for two benchmarks in the 0.3V-1V supply voltage range. First, a NAND-NOR chain was considered. Simulation results showed that the DML approach assures roughly the 40% savings in terms of energy consumption with respect to the static CMOS implementation and improves the speed about 20% in comparison to the dynamic CMOS design. Second, a 16-bit Carry Skip Adder was considered. Due to the unique capability of the DML to switch on-the-fly between static and dynamic modes of operation, an improvement of more than 20% in terms of EDP was obtained in comparison to the conventional CMOS adder design.

First-order and high-order correlation-power-analysis attacks have been shown to be a severe threat to cryptographic devices. As such, they serve as a security measure for evaluation and comparison of security-oriented implementations. When properly designed, data-dependent delays can be used as a barrier to these attacks. This paper introduces a security-oriented delay assignment algorithm for mitigating single and multibit attacks. The algorithm enables a reduction of the correlation between the processed data and the consumed current by utilizing the data-dependent delays as a source of correlated noise. This is done while minimizing the area overhead, propagation time, and power. We show that for the same security level this new algorithm provides X2 and X6 more area efficiency, and X1.5 and X2.25 higher frequencies than a permuted path delay assignment and random embedding of delay elements.

Recently, we proposed a low-granularity back-bias control technique [1] optimized for the ultra-thin body and box (UTBB) fully-depleted silicon-on-insulator (FD-SOI) technology. The technique was preliminary evaluated through the design of a low-voltage 8-bit ripple carry adder (RCA), showing very competitive energy and delay values. In this paper, the characteristics of the low-granularity back-biasing control are explored considering as benchmarks basic logic gates as well as adders with different bit lengths. All the designed circuits were compared to their equivalent dynamic threshold voltage MOSFET (DTMOS) and conventional CMOS designs. The higher efficiency of low granularity body bias control is emphasized by the single well layout strategy, offered by the 28 nm UTBB FD-SOI technology, thus leading our approach to achieve competitive silicon area occupancy along with significant performance and energy improvements. More precisely, post-layout simulations have demonstrated that circuits designed according the suggested strategy, can achieve a delay reduction of 33% compared to conventional CMOS designs, whereas the energy consumption can be reduced down to 46% compared to DTMOS solutions, for a supply voltage of 0.4V. These results were obtained while maintaining robustness against process and temperature variations.

Recently, a novel dual mode logic (DML) family was proposed. This logic allows operation in two modes: 1) static and 2) dynamic modes. DML gates, which can be switched between these modes on-the-fly, feature very low power dissipation in the static mode and high performance in the dynamic mode. A basic DML gate is very simple and is composed of any static logic family gate and an additional clocked transistor. In this paper, we introduce the logical effort (LE) methodology for the CMOS-based DML family. The proposed methodology allows path length minimization, delay optimization, and delay estimation of DML logic. This is done by development of complete and approximated LE models, which allows easy extraction of design optimization parameters, such as optimum number of stages, gates sizing factors, and delay estimations. The proposed optimization is shown for the dynamic mode of operation. Theoretical mathematical analysis is presented, and efficiency of the proposed methodology is shown in a standard 40-nm CMOS process.

A novel high speed Carry Look Ahead Adder (CLA) is presented. The proposed CLA is implemented using Dual Mode Logic (DML) methodology, as recently introduced by our group. DML allows dynamic switching between static and dynamic modes of operation. In static mode, the DML gates feature very low power dissipation with moderate performance, while in dynamic mode they achieve higher performance, albeit with increased power dissipation. The proposed CLA utilizes this powerful ability of DML by a dynamic selection of critical paths according to the input vectors. The chosen critical paths are operated in the dynamic mode and improve the CLA delay. The rest of the CLA operates in the DML static mode, improving CLA power consumption. A 32 bit DML CLA was designed in a 40nm low power TSMC process. Simulation results showed 45% gain in speed and 70% in power dissipation, when compared to the CMOS and dynamic CLAs, respectively.