Energy consumption of block ciphers is critical in resource constrained devices. Unrolling has been explored in literature as a technique to increase efficiency by eliminating energy spent in loop control elements such as registers and multiplexers. However these savings are minimal and are offset by the increase in glitching power that comes with unrolling. We propose an efficient latch-based glitch filter for unrolled designs that reduces energy per encryption by an order of magnitude over a straightforward implementation, and by 28-45 percent over the best existing glitch filtering schemes. We explore the optimal number of glitch filters that should be used in order to minimize total energy, and provide estimates of the area cost. Partially unrolled designs also benefit from using our scheme with energies competitive to fully serialized implementations. Power gating to reduce leakage power and reuse of computed key enable unrolled designs to be more efficient than serialized ones without compromising latency advantages. We demonstrate our approach on the SIMON-128 and AES-128 block ciphers.

Small-footprint implementations of the advanced encryption standard (AES) algorithm are of interest in resource-constrained applications like Internet of Things (IoT). Symmetries in AES allow the datapath to be scaled down to the S-Box width of 8 bits, but the ShiftRows operation leads to a potential data hazard that must be avoided. The common method for resolving the ShiftRows hazard wastes power by moving data through a sequence of pipelined registers. We present in this article a novel 8-bit AES architecture that solves data movement inefficiencies by renaming registers and saves clock power with a single state update per AES round. We then extend register renaming to include microarchitectural randomization to mitigate susceptibility to side-channel attacks, which are a concern especially for low power implementations of AES. We fabricate and evaluate our designs in a commercial 16-nm FinFET technology. Testchip measurements show that the register renaming architecture encrypts data at 0.55 pJ/bit at nominal voltage, a 2.2× improvement over a state-of-the-art reference 8-bit design implemented in the same technology. Side-channel evaluation indicates that the randomized variant of register renaming significantly reduces vulnerability to differential power analysis (DPA).

As FPGA use becomes more diverse, the shared use of these devices becomes a security concern. Multi-tenant FPGAs that contain circuits from multiple independent sources or users will soon be prevalent in cloud and embedded computing environments. The recent discovery of a new attack vector using neighboring long wires in Xilinx SRAM FPGAs presents the possibility of covert information leakage from an unsuspecting user's circuit. The work described in this paper makes two contributions that dramatically extend this finding. First, we rigorously evaluate several Intel SRAM FPGAs and confirm that long wire information leakage is also prevalent in these devices. Second, we present the first successful attack on an unsuspecting circuit in an FPGA using information passively obtained from neighboring long-lines. Information obtained from a single AES S-box input wire combined with analysis of encrypted output is used to rapidly expose an AES key. This attack is performed remotely without modifying the victim circuit, using electromagnetic probes or power measurements, or modifying the FPGA in any way. We show that our approach is effective for three different FPGA devices. Our results demonstrate that the attack can recover encryption keys from AES circuits running at 10MHz, and has the capability to scale to much higher frequencies.

Sub-round implementations of AES have been explored as an area and energy efficient solution to encrypt data in resource constrained applications such as the Internet of Things. Symmetry in AES operations across bytes and words allows the datapath to be scaled down to 8 bits resulting in very compact designs. However, such designs incur an area penalty to store intermediate results or energy penalty to shift data through registers without performing useful computation. We propose a smart clocking scheme and rename registers to minimize data movement and clock loading, and also avoid storing a duplicate copy of the system state. In comparison to the most efficient 8-bit implementation from literature, we save 45% energy per encryption and reduce clock energy by 70% at a reasonable area cost.