This work presents a power side-channel analysis (SCA) of a lightweight cryptography (LWC) algorithm, XOODYAK, implemented on an FPGA. First, we perform generic leakage detection tests for two phases of authenticated encryption with associated data (AEAD) mode, namely INITIALIZE, and ABSORB. Second, we develop novel hypothetical attack models for correlation power analysis (CPA) and demonstrate a success rate (SR) of 92%/82% and minimum-traces-to-disclosure (MTD)=13K/38K on the INITIALIZE/ABSORB phases, respectively. Third, we evaluate ABSORB against Profiled SCA using convolutional neural network (CNN), and achieve SR=96%/64% and MTD=2K/16K on the test set for the same/different keys used for training, respectively. Finally, we suggest low-overhead countermeasures to protect against these SCA attacks.

We propose design methodologies for building a compact, unified and programmable cryptoprocessor architecture that computes post-quantum key agreement and digital signature. Synergies in the two types of cryptographic primitives are used to make the cryptoprocessor compact. As a case study, the cryptoprocessor architecture has been optimized targeting the signature scheme ’CRYSTALS-Dilithium’ and the key encapsulation mechanism (KEM) ’Saber,’ both finalists in the NIST's post-quantum cryptography standardization project. The programmable cryptoprocessor executes key generations, encapsulations, decapsulations, signature generations, and signature verifications for all the security levels of Dilithium and Saber. On a Xilinx Ultrascale+ FPGA, the proposed cryptoprocessor consumes 18,406 LUTs, 9,323 FFs, 4 DSPs, and 24 BRAMs. It achieves 200 MHz clock frequency and finishes CCA-secure key-generation/encapsulation/decapsulation operations for LightSaber in 29.6/40.4/ 58.3$\mu$s; for Saber in 54.9/69.7/94.9$\mu$s; and for FireSaber in 87.6/108.0/139.4$\mu$s, respectively. It finishes key-generation/sign/verify operations for Dilithium-2 in 70.9/151.6/75.2$\mu$s; for Dilithium-3 in 114.7/237/127.6$\mu$s; and for Dilithium-5 in 194.2/342.1/228.9$\mu$s, respectively, for the best-case scenario. On UMC 65 nm library for ASIC the latency is improved by a factor of two due to a 2× increase in clock frequency.

While cryptographic implementations provide computational security in circuits and systems, hardware attack techniques, e.g., electromagnetic (EM) side-channel analysis (SCA) attack can still break through. The commonplace countermeasures for EM SCA attack require significant overheads in terms of power consumption. This article explores an on-chip capacitive sensing technique for the purpose of detection of an approaching EM probe even before an attack is performed, thereby alleviating the overheads incurred by any countermeasure against such attacks. Different type of capacitive structures are considered in regards to sensitivity and area. The proposed method of coplanar capacitive asymmetry sensing (CEASE) consists of a grid of four metal plates of the same size and dimensions determined through design space exploration. A comparison between the capacitive and inductive sensing technique is also performed in terms of detection range through theoretical arguments and EM simulation. A$>$17% change in capacitance is shown at a distance of 1 mm, implying a$>10\times $improvement in the detection range over inductive sensing methods. Furthermore, at 0.1-mm distance, a$>$45% change in capacitance is observed, leading to a$>3\times $and$>11\times $sensitivity improvement over capacitive parallel plate sensing and inductive sensing, respectively.

Securing ICs are becoming increasingly challenging with rapid improvements in electromagnetic (EM) side-channel analysis (SCA) and fault injection (FI) attacks. In this work, we develop a pro-active approach to detect and counter these attacks by embedding a single on-chip integrated loop around a crypto core (AES-256), designed and fabricated using TSMC 65nm process. The measured results demonstrate that the proposed system 1) provides EM-Self-awareness by acting as an on-chip H-field sensor, detecting voltage/clock glitching fault-attacks; 2) senses an approaching EM probe to detect any incoming threat; and 3) can be used to induce EM noise to increase resilience against EM attacks. This work combines EM analysis, ML based secured system and shows the efficacy by measurements from custom-built 65nm CMOS IC.

This work presents a Cross-device Deep-Learning based Electromagnetic (EM-X-DL) side-channel analysis (SCA) on AES-128, in the presence of a significantly lower signal-to-noise ratio (SNR) compared to previous works. Using a novel algorithm to intelligently select multiple training devices and proper choice of hyperparameters, the proposed 256-class deep neural network (DNN) can be trained efficiently utilizing pre-processing techniques like PCA, LDA, and FFT on measurements from the target encryption engine running on an 8-bit Atmel microcontroller. In this way, EM-X-DL achieves >90% single-trace attack accuracy. Finally, an efficient end-to-end SCA leakage detection and attack framework using EM-X-DL demonstrates high confidence of an attacker with <20 averaged EM traces.

This work presents a white-box modeling of the electromagnetic (EM) leakage from an integrated circuit (IC) to develop EM side-channel analysis (SCA)-aware design techniques. A new digital library cell layout design technique is proposed to minimize the EM leakage and is evaluated using a high-frequency structure simulator (HFSS)-based framework. Backed by our physics-based understanding of EM radiation, the proposed double-row power grid-based digital cell layout design shows$>5\times $reduction in the EM SCA leakage compared to the traditional digital logic gate layout design. Furthermore, exploiting the magneto-quasistatic (MQS) regime of operation of the EM leakage from the CMOS circuits, the HFSS-based framework is utilized to develop a pre-silicon (Si) EM SCA evaluation technique to assess the vulnerability of cryptographic implementations against such attacks during the design phase itself.

Electromagnetic (EM) side-channel analysis (SCA) attack, which breaks cryptographic implementations, has become a major concern in the design of circuits and systems. This paper focuses on EM SCA and proposes the detection of an approaching EM probe even before an attack is performed. The proposed method of co-planar capacitive asymmetry sensing consists of a grid of four metal plates of the same size and dimension. As an EM probe approaches the sensing metal plates, the symmetry of the sensing metal plate system breaks, and the capacitance between each pair diverge from their baseline capacitances. Using Ansys Maxwell Finite Element Method (FEM) simulations, we demonstrate that the co-planar capacitive asymmetry sensing has an enhanced detection range compared to other sensing methods. At a distance of 1 mm between the sensing metal plates and the approaching EM probe, it shows >17 % change in capacitance, leading to a > 10 × improvement in detection range over the existing inductive sensing methods. At a distance of 0.1 mm, a > 45% change in capacitance is observed, leading to a > 3 × and > 11 × sensitivity improvement over capacitive parallel sensing and inductive sensing respectively. Finally, we show that the co-planar capacitive asymmetry sensing is sensitive to both E-field and H-field probes, unlike inductive sensing which cannot detect an E-field probe.

Electromagnetic (EM) side-channel analysis (SCA) attack, which breaks cryptographic implementations, has become a major concern in the design of circuits and systems. This paper presents the design and analysis of the EM side-channel attack detection system utilizing patterned-ground co-planar capacitive asymmetry sensing (PG-CAS) for approaching probe, targeting to improve sensitivity, detection range, and power consumption compared to LC oscillator utilizing inductive sensing. The PG-CAS consists of a grid of four metal plates of the same size at the top metal layer and a patterned ground plane at a lower metal. As an EM probe approaches, electric field lines between the plates and plate-ground get distorted, thereby breaking the symmetry of the inter-plate and the plate-ground capacitance system and this change in capacitance is sensed. The PG-CAS circuit consists of two LC oscillators, mixer, low pass filter (LPF), resistive feedback amplifier (RFA) and a digital logic. By down-converting sensing signal to low-frequency using mixer, LPF, RFA and digital logic, the detection range is significantly improved. At a distance of 1 mm between the sensing metal plates and the approaching EM probe, system-level simulation results using TSMC 65nm technology and Ansys Maxwell show a > 10% change in the output frequency from the baseline frequency, leading to a > 10× improvement in the detection range and a ~ 3× improvement in power consumption over existing inductive sensing methods.

Capability architectures for memory safety have traditionally required expanding pointers and radically changing microarchitectural structures throughout processors, while only providing superficial hardening. We hence propose Cryptographic Capability Computing (C3) - the first memory safety mechanism that is stateless to avoid requiring extra metadata storage. C3 retains 64-bit pointer sizes providing legacy binary compatibility while imposing minimal touchpoints. Pointers are encrypted to unforgeably (within cryptographic bounds) reference each object. Data is encrypted even in caches and entangled with pointers for both spatial and temporal object-granular protection. Pointers become like unique keys for each allocation. C3 deploys a novel form of prediction for address translation that mitigates performance overheads even when addresses are partially encrypted. Use of a low-latency, low-area cipher from the NIST Lightweight Cryptography project avoids delaying loads by readying a data keystream by the time data is returned from the L1 cache. C3 is compatible with legacy binaries. Simulated performance overhead on SPEC CPU2006 is negligible with no memory overhead, which is a big leap forward compared to the overheads imposed by past memory safety approaches. C3 effectively replaces inefficient metadata with efficient cryptography.

Developers have access to a wide range of storage APIs and functionality in large-scale systems, such as relational databases, key-value stores, and namespaces. However, this diversity comes at a cost: each API is implemented by a complex distributed system that is difficult to develop and operate. Delos amortizes this cost by enabling different APIs on a shared codebase and operational platform. The primary innovation in Delos is a log-structured protocol: a fine-grained replicated state machine executing above a shared log that can be layered into reusable protocol stacks under different databases. We built and deployed two production databases using Delos at Facebook, creating nine different log-structured protocols in the process. We show via experiments and production data that log-structured protocols impose low overhead, while allowing optimizations that can improve latency by up to 100X (e.g., via leasing) and throughput by up to 2X (e.g., via batching).

We present the design of a novel low latency, bit length parameterizable cipher, called the "K-Cipher". K-Cipher is particularly useful to applications that need to support ultra low latency encryption at arbitrary ciphertext lengths. We can think of a range of networking, gaming and computing applications that may require encrypting data at unusual block lengths for many different reasons, such as to make space for other unencrypted state values. Furthermore, in modern applications, encryption is typically required to complete inside stringent time frames in order not to affect performance. K-Cipher has been designed to meet these requirements. In the paper we present the K-Cipher design and discuss its rationale. We also present results from our ongoing security analysis which suggest that only 2 to 4 rounds are sufficient to make the cipher operate securely. Finally, we present synthesis results from 2-round 32-bit and 64-bit K-Cipher encrypt datapaths, produced using Intel’s ® 10 nm process technology. Our results show that the encrypt datapaths can complete in no more than 767 psec, or 3 clocks in 3.9-4.9 GHz frequencies, and are associated with a maximum area requirement of 1875 m2.

This article, for the first time, demonstrates Cross-device Deep Learning Side-Channel Attack (X-DeepSCA), achieving an accuracy of > 99.9%, even in presence of significantly higher inter-device variations compared to the inter-key variations. Augmenting traces captured from multiple devices for training and with proper choice of hyper-parameters, the proposed 256-class Deep Neural Network (DNN) learns accurately from the power side-channel leakage of an AES-128 target encryption engine, and an N-trace (N ≤ 10) X-DeepSCA attack breaks different target devices within seconds compared to a few minutes for a correlational power analysis (CPA) attack, thereby increasing the threat surface for embedded devices significantly. Even for low SNR scenarios, the proposed X-DeepSCA attack achieves ~ 10× lower minimum traces to disclosure (MTD) compared to a traditional CPA.

Power side-channel analysis (SCA) has been of immense interest to most embedded designers to evaluate the physical security of the system. This work presents profiling-based cross-device power SCA attacks using deep-learning techniques on 8-bit AVR microcontroller devices running AES-128. First, we show the practical issues that arise in these profiling-based cross-device attacks due to significant device-to-device variations. Second, we show that utilizing principal component analysis (PCA)-based preprocessing and multidevice training, a multilayer perceptron (MLP)-based 256-class classifier can achieve an average accuracy of 99.43% in recovering the first keybyte from all the 30 devices in our data set, even in the presence of significant interdevice variations. Results show that the designed MLP with PCA-based preprocessing outperforms a convolutional neural network (CNN) with four-device training by ~20% in terms of the average test accuracy of cross-device attack for the aligned traces captured using the ChipWhisperer hardware. Finally, to extend the practicality of these cross-device attacks, another preprocessing step, namely, dynamic time warping (DTW) has been utilized to remove any misalignment among the traces, before performing PCA. DTW along with PCA followed by the 256-class MLP classifier provides ≥10.97% higher accuracy than the CNN-based approach for cross-device attack even in the presence of up to 50 time-sample misalignments between the traces.

Side-channel attacks are a potent threat to the security of devices implementing cryptographic algorithms. Designing lightweight countermeasures against side-channel analysis that can run on resource constrained devices is a major challenge. One such lightweight countermeasure is shuffling, in which the designer randomly permutes the order of execution of potentially vulnerable operations. State of the art shuffling countermeasures advocate shuffling a set of independent operations in a single round of a cryptographic algorithm, but are often found to be insufficient as standalone countermeasures. In this paper, we propose a two-round version of the shuffling countermeasure, and test its security when applied to a serialized implementation of AES-128 using Test Vector Leakage Assessment (TVLA). Our results show that the required number of traces to break AES-128 implemented using our proposed countermeasure is significantly larger than the implementations using simple one-round shuffling. Furthermore, the new shuffling method has significantly lower overhead of around 1.3 times, as compared to other side-channel countermeasures such as masking that have an overhead of approximately two times.

This paper deals with the design and implementation of the post-quantum public-key algorithm McEliece. Seamless incorporation of a new error generator and new SHA-3 module provides higher indeterminacy and more randomization of the original McEliece algorithm and achieves CCA2 security standard. Due to the lightweight and high-speed implementation of SHA-3 module the proposed 128-bit secure McEliece architecture provides 6% higher performance in only 0.78 times area of the best known existing design.

This paper presents a 128-bit CCA2-secure McEliece cryptoprocessor. The existing side-channel vulnerabilities in this regard are also taken care during the implementation of such a post-quantum immune code-based cryptosystem. In order to achieve CCA2 security on original McEliece algorithm, we incorporate a SHA-3 finalist, BLAKE-512 module into the architecture. A complete binary-XGCD algorithm for Goppa field is introduced. The final design on a Virtex-6 FPGA performs an encryption in${\bf 4.74}\nbsp \mu {\mbi{s}}$and a decryption in${\bf 0.92}\nbsp {\mbi{ms}}$. To the best of our knowledge, this is the first hardware design of McEliece with the above mentioned advanced security features which is also resistant against existing timing attacks.

Test compression is widely used for reducing test time and cost of a very large scale integration circuit. It is also claimed to provide security against scan-based side-channel attacks. This paper pursues the legitimacy of this claim and presents scan attack vulnerabilities of test compression schemes used in commercial electronic design automation tools. A publicly available advanced encryption standard design is used and test compression structures provided by Synopsys, Cadence, and Mentor Graphics design for testability tools are inserted into the design. Experimental results of the differential scan attacks employed in this paper suggest that tools using X-masking and X-tolerance are vulnerable and leak information about the secret key. Differential scan attacks on these schemes have been demonstrated to have a best case success rate of 94.22% and 74.94%, respectively, for a random scan design. On the other hand, time compaction seems to be the strongest choice with the best case success rate of 3.55%. In addition, similar attacks are also performed on existing scan attack countermeasures proposed in the literature, thus experimentally evaluating their practical security. Finally, a suitable countermeasure is proposed and compared to the previously proposed countermeasures.

This paper is devoted to the design and the physical security of a parallel dual-core flexible cryptoprocessor for computing pairings over Barreto-Naehrig (BN) curves. The proposed design is specifically optimized for field-programmable gate-array (FPGA) platforms. The design explores the in-built features of an FPGA device for achieving an efficient cryptoprocessor for computing 128-bit secure pairings. The work further pinpoints the vulnerability of those pairing computations against side-channel attacks and demonstrates experimentally that power consumptions of such devices can be used to attack these ciphers. Finally, we suggest a suitable countermeasure to overcome the respective weaknesses. The proposed secure cryptoprocessor needs 1 730 000, 1 206 000, and 821 000 cycles for the computation of Tate, ate, and optimal-ate pairings, respectively. The implementation results on a Virtex-6 FPGA device shows that it consumes 23 k Slices and computes the respective pairings in 11.93, 8.32, and 5.66 ms.

This paper describes the systematic design methods of an embedded co-processor for a post quantum secure McEliece cryptosystem. A hardware/software co-design has been targeted for the realization of McEliece in practice on low-cost embedded platforms. Design optimizations take place when choosing system parameters, algorithm transformations, architecture choices, and arithmetic primitives. The final architecture consists of an 8-bit PicoBlaze softcore for flexibility and several parallel acceleration units for throughput optimization. A prototype of the co-processor is implemented on a Spartan-3an xc3s1400an FPGA, using less than 30% of its resources. On this FPGA, one McEliece decryption of an 80-bit security level takes less than 100K clock cycles corresponding to only 1 ms at a clock frequency of 92 MHz. This is 10 times faster and 3.8 times smaller than the existing design.

Scan-chains are test infrastructures included in a circuit for providing high fault coverage. However, they can be exploited by an attacker as a side-channel in the case of a cryptographic application like AES. Test Compression and thereafter X-tolerance and X-masking over it, which reduce test effort without compromising on testability, can help in counteracting scan-based attacks. This work focuses on the security issues of an AES-circuit containing test compression with X-masking and X-tolerance logic. With experimental results, we show the weakness of such an AES circuit against our modified differential scan-attack. Finally, the paper outlines two suitable countermeasures to prevent such attacks.

Masking of gates is one of the most popular techniques to prevent differential power analysis (DPA) of AES algorithm. It has been shown that the logic circuits used in the implementation of cryptographic algorithms leak side-channel information inspite of masking, which can be exploited, in differential power attacks. The phenomenon in CMOS circuits responsible for the leakage of masked circuits is known as glitching. Motivated by this fact, the authors analyse the effect of glitches in CMOS circuits against masked implementation of the AES S-box. The authors explicitly demonstrate that glitches do not affect always. There exists a relation between combinational path delay of the circuit and timing difference of input vectors to the circuit, which has a bearance on the amount of information leaked by the masked gates. A balanced masked S-box circuit is proposed where the inputs are synchronised by sequential components. Detailed SPICE results are shown to support the claim that the modifications indeed reduce the vulnerability of the masked AES S-box against DPA attacks.

This paper deals with FPGA and ASIC implementations of side-channel attack resistant elliptic curve cryptosystems defined over GF(p). The elegance of the design lies in the fact that all operations are performed in binary number system, thus reducing conversion overheads of existing architectures. In our implementation, point addition and point doubling operations are performed in affine coordinates. They are performed using same amount of computation, which provides a secure design against timing and power analysis attacks. Implementation and side-channel analysis results are compared with related existing designs.

This paper presents the architecture and FPGA implementation of a robust GF(p) parallel arithmetic unit. The most efficient modular multiplication, inversion and division units greatly reduce the clock cycles requirement for point operations applicable to elliptic curve cryptography. The parallel arithmetic unit helps to achieve a high speed up in cryptographic applications. The architecture can resist the cryptographic timing attack. Integrated input and output interface units provide lower bandwidth requirement to plug in the architecture with automated cryptographic systems. The design exhibits its elegance among competitive architecture with respect to throughput and robustness.

This paper presents an FPGA based hardware design for full search block matching (FSBM) based motion estimation (ME) in video compression. The significantly higher resolution of HDTV based applications is achieved by using FSBM based ME. The proposed architecture uses a modification of the sum-of-absolute-differences (SAD) computation in FSBM such that the total number of additions/subtraction operations is drastically reduced. This successfully optimizes the conflicting design requirements of high throughput and small silicon area. Comparison results demonstrate the superior performance of our architecture. Finally, the design of a reconfigurable block matching hardware has been discussed.