State-of-the-art hardware masking approaches like threshold implementations and domain-oriented masking provide a guaranteed level of security even in the presence of glitches. Although provable secure in theory, recent work showed that the effective security order of a masked hardware implementation can be lowered by applying a multi-probe attack or exploiting externally amplified coupling effects. However, the proposed attacks are based on an unrealistic adversary model (i.e. knowledge of masks values during profiling) or require complex measurement setup manipulations.In this work, we propose a novel attack vector that exploits location dependent leakage from several decoupling capacitors of a modern System-on-Chip (SoC) with 16 nm fabrication technology. We combine the leakage from different sources using a deep learning-based information fusion approach. The results show a remarkable advantage regarding the number of required traces for a successful key recovery compared to state-of-the-art profiled side-channel attacks. All evaluations are performed under realistic conditions, resulting in a real-world attack scenario that is not limited to academic environments.

Power analysis attacks have evolved rapidly over the past two decades, recently strengthened by advanced deep learning algorithms. However, the application of effective countermeasures such as masking is often challenging in practice due to restricted power and area resources of cryptographic devices. On the other hand, lightweight hiding methods like random data delays often introduce only a small amount of entropy in the execution process, and thus provide only a moderate level of protection. In this work, we propose and evaluate a generic hiding countermeasure based on dynamic clock frequency randomization. We exploit runtime reconfiguration of modern reconfigurable devices to produce a highly unstable clock signal, which yields up to 20 million different execution times for an AES encryption operation. Our design not only creates heavy misalignments in the power traces, but is also highly customizable and can be easily composed with other side-channel countermeasures. We test our approach using recently proposed evaluation methods for desynchronized power traces including sliding-window correlation analysis and deep neural networks. The results show that none of the attacks is able to recover the secret key with one million power traces. Furthermore, we could not detect any first-order leakage in five million encryptions using state-of-the-art leakage assessment.