RISC-V has emerged as a viable solution on academia and industry. However, to use open source hardware for safety-critical applications, we need a deep understanding of the way in which well established mechanisms for testing and reliability could be integrated and deployed on the RISC-V ecosystem, and we need a clear knowledge on how such an ecosystem can be leveraged to improve security. This paper includes four contributions presenting the potential of RISC-V in security research, the way in which RISC-V can be hardened against power analysis attacks, how to implement, using RISC-V, software and hardware/software solutions for dual core lock step, and how to perform system-level testing in the RISC-V ecosystem.

Cryptographic algorithm implementations are subject to specific attacks, called side channel attacks, focusing on the analysis of their power consumption or execution time or on the analysis of faulty computations. At FDTC06, Fumaroli and Vigilant presented a generic method to compute an exponentiation resistant against different side channel attacks. However, even if this algorithm does not reveal information on the secrets in case of a fault attack, it can not be used to safely implement a crypto-system involving an exponentiation. In this paper, we propose a new exponentiation method without this drawback and give a security proof of resistance to fault attacks. As an application, we propose an RSA algorithm implemented using the Chinese Remainder Theorem protected against side channel attacks. The exponentiation algorithm is also 33% faster than the previous method.

Over the past ten years, cryptographic algorithms have been found to be vulnerable against side-channel attacks such as power analysis attacks, timing attacks, electromagnetic radiation attacks and fault attacks. These attacks capture leaking information from an implementation of the algorithm in software or in hardware and apply cryptanalytical and statistical tools to recover the secret keys. A very well-known countermeasure against these attacks is to randomize every execution of the algorithm and every intermediate piece of data with a so-called masking method. In this paper we demonstrate that traditional countermeasures such as masking methodsfor symmetric cryptosystems are completely inefficient against fault attacks. In other words, differential fault attacks still apply on masked data. As an example we show how to recover secret keys from two masked AES implementations using a basic differential fault attack.

Flash memory is a type of non-volatile semiconductor memory that can be electrically erased and programmed. It can be found in almost every high-capacity consumer electronic device in the market. Examples of such mass memory products include USB flash drives, digital cameras, mobile handsets, set-top boxes for Pay-TV applications, and many more. Some of them use NAND flash technology and others use NOR flash technology. To put it simply, NAND flash is the most adequate for mass-storage of user data because of its high speed access and because the organization of user data is usually error-tolerant (digital pictures, music) and NOR flash is more adequate for code-type data because of its highly reliable nature and its XIP (execute in place) capability, meaning that a program stored in NOR flash does not need to be transferred to RAM before being executed. When it comes to set-top boxes or handsets, manufacturers and operators are becoming increasingly security concerned. Conditional Access providers do not want to see their operating system and security codes dispatched over the internet and mobile phone operators fear that viruses or Trojan horses will eventually reach the handset platform. Thus new security features start appearing on those types of flash memory devices. Another sector which needs increasing data and program storage capacity is the smart card industry. Current high-end cards have a few hundred kilobytes of embedded ROM and EEPROM memory to hold their operating system and application data when several megabytes would ideally be required. The new high density smart cards will address such requirements in the near future by providing increased on-board storage capacity. The question then becomes how to reach the required security level operators expect for all these new devices.