ElectroMagnetic Fault Injection (EMFI) is a hard-ware attack technique that uses EM perturbations to deliberately induce faults in integrated circuits for attack purposes. In this paper, we propose to use a Digital Sensor (DS) based on a Time-to-Digital Converter (TDC) to detect such EMFI attacks. A TDC uses a delay line to sense variations in a device’s core voltage at the rate of its clock. Thus, it can detect EMFI attacks involving voltage and clock signal perturbations. The sensor output is expressed as a digital index, FN, which captures EMFI-induced delay variations. We evaluated the sensor’s effectiveness on real silicon using an FPGA test vehicle through extensive experiments. The results demonstrate that a single sensor can efficiently detect 100% of faults injected into an AES crypto-accelerator while ensuring wide circuit area coverage, with a highly negligible 1% false alarms rate thanks to the proposed differential fault detection methodology. To ascertain the sensor’s robustness, experiments were conducted under various thermal and noise conditions. Beyond fault detection, the sensor provides insight into the EMFI mechanism. The observed behavior is consistent with a timing constraint violation fault model.

Though considered secure the cryptographic hardware can be compromised by fault injection attack, especially laser illumination due to its precision in targeting specific areas and its fine temporal control. To address this threat, this paper presents a low-cost detection scheme that utilizes Time-to-Digital Converters (TDCs) to sense the IR drops induced by laser illumination. To achieve a high detection rate while minimizing false alarms, the proposed approach incorporates multiple sensors, with as few as two sensors demonstrated in the study. The effectiveness of the scheme is validated using a real laser setup to illuminate a targeted AES module implemented on an AMD/Xilinx Artix-7 FPGA.

This paper introduces a novel sensor that is capable of detecting faults injected by electromagnetic disturbances. The sensor has been designed from an understanding of the physical mechanisms of ElectroMagnetic Fault Injection (EMFI). A recent study has identified an EMFI mechanism based on the timing violation fault model, which highlights the coexistence of two distinct mechanisms: electromagnetic disturbances that are coupled to the target’s power distribution network, which can cause timing faults by extending the propagation time of logic gates beyond the clock period, and disturbances that are coupled to the target’s clock distribution network, which can cause timing constraint violations due to EMFI-induced voltage glitches within the target’s clock tree. Building on this work, we have investigated the mechanism of EMFI-induced clock glitches, providing useful insights for designing a new sensor. The sensor incorporates two dummy clock paths that are maintained in a frozen state within the circuit. Both paths are respectively capable of detecting both positive and negative EMFI-induced glitches along these paths. The proposed sensor offers significant advantages, including full digitization, ease of implementation, low cost in terms of silicon area, low power consumption, and a high fault detection rate. Accurate design and experimental tests were performed on an FPGA board. Validation experiments were supported by spatial and temporal sensitivity maps covering the full-frequency spectrum of the target, which confirmed the effectiveness of the sensor.

Abstract Protecting sensitive logic functions in ASICs requires side-channel countermeasures. Many gate-level masking styles have been published, each with pros and cons. Some styles such as RSM, GLUT, and ISW are compact but can feature 1st-order leakage. Some other styles, such as TI, DOM, and HPC are secure at the 1st-order but incur significant overheads in terms of performance. Another requirement is that security shall be ensured even when the device is aged. Pre-silicon security evaluation is now a normatively approved method to characterize the expected resiliency against attacks ahead of time. However, in this regard, there is still a fragmentation in terms of leakage models, Points of Interest (PoI) selection, attack order, and distinguishers. Accordingly, in this paper we focus on such factors as they affect the success of side-channel analysis attacks and assess the resiliency of the state-of-the-art masking styles in various corners. Moreover, we investigate the impact of device aging as another factor and analyze its influence on the success of side-channel attacks targeting the state-of-the-art masking schemes. This pragmatic evaluation enables risk estimation in a complex PPA (Power, Performance, and Area) and security plane while also considering aging impacts into account. For instance, we explore the trade-off between low-cost secure styles attackable at 1st-order vs high-cost protection attackable only at 2nd-order.

Masking is one of the most well-established methods to thwart side-channel attacks. Many masking schemes have been proposed in the literature, and code-based masking emerges and unifies several masking schemes in a coding-theoretic framework. In this work, we investigate the side-channel resistance of code-based masking from a non-profiling perspective by utilizing correlation-based side-channel attacks. We present a systematic evaluation of correlation attacks with various higher-order (centered) moments and then present the form of optimal correlation attacks. Interestingly, the Pearson correlation coefficient between the hypothetical leakage and the measured traces is connected to the signal-to-noise ratio in higher-order moments, and it turns out to be easy to evaluate rather than launch repeated attacks. We also identify some ineffective higher-order correlation attacks at certain orders when the device leaks under the Hamming weight leakage model. Our theoretical findings are verified through both simulated and real-world measurements.

Laser Fault Injection Attacks (LFIA) are a major concern in physical security of electronic circuits as they allow an attacker to inject a fault with a very high spatial accuracy. They are also often considered by information technology security evaluation facilities (ITSEFs) to deliver security certification, as Common Criteria, of embedded systems. Time or spatial redundancy can be foreseen as protection methods but they are costly and do not ensure immunity against multiple laser injections. The detection would be efficient if the detecting sensors meet enough density and sensitivity to cover the functional blocks being protected. Most sensors rely on analog and specific technology. In this article, we propose a method to detect LFIAs via a fully digital sensor based on a time to digital converter (TDC) and show its efficacy in detecting such faults in various conditions related to the current induced by the laser, the characteristics of the power grid network (PGN) of the circuit and the environmental variables (voltage, temperature). The simulation results obtained using a 45nm Nangate technology confirms the high efficiency of the proposed scheme in detecting LFIAs in a large range of such conditions.

Profiling side-channel analysis (SCA) attacks have received a lot of attention in the recent years. To perpetrate these attacks, the adversary creates a profile of a sensitive device at her disposal, and uses it to model a target device with a similar implementation to extract its key. Template attacks are recognized to be the most powerful profiling attacks when the measurement noise is Gaussian. To tackle SCA attacks, different countermeasures have been proposed in the literature, among which masking schemes have received the utmost attention. By adding randomness to the circuit, masking schemes prevent the adversary from relating the power consumption to the evaluated data, thus making the attack more difficult. In this article, we study the protection provided by several masking schemes against template attacks. More precisely, we investigate how the success of the template attack is changed when there is a misalignment between the target and profiling devices in terms of temperature and process variations. As another innovative analysis angle, we extensively study the impact of device aging on the template attack and demonstrate quantitatively how aging misalignments in side-channel traces, between the profiling and the target devices, do hinder the attack. The main objective of this study is to get accurate and numerous results allowing the designer to compare different implementations of masking and accordingly choose one which corresponds to the best compromise among complexity, security, and sensitivity to temperature and aging. We target the S-Box module of the unprotected PRESENT cipher along with its five masking variants including global lookup table (GLUT), rotating S-Box masking (referred to as RSM-LOG hereafter), RSM with read-only memory (RSM-ROM), Ishai-Sahai–Wagner masking (ISW), and threshold implementation (TI). The unprotected circuit gets impacted by such aging misalignments with$\approx 12.5$% increase in the number of traces needed to reach 80% success rate (SR) in the course of 20 weeks of aging at 105 °C. Such increase is 23.3%, 37.19%, and 38.24% for ISW, GLUT, and RSM-LOG, respectively. For RSM-ROM such increase is 193.37% for ten weeks of aging. Interestingly, TI is not much affected by aging in this regard.

Fault injection attacks can be carried out against an operating circuit by exposing it to EM perturbations. These attacks can be detected using embedded digital sensors based on the EM fault injection mechanism, as the one introduced by El Baze et al. [1] which uses the sampling fault model [2], [3]. We tested on an experimental basis the efficiency of this sensor embedded in the AES accelerator of an FPGA. It proved effective when the target was clocked at moderate frequency (the injected faults were consistent with the sampling fault model). As the clock frequency was progressively increased, faults started to escape detection, which raises warnings about possible limitations of the sampling model. Further tests at frequencies close to the target maximal frequency revealed faults injected according to a timing fault model. Both series of experimental results ascertain that EM injection can follow at least two different fault models. Undetected faults and the existence of different fault injection mechanisms cast doubt upon the use of sensors based on a single model.

Investigating the dynamics and mechanisms of Electromagnetic Fault Injection (EMFI) attacks, which expose an active circuit to electromagnetic disturbances, presents a persisting challenge due to the diverse and complex fault mechanisms involved. An improved understanding of EMFI modeling is paramount for developing proficient on-chip detection sensors, serving as countermeasures to these attacks. In light of this, our research evaluated the effectiveness of EMFI detection sensors, introduced by Elbaze et al., which rest on the premise that the sampling fault model accounts for EMFI. To assess the functionality of these sensors, we integrated them into an Advanced Encryption Standard (AES) accelerator of a Field-Programmable Gate Array (FPGA) and performed a series of experiments. The resulting evidence suggests that the explanation for EMFI is not a singular fault model but rather, two underlying mechanisms are implicated. At high frequencies, which corresponds to low slack, electromagnetic disturbances, in tandem with the target's Power Distribution Network (PDN), initiated timing constraint violations. This violation subsequently increased the logic propagation times, surpassing the clock period. Contrarily, at low to moderate frequencies, the induced faults generally aligned with the sampling fault model. However, certain deviations from the theoretical framework called into question the model's validity. Upon a deeper examination of the results, we determined that these faults, rather than being sampling faults, were tied to a different mechanism. Electromagnetic disturbances, when coupled with a target's Clock Distribution Network (CDN), can cause timing constraint violations due to EMFI-induced voltage glitches within the target's clock tree. By integrating the mechanisms of EMFI-induced clock glitches and timing faults into the timing violations fault model, we attain a holistic comprehension of EMFI mechanisms. It encapsulates both mechanisms induced by EMFI, spanning the full-frequency spectrum of the target.

Aggressive scaling continues to push technology into smaller feature sizes and results in more complex systems in a single chip. With such scaling, various robustness concerns have come into account among which the change of circuits' properties during their lifetime, so-called device aging, has received a lot of attention. Due to aging, the electrical behavior of transistors deviates from its original intended one resulting in degrading the chip's performance, and ultimately the chip fails to provide correct outputs. Thereby, prognosis of circuit performance degradation during the runtime, before the chip actually fails is highly crucial in increasing the reliability of chips. Accordingly in this paper, we develop a machine-learning based framework that, leveraging the outcome of embedded time-to-digital-convertors (so-called "digital sensors''), predicts aging-induced degradation. This information can be used to prevent chip failures via deploying Dynamic Voltage and Frequency Scaling (DVFS).

Secure chips implement cryptographic algorithms and protocols to ensure self-protection (e.g., firmware authenticity) as well as user data protection (e.g., encrypted data storage). In turn, cryptography needs to defer to incorruptible sources of entropy to implement their functions according to their mandatory usage guidance. Typically, keys, nonces, initialization vectors, tweaks, etc. shall not be guessed by attackers. In practice, True Random Number Generators (TRNGs) are in charge of producing such sensitive elements.Fully aware of the central role of TRNGs in the proper implementation of security in chips, stakeholders have been formalizing the requirements recently. The methods to strengthen such requirements are manifold. In this paper, we discuss and apply three of them by targeting the Set-Reset Latch TRNG which is an alternative to Ring-Oscillator (RO) TRNGs as it provides faster throughputs. The first method concerns the confidence in the TRNG being random enough. It explores how the TRNG properties can be reliably predicted by simulation, compared to real silicon experiments. The second aspect dealt with in this paper is the assessment of the TRNG properties over time, i.e., considering the impact of aging in the TRNG properties. Such knowledge is important as secure chips are expected to be in service for a long period, and it would be detrimental to the service they render if the quality of the entropy they deliver would be declining over time. Eventually, the third aspect of this paper is the timely detection of unforeseen failures or malevolent attacks. The mitigation lies in leveraging "health tests" launched prior to using random numbers.This paper focuses on a particular type of TRNG that is not prone to biasing by attackers: it is the so-called Set-Reset Latch (SR-latch) TRNG and exploits a race condition in an arbitration gate. Such kind of TRNG is of great practical interest as an alternative design compared to the mainstream "Ring Oscillator" TRNG, and it is also very amenable to analyses by various sorts of simulations aiming at properly characterizing its security in various operational environments.

Due to the rising number of sophisticated customer functionalities, electronic control units (ECUs) are increasingly integrated into modern automotive systems. However, the high connectivity between the in-vehicle and the external networks paves the way for hackers who could exploit in-vehicle network protocols' vulnerabilities. Among these protocols, the Controller Area Network (CAN), known as the most widely used in-vehicle networking technology, lacks encryption and authentication mechanisms, making the communications delivered by distributed ECUs insecure. Inspired by the outstanding performance of bidirectional encoder representations from transformers (BERT) for improving many natural language processing tasks, we propose in this paper “CAN-BERT”, a deep learning based network intrusion detection system, to detect cyber attacks on CAN bus protocol. We show that the BERT model can learn the sequence of arbitration identifiers (IDs) in the CAN bus for anomaly detection using the “masked language model” unsupervised training objective. The experimental results on the “Car Hacking: Attack & Defense Challenge 2020” dataset show that “CAN-BERT” outperforms state-of-the-art approaches. In addition to being able to identify in-vehicle intrusions in real-time within 0.8 ms to 3 ms w.r.t CAN ID sequence length, it can also detect a wide variety of cyberattacks with an F1-score of between 0.81 and 0.99.

Internet-of- Things (IoT) devices are natural targets for side-channel attacks. Still, side-channel leakage can be com-plex: its modeling can be assisted by statistical tools. Projection of the leakage into an orthonormal basis allows to understand its structure, typically linear (1st-order leakage) or non-linear (sometimes referred to as glitches). In order to ensure cryptosystems protection, several masking methods have been published. Unfortunately, they follow different strategies; thus it is hard to compare them. Namely, ISW is constructive, GLUT is systematic, RSM is a low-entropy version of GLUT, RSM-ROM is a further optimization aiming at balancing the leakage further, and TI aims at avoiding, by design, the leakage arising from the glitches. In practice, no study has compared these styles on an equal basis. Accordingly, in this paper, we present a consistent methodology relying on a Walsh-Hadamard transform in this respect. We consider different masked implementations of substitution boxes of PRESENT algorithm, as this function is the most leaking in symmetric cryptography. We show that ISW is the most secure among the considered masking implementations. For sure, it takes strong advantage of the knowledge of the PRESENT substitution box equation. Tabulated masking schemes appear as providing a lesser amount of security compared to unprotected counterparts. The leakage is assessed over time, i.e., considering device aging which contributes to mitigate the leakage differently according to the masking style.

Network Intrusion Detection Systems (NIDSs) are widely regarded as efficient tools for securing in-vehicle networks against diverse cyberattacks. However, since cyberattacks are always evolving, signature-based intrusion detection systems are no longer adopted. An alternative solution can be the deployment of deep learning based intrusion detection system which play an important role in detecting unknown attack patterns in network traffic. Hence, in this paper, we compare the performance of different unsupervised deep and machine learning based anomaly detection algorithms, for real-time detection of anomalies on the Audio Video Transport Protocol (AVTP), an application layer protocol implemented in the recent Automotive Ethernet based in-vehicle network. The numerical results, conducted on the recently published “Automotive Ethernet Intrusion Dataset show that deep learning models significantly outperfom other state-of-the art traditional anomaly detection models in machine learning under different experimental settings.

International audience

Profiling side-channel attacks in which an adversary creates a “profile” of a sensitive device and uses such a profile to model a target device with similar implementation has received the lion’s share of attention in the recent years. In particular, template attacks are known to be the most powerful profiling side-channel attacks from an information theoretic point of view. When launching such an attack, the adversary first builds a model based on the leakage of the profiling (training) device in his disposal, which is then exploited in the second phase of the attack (i.e., matching) to extract the key from the target device. Discrepancies between the device used for modeling and the target device affect the attack success. The effect of process variation and temperature misalignment between the profiling and target devices in the template attack’s success has been studied extensively in the literature, while the impact of device aging on the template attack’s success is yet to be investigated thoroughly. This article moves one step forward and studies the impact of device aging, mainly bias temperature instability (BTI) and hot carrier injection (HCI), in the devices that have been protected against power analysis attacks via dual rail logics. In particular, we focus on the wave dynamic differential logic (WDDL) circuits, and via extensive transistor-level simulations, we will show how device aging misalignments between the profiling and target devices can hinder template attacks for both unprotected and WDDL protected counterparts. We mounted several attacks on the PRESENT cipher, with and without WDDL protection, at different temperatures and aging times. Our results show that the attack is more difficult if there is an aging-duration mismatch between the training and target devices, and the attack-efficiency decrease is especially significant for mismatches of few weeks.

Physical Unclonable Functions (PUFs) leverage manufacturing variations to generate device-specific keys during runtime only, overcoming the need for protection after power-off as for Non-Volatile Memory. The main challenges of PUF-based key storage are reliability of the response and sensitivity to Side-Channel Analysis (SCA). Oscillator-based PUFs are particularly sensitive to frequency spectrum SCA. Existing countermeasures can protect sign-based bit derivation that requires error correction or discarding unreliable bits to achieve reliable key generation. Amplitude-based bit derivation enhances the reliability of oscillator-based PUFs without discarding unsteady response bits, keeping a high entropy. However, existing lightweight countermeasures against SCA are not applicable for this case. This raises the demand for an alternative solution. This work targets the protection of amplitude-based bit derivation combined with the Loop PUF, an oscillator-based PUF primitive well suited for key generation. It presents the Interleaved Challenge Loop PUF (ICLooPUF), a side-channel-hardened offspring of the Loop PUF that uses dynamic challenge interleaving. The SCA-protected PUF primitive is applicable to amplitude-based and sign-based bit derivation methods, and requires a low hardware overhead. Theoretical and experimental results show the efficiency of the protection mechanism.

Code-based masking is a recent line of research on masking schemes aiming at provably counteracting side-channel attacks. It generalizes and unifies many masking schemes within a coding-theoretic formalization. In code-based masking schemes, the tuning parameters are the underlying linear codes, whose choice significantly affects the side-channel resilience. In this paper, we investigate the exploitability of the information leakage in code-based masking and present attack-based evaluation results of higher-order optimal distinguisher (HOOD). Particularly, we consider two representative instances of code-based masking, namely inner product masking (IPM) and Shamir’s secret sharing (SSS) based masking. Our results do confirm the state-of-the-art theoretical derivatives in an empirical manner with numerically simulated measurements. Specifically, theoretical results are based on quantifying information leakage; we further complete the panorama with attack-based evaluations by investigating the exploitability of the leakage. Moreover, we classify all possible candidates of linear codes in IPM with 2 and 3 shares and (3, 1)-SSS based masking, and highlight both optimal and worst codes for them. Relying on our empirical evaluations, we therefore recommend investigating the coding-theoretic properties to find the best linear codes in strengthening instances of code-based masking. As for applications, our attack-based evaluation directly empowers designers, by employing optimal linear codes, to enhance the protection of code-based masking. Our framework leverages simulated leakage traces, hence allowing for source code validation or patching in case it is found to be attackable.

Unintentional uncontrollable variations in the manufacturing process of integrated circuits are used to realize silicon primitives known as physical unclonable functions (PUFs). These primitives are used to create unique signatures for security purposes. Investigating the vulnerabilities of PUFs is of utmost importance to uphold their usefulness in secure applications. One such investigation includes exploring the susceptibility of PUFs to modeling attacks that aim at extracting the PUFs’ behavior. To date, these attacks have mainly focused on a single PUF instance where the targeted PUF is attacked using the model built based on the very same PUF’s challenge–response pairs or power side channel. In this article, we move one step forward and introduceCross-PUFattacks where a model is created using the power consumption of one PUF instance to attack another PUF created from the same GDSII file. Through SPICE simulations, we show that these attacks are highly effective in modeling PUF behaviors even in the presence of noise and mismatches in temperature and aging of the PUF used for modeling versus the targeted PUF. To mitigate theCross-PUFattacks, we then propose a lightweight countermeasure based on dual-rail and random initialization logic approaches called DRILL. We show that DRILL is highly effective in thwartingCross-PUFattacks.

To enhance the security of digital circuits, there is often a desire to dynamically generate, rather than statically store, random values used for identification and authentication purposes. Physically Unclonable Functions (PUFs) provide the means to realize this feature in an efficient and reliable way by utilizing commonly overlooked process variations that unintentionally occur during the manufacturing of integrated circuits (ICs) due to the imperfection of fabrication process. When given a challenge, PUFs produce a unique response. However, PUFs have been found to be vulnerable to modeling attacks where by using a set of collected challenge response pairs (CRPs) and training a machine learning model, the response can be predicted for unseen challenges. To combat this vulnerability, researchers have proposed techniques such as Challenge Obfuscation. However, as shown in this paper, this technique can be compromised via modeling the PUF's power side-channel. We first show the vulnerability of a state-of-the-art Challenge Obfuscated PUF (CO-PUF) against power analysis attacks by presenting our attack results on the targeted CO-PUF. Then we propose two countermeasures, as well as their hybrid version, that when applied to the CO-PUFs make them resilient against power side-channel based modeling attacks. We also provide some insights on the proper design metrics required to be taken when implementing these mitigations. Our simulation results show the high success of our attack in compromising the original Challenge Obfuscated PUFs (success rate > 98%) as well as the significant improvement on resilience of the obfuscated PUFs against power side-channel based modeling when equipped with our countermeasures.

In this paper, we present a method to obtain a new Laser Fault Injection (LFI)-induced fault model: replay of instructions on a 32-bit Microcontroller (MCU). This method allows a potential adversary to replay a block of two or four instructions with a fault rate up to 100%. These faults are induced by laser pulses and cause the instructions updating process of a Flash buffer to fail. As a result, the new instructions failing to be stored in the Flash buffer, the previous ones are replayed. We deeply studied the properties of this replay fault model by many experiments of laser fault injections. We have notably shown that the sensitivity window is proportional to the laser Pulse Width (PW), and that up to 20 instructions in a row were tested to be overwritten due to replaying five times the block of four instructions. The effects of the laser power and cache status (enabled or disabled) are also presented. Finally, we proposed and assessed a simple method to detect the LFI-induced replay faults using a hardware counter with different increments. Our results extend the ability of LFI on MCU, illustrating the accuracy and reproducibility of LFI.

Embedded technologies such as IoTs, connected cars or medical equipment are often executed in constrained environment with limited resources. The high demand of security makes cryptography essential. Moreover, the security must consider physical attacks as these objects are physically accessible and can be tampered with. Lightweight Cryptography (LWC) proposes interesting candidates for securing the communications in constrained environments. As many lightweight cryptographic algorithms have been proposed with closed architectures, the features of agility and genericity could be considered. Moreover, a high robustness against side-channel analysis (SCA) is required when the connected object executes sensitive applications or manipulates private data.In this work, we propose the use of Rotating SBox Masking (RSM) protection as a generic protection that would fit most lightweight block cipher, more specifically those using 4×4 substitution boxes. This protection is developed as an extension to the RISC-V ISA through the use of additional generic instructions. This specific instruction set was implemented on the VexRisc core processor and tested with a protected implementation of the PRESENT cipher. It is easily portable to most nibble-based LWC cipher types. The security analysis of this secure RISC-V processor showed that SCA were impossible with up to 1 million traces.

In this paper, we report on a method for obtaining faults using Laser Fault Injection (LFI) in a 32-bit Microcontroller (MCU) from the Flash interface to the execution pipeline via the AHB bus. Different fault behaviors were obtained at six positions along the instruction channel. Instruction(s) were observed to be faulted with a reproducibility of 100% at each position. By collecting the faults on all the positions together and analyzing their behaviors, the faults were identified and characterized. The faults on the Flash interface buffer are different depending on the cache operation modes. When the cache is disabled, the fault is related to a block of 32 bits, whereas when the cache is enabled, the fault is related to a block of 64 bits. Two fault models, namely, replay and skip of instructions block were obtained depending on the injection position. The fault happening at the AHB bus is with a block of two instructions in both cache operation modes. Depending on the injection position, two fault models of replay and skip of two instructions were also observed. The faults on the core pipeline are related to a single instruction. The fault behavior is such that both the fetch and execution stages were faulted. The skip of a single instruction was obtained by faulting either the fetch or the execution stage of the core pipeline. By increasing the Pulse Width (PW), tens to more than one hundred of instructions were faulted at each position. The impacts of LFI parameters such as the PW and the power on the faults were studied. In addition, we compared skip fault models achieved at different positions. Our results illustrate the spatial and temporal accuracy of the LFI, thus pointing out the vulnerable positions and unveiling information of the device architecture.

The demand for Internet of Things services is increasing exponentially, and consequently a big number of devices are being deployed. To efficiently authenticate these services, the use of Physical Unclonable Functions (PUF) has been introduced as a promising solution that is suitable for the resource-constraint nature of these devices. A growing number of PUF architectures has been demonstrated mathematically clonable through Machine Learning (ML) modeling techniques. The use of ML PUF models has been recently proposed to authenticate the IoT objects. This procedure facilitates the scalability of the authentication process by reducing the storage space required for each device. Nonetheless, the leakage scenario of the PUF model to an adversary due to an insider threat within the organization is not supported by the existing solutions. Hence, the security of these PUF model-based enrollment proposals can be compromised. In this paper, we propose an enrollment solution that exploits a ML PUF model in the authentication process, called Water-PUF. Our enrollment scheme is based on a specifically designed black-box watermarking technique for PUF models with a binary output response. This procedure prevents an adversary from relying on the watermarked model in question or another derivative model to bypass the authentication. Therefore, any leakage of the watermarked PUF model that is used for the enrollment does not affect the correctness of the protocol. The Water- PUF design is validated by a number of simulations against numerous watermark suppression attacks to assess the robustness of our proposal.

Detection of abnormal behaviors is essential in complex and/or strategic systems requiring a high level of safety and security. Sensing environmental conditions to ensure that the device is not operating out-of-specifications is highly useful in detecting anomalies caused by failures or malevolent actions. In this regard, digital sensors (DSs) are particularly attractive as they are portable and can be easily calibrated. In contrast to analog sensors, DSs have an interesting property that considers the operating environmental conditions as a whole, i.e., they are sensitive to temperature, voltage, and process altogether, without precise knowledge about each. This property endows DSs with fewer false positives compared to analog sensors. This article studies a low-cost DS, discusses its presilicon architecture and post-silicon calibration such that it detects system failures accurately in the designer's preferable range of operating conditions. The impact of aging in this sensor is studied extensively. Tradeoffs between false positive and undetection rates are discussed. As an example, we target the substitution box (S-Box) of the PRESENT cipher assuming that it can be the target of fault injection attacks launched via abruptly changing the operating temperature and voltage. We show that such malfunction can be accurately detected by our DS, i.e., with a very negligible percentage of false and missed alarms (<; 1% totally). The results show that the number of false alarms raises with aging (while the rate is highly negligible), whereas the number of missed alarms remains at a reasonable low rate.

Masking is one of the most popular countermeasures to protect cryptographic implementations against side-channel analysis since it is provably secure and can be deployed at the algorithm level. To strengthen the original Boolean masking scheme, several works have suggested using schemes with high algebraic complexity. The Inner Product Masking (IPM) is one of those. In this paper, we propose a unified framework to quantitatively assess the side-channel security of the IPM in a coding-theoretic approach. Specifically, starting from the expression of IPM in a coded form, we use two defining parameters of the code to characterize its side-channel resistance. In order to validate the framework, we then connect it to two leakage metrics (namely signal-to-noise ratio and mutual information, from an information-theoretic aspect) and one typical attack metric (success rate, from a practical aspect) to build a firm foundation for our framework. As an application, our results provide ultimate explanations on the observations made by Balasch et al. at EUROCRYPT'15 and at ASIACRYPT'17, Wang et al. at CARDIS'16 and Poussier et al. at CARDIS'17 regarding the parameter effects in IPM, like higher security order in bounded moment model. Furthermore, we show how to systematically choose optimal codes (in the sense of a concrete security level) to optimize IPM by using this framework. Eventually, we present a simple but effective algorithm for choosing optimal codes for IPM, which is of special interest for designers when selecting optimal parameters for IPM.

This study investigates a new side-channel leakage observed in the inner rounds of an unrolled hardware implementation of block ciphers in a chosen-input attack scenario. The side-channel leakage occurs in the first round and it can be observed in the later inner rounds because it arises from path activation bias caused by the difference between two consecutive inputs. Therefore, a new attack that exploits the leakage is possible even for unrolled implementations equipped with countermeasures (masking and/or deglitchers that separate the circuit in terms of glitch propagation) in the round involving the leakage. We validate the existence of such a unique side-channel leakage through a set of experiments with a fully unrolled PRINCE cipher hardware, implemented on a field-programmable gate array (FPGA). In addition, we verify the validity and evaluate the hardware cost of a countermeasure for the unrolled implementation, namely the Threshold Implementation (TI) countermeasure.

Thanks to the imperfections in manufacturing process, Physically Unclonable Functions (PUFs) produce their unique outputs for given input signals (challenges) fed to identical circuitry designs. PUFs are often used as hardware primitives to provide security, e.g., for key generation or authentication purposes. However, they can be vulnerable to modeling attacks that predict the output for an unknown challenge, based on a set of known challenge/response pairs (CRPs). In addition, an attacker may benefit from power side-channels to break a PUFs' security. Although such attacks have been extensively discussed in literature, the effect of device aging on the efficacy of these attacks is still an open question. Accordingly, in this paper, we focus on the impact of aging on Arbiter-PUFs and one of its modeling-resistant counterparts, the Voltage Transfer Characteristic (VTC) PUF. We present the results of our SPICE simulations used to perform modeling attack via Machine Learning (ML) schemes on the devices aged from 0 to 20 weeks. We show that aging has a significant impact on modeling attacks. Indeed, when the training dataset for ML attack is extracted at a different age than the evaluation dataset, the attack is greatly hindered despite being performed on the same device. We show that the ML attack via power traces is particularly efficient to recover the responses of the anti-modeling VTC PUF, yet aging still contributes to enhance its security.

Lightweight Cryptography (LWC) is suitable for IoTs which require a high level of security while keeping a low complexity. Many lightweight cryptographic algorithms have been proposed to satisfy these requirements. But there is currently no emerging standard concerning the symmetric block ciphering, as every algorithm has its own advantage. For instance one can be optimized for low latency, another one for low complexity but requires more rounds to be cryptographically secure to the detriment of throughput. Hence, a processor able to cope with all the algorithms should be ideal to provide agility, performance and security while keeping an affordable complexity. We present in this paper a specific execution unit of the RISC-V processor which is able to run the most common lightweight 64-bit block ciphers. The gain in performance can reach over a hundred compared to the reference architecture. The acceleration takes advantage of five specific instructions which can easily be adapted to the execution unit of a VexRiscv architecture. The complexity can double when implementing the new execution unit, but provide a high degree of agility and performance when executing most of lightweight cryptographic implementations.

Physically Unclonable Functions (PUFs) allow to extract unique fingerprints from silicon chips. The applications are numerous: chip identification, chip master key extraction, authentication protocol, unique seeding, etc. However, secure usage of PUF requires some precautions. This paper reviews industrial concerns associated with PUF operation, including those occurring before and after market. Namely, starting from PUF “secure” specifications, aligned with state-of-the-art standards, we explore innovative techniques to handle enrollment and subsequent PUF queries, in nominal as well as in adversarial environment.

Timely notification of abnormal behaviors is essential in strategic systems requiring a high level of safety and security. Sensing environmental conditions to ensure that the device is not operating out-of-specifications is highly useful in detecting anomalies caused by failures or malevolent actions. Digital sensors consider the operating environmental conditions as a whole, i.e. they are sensitive to temperature, voltage and process altogether, without precise knowledge about each. This paper proposes a low-cost digital sensor that can detect system failures accurately in the designer's preferable range of operating conditions. Our experimental results show the high accuracy of this sensor in detecting circuits failure which occurred due to change of the operating temperature and supply voltage.

Laser injection is a powerful fault injection technique with a high spatial accuracy which allows an adversary to efficiently extract the secret information from an electronic device. The control and the repeatability of faults requires the attacker to understand the relation of the fault model to the setup (notably the laser spot size) and the process node of the target device. Most studies on laser fault injection report fault models resulting from a photo-electric current in CMOS transistors. This study provides a black-box analysis of the effect of a photo-electric current in floating-gate transistors of two embedded NOR Flash memories from two different manufacturers. Experimental results demonstrate that single-bit bit-set faults can be injected in code and data without corrupting the Flash memory, even with a laser spot of more than 20 μm in diameter, which is several orders of magnitude larger than the process node of the floating-gate transistors in the experiments. This article also presents the specifics of performing a "safe-error" attack on AES, leveraging the previously detailed single-bit bit-set fault model.

The integrated circuits can be exposed to various stresses during run-time due to unexpected environmental conditions or attacks. Ensuring that a circuit is not working out-of-specification via sensing its operating conditions, e.g., temperature and voltage, is highly useful in detecting anomalies. Analog sensors have been used to monitor the operating conditions for a long time, however, weaknesses including lack of portability to thin technology nodes, costly & complex calibration process, and low attack resistance make such sensors inefficient. Digital sensors, via considering the temperature and voltage effects altogether instead of treating each separately, have been demonstrated as a qualified replacement. In this paper, we develop an integrated framework for continuous monitoring of the operating voltage and temperature of each chip. The framework includes an embedded on-chip sensor circuitry along with a Neural Network model that quantifies the temperature and voltage values via processing the data collected by this sensor. The experimental results confirm the high accuracy of the proposed framework in tracking on-chip voltage and temperature variations, i.e., with the average error of 0.014V in a range of 0.65V to 1.4V, and the average error of 3.9°C in a range of -10°C to 150°C, respectively.

The silicon primitives known as Physically Unclonable Functions (PUFs) are used for various security purposes including key generation, device authentication, etc. Due to the imperfections in manufacturing process, PUFs produce their unique outputs (responses) for given input signals (challenges) fed to identical circuitry designs. Although PUFs are deployed to preserve security and are assumed to be unclonable, their functionality may still be compromised by modeling attacks. However, such attacks only target one single PUF aiming at reversing its behavior (based on a subset of its challenge-response pairs), and are not useful for attacking other PUFs. Moreover a subset of the target PUF's response has to be known by the attacker. This paper moves one step forward and investigates the possibility of Cross-PUF attacks in which a particular PUF's power fingerprints can be used to break another PUF's security. In these Cross-PUF attacks, the attacker has at his disposal a reference PUF, and uses its power side-channel to train a machine learning model which can be deployed to attack other identical PUFs. The experimental results show the high success of the proposed attacks even in presence of noise and temperature differences between the target PUF and the one used to train the model. We target arbiter-PUFs but we deduce that the findings extend to all its derivatives, e.g., XOR-PUFs and Feed-Forward-PUFs.

This article proposes highly efficient Advanced Encryption Standard (AES) hardware architectures that support encryption and both encryption and decryption. New operation-reordering and register-retiming techniques presented in this article allow us to unify the inversion circuits in SubBytes and InvSubBytes without any delay overhead. In addition, a new optimization technique for minimizing linear mappings, named multiplicative-offset, further enhances the hardware efficiency. We also present a shared key scheduling datapath that can work on-the-fly in the proposed architecture. To the best of our knowledge, the proposed architecture has the shortest critical path delay and is the most efficient in terms of throughput per area among conventional AES encryption/decryption and encryption architectures with tower-field S-boxes. The proposed round-based architecture can perform AES encryption where block-wise parallelism is unavailable (e.g., cipher block chaining (CBC) mode); thus, our techniques can be globally applied to any type of architecture including pipelined ones. We evaluated the performance of the proposed and some conventional datapaths by logic synthesis with the NanGate 45-nm open-cell library. As a result, we can confirm that our proposed architectures achieve approximately 51-64 percent higher efficiency (i.e., higher bps/GE) and lower power/energy consumption than the other conventional counterparts.

Hardware Trojan Horses and active fault attacks are a threat to the safety and security of electronic systems. By such manipulations, an attacker can extract sensitive information or disturb the functionality of a device. Therefore, several protections against malicious inclusions have been devised in recent years. A prominent technique to detect abnormal behavior in the field is run-time verification. It relies on dedicated monitoring circuits and on verification rules generated from a set of temporal properties. An important question when dealing with such protections is the effectiveness of the protection against unknown attacks. In this paper, we present a methodology based on automatic generation of monitoring and formal verification techniques that can be used to validate and analyze the quality of a set of temporal properties when used as protection against generic attackers of variable strengths.

Fault injection techniques allow an attacker to alter the behavior of an electronic device in order to extract confidential information or be granted unauthorized privileges. To this end, local electromagnetic fault injections (EMFI) are commonly used to corrupt or prevent the execution of instructions. However, little attention is devoted to practical data corruption. This article investigates the local effects of EMFI on data transfer from the Flash memory to the 128-bit data buffer of a cortex-M microcontroller. We demonstrate that the corrupted bits are closely related to the location of the injection probe, allowing us to set or reset from 0 to 128 bits with a byte-level precision. Moreover, the spatial and temporal accuracy of the injection technique allowed us to target the data prefetch mechanism without corrupting the code execution. We highlight the efficiency of the derived fault model with three practical case studies. Firstly, we demonstrate precise key-zeroing and key-setting capability, with further extension to a DFA on the secret key of a cipher from Biham and Shamir, that was never implemented practically. Next, we report practical persistent faults on ARM microcontroller, which allows an attacker to retrieve the secret key of a cipher with a single successful injection.

In this paper we present a hardware based solution to verify simultaneously Code and Control-Flow Integrity (CCFI), aiming at protecting microcontrollers against both cyber-and physical attacks. This solution is non-intrusive as it does not require any modification of the CPU core. It relies on two additional hardware blocks external to the CPU: The first one – called CCFI-cache – acts as a dedicated cache for the storage of information to check the code and control-flow integrity, and the second one – CCFI-checker – performs control-flow and code integrity verification. Based on a RISC-V platform implementation, we show that the proposed scheme is able to perform online CCFI validation at the price of a small hardware area overhead and doubling the size of the. text section. In most cases, the impact on the run-time performance is on average 32 percent, offering for the first time a generic and practical hardware-enabled cyber-security solution.

An SR-latch can be regarded as primitive to build a True Random Number Generation (TRNG) or Physically Unclonable Function (PUF). Indeed, when the SR inputs of the latch are tied together and go from an unknown state (i.e. S=R=1) to a memory state (i.e. S=R=0), the behaviour depends on the balance between the NAND or NOR gates composing the latch. With the process mismatch, there is a great chance that the latch converges towards the same state, thus creating a PUF equivalent to a SRAM-PUF or latch-PUF. However, if the latch is well-balanced, it can enter a metastable state and converges to a stable state depending on the input noise, thus making a TRNG. In order to make sure some latches are able to behave like a TRNG, and some like a PUF, we consider a set of latches driven by the same SR signal. A test-chip in 28nm UTBB-FDSOI technology has been designed with 1024 latches in order to analyze the behavior. The FD-SOI technology enables easy change of the performances of gates using the body biasing, which consists in applying a specific body voltage to each gate. Hence, the two NOR gates composing the SR-latch can be tuned individually to get the optimality, i.e. the maximum entropy, for both PUF and TRNG. The results show that the optimal point is the same for both PUF and TRNG, and that the proposed structure can generate concurrently a PUF with high reliability, and a TRNG with high speed.

Physicallyunclonable functions(PUF) have been used in various applications, such as device authentication, secure storage of sensitive data, and anti-counterfeiting. Different applications require various levels of reliability from the PUF. However, as of today, nopredictivemodel to characterize the PUF reliability has been developed. This is particularly a problem for PUFs with low error rates, because the lower the error rate, the larger the number of measurements required to obtain a good estimate. In this paper, we develop a predictive framework, which enables us to derive a closed-form expression of bothentropyandreliabilityfor several families of delay PUFs: the ring oscillator (RO) PUF, the RO sum PUF as well as the Loop PUF. Improving reliability with bit-filtering, we provide an explicit tradeoff between complexity, reliability and entropy. Error rates as low as 10-9or even lower can be achieved. Our theoretical results are validated by experiments on Loop PUFs implemented in 65 nm CMOS ASIC technology, also used to simulate the behavior of the RO PUF and the RO sum PUF.

Template attack is the most powerful side-channel attack from an information theoretic point of view. This attack is launched in two phases. In the first phase (training) the attacker uses a training device to estimate leakage models for targeted intermediate computations, which are then exploited in the second phase (matching) to extract secret information from the target device. Process variation and discrepancy of operating conditions (e.g., temperature) between training and matching phases adversely affect the success probability of the attack. Attack-success degradation is exacerbated when device aging comes into account. Due to aging, electrical specifications of transistors change over time. Thereby, if the training and target devices have experienced different usage time, the attack will be more difficult. Aging alignment between training and target devices is difficult as aging degradation is highly affected by operating conditions and technological variations. This paper investigates the effect of aging on the success rate of template attacks. In particular, we focus on NBTI and HCI aging mechanisms. We mount several attacks on the PRESENT cipher at different temperatures and aging times. Our results show that the attack is more difficult if there is an aging-duration mismatch between the training and target devices.

With the outsourcing of design flow, ensuring the security and trustworthiness of integrated circuits has become more challenging. Potential malicious modification of circuits, so-called Hardware Trojans Horses (HTH), has emerged as a major security threat. When triggered, the HTH delivers its payload resulting in denial of service, decreasing the device performance, or leaking sensitive information. Deploying VLSI testing schemes to detect HTH may fail in most cases as HTH are designed such that they are rarely activated. Side-channel analysis schemes have a higher detection coverage. The template analysis is the most powerful side-channel tool from an information theoretic point of view. In this paper, we focus on the template analysis used for detecting HTH in cryptographic devices, and study the effect of device aging on the success of these HTH detection schemes. Due to aging, electrical specifications of transistors, and in turn the power signatures used by template schemes change over time. We focus on Negative-Bias Temperature Instability and Hot-Carrier Injection aging mechanisms. We use the PRESENT cipher as a target, and mount several template attacks at different aging times on target devices and a genuine device used as reference. We deduce the authenticity of the target devices based on the attack success rates obtained by template analysis. Our results show that aging makes template-based HTH detection easier as it needs less traces in old devices compared to the new one (137 traces for a 20-week old device versus 195 traces for a new one).

Leakage models, regarded as a bridge between the physical signal and the sensitive operation, have a great influence on the effectiveness of the side channel analysis. The existing leakage models are usually divided into two categories, the non-profiled leakage models which have been chosen before sampling and analyzing, such as Hamming weight and Hamming distance, while the profiled leakage models, whose parameters have to be trained in the profiling phase, such as the Stochastic model of which both coefficient vector and pooled covariance matrix are required to be estimated based on the acquired samples. In general, a profiled leakage model is more accurate than a non-profiled one. However, it may lead to an inefficient attack if the leakage function is inaccurate, e.g., the over-fitting and under-fitting in the profiling phase. In this paper, we mathematically prove the relationship among different stochastic models, and propose a new method named ECM to solve the problem that much time is required to solve matrix in the profiling phase. Replacing the observations in the matrix solution with the average signals, the new method accelerates the construction of any stochastic model significantly, as long as the data-dependent signal has the property equal images under different subkeys. On the basis of theoretical results, we analyze the reasons why over-fitting and under-fitting happen, and quantify the condition when some of them occur. Finally, comparing with the existing construction method (HSS2012), we verify the effectiveness and efficiency of ECM with different metrics. Under the same accuracy, the ECM obviously has lower time complexity than HSS2012.

Side-channel and fault injection attacks are two threats on devices carrying sensitive information. Protections are thus implemented at design time. However, CAD (Computer Aided Design) tools can compromise them, in ways we detail pedagogically in this paper. Then, we explain how a simulation-based methodology allows to check for non-regression, and find problems in case some are introduced while refining the design description from RTL (Register Transfer Level) source code to GDS (Graphic Display System) stream format.

Physically Unclonable Functions (PUFs) are mainly used for generating unique keys to identify electronic devices. The reliability of PUFs needs to be assured under a wide variety of environmental conditions and aging mechanisms. In this paper, we evaluate the impact of NBTI and HCI aging on two types of delay-PUFs (arbiter-PUFs and loop-PUFs). The results show that the switching activity has a limited impact on delay chains and a significant impact on the arbiter (RS latch) of the arbiter-PUF.

Probing attacks are serious threats on integrated circuits. Security products often include a protective layer called shield that acts like a digital fence. In this article, we demonstrate a new shield structure that is cryptographically secure. This shield is based on the lightweight block cipher and independent mesh lines to ensure the security against probing attacks of the hardware located behind the shield. Such structure can be proven secure against state-of-the-art invasive attacks. Then, we evaluate the impact of active shield on the performance of security IPs as PUF, TRNG, secure clock and AES using a set of fabricated ASICs with 65 nm CMOS technology of STMicroelectronics. Also, the impact of active shield on Side-Channel Attack (SCA) is evaluated.

Based on the idea of secret sharing, masking is one of the most popular countermeasure to prevent side channel attacks (SCAs). Despite the redundant time and resource consumption, the existing masking schemes have constant speed and resources, and thus unsuitable for different applications with variable demand for time or space. Motivated by the reconfiguration technology of programmable hardware and disjunctive normal form expression of any logic function, we define a random variable logic circuit to reach the same security for any-order masking schemes. During the encryption, we induce random sequences and utilize them as configuration sequences to generate variable logic circuits, whose results are independent from the original and divided into several shares. We call our new approach polynomial function division (PFD) masking. Furthermore, we analyze the effectiveness and proof the security of PFD in theory. Our experiments using PFD on the advanced encryption standard (AES) algorithm show that the space complexity is almost as small as an implementation of the original AES without any countermeasure. Moreover, due to the flexible structure of PFD, the cost-to-efficiency ratio of PFD is much lower than state-of-the art in software, and its flexibility is coin with the reconfigurable chip.

Masking is a class of well-known countermeasure against side-channel attacks by employing the idea of secret sharing. In this paper, we propose a generic table recomputation-based masking scheme at any chosen order t, named divided S-box masking (DSM), and its security has been proved under the security framework from Crypto 2003. The table recomputation-based masking is suitable for software implementation and the masked table can be stored in memory, where it can be accessed fast. For any input, DSM scheme generates n output shares by two queries. DSM scheme requires two vectors L and R, and a matrix M of random numbers. Each element of L is the XOR result of the output of S-box and n - 1 random numbers. These n - 1 random numbers are stored in two lines of M and R which is a vector of indexes for the second query. Furthermore, we performed the attacks on the software implementation of DSM to evaluate its practical security, and compared the timing and space complexity with the existing table recomputation-based masking in the same platform to verify the advantage of the DSM.

Electromagnetic injection (EMI) is a powerful and precise technique for fault injection in modern ICs. This intentional fault can be utilized to steal secret information hidden inside of ICs. Unlike laser fault injection, tedious package decapsulation is not needed for EMI, which reduces an attacker's cost and thus causes a serious information security threat. In this paper, a PLL-based sensor circuit is proposed to detect EMI reactively on chip. A fully automatic design flow is devised to integrate the proposed sensor together with a cryptographic processor. A high fault detection coverage and a small hardware overhead are demonstrated experimentally on an FPGA platform.

A novel “interclass information” side-channel distinguisher is compared to mutual information analysis. Interclass information possesses properties similar to mutual information but uses a different comparing strategy between the underlying conditional distributions. It is shown that interclass information can outperform mutual information in side-channel analysis, especially under low noise. The theoretical comparison is confirmed by simulations.

A physically unclonable function (PUF) is a hardware device that can generate intrinsic responses from challenges. The responses serve as unique identifiers and it is required that they be as little predictable as possible. A loop-PUF is an architecture where n single-bit delay elements are chained. Each PUF generates one bit response per challenge. We model the relationship between responses and challenges in a loop-PUF using Gaussian random variables and give a closed-form expression of the total entropy of the responses. It is shown that n bits of entropy can be obtained with n challenges if and only if the challenges constitute a Hadamard code. Contrary to a previous belief, it is shown that adding more challenges results in an entropy strictly greater than n bits. A greedy code construction is provided for this purpose.

For security-critical applications, the security and trust of devices must be tested before shipping. In this paper, we promote the use of On-Chip Power noise Measurements (OCM), in order to test security using side-channel techniques. We then propose for the first time a standard side-channel measurement setup using OCM. Finally, we provide some key ideas on methodology to integrate the validation of hardware security and trust in the standard testing flow, exploiting OCM.

Embedded system face a serious threat from physical attacks when applied in critical applications. Therefore, modern systems have several integrated sensors to detect potential threats. In this paper, we put forward a new issue where these sensors can open other security loopholes. We demonstrate that sensors, which are deployed to prevent faults, can be exploited to insert effective and almost zero-overhead hardware Trojans. Two case studies are presented on Xilinx Virtex-5 FPGA. The first case study exploits the in-build temperature sensor of Virtex-5 system monitors while the other exploits a user deployed sensor. Both the sensor can be used to trigger a powerful Trojan with minimal and at times zero overhead.

Private circuits, from their publication, have been really popular among the researchers. They also form the basis for provable masking schemes. There are several works which try to improve the results of bit-level private circuits based on 2-input gates for the combinational logic. However, strangely, no practical side-channel analysis of private circuits has been presented so far, which is the focus of the present paper. In this paper, we have tried to identify the `ambush' or hidden dangers in the implementation of private circuits, which can compromise its security in practical scenarios. We have implemented block cipher SIMON with private circuit and have performed side-channel analysis on it. The result shows that, in practice, there is significant amount of information leakage which can be exploited by adversaries. Some leakage comes from practical optimization applied by standard CAD tools, if they restructure the netlists. But even with immutable netlists, we identify leakage caused by a kind of glitch known as early evaluation. Lastly, we demonstrate how to translate theoretically secure private circuit to practically secure private circuit with added overhead, by clocking every combinational gate. Leakage detection tests are applied to attest the security of considered variants of private circuits.

Conventional dual‐rail precharge logic suffers from difficult implementations of dual‐rail structure for obtaining strict compensation between the counterpart rails. As a light‐weight and high‐speed dual‐rail style, balanced cell‐based dual‐rail logic (BCDL) uses synchronised compound gates with global precharge signal to provide high resistance against differential power or electromagnetic analyses. BCDL can be realised from generic field programmable gate array (FPGA) design flows with constraints. However, routings still exist as concerns because of the deficient flexibility on routing control, which unfavourably results in bias between complementary nets in security‐sensitive parts. In this article, based on a routing repair technique, novel verifications towards routing effect are presented. An 8 bit simplified advanced encryption processing (AES)‐co‐processor is executed that is constructed on block random access memory (RAM)‐based BCDL in Xilinx Virtex‐5 FPGAs. Since imbalanced routing are major defects in BCDL, the authors can rule out other influences and fairly quantify the security variants. A series of asymptotic correlation electromagnetic (EM) analyses are launched towards a group of circuits with consecutive routing schemes to be able to verify routing impact on side channel analyses. After repairing the non‐identical routings, Mutual information analyses are executed to further validate the concrete security increase obtained from identical routing pairs in BCDL.

Modern field programmable gate arrays (FPGAs) are power packed with features to facilitate designers. Availability of features like large block memory (BRAM), digital signal processing cores, and embedded CPU makes the design strategy of FPGAs quite different from ASICs. FPGAs are also widely used in security-critical applications where protection against known attacks is of prime importance. We focus on physical attacks that target physical implementations. To design countermeasures against such attacks, the strategy for FPGA designers should be different from that in ASIC. The available features should be exploited to design compact and strong countermeasures. In this article, we propose methods to exploit the BRAMs in FPGAs for designing compact countermeasures. Internal BRAM can be used to optimize intrinsic countermeasures such as masking and dual-rail logics, which otherwise have significant overhead (at least 2 × ) compared to unprotected ones. The optimizations are applied on a real AES-128 co-processor and tested for area overhead and resistance on Xilinx Virtex-5 chips. The presented masking countermeasure has an overhead of only 16% when applied on AES. Moreover, the dual-rail precharge logic (DPL) countermeasure has been optimized to pack the whole sequential part in the BRAM, hence enhancing the security. Proper robustness evaluations are conducted to analyze the optimization in terms of area and security.

In this paper, we present an efficient countermeasure against fault sensitivity analysis (FSA) based on configurable delay blocks (CDBs). FSA is a new type of fault attack, which exploits the relationship between fault sensitivity (FS) and secret information. Previous studies reported that it could break cryptographic modules equipped with conventional countermeasures against differential fault analysis (DFA), such as redundancy calculation, masked and-or, and wave dynamic differential logic. The proposed countermeasure can thwart both DFA and FSA attacks based on setup time violation faults. The proposed ideas are to use a CDB as a time base for detection and to combine the technique with Li's countermeasure concept that removes the dependency between FSs and secret data. The postmanufacture configuration of the CDBs allows minimization of the overhead in operating frequency that comes from manufacture variability. In this paper, we also present an implementation of the proposed countermeasure in application-specified integrated circuit, and describe its configuration method. We then investigate the hardware overhead of the proposed countermeasure for an advanced encryption standard processor and demonstrate its validity through an experiment.

Traditionally most of people treat a hardware solution as an inherently trusted box. “it is hardware not software; so it is secure and trustworthy”, they say. Recent research shows the need to re-asses this trust in hardware and even in its supply chain. For example, attacks are performed on ICs to retrieve secret information such as cryptographic keys. Moreover, backdoors can be inserted into electronic designs and allow for silent intruders into the system. And, even protecting intellectual-property is becoming a serious concern in the modern globalized, horizontal semiconductor business model. This paper discusses hardware security, both from hacking and protecting aspects. A classification of all possible hardware attacks is provided and most popular attacks are discussed including the countermeasures.

The Tree-based FPGA offers better density and timing determinism than traditional mesh-based FPGA. Moreover, thanks to its multilevel structure, it offers greater easiness to balance dual signals in terms of routing resources number. In this paper, we study the use of the Wave Dynamic Differential Logic (WDDL) on a custom tree-based FPGA of 2048 cells. The WDDL technique offers an effective way to withstand Differential Power Attacks (DPA). However, the effectiveness of this countermeasure is guaranteed provided a symmetry is maintained between the routing of both the direct and complementary paths, which is very hard to achieve in FPGA. Thus, balancing aware Computer-Aided Design (CAD) tools must be developed. In this work, we propose first adjacent placement and balancing-aware routing techniques for tree-based FPGA to counter the routing unbalance. Then side channel analyses are performed on FPGA circuit implementing PRESENT crypto-processor. Experimental results show that the balancing methods enhance the design security against side channel attacks.

We introduce the class of multiply constant-weight codes to improve the reliability of certain physically unclonable function response, and extend classical coding methods to construct multiply constant-weight codes from known \(q\) -ary and constant-weight codes. We derive analogs of Johnson bounds and give constructions showing these bounds to be asymptotically tight up to a constant factor under certain conditions. We also examine the rates of multiply constant-weight codes and demonstrate that these rates are the same as those of constant-weight codes of corresponding parameters.

This paper presents the design methodology of a metastability-based True Random Number Generator (TRNG) on a Xilinx FPGA. As its structure is based on an open-loop delay chain, it provides both high throughput and security against physical attacks since it is not sensitive to coupling attacks as for oscillator-based TRNG. The proposed architecture, implemented in a Virtex-5 XC5VLX50T, uses 4% of the available resources and generates random bits at a 20~Mbps rate. This work gives a detailed description of the design methodology, more specifically the placement, routing and timing analysis of the TRNG structure. Also, the randomness quality of this TRNG has been validated using AIS-31 and NIST statistical tests.

Detecting hardware trojans is a difficult task in general. In this article we study hardware trojan horses insertion and detection in cryptographic intellectual property (IP) blocks. The context is that of a fabless design house that sells IP blocks as GDSII hard macros, and wants to check that final products have not been infected by trojans during the foundry stage. First, we show the efficiency of a medium cost hardware trojans detection method if the placement or the routing have been redone by the foundry. It consists in the comparison between optical microscopic pictures of the silicon product and the original view from a GDSII layout database reader. Second, we analyze the ability of an attacker to introduce a hardware trojan horse without changing neither the placement nor the routing of the cryptographic IP logic. On the example of an AES engine, we show that if the placement density is beyond 80%, the insertion is basically impossible. Therefore, this settles a simple design guidance to avoid trojan horses insertion in cryptographic IP blocks: have the design be compact enough, so that any functionally discreet trojan necessarily requires a complete replace and re-route, which is detected by mere optical imaging (and not complete chip reverse-engineering).

The function M(m, n, d, w), the largest size of an unrestricted binary code made of m by n arrays, with constant row weight w, and minimum distance d is introduced and compared to the classical functions of combinatorial coding theory Aq(n, d) and A(n, d, w). The analogues for systematic codes of A(n, d) and A(n, d, w) are introduced apparently for the first time. An application to the security of embedded systems is given: these codes happen to be efficient challenges for physically unclonable functions.

Amongst the many existing countermeasures against Side Channel Attacks (SCA) on symmetrical cryptographic algorithms, masking is one of the most widespread, thanks to its relatively low overhead, its low performance loss and its robustness against first-order attacks. However, several articles have recently pinpointed the limitations of this countermeasure when matched with variance-based and other high-order analyses. In this article, we present a new form of Boolean masking for the Advanced Encryption Standard (AES) called “RSM”, which shows the same level in performances as the state-of-the-art, while being less area consuming, and secure against Variance-based Power Analysis (VPA) and second-order zero-offset CPA. Our theoretical security evaluation is then validated with simulations as well as real-life CPA and VPA on an AES 256 implemented on FPGA.

This paper presents an easy to design Physically Unclonable Function (PUF). The proposed PUF implementation is a loop composed of N identical and controllable delay chains which are serially assembled in a loop to create a single ring oscillator. The frequency discrepancies resulting from the oscillator driven by complementary combinations of the delay chains allows to characterize one device. The presented PUF, nicknamed the Loop PUF (LPUF), returns a frequency comparison of loops made of N delay chains (N ≥ 2). The comparisons are done sequentially on the same structure. Unlike others PUFs based on delays, there is no specific routing constraints. Hence the LPUF is particularly flexible and easy to design. The basic use of the Loop PUF is to generate intrinsic device keys for cryptographic algorithms. It can also be used to generate challenge response pairs for simple authentication. Experiments have been carried out on CYCLONE II FPGAs to assess the performance of the LPUF, such as randomness, uniqueness and steadiness. They clearly show both the easiness of design and the quality level of the LPUF. The measurement time vs steadiness, as well as resistance against side-channel and modeling attacks are discussed.

In this paper we put forward a high-performance biometric fingerprint authentication algorithm for Match-On-Card (MOC) applications, compatible with the INCITS 378 and ISO/IEC 19794 standard. An efficient hardware implementation is proposed to adapt the algorithm for constrained embedded systems as smart cards. Time and memory complexities are reduced such that both integration and real time matching-on card can be met. The proposed architecture drops the required memory to 0.05% w.r.t. initial complexity, without any performance degradation. Therefore, the proposed solution is sufficient to meet the high level of security and the low computation time required in demanding authentication systems (e.g airports, electronic commerce and banking transactions).

Recently, some active shielding techniques have been broken (e.g. by FlyLogic). The caveat is that their geometry is easy to guess, and thus they can be bypassed with an affordable price. This paper has two contributions. First of all, it provides a definition of the objectives of shielding, which is seldom found in publicly available sources. Notably, we precise the expected functionality, but also the constraints it must meet to be both manufacturable and secure. Second, we propose an innovative solution based on random shielding. The goal of this shielding is to make the geometry of the shield difficult to recognize, thereby making the "identification" phase of the attack harder than in previous schemes. Also, a proof of the shielding existence for two layers of metal is provided, which guarantees that the generation of the layout will succeed. Finally, we provide real tests of the shield generation algorithm, that show it is computationally tractable even for large areas to protect.

In this paper we introduce a fully non intrusive test method which is based on the Differential Electro-Magnetic Analysis (EMA). Our objective is to demonstrate the capability of this new method to detect stuck-at-0 faults voluntary injected in a full-custom circuit. This detection is carried out by comparing a reference trace, called Reference Signature, with a differential trace representing the observed electromagnetic activity. The results show the efficiency of the proposed method. We will then introduce the possibility offered by EM measurement to be used to detect degradation of physical parameters on equipments where no intrusions are allowed.

Fault attacks are real threats against hardware implementations of robust cryptographic algorithms such as advanced encryption standard (AES). The authors present an active non-invasive attack to inject faults during the execution of the algorithm and describe setup time violation attacks by under-powering and overclocking an application-specific integrated circuit. Then a security evaluation is presented against setup time violation attacks of several AES architectures on two field programmable gate arrays (FPGA) brands, namely Altera Stratix and Xilinx Virtex5. The authors notice that the architecture of the substitution box greatly impacts the faults statistics. These statistics are furthermore different depending on the FPGA vendor, and also notice that it is more difficult to inject single fault in the most recent technology. Also, the use-cases show how difficult it is to predict the most vulnerable resource in an FPGA. Finally, a low-cost countermeasure against this kind of attack is presented.

Electromagnetic analysis is an important class of attacks against cryptographic devices. In this article, we prove that Correlation-based on ElectroMagnetic Analysis (CEMA) on a hardware-based high-performance AES module is possible from a distance as far as 50 cm. First we show that the signal-to-noise ratio (SNR) tends to a non-zero limit when moving the antenna away from the cryptographic device. An analysis of the leakage structure shows that the Hamming distance model, although suitable for small distances gets more and more distorted when the antenna is displaced far from the device. As we cannot devise any physical model that would predict the observations, we instead pre-characterized it using a first order templates construction. With this model, we enhanced the CEMA by a factor up to ten. Therefore, we conclude that EMA at large distance is feasible with our amplification strategy coupled to an innovative training phase aiming at precharacterizing accurate coefficients of a parametric weighted distance leakage model.

In this paper, we present BCDL (Balanced Cell-based Dual-rail Logic), a new counter-measure against Side Channel Attacks (SCA) on cryptoprocessors implementing symmetrical algorithms on FPGA. BCDL is a DPL (Dual-rail Precharge Logic), which aims at overcoming most of the usual vulnerabilities of such counter-measures, by using specific synchronization schemes, while maintaining a reasonable complexity. We compare our architecture in terms of complexity, performances and easiness to design with other DPLs (WDDL, IWDDL, MDPL, iMDPL, STTL, DRSL, SecLib). It is shown that BCDL can be optimized to achieve higher performances than any other DPLs (more than 1/2 times the nominal data rate) with an affordable complexity. Finally, we implement a BCDL AES on an FPGA and compare its robustness against DPA by using the number of Measurements To Disclosure (MTD) required to find the key with regards to unprotected AES. It is observed that the SCA on a BCDL implementation failed for 150,000 power consumption traces which represents a gain greater than 20 w.r.t. the unprotected version. Moreover the fault attack study has pointed out the natural resistance of BCDL against simple faults attacks.

Fault injections constitute a major threat to the security of embedded systems. Errors occurring in the cryptographic algorithms have been shown to be extremely dangerous, since powerful attacks can exploit few of them to recover the full secrets. Most of the resistance techniques to perturbation attacks have relied so far on the detection of faults. We present in this paper another strategy, based on the resilience against fault attacks. The core idea is to allow an erroneous result to be outputted, but with the assurance that this faulty information conveys no information about the secrets concealed in the chip. We first underline the benefits of FIR: false positive are never raised, secrets are not erased uselessly in case of uncompromising faults injections, which increases the card lifespan if the fault is natural and not malevolent, and FIR enables a high potential of resistance even in the context of multiple faults. Then we illustrate two families of fault injection resilience (FIR) schemes suitable for symmetric encryption. The first family is a protocol-level scheme that can be formally proved resilient. The second family mobilizes a special logic-level architecture of the cryptographic module. We notably detail how a countermeasure of this later family, namely dual-rail with precharge logic style, can both protect both against active and passive attacks, thereby bringing a combined global protection of the device. The cost of this logic is evaluated as lower than detection schemes. Finally, we also give some ideas about the modalities of adjunction of FIR to some certification schemes.

Power analysis attacks are non intrusive and easily mounted. As a consequence, there is a growing interest in efficient implementation of these attacks against block cipher algorithms such as Data Encryption Standard (DES) and Advanced Encryption Standard (AES). In our paper we propose a new technique based on the Kalman theory. We show how this technique could be useful for the cryptographic domain by making power analysis attacks faster. Moreover we prove that the Kalman filter is more powerful than the High Order Statistics technique.

In this paper, we propose a preprocessing method to improve side channel attacks (SCAs) on dual-rail with precharge logic (DPL) countermeasure family. The strength of our method is that it uses intrinsic characteristics of the countermeasure: classical methods fail when the countermeasure is perfect, whereas our method still works and enables us to perform advanced attacks. We have experimentally validated the proposed method by attacking a DES cryptoprocessor embedded in a field programmable gates array (FPGA), and protected by the wave dynamic differential logic (WDDL) countermeasure. This successful attack, unambiguous as the full key is retrieved, is the first to be reported.

In order to protect crypto-systems against side channel attacks various countermeasures have been implemented such as dual-rail logic or masking. Faults attacks are a powerful tool to break some implementations of robust cryptographic algorithms such as AES and DES. Various kind of fault attacks scenarios have been published. However, very few publications available in the public literature detail the practical realization of such attacks. In this paper we present the result of a practical fault attack on AES in WDDL and its comparison with its non-protected equivalent. The practical faults on an FPGA running an AES encrypt or are realized by under-powering it and further exploited using Piret's attack. The results show that WDDL is protected against setup violation attacks by construction because a faulty bit is replaced by a null bit in the cipher text. Therefore, the fault leaks no exploitable information. We also give a theoretical model for the above results. Other references have already studied the potential of fault protection of the resynchronizing gates (delay-insensitive). In this paper, we show that non-resynchronizing gates (hence combinatorial DPL such as WDDL) are natively immune to setup time violation attacks.

This paper presents a RTR FPGA embedded in a System on Chip fabricated in 130nm CMOS process. Various aspects of the design flow, from automation to floor-planning are discussed. We explain the measures taken in the FPGA design to guarantee RTR functionality free of electrical conflicts, and we present a flow based on Altera synthesis tools to implement IPs(Hardware Blocks) in this FPGA. We demonstrate the full functionality with experiments on the FPGA, and as conclusion we highlight the limitations and future research directions.

This article presents a family of cryptographic ASICs, called SecMat, designed in CMOS 130 nanometer technology by the authors with the help of STMicroelectronics.The purpose of these prototype circuits is to experience with the published ``implementation-level'' attacks(SPA, DPA, EMA, templates, DFA). We report our conclusions about the practicability of these attacks:which ones are the most simple to mount, and which ones require more skill, time, equipments, etc.The potential of FPGAs as security evaluation commodities at design time is also detailed.Then, we discuss about ``dual counter-measures'', that are meant to resist both passive and active attacks.This study started four years ago with TIMA (Grenoble), in the framework of the project MARS. We highlight some research directions towards dependable and cost-effective dual counter-measures.

This article does a purely mathematical analysis based on generic models, and the idea is to investigate the possibility of using tiling patterns other than Manhattan grid in FPGAs. The goal of our research is to evolve FPGA architectures with advances in technology, and specifically better utilization of available interconnect layers. We propose a method to evaluate tiling patterns based on the first principles ( i.e Rent's Rule, Donath's result, equivalence of wire flux and wire length). We show that, use of tiling patterns formed with higher order polygons can improve the speed and area performances of an FPGA. This gain is highly dependent on depopulation schemes and other parameters. However for generic tiling patterns with crossbar switchboxes there is a 22% gain in area for the hexagonal tiling pattern, and a 30% gain in area for the octagonal tiling pattern. Moreover the average interconnect length is around 15% lesser for hexagonal and 31% lesser for the octagonal tiling compared to square tiling. We can expect a proportional increase in speed. We also present a comparative plot of total interconnect lengths for these tiling patterns and the hierarchical gate arrays

Field programmable gate arrays (FPGAs) become very popular for embedded cryptographic operations. In order to resist side-channel attacks, FPGAs must implement reasoned countermeasures. The most efficient way to mitigate attacks is to adopt a gate-level protection. Two secure gates families exist: those that ldquohiderdquo and those that ldquomaskrdquo side-channel leakage. In this article, we detail methods to reduce the size of wave dynamic differential logic (WDDL) implementations. These circuits are designed to hide any physical leak by ensuring a data-independent activity. This study is meant to be generic, and thus applies to any 4 rarr 1 LUT-based FPGAs. Further optimizations can be reached by taking advantage of some FPGAs proprietary features. Our solutions include RTL code modification, synthesizer usage (potentially in a re-entrant way), and ad hoc mapping. We show that linear parts of algorithms can be delegated to a synthesizer, but that non-linear parts are better off to be handled with heuristics. We present a 23 % area gain over the state-of-the-art as for the positive WDDL triple-DES symmetric encryption algorithm.

This study proposes an efficient way of interference mitigation for ultra-wideband energy detection. A receiver for pulse position modulation systems is investigated. The inter-slot (i.e., intra-symbol) and inter-symbol interferences are studied and a probabilistic equalizer is derived. This energy equalizer is embedded into the loop of an iterative channel decoder. Computer simulations are performed on the channel models from the IEEE 802.15.3a task group.

In this paper we present an automatic design flow for generating customized embedded FPGA (eFPGA) fabric and a domain specific SOC+eFPGA architecture. This design flow encompasses both the eFPGA user and automatic layout generator perspectives. We discuss generic FPGA modeling based on VPR tool, simulation and high-level models of reconfigurable components, and we present an innovative floor-planing for island style FPGAs using rectilinear macros. Several system integration issues are highlighted. Layout of a real life SOC with an embedded RTR FPGA for cryptographic applications, designed with this flow, is also presented.

With the growing security needs of applications such as homeland security or banking, the frequent updates in cryptographic standards and the high ASIC costs, the ciphering algorithms on an asynchronous embedded FPGA co-processor are becoming a viable alternative. Within the SAFE project, a novel architecture of asynchronous e-FPGA has been proposed. This architecture is natively robust against side channel attacks such as simple and differential power analysis or clock based fault attacks. Simulation-based security proofs are also presented.

Through a rapid survey of the architecture of low-density parity-check (LDPC) decoders, this paper proposes a general framework to describe and compare the LDPC decoder architectures. A set of parameters makes it possible to classify the scheduling of iterative decoders, memory organization, and type of check-node processors and variable-node processors. Using the proposed framework, an efficient generic architecture for nonflooding schedules is also given.

In this paper a reconfigurable implementation for the data detection in high data rate direct sequence code division multiple access (DS-CDMA) connections is presented. Due to some well defined real time system parameters, traditional implementations of this detector which deal with the mean operational case are not optimal. They consume a lot of power in the favorable operational cases and they loose a diversity gain in the worst cases. Thanks to reconfigurability, a detector can adapt its configuration to each operational condition. Reconfigurability can perform jointly performance and computational power optimization. Implementation issues have shown that the traditional DSPs provide a high degree of flexibility but they are inefficient for the high rate processing constraints involved to DS-CDMA detection with low spreading factors (SF). A reconfigurable hardware implementation is proposed and analyzed which besides its performance capabilities provides a minimum area overhead.

Recent advances in the reconfigurability concept have now made it possible to design blocks of the transceiver chain which can change its functionality in real time. Reconfigurability in general can provide performance improvements and reduction of the battery power consumption. In this paper we focus on the well-known Rake principle and we propose a reconfigurable receiver structure, able to support the required processing for a RAKE combination and a one-stage inter-path interference canceller (IC). This approach allows a more efficient use of the constraint calculation power of the reception block and improves the system performance. Through theoretical analysis and simulation, we also investigate a controller which can supervise, at run-time, switching between the two possible configurations.

The purpose of this paper is to calculate the bit error rate (BER) of a multiband non-coherent on-off keying (OOK) demodulation. The results fit perfectly the simulations of the system. It allows us to study the influence of the filter and the decimation factor on the modulation performance. It is also possible to optimize the system by means of other criteria (e.g. system complexity, jammer sensitivity), thus avoiding time consuming simulations.

No abstract available.

Some techniques for low power operation in VLSI using the lowest possible supply voltage coupled with an architectural optimization have shown that we can save power even if we increase silicon area. In this paper we present a strategy to reduce power consumption in FPGAs based on pipeline architectures working with a low supply voltage.

No abstract available.