An ASIC Implementation of the AES SBoxes

Wolkerstorfer, Johannes; Oswald, Elisabeth; Lamberger, Mario

doi:10.1007/3-540-45760-7_6

Cited by 212 publications

(151 citation statements)

References 3 publications

Supporting

Mentioning

151

Contrasting

Order By: Relevance

“…S-boxes and the ShiftRows transformations can be applied to all 16 bytes of the state within five clock cycles due to pipelining. The S-Boxes in the AES module are implemented by using composite field arithmetic as proposed by Wolkerstorfer et al [26] following the original idea of Rijmen [1].…”

Section: Resultsmentioning

confidence: 99%

Differential Cluster Analysis

Batina

Gierlichs

Lemke‐Rust

2009

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. We propose a new technique called Differential Cluster Analysis for side-channel key recovery attacks. This technique uses cluster analysis to detect internal collisions and it combines features from previously known collision attacks and Differential Power Analysis. It captures more general leakage features and can be applied to algorithmic collisions as well as implementation specific collisions. In addition, the concept is inherently multivariate. Various applications of the approach are possible: with and without power consumption model and single as well as multi-bit leakage can be exploited. Our findings are confirmed by practical results on two platforms: an AVR microcontroller with implemented DES algorithm and an AES hardware module. To our best knowledge, this is the first work demonstrating the feasibility of internal collision attacks on highly parallel hardware platforms. Furthermore, we present a new attack strategy for the targeted AES hardware module.

show abstract

Section: Resultsmentioning

confidence: 99%

Differential Cluster Analysis

Batina

Gierlichs

Lemke‐Rust

2009

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…The third implementation is based on finite field arithmetic instead of look up tables. As described by authors in [10], sbox operation in GF(2 8 ) can be implemented only with combinatorial logic. The operations in GF (2 8 ) can be done in GF(2 4 ) by representing the original polynomial as a linear polynomial with coefficients of four bits each.…”

Section: Aes Architecturementioning

confidence: 99%

“…To make the design area efficient, we have moved the sbox to RAM in the second implementation. In the third design we use the sbox in binary Galois field GF(2 4 ) (a variant of the latter calculation method) as described in [10]. The first & the third sbox are similar to what have been discussed in [11] as LUT & GF (2 4 ).…”

Section: Introductionmentioning

confidence: 99%

Security evaluation of different AES implementations against practical setup time violation attacks in FPGAs

Bhasin

Selmane

Guilley

et al. 2009

2009 IEEE International Workshop on Hardware-Oriented Security and Trust

View full text Add to dashboard Cite

Abstract-Security evaluation of various AES implementation against practical power attacks has been reported in literature. However, to the authors' knowledge, very few of the fault attacks reported on AES have been practically realized. Since sbox is a crucial element in AES, in this article, we evaluate the security of some unprotected AES implementations differing in sbox construction, targeted for FPGA. Here the faults have been generated practically by underpowering the targeted circuit. Then we correlate our results with the underlying architecture, along a methodology already suggested in other articles, albeit theoretically. We also carry out an extensive characterization of the faults, in terms of temporal localization. On the basis of our results, we reach the conclusion that the two cheaper implementations in terms of silicon area are also the more vulnerable against DFA when implemented without countermeasures.

show abstract

“…However, for implementations of operations like the AES S-Box, nonlinear operations are crucial (see [18] and [25]). …”

Section: Analyzing the Effect Of Glitches On The Dpa-resistance Of Mamentioning

confidence: 99%

Side-Channel Leakage of Masked CMOS Gates

Mangard

Popp

Gammel

2005

Lecture Notes in Computer Science

239

171

View full text Add to dashboard Cite

Abstract. There are many articles and patents on the masking of logic gates. However, the existing publications assume that a masked logic gate switches its output no more than once per clock cycle. Unfortunately, this assumption usually does not hold true in practice. In this article, we show that glitches occurring in circuits of masked gates make these circuits susceptible to classical first-order DPA attacks. Besides a thorough theoretical analysis of the DPA-resistance of masked gates in the presence of glitches, we also provide simulation results that confirm the theoretical elaborations. Glitches occur in every CMOS circuit. Consequently, the currently known masking schemes for CMOS gates do not prevent DPA attacks.

show abstract

An ASIC Implementation of the AES SBoxes

Cited by 212 publications

References 3 publications

Differential Cluster Analysis

Differential Cluster Analysis

Security evaluation of different AES implementations against practical setup time violation attacks in FPGAs

Side-Channel Leakage of Masked CMOS Gates

Contact Info

Product

Resources

About