Unrolled Cryptography on Silicon

Abstract

Cryptographic primitives with low-latency performance have gained momentum lately due to an increased demand for real-time applications. Block ciphers such as PRINCE enable data encryption (resp. decryption) within a single clock cycle at a moderately high operating frequency when implemented in a fully-unrolled fashion. Unsurprisingly, many typical environments for unrolled ciphers require protection against physical adversaries as well. Yet, recent works suggest that most common SCA countermeasures are hard to apply to low-latency circuits. Hardware masking, for example, requires register stages to offer resistance, thus adding delay and defeating the purpose of unrolling. On another note, it has been indicated that unrolled primitives without any additional means of protection offer an intrinsic resistance to SCA attacks due to their parallelism, asynchronicity and speed of execution. In this work, we take a closer look at the physical security properties provided by unrolled cryptographic IC implementations. We are able to confirm that the nature of unrolling indeed bears the potential to decrease the susceptibility of cipher implementations significantly when reset methods are applied. With respect to certain adversarial models, e.g., ciphertext-only access, an amazingly high level of protection can be achieved. While this seems to be a great result for cryptographic hardware engineers, there is an attack vector hidden in plain sight which still threatens the security of unrolled implementations remarkably – namely the static power consumption of CMOS-based circuits. We point out that essentially all reasons which make it hard to extract meaningful information from the dynamic behavior of unrolled primitives are not an issue when exploiting the static currents for key recovery. Our evaluation is based on real-silicon measurements of an unrolled PRINCE core in a custom 40nm ASIC. The presented results serve as a neat educational case study to demonstrate the broad differences between dynamic and static power information leakage in the light of technological advancement.

Balancing the Leakage Currents in Nanometer CMOS Logic—A Challenging Goal

“…It remained uncertain, however, whether the small data-dependent differences in the leakage currents could be captured in sufficiently high quality to perform such attacks in real world experiments. Hence, several practical evaluations has been conducted on the subject [10][11][12][13][14][15][16][17]. It was not only confirmed that those attacks are indeed feasible, but also that this source of information leakage can become the most informative side channel in certain scenarios.…”

“…In detail, it was shown that the effectiveness of static power attacks can be increased exponentially by manipulating the operating conditions of devices [14,16]. Previous works also demonstrated that common side-channel countermeasures against dynamic leakage behavior are less effective against its static counterpart [8,10,12,16,17]. For instance, due to a possibility to limit the noise in static power measurements, adversaries can exploit higher-order leakages of masked implementations with a lower data complexity [11,12,16].…”