Updates on the Security of FPGAs Against Power Analysis Attacks

Standaert, François‐Xavier; Macé, François; Peeters, Eric; Quisquater, Jean-Jacques

doi:10.1007/11802839_42

Cited by 21 publications

(13 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The leakage is a function of the distance between y and x, i.e. x ⊕ y [25]. Now, when the rotating tables countermeasure is applied, the value y is actually replaced by y ⊕ m, where m is one of the 16 mask values.…”

Section: Modelizationmentioning

confidence: 99%

Formal Analysis of the Entropy / Security Trade-off in First-Order Masking Countermeasures against Side-Channel Attacks

Nassar

Guilley

Danger

2011

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Several types of countermeasures against side-channel attacks are known. The one called masking is of great interest since it can be applied to any protocol and/or algorithm, without nonetheless requiring special care at the implementation level. Masking countermeasures are usually studied with the maximal possible entropy for the masks. However, in practice, this requirement can be viewed as too costly. It is thus relevant to study how the security evolves when the number of mask values decreases. In this article, we study a first-order masking scheme, that makes use of one n-bit mask taking values in a strict subset of F n 2 . For a given entropy budget, we show that the security does depend on the choice of the mask values. More specifically, we explore the space of mask sets that resist first-and second-order correlation analysis (CPA and 2O-CPA), using exhaustive search for word size n 5 bit and a SAT-solver for n up to 8 bit. We notably show that it is possible to protect algorithms against both CPA and 2O-CPA such as AES with only 12 mask values. If the general trend is that more entropy means less leakage, some particular mask subsets can leak less (or on the contrary leak remarkably more). Additionally, we exhibit such mask subsets that allows for a minimal leakage.

show abstract

Section: Modelizationmentioning

confidence: 99%

Formal Analysis of the Entropy / Security Trade-off in First-Order Masking Countermeasures against Side-Channel Attacks

Nassar

Guilley

Danger

2011

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…The factor of proportionality ranges from 2 to 5 depending on the fact that the attack uses trace averaging [10] or not [9]. Note also that correlation attacks require in general to carefully preprocess the traces, for example using several filters.…”

Section: Aes Rijndaelmentioning

confidence: 99%

Template Attacks in Principal Subspaces

Archambeau

Peeters

Standaert

et al. 2006

Lecture Notes in Computer Science

Self Cite

207

186

View full text Add to dashboard Cite

Abstract. Side-channel attacks are a serious threat to implementations of cryptographic algorithms. Secret information is recovered based on power consumption, electromagnetic emanations or any other form of physical information leakage. Template attacks are probabilistic sidechannel attacks, which assume a Gaussian noise model. Using the maximum likelihood principle enables us to reveal (part of) the secret for each set of recordings (i.e., leakage trace). In practice, however, the major concerns are (i) how to select the points of interest of the traces, (ii) how to choose the minimal distance between these points, and (iii) how many points of interest are needed for attacking. So far, only heuristics were provided. In this work, we propose to perform template attacks in the principal subspace of the traces. This new type of attack addresses all practical issues in principled way and automatically. The approach is validated by attacking stream ciphers such as RC4. We also report analysis results of template style attacks against an FPGA implementation of AES Rijndael. Roughly, the template attack we carried out requires five time less encrypted messages than the best reported correlation attack against similar block cipher implementations.

show abstract

“…In this way, an attacker cannot deduce the position of the registers from the height of the first two peaks. This technique is similar to randomly pre-loading registers in a pipeline, as described in [22]. The plots support our claim that all implementations execute the algorithm in the same constant time.…”

Section: Can the Countermeasure Be Circumvented?supporting

confidence: 73%

“…Standaert et al examined the effect of pipelining and unrolling techniques on the power consumption of FPGAs [23]. Power analysis countermeasures based on the random pre-loading of pipelining registers are evaluated in [22]. Successful fault injection on FPGAs is reported by Maingot et al in [16].…”

Section: Introductionmentioning

confidence: 99%

Power and Fault Analysis Resistance in Hardware through Dynamic Reconfiguration

Mentens

Gierlichs

Verbauwhede

Cryptographic Hardware and Embedded Systems – CHES 2008

View full text Add to dashboard Cite

Abstract. Dynamically reconfigurable systems are known to have many advantages such as area and power reduction. The drawbacks of these systems are the reconfiguration delay and the overhead needed to provide reconfigurability. We show that dynamic reconfiguration can also improve the resistance of cryptographic systems against physical attacks. First, we demonstrate how dynamic reconfiguration can realize a range of countermeasures which are standard for software implementations and that were practically not portable to hardware so far. Second, we introduce a new class of countermeasure that, to the best of our knowledge, has not been considered so far. This type of countermeasure provides increased resistance, in particular against fault attacks, by randomly changing the physical location of functional blocks on the chip area at run-time. Third, we show how fault detection can be provided on certain devices with negligible area-overhead. The partial bitstreams can be read back from the reconfigurable areas and compared to a reference version at run-time and inside the device. For each countermeasure, we propose a prototype architecture and evaluate the cost and security level it provides. All proposed countermeasures do not change the device's input-output behavior, thus they are transparent to upper-level protocols. Moreover, they can be implemented jointly and complemented by other countermeasures on algorithm-, circuit-, and gate-level.

show abstract

Updates on the Security of FPGAs Against Power Analysis Attacks

Cited by 21 publications

References 8 publications

Formal Analysis of the Entropy / Security Trade-off in First-Order Masking Countermeasures against Side-Channel Attacks

Formal Analysis of the Entropy / Security Trade-off in First-Order Masking Countermeasures against Side-Channel Attacks

Template Attacks in Principal Subspaces

Power and Fault Analysis Resistance in Hardware through Dynamic Reconfiguration

Contact Info

Product

Resources

About