IEEE Solid-State Circuits Magazine - Fall 2017 - 44

In the future, we expect that the capabilities
of attackers will improve and that we will
evolve from a gray testing box model toward
an immersed model.
general, SPA attacks are not that sim-
ple to mount.)
Differential power attacks (DPAs)
and EM attacks typically require mul-
tiple (in the hundreds or, sometimes,
millions) power or EM traces to guess
cryptographic secrets. In a typical
setup, the attacker creates a model
for the power consumption behav-
ior of the device. For example, the
attacker assumes that the power con-
sumption is related to the Hamming
distance between current and previ-
ous data values stored in flip-flops
or registers. Indeed, this closely
corresponds to the dy namic power
consumption profile in standard
complementary-metal-oxide-semi-
conductor designs, where power is
consumed only when the state of the
flip-flop changes. Up until now, we
have typically ignored leakage cur-
rent and other noisy effects because
dynamic power is still dominant.
DPA attacks are quite robust and re-
silient to noise: noisy uncorrelated

effects can be reduced by increasing
the number of measurements.
To protect symmetric key algori-
thms such as AES, two main classes of
countermeasures have been devel-
oped. One is a set of circuit styles
that make the switching activity of
gates independent of the data being
processed: it is based on dynamic
differential logic styles [12]. Masking
techniques are a second major class
of countermeasures: these are based
on randomly splitting sensitive data
into multiple shares and obtaining
a subset of shares that do not dis-
close those actual data [8]. Public key
algorithms are usually protected at
the algorithm level (by adding ran-
domness to the calculations) with
techniques such as key or scalar
blinding or the use of projective
coordinates, making it difficult for
the attacker to obtain multiple power
or EM measurements.
In practice, side-channel information
is used to reduce the computational

complexity of a brute-force attack.
As an example, the popular correla-
tion power attack reduces the effort
of attacking an AES key from 2128
to the size of the AES Sbox, 28 (the
input data to the Sbox being cor-
related to the key). The attacker makes
256 possible Ha m m ing dist a nce
power models and looks for the model
that results in a ma ximum corre-
lation w it h t he me a sur ed power
t r a c e s . This is then repeated for
every key byte. Hence, a correlation
attack is a divide-and-conquer attack:
it combines side-channel informa-
tion with brute-forcing 256 possible
key byte guesses.

Fault Attacks
Fault attacks are an active attack
but not necessarily an invasive one.
Faults can be triggered by playing
with the power supply, introducing
clock glitches, freezing or heating
the device (typically also applied
to random number generators), or
any other means that triggers faulty
results [5].
IC designers have developed many
test strategies to address random
faults in ICs, including those based
on scan chains, built-in-self-tests,
and more. Many countermeasures,
such as adding redundancy, could be
reused to detect fault attacks. There
are, however, two main differenc-
es between an attacker aiming to
inject faults and a designer testing for
random faults. The first is the simple
fact that knowing whether a fault
occurred (yes or no) could in itself
disclose sensitive information and so
needs to be avoided [2]. The second
is that the designer must avoid hav-
ing key registers and other sensitive
data sitting on the scan chains. This
would otherwise provide a very nice
back door.

Side Note on
White Box Cryptography

FIGURE 3: A graphic depicting an immersed model.

44

FA L L 2 0 17

IEEE SOLID-STATE CIRCUITS MAGAZINE

White box cryptography is used in
the context of secure software dis-
tribution, where a cr y ptog r aph ic
algorithm with an associated key
is conver ted into a key-specific,
Table of Contents for the Digital Edition of IEEE Solid-State Circuits Magazine - Fall 2017
