Bricks and Tools for Secure Hardware Implementations Francesco - - PowerPoint PPT Presentation

▶
bricks and tools for secure hardware implementations
SMART_READER_LITE
LIVE PREVIEW

Bricks and Tools for Secure Hardware Implementations Francesco - - PowerPoint PPT Presentation

Dec 23, 2022 26 likes •849 views

Bricks and Tools for Secure Hardware Implementations Francesco Regazzoni Francesco Regazzoni 06 June 2014, ibenik, Croatia P. 1 Why Electronic Design Automation? Surely the purpose of science is to ease human hardship Galileo,

slide-1
SLIDE 1

Bricks and Tools for Secure Hardware Implementations Francesco Regazzoni

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 1
slide-2
SLIDE 2

Why Electronic Design Automation?

“Surely the purpose of science is to ease human hardship”

Galileo, Bertolt Brecht

Handle the complexity Time to market Design optimization

From G. De Micheli, Synthesis and Optimization of Digital Circuits, McGraw-Hill Higher Education, 1994.

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 2
slide-3
SLIDE 3

Why Electronic Design Automation for security? Security is very often considered at later stages

  • f design

Cost and Time to Market Possible Security pitfalls

EXTRA CONSTRAINT

Use as much as possible “standard” EDA commodities!

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 3
slide-4
SLIDE 4

Outline

Logic Synthesis (Secure) Design Flow for secure ISE Quick note on Software

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 4
slide-5
SLIDE 5

Simplified Hardware Design Flow (ASIC)

Algorithm Design C, Matlab, VHDL RTL (Architecture) Design Synthesizable HDL Gate

x y x XOR y

Layout

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 5
slide-6
SLIDE 6

Let’s focus on Synthesis

RTL (Architecture) Design Synthesizable HDL Logic Synthesis Gate Level

x y x XOR y

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 6
slide-7
SLIDE 7

A bit of history Few algorithms and tools existed in the 70’s First prototype synthesis tools in the early 80’s First logic synthesis companies in the late 80’s

Design Automation Conference (DAC) turned 51 years last week: happy birthday!

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 7
slide-8
SLIDE 8

Definitions Logic Synthesis is the manipulation of logic specifications to create logic models as an interconnection of logic primitives Logic Synthesis determines the gate level structure of a circuit

From G. De Micheli, Synthesis and Optimization of Digital Circuits, McGraw-Hill Higher Education, 1994.

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 8
slide-9
SLIDE 9

Logic Synthesis Input and Output INPUT: HDL Description Technological Library (area, timing, power) Synthetic Library (multipliers...) Constraints OUTPUT: Gate Level Netlist Estimation of area, timing, power (!) Timing constraints

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 9
slide-10
SLIDE 10

Typical Logic Synthesis Steps

  • ne

State Minimization two State Encoding three Combinatorial Logic Minimization four Technology Mapping

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 10
slide-11
SLIDE 11

Is it sufficient for Security? Paul Kocher, Joshua Jaffe, and Benjamin Jun, “Differential Power Analysis”, in Proceedings of Advances in Cryptology-CRYPTO’99, Santa Barbara, California, USA, August 15-19, 1999. (Cited by 4128)

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 11
slide-12
SLIDE 12

Approach One INPUT: HDL Description Technological Library (area, timing, power) Synthetic Library (multipliers...) Constraints OUTPUT: DPA resistant Gate Level Netlist Estimation of area, timing, power (!) Timing constraints

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 12
slide-13
SLIDE 13

Approach Two

INPUT: HDL Description Technological Library (area, timing, power) Synthetic Library (multipliers...) Constraints (limit the gates) OUTPUT: Gate Level Netlist “Cell Substitution”: Replace cells Reload in the tool for correct area and timing constraints

  • K. Tiri and I. Verbauwhede, A digital design flow for secure integrated circuits, IEEE TCAD,

2006

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 13
slide-14
SLIDE 14

Careful! As a example of design for security, we have focused

  • n synthesis, and we have detailed two possible

approaches for synthesis of DPA resistant circuits However Synthesis is only one step of the whole design flow Security should be considered in every steps of the of the design flow Doing DPA resistant synthesis alone is not sufficient!

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 14
slide-15
SLIDE 15

Outline

Logic Synthesis (Secure) Design Flow for secure ISE Quick note on Software

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 15
slide-16
SLIDE 16

Protect PRESENT with secure hardware Lightweight block cipher 4 bit S-box addRoundKey, sBoxLayer

// Calculate S-box (plaintext XOR key) int PRESENT(int plaintext, int key) {

1 int result = 0; // initialize the result 2 plaintext = plaintext ^key; // perform the xor with the key 3 result = S[plaintext]; // perform the S-box 4 return result; }; // return the result

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 16
slide-17
SLIDE 17

What can I do?

ALU ISE A B Memory Register File ISE ISE IMM.

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 17
slide-18
SLIDE 18

What can I do?

ALU ISE A B Memory Register File ISE ISE IMM.

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 18
slide-19
SLIDE 19

What can I do?

ALU ISE A B Memory Register File ISE ISE IMM.

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 19
slide-20
SLIDE 20

What can I do?

ALU ISE A B Memory Register File ISE ISE IMM.

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 20
slide-21
SLIDE 21

What can I do?

ALU ISE A B Memory Register File ISE ISE IMM.

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 21
slide-22
SLIDE 22

What can I do?

ALU ISE A B Memory Register File ISE ISE IMM.

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 22
slide-23
SLIDE 23

What can I do? Something easier?

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 23
slide-24
SLIDE 24

Protected / Non Protected Co-Design!

ALU A B Memory Register File ISE ISE IMM. ISE

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 24
slide-25
SLIDE 25

Protected / Non Protected Co-Design!

B ALU ISE A Memory Register File ISE ISE IMM.

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 25
slide-26
SLIDE 26

Protected / Non Protected Co-Design!

B ALU ISE A Memory Register File ISE ISE IMM.

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 26
slide-27
SLIDE 27

Automatic design of DPA resistant ISE

identify sensitive parts Partition Sensitive / Non Sensitive Protect Sensitive Security Evaluation

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 27
slide-28
SLIDE 28

Needed “Basic Blocks”

identify sensitive parts Partition Sensitive / Non Sensitive Protect Sensitive Security Evaluation

Generate useful power traces?

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 28
slide-29
SLIDE 29

Needed “Basic Blocks”

identify sensitive parts Partition Sensitive / Non Sensitive Protect Sensitive Security Evaluation

Generate useful power traces? Measure the DPA resistance?

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 29
slide-30
SLIDE 30

Needed “Basic Blocks”

identify sensitive parts Partition Sensitive / Non Sensitive Protect Sensitive Security Evaluation

Generate useful power traces? Measure the DPA resistance? Countermeasure and its design flow?

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 30
slide-31
SLIDE 31

Needed “Basic Blocks”

identify sensitive parts Partition Sensitive / Non Sensitive Protect Sensitive Security Evaluation

Generate useful power traces? Measure the DPA resistance? Countermeasure and its design flow? Partition the algorithm?

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 31
slide-32
SLIDE 32

Needed “Basic Blocks”

identify sensitive parts Partition Sensitive / Non Sensitive Protect Sensitive Security Evaluation

Generate useful power traces? Measure the DPA resistance? Countermeasure and its design flow? Partition the algorithm?

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 32
slide-33
SLIDE 33

Fast Simulation SPICE level

Simulate Complex Design at SPICE level (whole processor)

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 33
slide-34
SLIDE 34

Fast Simulation SPICE level

Simulate Complex Design at SPICE level (whole processor) Simulated about 400 traces: approximately 20 hours!

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 33
slide-35
SLIDE 35

Fast Simulation SPICE level

Simulate Complex Design at SPICE level (whole processor) Simulated about 400 traces: approximately 20 hours!

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 33
slide-36
SLIDE 36

Careful! Results obtained in simulations are often very different from the ones obtained from the real silicon Check and evaluate if and to which extent simulations results are matching the real measures

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 34
slide-37
SLIDE 37

Needed “Basic Blocks”

identify sensitive parts Partition Sensitive / Non Sensitive Protect Sensitive Security Evaluation

Generate useful power traces? Measure the DPA resistance? Countermeasure and its design flow? Partition the algorithm?

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 35
slide-38
SLIDE 38

Needed “Basic Blocks”

identify sensitive parts Partition Sensitive / Non Sensitive Protect Sensitive Security Evaluation

Generate useful power traces? Measure the DPA resistance? Countermeasure and its design flow? Partition the algorithm?

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 36
slide-39
SLIDE 39

Information Theory Metric

H[K|L] = −

  • k

Pr[k] ·

  • x

Pr[x]

  • Pr[l|k, x] · log2 Pr[k|l, x] dl.

Add white noise Reduce the dimension using compression Compute the mutual information

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 37
slide-40
SLIDE 40

Needed “Basic Blocks”

identify sensitive parts Partition Sensitive / Non Sensitive Protect Sensitive Security Evaluation

Generate useful power traces? Measure the DPA resistance? Countermeasure and its design flow? Partition the algorithm?

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 38
slide-41
SLIDE 41

Needed “Basic Blocks”

identify sensitive parts Partition Sensitive / Non Sensitive Protect Sensitive Security Evaluation

Generate useful power traces? Measure the DPA resistance? Countermeasure and its design flow? Partition the algorithm?

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 39
slide-42
SLIDE 42

Protected Logic styles WDDL iMDPL MCML ...

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 40
slide-43
SLIDE 43

Needed “Basic Blocks”

identify sensitive parts Partition Sensitive / Non Sensitive Protect Sensitive Security Evaluation

Generate useful power traces? Measure the DPA resistance? Countermeasure and its design flow? Partition the algorithm?

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 41
slide-44
SLIDE 44

Needed “Basic Blocks”

identify sensitive parts Partition Sensitive / Non Sensitive Protect Sensitive Security Evaluation

Generate useful power traces? Measure the DPA resistance? Countermeasure and its design flow? Partition the algorithm?

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 42
slide-45
SLIDE 45

Algorithm partitioning tool

ALU ISE A B Memory Register File ISE ISE IMM.

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 43
slide-46
SLIDE 46

Algorithm partitioning tool

ALU A B Memory Register File ISE ISE IMM. ISE

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 44
slide-47
SLIDE 47

Algorithm partitioning tool

B ALU ISE A Memory Register File ISE ISE IMM.

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 45
slide-48
SLIDE 48

Algorithm partitioning tool

B ALU ISE A Memory Register File ISE ISE IMM.

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 46
slide-49
SLIDE 49

Needed “Basic Blocks”

identify sensitive parts Partition Sensitive / Non Sensitive Protect Sensitive Security Evaluation

Generate useful power traces? Measure the DPA resistance? Countermeasure and its design flow? Partition the algorithm?

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 47
slide-50
SLIDE 50

The CMOS Design Flow

processor HDL code ISE HDL code Protected Library crypto.c software CMOS Library

0101001. 1100001. 1100001. 0101001.

Security Evaluaton ISE Extractor Protected Synth and P&R CMOS Synth and P&R crypto_ISE.c SPICE level simulation Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 48
slide-51
SLIDE 51

The Processor Customization

processor HDL code ISE HDL code Protected Library crypto.c software CMOS Library

0101001. 1100001. 1100001. 0101001.

Security Evaluaton ISE Extractor Protected Synth and P&R CMOS Synth and P&R crypto_ISE.c SPICE level simulation Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 49
slide-52
SLIDE 52

The Protected Design Flow

processor HDL code ISE HDL code Protected Library crypto.c software CMOS Library

0101001. 1100001. 1100001. 0101001.

Security Evaluaton ISE Extractor Protected Synth and P&R CMOS Synth and P&R crypto_ISE.c SPICE level simulation Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 50
slide-53
SLIDE 53

The Hybrid Design Flow

processor HDL code ISE HDL code Protected Library crypto.c software CMOS Library

0101001. 1100001. 1100001. 0101001.

Security Evaluaton ISE Extractor Protected Synth and P&R CMOS Synth and P&R crypto_ISE.c SPICE level simulation Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 51
slide-54
SLIDE 54

The Simulation Environment

processor HDL code ISE HDL code Protected Library crypto.c software CMOS Library

0101001. 1100001. 1100001. 0101001.

Security Evaluaton ISE Extractor Protected Synth and P&R CMOS Synth and P&R crypto_ISE.c SPICE level simulation Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 52
slide-55
SLIDE 55

The Design Evaluation

processor HDL code ISE HDL code Protected Library crypto.c software CMOS Library

0101001. 1100001. 1100001. 0101001.

Security Evaluaton ISE Extractor Protected Synth and P&R CMOS Synth and P&R crypto_ISE.c SPICE level simulation Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 53
slide-56
SLIDE 56

Partitioning of the PRESENT algorithm S-box

sbox result

Plain Text key Plain Text key

sbox result

Plain Text key

sbox result

Plain Text key

sbox result

Plain Text key

sbox result

full ISE XOR + S-box ISE S-box ISE XOR ISE Full CMOS

protected logic non protected logic Legend Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 54
slide-57
SLIDE 57

Example of ISE and its Source Code

// Calculate S-box (plaintext XOR key) int PRESENT(int plaintext, int key) {

1 int result = 0; // initialize the result 2 plaintext = plaintext ^key; // perform the xor with the key 3 result = S[plaintext]; // perform the S-box 4 return result; }; // return the result SBOX (std-cell)

MCML-CMOS converter key-reg CMOS -MCML converter 4 4 4 4

XOR+S-box ISE

// Calculate S-box (plaintext XOR key) int PRESENT_XOR+S-box-ISE(int plaintex) {

1 int result = 0; // initialize the result

// instantiate the new instruction s-box(pt ^key)

2 Instr_1(plaintex, result); 3 return result; }; // return the result

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 55
slide-58
SLIDE 58

Example of ISE and its Source Code

// Calculate S-box (plaintext XOR key) int PRESENT(int plaintext, int key) {

1 int result = 0; // initialize the result 2 plaintext = plaintext ^key; // perform the xor with the key 3 result = S[plaintext]; // perform the S-box 4 return result; }; // return the result

SBOX (std-cell) converter key-reg converter

4 4 4 4

XOR+S-box ISE

// Calculate S-box (plaintext XOR key) int PRESENT_XOR+S-box-ISE(int plaintex) {

1 int result = 0; // initialize the result

// instantiate the new instruction s-box(pt ^key)

2 Instr_1(plaintex, result); 3 return result; }; // return the result

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 56
slide-59
SLIDE 59

Security Evaluation

10

  • 6

10

  • 5

10

  • 4

10

  • 3

10

  • 2

10

  • 1

10 10

1

0.5 1 1.5 2 2.5 3 3.5 4

noise standard deviation mutual information [bit] full CMOS XOR ISE S-box ISE XOR + S-box ISE full ISE

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 57
slide-60
SLIDE 60

Security Evaluation

10

  • 6

10

  • 5

10

  • 4

10

  • 3

10

  • 2

10

  • 1

10 10

1

0.5 1 1.5 2 2.5 3 3.5 4

noise standard deviation mutual information [bit]

Treshold

full CMOS XOR ISE S-box ISE XOR + S-box ISE full ISE

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 58
slide-61
SLIDE 61

Total Time for experiments

PC Features: CPU: Intel(R) Core(TM)2 Quad CPU Q6700 GHz 2.6 Memory: 4 GB Example program 470 clock cycles (boot+cipher) SPICE Level Simulation (Synopsys Nanosim resolution: 1ps): Total simulated time 4700ns Total simulation time more or less 20 minutes 2.8s per clock cycle (full processor simulation core+ISE) Security Evaluation 4 hours per partitioning Full case study Worst case: 15 days on a single PC Parallelizable! Actual experiment: 2 days on 8 PCs

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 59
slide-62
SLIDE 62

Outline

Logic Synthesis (Secure) Design Flow for secure ISE Quick note on Software

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 60
slide-63
SLIDE 63

Needed “Basic Blocks”

identify sensitive parts Partition Sensitive / Non Sensitive Protect Sensitive Security Evaluation

Generate useful power traces? Measure the DPA resistance? Countermeasure and its design flow? Partition the algorithm?

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 61
slide-64
SLIDE 64

Real Measures on Microcontroller No need to simulate or emulate Power traces are obtained directly by measuring with an oscilloscope the software running on the microcontroller

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 62
slide-65
SLIDE 65

Needed “Basic Blocks”

identify sensitive parts Partition Sensitive / Non Sensitive Protect Sensitive Security Evaluation

Generate useful power traces? Measure the DPA resistance? Countermeasure and its design flow? Partition the algorithm?

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 63
slide-66
SLIDE 66

Needed “Basic Blocks”

identify sensitive parts Partition Sensitive / Non Sensitive Protect Sensitive Security Evaluation

Generate useful power traces? Measure the DPA resistance? Countermeasure and its design flow? Partition the algorithm?

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 64
slide-67
SLIDE 67

Metric Same as before.... Applied instruction by instruction!

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 65
slide-68
SLIDE 68

Needed “Basic Blocks”

identify sensitive parts Partition Sensitive / Non Sensitive Protect Sensitive Security Evaluation

Generate useful power traces? Measure the DPA resistance? Countermeasure and its design flow? Partition the algorithm?

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 66
slide-69
SLIDE 69

Needed “Basic Blocks”

identify sensitive parts Partition Sensitive / Non Sensitive Protect Sensitive Security Evaluation

Generate useful power traces? Measure the DPA resistance? Countermeasure and its design flow? Partition the algorithm?

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 67
slide-70
SLIDE 70

Code Transformation

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 68
slide-71
SLIDE 71

Needed “Basic Blocks”

identify sensitive parts Partition Sensitive / Non Sensitive Protect Sensitive Security Evaluation

Generate useful power traces? Measure the DPA resistance? Countermeasure and its design flow? Partition the algorithm?

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 69
slide-72
SLIDE 72

Needed “Basic Blocks”

identify sensitive parts Partition Sensitive / Non Sensitive Protect Sensitive Security Evaluation

Generate useful power traces? Measure the DPA resistance? Countermeasure and its design flow? Partition the algorithm?

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 70
slide-73
SLIDE 73

Transformation Target Identification

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 71
slide-74
SLIDE 74

Needed “Basic Blocks”

identify sensitive parts Partition Sensitive / Non Sensitive Protect Sensitive Security Evaluation

Generate useful power traces? Measure the DPA resistance? Countermeasure and its design flow? Partition the algorithm?

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 72
slide-75
SLIDE 75

Overall Software Flow

Transformation Target Identification Code Transformation

sbci r21,0xfd ld r25,Y movw r18,r26 subi r18,0x4f

Input Software Implementation Sensitive Parts

sbci r21,0xfd lds r23,705 mov r25,r23 ld r25,Y lds r23,705 mov r18,r23 mov r19,r23 movw r18,r26 subi r18,0x4f Targets for Protection Example (A) Protected Implementation Example (A) Targets for Protection Example (B) Protected Implementation Example (B) sbci r21,0xfd ld r25,Y movw r18,r26 subi r18,0x4f sbci r21,0xfd ld r25,Y movw r18,r26 subi r18,0x4f

Information Leakage Analysis

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 73
slide-76
SLIDE 76

Information Leakage Analysis

100 200 300 400 500 600 700 800 900 1000 1100 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1

Sensitivity (Mutual information) Clock cycle ARK SB SR MC

Sensitivity values for unprotected implementation

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 74
slide-77
SLIDE 77

Example on Software

846 847 848 849 850 851 852 853 854 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1

sbci r21,0xfd ld r25,Y movw r18,r26 subi r18,0x4f sbci r19,0xfd movw r28,r18 ld r30,Y Sensitivity (Mutual information) Clock cycle

Instruction - time mapping of unprotected implementation

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 75
slide-78
SLIDE 78

Example on Software

846 847 848 849 850 851 852 853 854 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1

sbci r21,0xfd ld r25,Y movw r18,r26 subi r18,0x4f sbci r19,0xfd movw r28,r18 ld r30,Y Sensitivity (Mutual information) Clock cycle

Instruction - time mapping of unprotected implementation

1620 1622 1624 1626 1628 1630 1632 1634 1636 1638 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1

sbci r21,0xfd lds r23,705 mov r25,r23 ld r25,Y lds r23,705 mov r18,r23 mov r19,r23 movw r18,r26 subi r18,0x4f sbci r19,0xfd movw r28,r18 lds r23,705 mov r30,r23 ld r30,Y Sensitivity (Mutual information) Clock cycle

Instruction - time mapping of protected implementation

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 75
slide-79
SLIDE 79

Security Evaluation

500 1000 1500 2000 2500 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1

Sensitivity (Mutual information) Clock cycle ARK SB SR MC

Sensitivity values for protected implementation

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 76
slide-80
SLIDE 80

Conclusions and Tips Initial steps for power analysis are promising This is just the beginning... PS: Never re-invent the wheel!

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 77
slide-81
SLIDE 81

Acknowledgments Paolo Ienne, Alessandro Cevrero, Yusuf Leblebici, Stéphane Badel, Johann Großschädl, Ali Galip Bayrak, Axel Poschmann, Zeynep Toprak, Marco Macchetti, Laura Pozzi, Christof Paar, Frank Gurkaynak, François-Xavier Standaert, Theo Kluter, Philip Brisk, Michael Schwander, Thomas Eisenbarth

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 78
slide-82
SLIDE 82

Questions? “There is beauty in what we do in EDA!” Alberto Sangiovanni-Vincentelli, EDA Café - 2009 Thank you for your attention! mail: regazzoni@alari.ch

Francesco Regazzoni 06 June 2014, Šibenik, Croatia

  • P. 79