Search

Neural networks have become popular due to their versatility and state-of-the-art results in many applications, such as image classification, natural language processing, speech recognition, forecasting, etc. These applications are also used in resource-constrained environments such as embedded devices. In this work, the susceptibility of neural network implementations to reverse engineering is explored on the NVIDIA Jetson Nano microcomputer via side-channel analysis. To this end, an architecture extraction attack is presented. In the attack, 15 popular convolutional neural network architectures (EfficientNets, MobileNets, NasNet, etc.) are implemented on the GPU of Jetson Nano and the electromagnetic radiation of the GPU is analyzed during the inference operation of the neural networks. The results of the analysis show that neural network architectures are easily distinguishable using deep learning-based side-channel analysis., Comment: Will appear at the AIHWS 2024 workshop at ACNS 2024

Side-channel attacks represent a realistic and serious threat to the security of embedded devices for already almost three decades. A variety of attacks and targets they can be applied to have been introduced, and while the area of side-channel attacks and their mitigation is very well-researched, it is yet to be consolidated.Deep learning-based side-channel attacks entered the field in recent years with the promise of more competitive performance and enlarged attackers' capabilities compared to other techniques. At the same time, the new attacks bring new challenges and complexities to the domain, making the systematization of knowledge (SoK) even more critical.We first dissect deep learning-based side-channel attacks according to the different phases they can be used in and map those phases to the efforts conducted so far in the domain. For each phase, we identify the weaknesses and challenges that triggered the known open problems. We also connect the attacks to the threat models and evaluate their advantages and drawbacks. Finally, we provide a number of recommendations to be followed in deep learning-based side-channel attacks.

The efficiency of the profiling side-channel analysis can be significantly improved with machine learning techniques. Although powerful, a fundamental machine learning limitation of being data-hungry received little attention in the side-channel community. In practice, the maximum number of leakage traces that evaluators/attackers can obtain is constrained by the scheme requirements or the limited accessibility of the target. Even worse, various countermeasures in modern devices increase the conditions on the profiling size to break the target. This work demonstrates a practical approach to dealing with the lack of profiling traces. Instead of learning from a one-hot encoded label, transferring the labels to their distribution can significantly speed up the convergence of guessing entropy. By studying the relationship between all possible key candidates, we propose a new metric, denoted Label Correlation (LC), to evaluate the generalization ability of the profiling model. We validate LC with two common use cases: early stopping and network architecture search, and the results indicate its superior performance., Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Cyber Security

Side-channel attacks represent a realistic and serious threat to the security of embedded devices for already almost three decades. A variety of attacks and targets they can be applied to have been introduced, and while the area of side-channel attacks and their mitigation is very well-researched, it is yet to be consolidated. Deep learning-based side-channel attacks entered the field in recent years with the promise of more competitive performance and enlarged attackers' capabilities compared to other techniques. At the same time, the new attacks bring new challenges and complexities to the domain, making the systematization of knowledge (SoK) even more critical.We first dissect deep learning-based side-channel attacks according to the different phases they can be used in and map those phases to the efforts conducted so far in the domain. For each phase, we identify the weaknesses and challenges that triggered the known open problems. We also connect the attacks to the threat models and evaluate their advantages and drawbacks. Finally, we provide a number of recommendations to be followed in deep learning-based side-channel attacks., Green Open Access added to TU Delft Institutional Repository ‘You share, we take care!’ – Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Cyber Security

Over the last decade, applications of neural networks (NNs) have spread to various aspects of our lives. A large number of companies base their businesses on building products that use neural networks for tasks such as face recognition, machine translation, and self-driving cars. Much of the intellectual property underpinning these products is encoded in the exact parameters of the neural networks. Consequently, protecting these is of utmost priority to businesses. At the same time, many of these products need to operate under a strong threat model, in which the adversary has unfettered physical control of the product. In this work, we present BarraCUDA, a novel attack on general purpose Graphic Processing Units (GPUs) that can extract parameters of neural networks running on the popular Nvidia Jetson Nano device. BarraCUDA uses correlation electromagnetic analysis to recover parameters of real-world convolutional neural networks.

At CRYPTO’19, A. Gohr proposed neural distinguishers for the lightweight block cipher Speck32/64, achieving better results than the state-of-the-art at that point. However, the motivation for using that particular architecture was not very clear; therefore, in this paper, we study the depth-10 and depth-1 neural distinguishers proposed by Gohr [7] with the aim of finding out whether smaller or better-performing distinguishers for Speck32/64 exist. We first evaluate whether we can find smaller neural networks that match the accuracy of the proposed distinguishers. We answer this question in the affirmative with the depth-1 distinguisher successfully pruned, resulting in a network that remained within one percentage point of the unpruned network’s performance. Having found a smaller network that achieves the same performance, we examine whether its performance can be improved as well. We also study whether processing the input before giving it to the pruned depth-1 network would improve its performance. To this end, convolutional autoencoders were found that managed to reconstruct the ciphertext pairs successfully, and their trained encoders were used as a preprocessor before training the pruned depth-1 network. We found that, even though the autoencoders achieved a nearly perfect reconstruction, the pruned network did not have the necessary complexity anymore to extract useful information from the preprocessed input, motivating us to look at the feature importance to get more insights. To achieve this, we used LIME, with results showing that a stronger explainer is needed to assess it correctly., Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Cyber Security

This paper introduces a deep learning modular network for side-channel analysis. Our deep learning approach features the capability to exchange part of it (modules) with others networks. We aim to introduce reusable trained modules into side-channel analysis instead of building architectures for each evaluation, reducing the body of work when conducting those. Our experiments demonstrate that our architecture feasibly assesses a side-channel evaluation suggesting that learning transferability is possible with the network we propose in this paper.

In this paper we report on the results of selected horizontal SCA attacks against two open-source designs that implement hardware accelerators for elliptic curve cryptography. Both designs use the complete addition formula to make the point addition and point doubling operations indistinguishable. One of the designs uses in addition means to randomize the operation sequence as a countermeasure. We used the comparison to the mean and an automated SPA to attack both designs. Despite all these countermeasures, we were able to extract the keys processed with a correctness of 100%., Comment: Author's version accepted for DSD-2020; the final publication is available at https://ieeexplore.ieee.org/document/9217817

Deep learning-based side-channel analysis performance heavily depends on the dataset size and the number of instances in each target class. Both small and imbalanced datasets might lead to unsuccessful side-channel attacks. The attack performance can be improved by generating traces synthetically from the obtained data instances instead of collecting them from the target device, but this is a cumbersome and challenging task. We propose a novel data augmentation approach based on conditional Generative Adversarial Networks (cGAN) and Siamese networks, enhancing the attack capability. We also present a quantitative comparative deep learning-based side-channel analysis between a real raw signal leakage dataset and an artificially augmented leakage dataset. The analysis is performed on the leakage datasets for both symmetric and public-key cryptographic implementations. We investigate non-convergent networks’ effect on the generation of fake leakage signals using two cGAN based deep learning models. The analysis shows that the proposed data augmentation model results in a well-converged network that generates realistic leakage traces, which can be used to mount deep learning-based side-channel analysis successfully even when the dataset available from the device is not optimal. Our results show that the datasets enhanced with “faked” leakage traces are breakable (while not without augmentation), which might change how we perform deep learning-based side-channel analysis., Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Cyber Security

This paper was selected for Top Picks in Hardware and Embedded Security 2020 and it presents a physical side-channel attack aiming at reverse engineering neural networks implemented on an edge device. The attack does not need access to training data and allows for neural network recovery by feeding known random inputs. We successfully reverse engineer information about layers, neurons, activation functions, and weights associated with neurons. This attack opens a new door in the domain of security of neural networks. Follow-up works by other researchers have shown this attack to be applicable for various settings and difficult to protect against., Green Open Access added to TU Delft Institutional Repository 'You share, we take care!' - Taverne project https://www.openaccess.nl/en/you-share-we-take-care Otherwise as indicated in the copyright section: the publisher is the copyright holder of this work and the author uses the Dutch legislation to make this work public., Cyber Security

Contains fulltext : 237439.pdf (Publisher’s version ) (Open Access)

Since 1996, numerous attacks have been shown to uncover secrets by exploiting a device's physical behavior or emanation, such as power consumption, electromagnetic radiation, execution time, or temperature. Until then, the adversary was always assumed to be constrained by black box assumptions, but we are aware now that he is considerably more powerful than expected. These new attacks, called side-channel attacks, have led to the design of several countermeasures to protect cryptographic secrets. This raises the need for sound methods to assess their security. However, this is a challenging task and the difficulty resides in the fact that unsuccessful attacks do not prove security. We must expand our scope to more powerful adversaries to reach higher security guarantees. In this thesis, we investigate such worst-case evaluations in the context of both symmetric and asymmetric cryptography. In the first part of the thesis, we speed up evaluations of elliptic curve cryptography implementations against horizontal attacks using shortcut formulas. In the second part, we study worst-case analytical belief-propagation-based attacks and compare them to simpler divide-and-conquer attacks to evaluate the elliptic curve point randomization countermeasure. The third part of the thesis relates to the masking and shuffling countermeasures. In this respect, we first improve tools for their evaluations, then we analyze and enhance the security impact of their combination., (FSA - Sciences de l'ingénieur) -- UCL, 2021

The absence of an algorithm that effectively monitors deep learning models used in side-channel attacks increases the difficulty of evaluation. If the attack is unsuccessful, the question is if we are dealing with a resistant implementation or a faulty model. We propose an early stopping algorithm that reliably recognizes the model's optimal state during training. The novelty of our solution is an efficient implementation of guessing entropy estimation. Additionally, we formalize two conditions, persistence and patience, for a deep learning model to be optimal. As a result, the model converges with fewer traces.

Evaluating side-channel analysis (SCA) security is a complex process, involving applying several techniques whose success depends on human engineering. Therefore, it is crucial to avoid a false sense of confidence provided by non-optimal (failing) attacks. Different alternatives have emerged lately trying to mitigate human dependency, among which deep learning (DL) attacks are the most studied today. DL promise to simplify the procedure by e.g. evading the need for point of interest selection or the capability of bypassing noise and desynchronization, among other shortcuts. However, including DL in the equation comes at a price, since working with neural networks is not straightforward in this context. Recently, an alternative has appeared with the potential to mitigate this dependence without adding extra complexity: Estimation of Distribution Algorithm-based SCA. In this paper, we compare these two relevant methods, supporting our findings by experiments on various datasets.

Side-channel attacks are a major threat to the security of cryptographic implementations, particularly for small devices that are under the physical control of the adversary. While several strategies for protecting against side-channel attacks exist, these often fail in practice due to unintended interactions between values deep within the CPU. To detect and protect from side-channel attacks, several automated tools have recently been proposed; one of their common limitations is that they only support first-order leakage. In this work, we present the first automated tool for detecting and eliminating higher-order leakage from cryptographic implementations. Rosita++ proposes statistical and software-based tools to allow high-performance higher-order leakage detection. It then uses the code rewrite engine of Rosita (Shelton et al. NDSS 2021) to eliminate detected leakage. For the sake of practicality we evaluate Rosita++ against second and third order leakage, but our framework is not restricted to only these orders. We evaluate Rosita++ against second-order leakage with three-share implementations of two ciphers, PRESENT and Xoodoo, and with the second-order Boolean-to-arithmetic masking, a core building block of masked implementations of many cryptographic primitives, including SHA-2, ChaCha and Blake. We show effective second-order leakage elimination at a performance cost of 36% for Xoodoo, 189% for PRESENT, and 29% for the Boolean-to-arithmetic masking. For third-order analysis, we evaluate Rosita++ against the third-order leakage using a four-share synthetic example that corresponds to typical four-share processing. Rosita++ correctly identified this leakage and applied code fixes.

Side-channel attacks that leak sensitive information through a computing device's interaction with its physical environment have proven to be a severe threat to devices' security, particularly when adversaries have unfettered physical access to the device. Traditional approaches for leakage detection measure the physical properties of the device. Hence, they cannot be used during the design process and fail to provide root cause analysis. An alternative approach that is gaining traction is to automate leakage detection by modeling the device. The demand to understand the scope, benefits, and limitations of the proposed tools intensifies with the increase in the number of proposals. In this SoK, we classify approaches to automated leakage detection based on the model's source of truth. We classify the existing tools on two main parameters: whether the model includes measurements from a concrete device and the abstraction level of the device specification used for constructing the model. We survey the proposed tools to determine the current knowledge level across the domain and identify open problems. In particular, we highlight the absence of evaluation methodologies and metrics that would compare proposals' effectiveness from across the domain. We believe that our results help practitioners who want to use automated leakage detection and researchers interested in advancing the knowledge and improving automated leakage detection.

Radboud University, 26 mei 2020, Promotor : Batina, Lejla, Contains fulltext : 218980.pdf (publisher's version ) (Open Access), The modern, always-online world relies on numerous electronic devices. Ensuring the unobstructed operation of transactions is quintessential, yet non-trivial to achieve. Devices operate in resource-constraint environments, often trying to achieve security with very narrow margins. Physical attacks such as side-channel cryptanalysis and fault injection pose a serious threat against their security. Techniques such as Differential Power Analysis and Template Attacks exploit physical observables of embedded targets, compromising cryptography in otherwise secure mathematical ciphers. To meet the security needs of our society, numerous countermeasures have been deployed. Masking and shuffling rank among the most popular choices, yet they do not come for free. Deploying them can make the implementation cost prohibitive, leading to situations where only partially secure products are used in the field. Therefore, this thesis puts forward the following contribution points. First, it develops efficient masking and shuffling countermeasures. To do so, it relies on high speed assembly-based implementations that push the limit of ARM/AVR devices. It also investigates closely the security level, aiming to remove leakage effects that hinder countermeasures. Second, instead of viewing countermeasures as isolated components, it promotes a holistic approach that examines the interactions between countermeasures, security and performance of a cryptographic implementation. Through information-theoretic analysis, we establish the tradeoff between randomness and masking/shuffling countermeasures, culminating in Reduced Randomness Masking/Shuffling schemes. Likewise, we link the fault injection resistance of duplication, infective protection and build-in fault detection to the side-channel security. Such tradeoffs can assist the designer and result in effective, yet affordable security. Third, it integrates new attack vectors to the existing arsenal. It inspects closely the location-based

This paper presents an investigation into the resistance of linearly filtered nonlinear feedback shift registers (LF-NFSRs) against distinguishing attacks. We formalise the method described by Orumiehchiha, Pieprzyk, Steinfeld and Bartlett and then extend it to develop a more efficient, systematic framework for accurately distinguishing an arbitrary LF-NFSR. Our method is then generalised to distinguish arbitrary LF-NFSRs with regularly decimated output sequences. The proposed method is demonstrated through application to the example LF-NFSR used by Orumiehchiha et al. with improved results. Additionally, our new method can be accurately applied to much larger registers and can predict how much output is needed to find the strongest bias. To demonstrate this, we derive time and keystream requirement estimates for our attacks on each variant of the Grain family of stream ciphers under weak key-IV pairs.

To mitigate side-channel attacks, real-world implementations of public-key cryptosystems adopt state-of-the-art countermeasures based on randomization of the private or ephemeral keys. Usually, for each private key operation, a “scalar blinding” is performed using 32 or 64 randomly generated bits. Nevertheless, horizontal attacks based on a single trace still pose serious threats to protected ECC or RSA implementations. If the secrets learned through a single-trace attack contain too many wrong (or noisy) bits, the cryptanalysis methods for recovering remaining bits become impractical due to time and computational constraints. This paper proposes a deep learning-based framework to iteratively correct partially correct private keys resulting from a clustering-based horizontal attack. By testing the trained network on scalar multiplication (or exponentiation) traces, we demonstrate that a deep neural network can significantly reduce the number of wrong bits from randomized scalars (or exponents). When a simple horizontal attack can recover around 52% of attacked multiple private key bits, the proposed iterative framework improves the private key accuracy to above 90% on average and to 100% for at least one of the attacked keys. Our attack model remains fully unsupervised and excludes the need to know where the error or noisy bits are located in each separate randomized private key., Cyber Security

Profiling attacks, especially those based on machine learning, proved to be very successful techniques in recent years when considering the side-channel analysis of symmetric-key crypto implementations. At the same time, the results for implementations of asymmetric-key cryptosystems are very sparse. This paper considers several machine learning techniques to mount side-channel attacks on two implementations of scalar multiplication on the elliptic curve Curve25519. The first implementation follows the baseline implementation with complete formulae as used for EdDSA in WolfSSl, where we exploit power consumption as a side-channel. The second implementation features several countermeasures, and in this case, we analyze electromagnetic emanations to find side-channel leakage. Most techniques considered in this work result in potent attacks, and especially the method of choice appears to be convolutional neural networks (CNNs), which can break the first implementation with only a single measurement in the attack phase. The same convolutional neural network demonstrated excellent performance for attacking AES cipher implementations. Our results show that some common grounds can be established when using deep learning for profiling attacks on very different cryptographic algorithms and their corresponding implementations., Cyber Security

Radboud University, 26 mei 2020, Promotor : Batina, Lejla, Contains fulltext : 218980.pdf (publisher's version ) (Open Access), The modern, always-online world relies on numerous electronic devices. Ensuring the unobstructed operation of transactions is quintessential, yet non-trivial to achieve. Devices operate in resource-constraint environments, often trying to achieve security with very narrow margins. Physical attacks such as side-channel cryptanalysis and fault injection pose a serious threat against their security. Techniques such as Differential Power Analysis and Template Attacks exploit physical observables of embedded targets, compromising cryptography in otherwise secure mathematical ciphers. To meet the security needs of our society, numerous countermeasures have been deployed. Masking and shuffling rank among the most popular choices, yet they do not come for free. Deploying them can make the implementation cost prohibitive, leading to situations where only partially secure products are used in the field. Therefore, this thesis puts forward the following contribution points. First, it develops efficient masking and shuffling countermeasures. To do so, it relies on high speed assembly-based implementations that push the limit of ARM/AVR devices. It also investigates closely the security level, aiming to remove leakage effects that hinder countermeasures. Second, instead of viewing countermeasures as isolated components, it promotes a holistic approach that examines the interactions between countermeasures, security and performance of a cryptographic implementation. Through information-theoretic analysis, we establish the tradeoff between randomness and masking/shuffling countermeasures, culminating in Reduced Randomness Masking/Shuffling schemes. Likewise, we link the fault injection resistance of duplication, infective protection and build-in fault detection to the side-channel security. Such tradeoffs can assist the designer and result in effective, yet affordable security. Third, it integrates new attack vectors to the existing arsenal. It inspects closely the location-based

Profiling attacks, especially those based on machine learning, proved to be very successful techniques in recent years when considering the side-channel analysis of symmetric-key crypto implementations. At the same time, the results for implementations of asymmetric-key cryptosystems are very sparse. This paper considers several machine learning techniques to mount side-channel attacks on two implementations of scalar multiplication on the elliptic curve Curve25519. The first implementation follows the baseline implementation with complete formulae as used for EdDSA in WolfSSl, where we exploit power consumption as a side-channel. The second implementation features several countermeasures, and in this case, we analyze electromagnetic emanations to find side-channel leakage. Most techniques considered in this work result in potent attacks, and especially the method of choice appears to be convolutional neural networks (CNNs), which can break the first implementation with only a single measurement in the attack phase. The same convolutional neural network demonstrated excellent performance for attacking AES cipher implementations. Our results show that some common grounds can be established when using deep learning for profiling attacks on very different cryptographic algorithms and their corresponding implementations., Cyber Security

To mitigate side-channel attacks, real-world implementations of public-key cryptosystems adopt state-of-the-art countermeasures based on randomization of the private or ephemeral keys. Usually, for each private key operation, a “scalar blinding” is performed using 32 or 64 randomly generated bits. Nevertheless, horizontal attacks based on a single trace still pose serious threats to protected ECC or RSA implementations. If the secrets learned through a single-trace attack contain too many wrong (or noisy) bits, the cryptanalysis methods for recovering remaining bits become impractical due to time and computational constraints. This paper proposes a deep learning-based framework to iteratively correct partially correct private keys resulting from a clustering-based horizontal attack. By testing the trained network on scalar multiplication (or exponentiation) traces, we demonstrate that a deep neural network can significantly reduce the number of wrong bits from randomized scalars (or exponents). When a simple horizontal attack can recover around 52% of attacked multiple private key bits, the proposed iterative framework improves the private key accuracy to above 90% on average and to 100% for at least one of the attacked keys. Our attack model remains fully unsupervised and excludes the need to know where the error or noisy bits are located in each separate randomized private key., Cyber Security

Performing a comprehensive side-channel analysis evaluation of small embedded devices is a process known for its variability and complexity. In real-world experimental setups, the results are largely influenced by a huge amount of parameters that are not easily adjusted without trial and error and are heavily relying on the experience of professional security analysts. In this paper, we advocate the use of an existing statistical methodology called Six Sigma (6{\sigma}) for side-channel analysis optimization for this purpose. This well-known methodology is commonly used in other industrial fields, such as production and quality engineering, to reduce the variability of industrial processes. We propose a customized Six Sigma methodology, which enables even a less-experienced security analysis to select optimal values for the different variables that are critical for the side-channel analysis procedure. Moreover, we show how our methodology helps in improving different phases in the side-channel analysis process., Comment: 30 pages, 8 figures

Due to the constant increase and versatility of IoT devices that should keep sensitive information private, Side-Channel Analysis (SCA) attacks on embedded devices are gaining visibility in the industrial field. The integration and validation of countermeasures against SCA can be an expensive and cumbersome process, especially for the less experienced ones, and current certification procedures require to attack the devices under test using multiple SCA techniques and attack vectors, often implying a high degree of complexity. The goal of this paper is to ease one of the most crucial and tedious steps of profiling attacks i.e. the points of interest (POI) selection and hence assist the SCA evaluation process. To this end, we introduce the usage of Estimation of Distribution Algorithms (EDAs) in the SCA field in order to automatically tune the point of interest selection. We showcase our approach on several experimental use cases, including attacks on unprotected and protected AES implementations over distinct copies of the same device, dismissing in this way the portability issue.

We introduce screen gleaning, a TEMPEST attack in which the screen of a mobile device is read without a visual line of sight, revealing sensitive information displayed on the phone screen. The screen gleaning attack uses an antenna and a software-defined radio (SDR) to pick up the electromagnetic signal that the device sends to the screen to display, e.g., a message with a security code. This special equipment makes it possible to recreate the signal as a gray-scale image, which we refer to as an emage. Here, we show that it can be used to read a security code. The screen gleaning attack is challenging because it is often impossible for a human viewer to interpret the emage directly. We show that this challenge can be addressed with machine learning, specifically, a deep learning classifier. Screen gleaning will become increasingly serious as SDRs and deep learning continue to rapidly advance. In this paper, we demonstrate the security code attack and we propose a testbed that provides a standard setup in which screen gleaning could be tested with different attacker models. Finally, we analyze the dimensions of screen gleaning attacker models and discuss possible countermeasures with the potential to address them., Comment: To appear at NDSS 2021

Contains fulltext : 203036.pdf (publisher's version ) (Open Access)

Profiled side-channel attacks consist of several steps one needs to take. An important, but sometimes ignored, step is a selection of the points of interest (features) within side-channel measurement traces. A large majority of the related works start the analyses with an assumption that the features are preselected. Contrary to this assumption, here, we concentrate on the feature selection step. We investigate how advanced feature selection techniques stemming from the machine learning domain can be used to improve the attack efficiency. To this end, we provide a systematic evaluation of the methods of interest. The experiments are performed on several real-world data sets containing software and hardware implementations of AES, including the random delay countermeasure. Our results show that wrapper and hybrid feature selection methods perform extremely well over a wide range of test scenarios and a number of features selected. We emphasize L1 regularization (wrapper approach) and linear support vector machine (SVM) with recursive feature elimination used after chi-square filter (Hybrid approach) that performs well in both accuracy and guessing entropy. Finally, we show that the use of appropriate feature selection techniques is more important for an attack on the high-noise data sets, including those with countermeasures, than on the low-noise ones., Accepted author manuscript, Cyber Security

Machine learning has become mainstream across industries. Numerous examples prove the validity of it for security applications. In this work, we investigate how to reverse engineer a neural network by using side-channel information such as timing and electromagnetic (EM) emanations. To this end, we consider multilayer perceptron and convolutional neural networks as the machine learning architectures of choice and assume a non-invasive and passive attacker capable of measuring those kinds of leakages. We conduct all experiments on real data and commonly used neural network architectures in order to properly assess the applicability and extendability of those attacks. Practical results are shown on an ARM Cortex-M3 microcontroller, which is a platform often used in pervasive applications using neural networks such as wearables, surveillance cameras, etc. Our experiments show that a side-channel attacker is capable of obtaining the following information: the activation functions used in the architecture, the number of layers and neurons in the layers, the number of output classes, and weights in the neural network. Thus, the attacker can effectively reverse engineer the network using merely side-channel information such as timing or EM., Cyber Security

Machine learning has become mainstream across industries. Numerous examples prove the validity of it for security applications. In this work, we investigate how to reverse engineer a neural network by using side-channel information such as timing and electromagnetic (EM) emanations. To this end, we consider multilayer perceptron and convolutional neural networks as the machine learning architectures of choice and assume a non-invasive and passive attacker capable of measuring those kinds of leakages. We conduct all experiments on real data and commonly used neural network architectures in order to properly assess the applicability and extendability of those attacks. Practical results are shown on an ARM Cortex-M3 microcontroller, which is a platform often used in pervasive applications using neural networks such as wearables, surveillance cameras, etc. Our experiments show that a side-channel attacker is capable of obtaining the following information: the activation functions used in the architecture, the number of layers and neurons in the layers, the number of output classes, and weights in the neural network. Thus, the attacker can effectively reverse engineer the network using merely side-channel information such as timing or EM., Cyber Security

Profiled side-channel attacks consist of several steps one needs to take. An important, but sometimes ignored, step is a selection of the points of interest (features) within side-channel measurement traces. A large majority of the related works start the analyses with an assumption that the features are preselected. Contrary to this assumption, here, we concentrate on the feature selection step. We investigate how advanced feature selection techniques stemming from the machine learning domain can be used to improve the attack efficiency. To this end, we provide a systematic evaluation of the methods of interest. The experiments are performed on several real-world data sets containing software and hardware implementations of AES, including the random delay countermeasure. Our results show that wrapper and hybrid feature selection methods perform extremely well over a wide range of test scenarios and a number of features selected. We emphasize L1 regularization (wrapper approach) and linear support vector machine (SVM) with recursive feature elimination used after chi-square filter (Hybrid approach) that performs well in both accuracy and guessing entropy. Finally, we show that the use of appropriate feature selection techniques is more important for an attack on the high-noise data sets, including those with countermeasures, than on the low-noise ones., Accepted author manuscript, Cyber Security

Since their introduction over two decades ago, side-channel attacks have presented a serious security threat. While many ciphers' implementations employ masking techniques to protect against such attacks, they often leak secret information due to unintended interactions in the hardware. We present Rosita, a code rewrite engine that uses a leakage emulator which we amend to correctly emulate the micro-architecture of a target system. We use Rosita to automatically protect masked implementations of AES, ChaCha, and Xoodoo. For AES and Xoodoo, we show the absence of observable leakage at 1,000,000 traces with less than 21% penalty to the performance. For ChaCha, which has significantly more leakage, Rosita eliminates over 99% of the leakage, at a performance cost of 64%., Comment: 17 pages, 16 figures. Accepted in Network and Distributed Systems Security (NDSS) Symposium 2021

Machine learning has become mainstream across industries. Numerous examples proved the validity of it for security applications. In this work, we investigate how to reverse engineer a neural network by using only power side-channel information. To this end, we consider a multilayer perceptron as the machine learning architecture of choice and assume a non-invasive and eavesdropping attacker capable of measuring only passive side-channel leakages like power consumption, electromagnetic radiation, and reaction time. We conduct all experiments on real data and common neural net architectures in order to properly assess the applicability and extendability of those attacks. Practical results are shown on an ARM CORTEX-M3 microcontroller. Our experiments show that the side-channel attacker is capable of obtaining the following information: the activation functions used in the architecture, the number of layers and neurons in the layers, the number of output classes, and weights in the neural network. Thus, the attacker can effectively reverse engineer the network using side-channel information. Next, we show that once the attacker has the knowledge about the neural network architecture, he/she could also recover the inputs to the network with only a single-shot measurement. Finally, we discuss several mitigations one could use to thwart such attacks., Comment: 15 pages, 16 figures

This report documents the program and the outcomes of Dagstuhl Seminar 16342 "Foundations of Secure Scaling". This seminar hosted researchers in secure electronic system design, spanning all abstraction levels from cryptographic engineering over chip design to system integration. We recognize that scaling is a fundamental force present at every abstraction level in electronic system design. While scaling is generally thought of as beneficial to the resulting implementations, this does not hold for secure electronic design. Indeed, the relations between scaling and the resulting security are poorly understood. This seminar facilitated the discussion between security experts at different abstraction levels in order to uncover the links between scaling and the resulting security.

This report documents the program and the outcomes of Dagstuhl Seminar 16342 "Foundations of Secure Scaling". This seminar hosted researchers in secure electronic system design, spanning all abstraction levels from cryptographic engineering over chip design to system integration. We recognize that scaling is a fundamental force present at every abstraction level in electronic system design. While scaling is generally thought of as beneficial to the resulting implementations, this does not hold for secure electronic design. Indeed, the relations between scaling and the resulting security are poorly understood. This seminar facilitated the discussion between security experts at different abstraction levels in order to uncover the links between scaling and the resulting security.

Cryptography is the foundation of modern IT security,it provides algorithms and protocols that can be usedfor secure communications. Cryptographic algorithmsensure properties such as confidentiality and data integrity.Confidentiality can be ensured using encryption algorithms.Encryption algorithms require a secret information called a key.These algorithms are implemented in cryptographic devices.There exist many types of attacks against such cryptosystems,the main goal of these attacks is the extraction of the secret key.Side-channel attacks are among the strongest types of attacksagainst cryptosystems. Side-channel attacks focus on the attacked device, they measure its physicalproperties in order to extract the secret key. Thus, these attacks targetweaknesses in an implementation of an algorithm rather than the abstract algorithm itself.Power analysis is a type of side-channel attacks that can be used to extract a secretkey from a cryptosystem through the analysis of its power consumption whilethe target device executes an encryption algorithm. We can say that the secret information is leaking from the device through itspower consumption. One of the biggest challenges in the domain of side-channel analysisis the evaluation of a device from the perspective of side-channel attacksor in other words the detection of information leakage.A device can be subject to several sources of information leakageand it is actually relatively easy to find just one side-channel attack that works(by exploiting just one source of leakage),however it is very difficult to find all sources of information leakage or to show that there is no information leakage in the givenimplementation of an encryption algorithm. Evaluators use various statistical tests during the analysis of a cryptographic device to checkthat it does not leak the secret key. However, in order to performsuch tests the evaluation lab needs the device to acquire the measurementsand analyse them. Unfortunately, the developm, Option Informatique du Doctorat en Sciences, info:eu-repo/semantics/nonPublished

Embedded systems (ESs) have been widely used in various application domains. It is very important to design ESs that guarantee functional correctness of the system under strict timing constraints. Such systems are known as the real-time embedded systems (RTESs). More recently, RTESs started to be utilized in safety and reliability critical areas, which made the overlooked security issues, especially confidentiality of the communication, a serious problem. Differential power analysis attacks (DPAs) pose serious threats to confidentiality protection mechanisms, i.e., implementations of cryptographic algorithms, on embedded platforms. In this work, we present a scheduling policy, SPARTA, that thwarts DPAs. Theoretical guarantees and preliminary experimental results are presented to demonstrate the efficiency of the SPARTA scheduler.

We describe the design and implementation of efficient signature and key-exchange schemes for the AVR ATmega and ARM Cortex M0 microcontrollers, targeting the 128-bit security level. Our algorithms are based on an efficient Montgomery ladder scalar multiplication on the Kummer surface of Gaudry and Schost's genus-2 hyperelliptic curve, combined with the Jacobian point recovery technique of Costello, Chung, and Smith. Our results are the first to show the feasibility of software-only hyperelliptic cryptography on constrained platforms, and represent a significant improvement on the elliptic-curve state-of-the-art for both key exchange and signatures on these architectures. Notably, our key-exchange scalar-multiplication software runs in under 9740k cycles on the ATmega, and under 2650k cycles on the Cortex M0.

Power and clock glitch attacks on smart cards can help an attacker to discover some internal secrets or bypass certain security checks. Also, an attacker can manipulate the temperature and supply voltage of the device, thus making the device glitch more easily. If these manipulations are within the device operating conditions, it becomes harder to distinguish between an extreme condition from an attacker. To demonstrate temperature and power supply effect on fault attacks, we perform several tests on an Atmega 163 microcontroller in different conditions. Our results show that this kind of attacks are still a serious threat to small devices, whilst maintaining the manufacturer recommendations.

Scalar multiplication, the main operation in elliptic curve cryptographic protocols, is vulnerable to side-channel (SCA) and fault injection (FA) attacks. An efficient countermeasure for scalar multiplication can be provided by using alternative number systems like the Residue Number System (RNS). In RNS, a number is represented as a set of smaller numbers, where each one is the result of the modular reduction with a given moduli basis. Under certain requirements, a number can be uniquely transformed from the integers to the RNS domain (and vice versa) and all arithmetic operations can be performed in RNS. This representation provides an inherent SCA and FA resistance to many attacks and can be further enhanced by RNS arithmetic manipulation or more traditional algorithmic countermeasures. In this paper, extending our previous work, we explore the potentials of RNS as an SCA and FA countermeasure and provide an description of RNS based SCA and FA resistance means. We propose a secure and efficient Montgomery Power Ladder based scalar multiplication algorithm on RNS and discuss its SCAFA resistance. The proposed algorithm is implemented on an ARM Cortex A7 processor and its SCA-FA resistance is evaluated by collecting preliminary leakage trace results that validate our initial assumptions.

Embedded systems (ESs) have been a prominent solution for enhancing system performance and reliability in recent years. ESs that are required to ensure functional correctness under timing constraints are referred to as real-time embedded systems (RTESs). With the emerging trend of utilizing RTESs in safety and reliability critical areas, security of RTESs, especially confidentiality of the communication, becomes of great importance. More recently, side-channel attacks (SCAs) posed serious threats to confidentiality protection mechanisms, namely, cryptographic algorithms. In this work, we present the first analytical framework for quantifying the influence of real-time scheduling policies on the robustness of secret keys against differential power analysis (DPA) attacks, one of the most popular type of SCAs. We validated the proposed concept on two representative scheduling algorithms, earliest deadline first scheduling (EDF) and rate-monotonic scheduling (RMS), via extensive experiments.

Physical Unclonable Functions or PUFs have gained importance since they appeared about a decade ago. PUFs are based on physical random features that can serve as primitives in designing security systems similarly to human biometrics. The basic idea of using random features for security applications seems very interesting since the randomness is there for free. However, it raises some important research questions to be studied. The first important question is that ``how good are PUFs?'' or in other words ``what are our expectations from them and how can we experimentally validate these expectations?''. The second question rising after evaluating the expected properties is that ``how can we connect these physical entities to secure systems?'' or ``how cryptographic primitives can be used to fill the gap between physics and secure systems?''. This dissertation tries to address these two main questions for a specific category of PUFs which are called Image-based PUFs and a particular secure system i.e., anti-counterfeiting. Image-based PUFs represent a category of PUFs based on random visual features of physical objects evaluated by an imaging method. The first part of the thesis is dedicated to build a unified model to deal with Image-based PUFs. The model includes all the procedures needed to evaluate and post-process the images taken from Image-based PUFs. We also provide practical implementations of system components. For example we introduce two new types of Image-based PUFs called Laser-written PUF and Crystal PUF. The relevance of the framework is further demonstrated by its accordance to these examples of Image-based PUFs. We also present two practical adaptive and non-adaptive image hashing methods called Gabor Binary Hashing and Random Binary Hashing. After building the model and instantiating its components, the second part of this thesis tries to address the first question i.e., ``how good are PUFs?''. For that, we experimentally characterize the important p, (FSA 3) -- UCL, 2013

[EN] Nowadays, it has become a common practice for companies to have dedicated hardware devices for protecting their sensitive information e.g. by enabling data encryption or enforcing access control policies. In order to assess the resistance of a device against external attacks and evaluate the security level of the protected information, there are several techniques which aim to gain access to this sensitive information. A widely known example of these attack techniques is VCC line Fault Injection. The VCC Fault Injection technique consists of injecting abnormal signals (called glitches) in the power line of an IC, aiming to alter the normal behavior of a hardware-based device. The fault injection is said to be successful if as a result of it the device under test entered a state which is exploitable by an attacker for gaining access to the sensitive information (such as e.g. cryptographic keys, application source code, or confidential data in general). This Final Year Project report is the product of six months of research, which has as a result a proposed methodology for automating the search for suitable parameters for a successful VCC FI attack. This methodology can be split into three parts: a theoretical model of a generic hardware device, a search strategy based on this theoretical model, and a report of findings from the search that allows us to visualize the behavior of the device under test under different parameter configurations., [ES] En la actualidad, la protección de información mediante el uso de dispositivos hardware dedicados es un hecho cada vez más común en todo tipo de ámbitos. Para evaluar la resistencia de un dispositivo hardware frente a ataques externos y garantizar la seguridad de la información protegida, existen multitud de técnicas cuyo objetivo es el acceso a la información confidencial, y entre dichas técnicas se encuentra la de inyección de fallos. La técnica de inyección de fallos en la línea de alimentación (en inglés VCC Fault Injection o simplemente VCC FI) consiste en la introducción de señales anómalas en la línea de alimentación de un circuito integrado (en inglés glitch) cuya finalidad es la de alterar el normal funcionamiento de un dispositivo hardware y provocar que entre en un estado que un atacante pueda explotar en su beneficio para obtener la información protegida por el dispositivo (bien sean claves criptográficas, código fuente de una aplicación o datos confidenciales). En el caso de que un analista de seguridad decida emplear VCC Fault Injection, se da la problemática de definir el ataque en sí: se debe especificar tanto la señal anómala a inyectar, como el instante temporal de inyección. Dado que el número de parámetros que permiten definir las características del ataque es elevado, el espacio de posibles configuraciones hace impracticable su exploración por completo. No obstante, el éxito de dicho ataque depende de utilizar una configuración (o configuraciones) específicas de los parámetros, por lo que encontrar valores para los diferentes parámetros del ataque de manera automática y eficiente cobra especial relevancia en una auditoría de seguridad de un dispositivo, en la cual el tiempo para realizar experimentos suele estar severamente restringido. La presente memoria de Proyecto Final de Carrera recoge seis meses de investigación en el ámbito de VCC Fault Injection, cuyo resultado ha sido la propuesta de un esquema para la automatización de la búsqued

[EN] Nowadays, it has become a common practice for companies to have dedicated hardware devices for protecting their sensitive information e.g. by enabling data encryption or enforcing access control policies. In order to assess the resistance of a device against external attacks and evaluate the security level of the protected information, there are several techniques which aim to gain access to this sensitive information. A widely known example of these attack techniques is VCC line Fault Injection. The VCC Fault Injection technique consists of injecting abnormal signals (called glitches) in the power line of an IC, aiming to alter the normal behavior of a hardware-based device. The fault injection is said to be successful if as a result of it the device under test entered a state which is exploitable by an attacker for gaining access to the sensitive information (such as e.g. cryptographic keys, application source code, or confidential data in general). This Final Year Project report is the product of six months of research, which has as a result a proposed methodology for automating the search for suitable parameters for a successful VCC FI attack. This methodology can be split into three parts: a theoretical model of a generic hardware device, a search strategy based on this theoretical model, and a report of findings from the search that allows us to visualize the behavior of the device under test under different parameter configurations., [ES] En la actualidad, la protección de información mediante el uso de dispositivos hardware dedicados es un hecho cada vez más común en todo tipo de ámbitos. Para evaluar la resistencia de un dispositivo hardware frente a ataques externos y garantizar la seguridad de la información protegida, existen multitud de técnicas cuyo objetivo es el acceso a la información confidencial, y entre dichas técnicas se encuentra la de inyección de fallos. La técnica de inyección de fallos en la línea de alimentación (en inglés VCC Fault Injection o simplemente VCC FI) consiste en la introducción de señales anómalas en la línea de alimentación de un circuito integrado (en inglés glitch) cuya finalidad es la de alterar el normal funcionamiento de un dispositivo hardware y provocar que entre en un estado que un atacante pueda explotar en su beneficio para obtener la información protegida por el dispositivo (bien sean claves criptográficas, código fuente de una aplicación o datos confidenciales). En el caso de que un analista de seguridad decida emplear VCC Fault Injection, se da la problemática de definir el ataque en sí: se debe especificar tanto la señal anómala a inyectar, como el instante temporal de inyección. Dado que el número de parámetros que permiten definir las características del ataque es elevado, el espacio de posibles configuraciones hace impracticable su exploración por completo. No obstante, el éxito de dicho ataque depende de utilizar una configuración (o configuraciones) específicas de los parámetros, por lo que encontrar valores para los diferentes parámetros del ataque de manera automática y eficiente cobra especial relevancia en una auditoría de seguridad de un dispositivo, en la cual el tiempo para realizar experimentos suele estar severamente restringido. La presente memoria de Proyecto Final de Carrera recoge seis meses de investigación en el ámbito de VCC Fault Injection, cuyo resultado ha sido la propuesta de un esquema para la automatización de la búsqued

[EN] Nowadays, it has become a common practice for companies to have dedicated hardware devices for protecting their sensitive information e.g. by enabling data encryption or enforcing access control policies. In order to assess the resistance of a device against external attacks and evaluate the security level of the protected information, there are several techniques which aim to gain access to this sensitive information. A widely known example of these attack techniques is VCC line Fault Injection. The VCC Fault Injection technique consists of injecting abnormal signals (called glitches) in the power line of an IC, aiming to alter the normal behavior of a hardware-based device. The fault injection is said to be successful if as a result of it the device under test entered a state which is exploitable by an attacker for gaining access to the sensitive information (such as e.g. cryptographic keys, application source code, or confidential data in general). This Final Year Project report is the product of six months of research, which has as a result a proposed methodology for automating the search for suitable parameters for a successful VCC FI attack. This methodology can be split into three parts: a theoretical model of a generic hardware device, a search strategy based on this theoretical model, and a report of findings from the search that allows us to visualize the behavior of the device under test under different parameter configurations., [ES] En la actualidad, la protección de información mediante el uso de dispositivos hardware dedicados es un hecho cada vez más común en todo tipo de ámbitos. Para evaluar la resistencia de un dispositivo hardware frente a ataques externos y garantizar la seguridad de la información protegida, existen multitud de técnicas cuyo objetivo es el acceso a la información confidencial, y entre dichas técnicas se encuentra la de inyección de fallos. La técnica de inyección de fallos en la línea de alimentación (en inglés VCC Fault Injection o simplemente VCC FI) consiste en la introducción de señales anómalas en la línea de alimentación de un circuito integrado (en inglés glitch) cuya finalidad es la de alterar el normal funcionamiento de un dispositivo hardware y provocar que entre en un estado que un atacante pueda explotar en su beneficio para obtener la información protegida por el dispositivo (bien sean claves criptográficas, código fuente de una aplicación o datos confidenciales). En el caso de que un analista de seguridad decida emplear VCC Fault Injection, se da la problemática de definir el ataque en sí: se debe especificar tanto la señal anómala a inyectar, como el instante temporal de inyección. Dado que el número de parámetros que permiten definir las características del ataque es elevado, el espacio de posibles configuraciones hace impracticable su exploración por completo. No obstante, el éxito de dicho ataque depende de utilizar una configuración (o configuraciones) específicas de los parámetros, por lo que encontrar valores para los diferentes parámetros del ataque de manera automática y eficiente cobra especial relevancia en una auditoría de seguridad de un dispositivo, en la cual el tiempo para realizar experimentos suele estar severamente restringido. La presente memoria de Proyecto Final de Carrera recoge seis meses de investigación en el ámbito de VCC Fault Injection, cuyo resultado ha sido la propuesta de un esquema para la automatización de la búsqued

Implementations of the Advanced Encryption Standard (AES), including hardware applications with limited resources (e.g., smart cards), may be vunerable to "side-channel attacks" such as differential power analysis. One countermeasure against such attacks is adding a random mask to the data; this rendomizes the statistics of the calculation at the cost of computing "mask corrections." The single nonlinear step in each AES round is the "S-box" (involving a Galois inversion), which incurs the majority of the cost for mark corrections. Oswald et al.(1) showed how the "tower field" representation allows maintaining an additive mask throughout the Galois inverse calculation. This work applies a similar masking strategy to the most compact Iunmasked) S-box to date (2). The result is the most compact S-box so far, with "perfect modeling" (by the definition of Blomer (3) giving suitable implementations immunity to first-order differential side-channel attacks.