National Institute of Standards and Technology における超伝導研究及び生活

Mutual Information Analysis is a generic side-channel distinguisher that has been introduced at CHES 2008. It aims to allow successful attacks requiring minimum assumptions and knowledge of the target device by the adversary. In this paper, we compile recent contributions and applications of MIA in a comprehensive study. From a theoretical point of view, we carefully discuss its statistical properties and relationship with probability density estimation tools. From a practical point of view, we apply MIA in two of the most investigated contexts for side-channel attacks. Namely, we consider first-order attacks against an unprotected implementation of the DES in a full custom IC and second-order attacks against a masked implementation of the DES in an 8-bit microcontroller. These experiments allow to put forward the strengths and weaknesses of this new distinguisher and to compare it with standard power analysis attacks using the correlation coefficient.

/pdf/mutual-information-analysis-a-comprehensive-study-4w8ydzyaar.pdf

Mutual Information Analysis: a Comprehensive Study

Grostl is a SHA-3 candidate proposal. Grostl is an iterated hash function with a compression function built from two fixed, large, distinct permutations. The design of Grostl
is transparent and based on principles very different from those used in the SHA-family. The two permutations are constructed using the wide trail design strategy, which makes it possible to give strong statements about the resistance of Grostl against large classes of cryptanalytic attacks. Moreover, if these permutations are assumed to be ideal, there is a proof for the security of the hash function. Grostl is a byte-oriented SP-network which borrows components from the AES. The S-box used is identical to the one used in the block cipher AES and the diffusion layers are constructed in a similar manner to those of the AES. As a consequence there is a very strong confusion and diffusion in Grostl. Grostl is a so-called wide-pipe construction where the size of the internal state is significantly larger than the size of the output. This has the effect that all known, generic attacks on the hash function are made much more difficult. Grostl has good performance on a wide range of platforms and counter-measures against side-channel attacks are well-understood from similar work on the AES.

Grøstl – a SHA-3 candidate

The need for lightweight (that is, compact, low-power, low-energy) cryptographic hash functions has been repeatedly expressed by professionals, notably to implement cryptographic protocols in RFID technology. At the time of writing, however, no algorithm exists that provides satisfactory security and performance. The ongoing SHA-3 Competition will not help, as it concerns general-purpose designs and focuses on software performance. This paper thus proposes a novel design philosophy for lightweight hash functions, based on the sponge construction in order to minimize memory requirements. Inspired by the stream cipher Grain and by the block cipher KATAN (amongst the lightest secure ciphers), we present the hash function family Quark, composed of three instances: u-Quark, d-Quark, and s-Quark. As a sponge construction, Quark can be used for message authentication, stream encryption, or authenticated encryption. Our hardware evaluation shows that Quark compares well to previous tentative lightweight hash functions. For example, our lightest instance u-Quark conjecturally provides at least 64-bit security against all attacks (collisions, multicollisions, distinguishers, etc.), fits in 1379 gate-equivalents, and consumes on average 2.44 μW at 100 kHz in 0.18 μm ASIC. For 112-bit security, we propose s-Quark, which can be implemented with 2296 gate-equivalents with a power consumption of 4.35 μW.

/pdf/quark-a-lightweight-hash-461jjxjajg.pdf

Quark: A Lightweight Hash

We introduce Slender PUF protocol, an efficient and secure method to authenticate the responses generated from a Strong Physical Unclonable Function (PUF). The new method is lightweight, and suitable for energy constrained platforms such as ultra-low power embedded systems for use in identification and authentication applications. The proposed protocol does not follow the classic paradigm of exposing the full PUF responses (or a transformation of the full string of responses) on the communication channel. Instead, random subsets of the responses are revealed and sent for authentication. The response patterns are used for authenticating the prover device with a very high probability. We perform a thorough analysis of the method's resiliency to various attacks which guides adjustment of our protocol parameters for an efficient and secure implementation. We demonstrate that Slender PUF protocol, if carefully designed, will be resilient against all known machine learning attacks. In addition, it has the great advantage of an inbuilt PUF error tolerance. Thus, Slender PUF protocol is lightweight and does not require costly additional error correction, fuzzy extractors, and hash modules suggested in most previously known PUF-based robust authentication techniques. The low overhead and practicality of the protocol are confirmed by a set of hardware implementation and evaluations.

/pdf/slender-puf-protocol-a-lightweight-robust-and-secure-2leggkl9s7.pdf

Slender PUF Protocol: A Lightweight, Robust, and Secure Authentication by Substring Matching

Hash functions play an important role in modern cryptography. This paper investigates optimisation techniques that have recently been proposed in the literature. A new VLSI architecture for the SHA-256 and SHA-512 hash functions is presented, which combines two popular hardware optimisation techniques, namely pipelining and unrolling. The SHA processors are developed for implementation on FPGAs, thereby allowing rapid prototyping of several designs. Speed/area results from these processors are analysed and are shown to compare favourably with other FPGA-based implementations, achieving the fastest data throughputs in the literature to date.

Optimisation of the SHA-2 family of hash functions on FPGAs

The HMAC algorithm is widely used to provide authentication and message integrity to digital communications However, if the HMAC algorithm is implemented in embedded hardware, it is vulnerable to side-channel attacks In this paper, we describe a DPA attack strategy for the HMAC algorithm, based on the SHA-2 hash function family Using an implementation on a commercial FPGA board, we show that such attacks are practical in reality In addition, we present a masked implementation of the algorithm, which is designed to counteract first-order DPA attacks

/pdf/differential-power-analysis-of-hmac-based-on-sha-2-and-1lo0j0t1x4.pdf

Differential power analysis of HMAC based on SHA-2, and countermeasures

Compression of biosignals is an important means of conserving power in wireless body area networks and ambulatory monitoring systems. In contrast to lossless compression techniques, lossy compression algorithms can achieve higher compression ratios and hence, higher power savings, at the expense of some degradation of the reconstructed signal. In this paper, a variant of the lossy JPEG2000 algorithm is applied to Electroencephalogram (EEG) data from the Freiburg epilepsy database. By varying compression parameters, a range of reconstructions of varying signal fidelity is produced. Although lossy compression has been applied to EEG data in previous studies, it is unclear what level of signal degradation, if any, would be acceptable to a clinician before diagnostically significant information is lost. In this paper, the reconstructed EEG signals are applied to REACT, a state-of-the-art seizure detection algorithm, in order to determine the effect of lossy compression on its seizure detection ability. By using REACT in place of a clinician, many hundreds of hours of reconstructed EEG data are efficiently analysed, thereby allowing an analysis of the amount of EEG signal distortion that can be tolerated. The corresponding compression ratios that can be achieved are also presented.

EEG compression using JPEG2000: How much loss is too much?

Security protocols are frequently accelerated by implementing the underlying cryptographic functions in reconfigurable hardware. However, unprotected hardware implementations are susceptible to side-channel attacks, and Differential Power Analysis (DPA) has been shown to be especially powerful. In this work, we evaluate and compare the effectiveness of common hiding countermeasures against DPA in FPGA-based designs, using the Whirlpool hash function as a case study. In particular, we develop a new design flow called Isolated WDDL (IWDDL). In contrast with previous works, IWDDL isolates the direct and complementary circuit paths, and also provides DPA resistance in the Hamming distance power model. The analysis is supported using actual implementation results.

Isolated WDDL: A Hiding Countermeasure for Differential Power Analysis on FPGAs

This paper examines the effects of compression on electroencephalogram (EEG) signals, in the context of automated detection of epileptic seizures. Specifically, it examines the use of lossy compression on EEG signals in order to reduce the amount of data which has to be transmitted or stored, while having as little impact as possible on the information in the signal relevant to diagnosing epileptic seizures. Two popular compression methods, JPEG2000 and SPIHT, were used. A range of compression levels was selected for both algorithms in order to compress the signals with varying degrees of loss. This compression was applied to the database of epileptiform data provided by the University of Freiburg, Germany. The real-time EEG analysis for event detection automated seizure detection system was used in place of a trained clinician for scoring the reconstructed data. Results demonstrate that compression by a factor of up to 120:1 can be achieved, with minimal loss in seizure detection performance as measured by the area under the receiver operating characteristic curve of the seizure detection system.

Robert P. McEvoy

Papers

Optimisation of the SHA-2 family of hash functions on FPGAs

Differential power analysis of HMAC based on SHA-2, and countermeasures

EEG compression using JPEG2000: How much loss is too much?

Isolated WDDL: A Hiding Countermeasure for Differential Power Analysis on FPGAs

The Effects of Lossy Compression on Diagnostically Relevant Seizure Information in EEG Signals