National Institute of Standards and Technology における超伝導研究及び生活

A new stream cipher, Grain, is proposed. The design targets hardware environments where gate count, power consumption and memory is very limited. It is based on two shift registers and a non-linear output function. The cipher has the additional feature that the speed can be increased at the expense of extra hardware. The key size is 80 bits and no attack faster than exhaustive key search has been identified. The hardware complexity and throughput compares favourably to other hardware oriented stream ciphers like E0 and A5/1.

/pdf/grain-a-stream-cipher-for-constrained-environments-2azyz8fiei.pdf

Grain: a stream cipher for constrained environments

The tight cost and implementation constraints of high-volume products, including secure RFID tags and smart cards, require specialized cryptographic implementations. The authors review recent developments in this area for symmetric and asymmetric ciphers, targeting embedded hardware and software. In this article, we present a selection of recently published lightweight-cryptography implementations and compare them to state-of-the-art results in their field.

/pdf/a-survey-of-lightweight-cryptography-implementations-2hbvlkwb1s.pdf

A Survey of Lightweight-Cryptography Implementations

During the last years, several masking schemes for AES have been proposed to secure hardware implementations against DPA attacks. In order to investigate the effectiveness of these countermeasures in practice, we have designed and manufactured an ASIC. The chip features an unmasked and two masked AES-128 encryption engines that can be attacked independently.

In addition to conventional DPA attacks on the output of registers, we have also mounted attacks on the output of logic gates. Based on simulations and physical measurements we show that the unmasked and masked implementations leak side-channel information due to glitches at the output of logic gates. It turns out that masking the AES S-Boxes does not prevent DPA attacks, if glitches occur in the circuit.

/pdf/successfully-attacking-masked-aes-hardware-implementations-88stha8iyu.pdf

Successfully attacking masked AES hardware implementations

This paper describes the Elliptic Curve Cryptography algorithm and its suitability for smart cards.

https://dl.acm.org/doi/pdf/10.1145/1386853.1378356

Elliptic curve cryptography

The AES (advanced encryption standard) is a new block cipher standard published by the US government in November 2001. As a consequence, there is a growing interest in efficient implementations of the AES. For many applications, these implementations need to be resistant against side channel attacks, that is, it should not be too easy to extract secret information from physical measurements on the device. We present the first results on the feasibility of power analysis attack against an AES hardware implementation. Our attack is targeted against an ASIC implementation of the AES developed by the ETH Zurich. We show how to build a reliable measurement setup and how to improve the correlation coefficients, i.e., the signal to noise ratio for our measurements. Our approach is also the first step to link a behavior HDL simulator generated simulated power measurements to real power measurements.

/pdf/power-analysis-attack-on-an-asic-aes-implementation-3hvlgrt1cy.pdf

Power-analysis attack on an ASIC AES implementation

Field Programmable Gate Arrays (FPGAs) are becoming increasingly popular, especially for rapid prototyping. For implementations of cryptographic algorithms, not only the speed and the size of the circuit are important, but also their security against implementation attacks such as side-channel attacks. Power-analysis attacks are typical examples of side-channel attacks, that have been demonstrated to be effective against implementations without special countermeasures. The flexibility of FPGAs is an important advantage in real applications but also in lab environments. It is therefore natural to use FPGAs to assess the vulnerability of hardware implementations to power-analysis attacks. To our knowledge, this paper is the first to describe a setup to conduct power-analysis attacks on FPGAs. We discuss the design of our hand-made FPGA-board and we provide a first characterization of the power consumption of a Virtex 800 FPGA. Finally we provide strong evidence that implementations of elliptic curve cryptosystems without specific countermeasures are indeed vulnerable to simple power-analysis attacks.

/pdf/power-analysis-attacks-on-an-fpga-first-experimental-results-1b3dxez8m8.pdf

Power-Analysis Attacks on an FPGA--First Experimental Results

Hardware architectures for public key cryptography

We describe a hardware implementation of an arithmetic processor which is efficient for bit-lengths suitable for both commonly used types of public key cryptography (PKC), i.e., elliptic curve (EC) and RSA cryptosystems. Montgomery modular multiplication in a systolic array architecture is used for modular multiplication. The processor consists of special operational blocks for Montgomery modular multiplication, modular addition/subtraction, EC point doubling/addition, modular multiplicative inversion, EC point multiplier, projective to affine coordinates conversion and Montgomery to normal representation conversion.

/pdf/hardware-implementation-of-an-elliptic-curve-processor-over-4itprzso6v.pdf

Hardware implementation of an elliptic curve processor over GF(p)

This paper presents simple (SEMA) and differential (DEMA) electromagnetic analysis attacks on an FPGA implementation of an elliptic curve processor Elliptic curve cryptography is a public key cryptosystem that is becoming increasingly popular Implementations of cryptographic algorithms should not only be fast, compact and power efficient, but they should also resist side channel attacks One of the side channels is the electromagnetic radiation out of an integrated circuit Hence it is very important to assess the vulnerability of implementations of cryptosystems against these attacks A SEMA attack on an unprotected implementation can find all the key bits with only one measurement We also describe a DEMA attack on an improved implementation and demonstrate that a correlation analysis requires 1000 measurements to find the key bits

S.B. Ors

Papers

Power-analysis attack on an ASIC AES implementation

Power-Analysis Attacks on an FPGA--First Experimental Results

Hardware architectures for public key cryptography

Hardware implementation of an elliptic curve processor over GF(p)

Electromagnetic Analysis Attack on an FPGA Implementation of an Elliptic Curve Cryptosystem