This paper proposes SCABoosting, a novel boosting framework for deep learning-based Side-Channel Analysis (SCA) that significantly enhances key recovery efficiency while maintaining computational lightweightness. Our method integrates multiple randomly generated CNN classifiers through a sequential boosting strategy, achieving superior performance with only 26 M parameters compared to 68 M parameters required by state-of-the-art CNNbest models. Extensive evaluation on three standard datasets demonstrates compelling results: on ASCAD dataset, our approach reduces guessing entropy (GE) to 102 (vs 204 for CNNbest) and achieves 92
This paper presents a ground-up approach to attack a novel single-trace side-channel vulnerability in FALCON, a lattice-based post-quantum digital signature protocol recently approved for standardization by NIST. We target the discrete Gaussian sampling operation within FALCON’s key generation scheme. Notably, negating the results of a 63-bit right-shift operation on 64-bit secret values leaks critical information about the assignment of ‘-1’ versus ‘0’ to intermediate coefficients during sampling. These information makes it feasible to extract the full secret key. We demonstrate a ground-up approach to the attack on an ARM Cortex-M4 microcontroller executing both the reference and optimized source code implementations from FALCON’s NIST round 3 software package. Although single-trace attacks generally require a profiling phase involving a substantial number of traces, our experimental results demonstrate that reliable power profiles can be constructed using as few as 10 profiling traces. We further quantify the attacker’s success rate using a univariate Gaussian template model, providing generalizable guarantees. Statistical analysis reveals a projected per-coefficient success rate of 99.9999999478
Anonymity infrastructures such as mix networks, anonymous storage, and privacy-preserving replication rely on public re-randomization: any party holding only public information can transform a ciphertext into a fresh-looking encryption of the same plaintext, hiding the linkage between the two. Classical ElGamal-based solutions are broken by quantum adversaries, while existing lattice-based alternatives carry very large ciphertexts with unanalyzed noise growth, rely on heavyweight homomorphic-encryption stacks with approximate (rounded) decryption, or lack a precise analysis of how many re-randomizations are safe. We address this gap with a practical Ring Learning with Errors (Ring-LWE) public-key encryption scheme supporting public re-randomization without ciphertext growth. Our construction is Lyubashevsky–Peikert–Regev/Fan–Vercauteren (LPR/BFV)-style encryption over R=ℤ[x]/(x^n+1) with n=4096 , engineered around a two-limb Chinese Remainder Theorem (CRT) modulus q=t· q_2 with 32-bit primes. Embedding plaintext as Δ M = q_2 M makes the message vanish modulo q_2 , so the q_2 -limb carries only the decryption noise, enabling exact message recovery without rounding. We prove correctness with explicit decryption-failure bounds that remain valid under repeated re-randomization, via an aggregation lemma showing that arbitrarily many re-randomizations affect decryption only through a single aggregated randomness triple. We also prove that two-limb ciphertexts are pseudorandom (indistinguishable from uniform, IND) under Decision Ring-LWE over the combined modulusq=tq_2; security against chosen-plaintext attack (IND-CPA) and re-randomization unlinkability follow. A constant-time Rust implementation encrypts in 0.80 ms, re-randomizes in 0.51 ms, and decrypts in 0.21 ms per 64 KiB ciphertext carrying 15.5 KiB of payload on a fixed-frequency 3.8 GHz CPU—on par with a modulus-matched Microsoft SEAL baseline—and passes timing-leakage tests. Empirical noise simulations validate the analysis.
Subgroup membership testing serves as a crucial countermeasure against small subgroup attacks, thereby ensuring the security of pairing-based cryptographic protocols. Despite its vital importance, the expensive computational requirements for membership testing on specific pairing-friendly curves pose a non-negligible challenge. In this paper, we revisit the 𝔾_2 membership testing algorithms on KSS16 curves and propose a novel approach specifically designed for the families constructed by the KSS method (Kachisa-Schaefer-Scott method). Moreover, we generalize several previous methods for 𝔾_2 membership testing, rendering them applicable to more generic pairing-friendly curves. Specifically, we implement an efficient 𝔾_2 membership testing on three well-known curves KSS16-329, KSS16-330, and KSS16-766 for verification. The experimental results illustrate that our new method achieves improvements of 24.0% , 33.3% , and 29.2% in terms of clock cycles compared to the state-of-the-art, respectively.
Physical Unclonable Functions (PUFs) are emerging security primitives designed to enhance the security of physical devices and overcome the challenges posed by conventional cryptographic algorithms. PUFs utilize logical operations to create a unique identity for each device based on the processing hardware’s unpredictable and non-reproducible physical characteristics. This generated key serves as device fingerprint providing a high level of security against cloning and counterfeiting. The dependence of PUFs on logical operation comes at the cost of exploiting the underlying hardware and contributes to the power consumption as well. This work addresses to reduce the resource consumption of delay-based Arbiter PUF(APUF) with help of Reversible Logic (RL) and its novel PUF design. RL is a computational method where each output state precisely determines its input, thereby reducing information loss and energy dissipation. This paper proposes a novel RL-based APUF design that generates 8/16/32 and 64-bit keys. The key generated is sensitive to the user input but not controlled by the user to maintain randomness. The research on PUFs shows that the best values of uniqueness, uniformity, and entropy metrics achieved across 8-bit/16-bit/32-bit and 64-bit implementations at 100
FrodoKEM is a lattice-based Public-Key Encryption (PKE)/Key Encapsulation Mechanism (KEM) scheme selected as a third-round candidate in the National Institute of Standards and Technology (NIST) post-quantum cryptography standardization process. It has also been recommended by the German Federal Office for Information Security and the Dutch National Communications Security Agency as a long-term confidential encryption algorithm and has been included in the ISO/IEC JTC 1/SC 27/WG 2 draft international standard for post-quantum cryptography. To address the threats of Side-Channel Attacks (SCA, including timing attacks, power analysis attacks, and fault attacks) against FrodoKEM, this paper proposes a security-enhanced implementation scheme. Specifically, during the sampling phase and ciphertext comparison, isochronous operations are adopted to eliminate timing sensitivity and mitigate the risk of timing attacks. In public key computation, masking techniques are incorporated to obscure critical data and operations, thereby resisting power analysis attacks. Additionally, a sampling calibration mechanism is implemented to detect and mitigate fault attacks. Under the same parameter sets, a performance comparison between the SCA-resistant scheme and the original FrodoKEM demonstrates that the increase in computational overhead is less than 0.8
Cryptographic software following sound, modern practices and adhering to recommendations for writing constant-time code (e.g., RFC 7748) may yet leak secret data via the most naïve kind of timing side channels when a “secure” implementation in a high-level language gets compiled down to assembly instructions. This paper shows that it is not only aggressive optimization done by smart compilers that leads to such vulnerabilities, as previously often thought, but also inherent limitations of the target CPU architecture that the compiler must work around, coupled with dangerous recommendations for instruction idioms found in the architecture documentation. The popular customizable IP core, Xtensa, is identified to be affected by the problem, and its particular vulnerability is studied and exploited. Key-recovery attacks are conducted against Xtensa-based ESP32 chips running ephemeral-static X25519 implementations found in wolfSSL and CycloneCRYPTO, both advertised as resistant against timing attacks and using two unrelated implementation strategies. The attacks are four orders of magnitude more effective than a similar attack against a related vulnerability in the MSVC compiler known in the literature. A resolution of the compiler bug responsible for the vulnerability is proposed. Finally, an optimized implementation of X25519 (Ed25519) and X448 (Ed448) field arithmetic for Xtensa, leveraging a DSP extension to the core instruction set, is proposed.
Multi-Scalar Multiplication is a critical operation in most pairing-based zero-knowledge proofs. In a lot of studies, memory limitations have often been reported to be the primary bottleneck preventing the calculation of larger MSMs. In this paper, we are particularly interested in the acceleration of this operation on devices with limited memory. Pippenger’s algorithm (also known as bucket method) is the most efficient and, consequently, the most widely used method to calculate Multi-Scalar Multiplications. We propose an optimization of Pippenger’s algorithm which is at least as efficient as the original, and significantly more effective when operating under limited memory. The main idea is to use an adapted number of buckets depending on the available memory instead of 2^w - 1 . We conducted tests on the curve BLS12-381 with Multi-Scalar Multiplications ranging from 2^8 to 2^14 points. The results obtained demonstrate that we have a very significant gain (up to 40% ) for very limited memories. This gain gradually decreases as more memory becomes available, until we achieve performance comparable to Pippenger’s once memory is no longer limited. For example, in a Multi-Scalar Multiplication with 2^13 points, we observe a gain of 40% with only 1 KB of memory, 20% with 15 KB, 15% with 35 KB, and so on, down to be equivalent to Pippenger’s algorithm once memory is no longer a constraint.
Nowadays, blockchain network is one of the most used solutions for the management of data communication in a secure way. In such a network, digital signature and verification are the most important tasks. This paper presents the FPGA implementation of the Elliptic Curve Digital Signature Algorithm (ECDSA) protocol. The most expensive entity in this protocol is the Scalar Multiplication (SM) computation. At low abstractions levels, hash function, Modular Multiplication (MM), and Modular Inversion (MI) are critical operations in ECDSA and SM algorithms. Our implementation strategy is based on the combination of the HardWare/SoftWare (HW/SW) co-design approach and the Multi-Processor System on Programmable Chip (MPSoPC). MicroBlaze (MB) processors are used for the flexible management of our MPSoPC. To achieve the best trade-off between execution time, occupied HW resources, and flexibility, we propose two implementations. In the first, the SM and ECDSA are implemented using a single MB. The hash function, MM, and MI are integrated in HW as accelerator cores. In the second configuration, we propose to build the SM and ECDSA as MPSoPC, where four MB processors are implemented. Dedicated HW cores are used for the execution of the required hash function, MM, and MI. Our MPSoPC implementation shows that the 256-bit SM is computed in 26.90 ms. It requires 4380 slices, 40 BRAM, and 32 DSP48E. The computation times of the 256-bit ECDSA signature and verification are 36.18 and 72.06 ms, respectively. The requirements of HW resources are 6417 slices, 41 BRAM, and 32 DSP48E.
In this work, we propose an optimized method for polynomial multiplication over GF(2)[x]\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$ ext {GF}(2)[x]$$\end{document}, targeting SIMD environments such as AVX2 and Neon. Polynomial multiplication is a core operation in code-based cryptographic schemes, including the recently standardized HQC. Our method provides a systematic, branch-free approach that selects efficient Toom-Cook/Karatsuba decomposition for GF(2)[x]\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$ ext {GF}(2)[x]$$\end{document} polynomial multiplication. We systematically explore Toom-Cook/Karatsuba decomposition trees and generate specialized implementations without table look-ups or conditional branches, enabling precise selection for a given parameter set. Unlike general-purpose libraries such as gf2x, which use table look-ups and conditional branches to support arbitrary polynomial degrees, our parameter-specific, branch-free design avoids this runtime selection overhead and enables precise algorithm selection for each parameter set. We further implement architecture-specific base multiplications using VPCLMULQDQ for AVX2 and PMULL for Neon. To evaluate our method, we compare against the gf2x library and state-of-the-art implementations of HQC and BIKE in both AVX2 and Neon environments. In particular, for HQC-1 and HQC-3 on AVX2 with PCLMULQDQ, our method reduces polynomial multiplication cycles by 17-32% compared to the official HQC implementation. For HQC-5, we observe that FFT-based multiplication can be preferable. For BIKE in the same environment, we observe a 5-11% improvement in polynomial multiplication cycles compared to the method of Chen et al. (CHES 2021).
Recent breakthroughs in deep learning-based side-channel analysis (DLSCA) have demonstrated unprecedented cross-device cryptographic profiling capabilities, even against provably secure masking schemes. The evolving DLSCA paradigm is shifting toward practical attacks with minimal prerequisites–neither signal pre-processing nor prior implementation knowledge is required–suggesting that automated AI-driven side-channel analysis will soon become a viable threat model. To investigate the intrinsic vulnerability of masking countermeasures under DLSCA, we construct a configurable leakage framework that simultaneously exposes first- and second-order side-channel emanations. Counterintuitively, deep neural networks tend to converge on biased low-order leakage patterns while systematically overlooking genuine higher-order correlations, a phenomenon we term Feature Extraction Fragility. Leveraging this observation, we introduce BLAM (Biased Leakage Augmentation Methodology), a systematic approach that enhances masking resilience against DLSCA with automated feature extraction. Through theoretical analysis and experimental validation, we show that BLAM strategically distorts leakage profiles to induce networks to learn erroneous low-order patterns. The proposed technique establishes a generic reinforcement framework that can be seamlessly complied with any existing masking design and introducing limited additional resource and speed overhead.
In this work, we propose an optimized method for polynomial multiplication over GF(2)[x] , targeting SIMD environments such as AVX2 and Neon. Polynomial multiplication is a core operation in code-based cryptographic schemes, including the recently standardized HQC. Our method provides a systematic, branch-free approach that selects efficient Toom-Cook/Karatsuba decomposition for GF(2)[x] polynomial multiplication. We systematically explore Toom-Cook/Karatsuba decomposition trees and generate specialized implementations without table look-ups or conditional branches, enabling precise selection for a given parameter set. Unlike general-purpose libraries such as gf2x, which use table look-ups and conditional branches to support arbitrary polynomial degrees, our parameter-specific, branch-free design avoids this runtime selection overhead and enables precise algorithm selection for each parameter set. We further implement architecture-specific base multiplications using VPCLMULQDQ for AVX2 and PMULL for Neon. To evaluate our method, we compare against the gf2x library and state-of-the-art implementations of HQC and BIKE in both AVX2 and Neon environments. In particular, for HQC-1 and HQC-3 on AVX2 with PCLMULQDQ, our method reduces polynomial multiplication cycles by 17-32
The rapid growth of the Internet of Things (IoT) emphasizes the need for secure data transmission between IoT devices and edge computing. Many IoT systems utilize asymmetric cryptography, particularly elliptic curve cryptography (ECC), which is favored in resource-constrained environments for its efficient encryption and smaller key sizes. ECC-based protocols and Diffie-Hellman (DH) key agreement schemes are integral to edge computing.WolfSSL is an efficient SSL library with a significantly smaller memory footprint, optimized for IoT and embedded systems, and supports ECC and DH public key options for over 2 billion devices daily. This study evaluates processor extensions and instruction customization within WolfSSL’s benchmark code to enhance ECC and DH performance. We dissect the implementation into key routines such as Montgomery reduction and multiplication, recommending processor hardware extensions and software modifications to improve computational speed. Our analysis covers various processor designs, from single-issue base processors to multi-issue configurations with custom instructions, revealing performance trade-offs. Our results indicate that our designs outperform the most optimized WolfSSL software implementations on base RISC processors, achieving speedups of up to {6.25x, 4.2x} for ECC and {5.6x, 3.9x} for DH algorithms. Moreover, comparing our work to architectures like ARM6/8 and RISC-V platforms shows significant performance improvements. These advancements not only enhance ECC and DH operations but also benefit various Post-Quantum Cryptography (PQC) primitives. Our findings achieve significant speed improvements for Montgomery reduction and point multiplication while maintaining minimal area cost, making them advantageous for applications using lattice-based and code-based PQC algorithms.
In response to the recent NIST call for a wider variant of the AES algorithm, we developed a fully pipelined, high-throughput FPGA implementation of the 256-bit block size AES, referred to as WAES-256. This design targets both 7th generation and UltraScale+ FPGAs, focusing on maximizing throughput and efficient hardware utilization. Our work supports AES-128, AES-256, and WAES-256, employing composite field arithmetic in the S-box to reduce critical path delay. All AES layers are fully pipelined, enabling multiple levels of parallelism with minimal architectural changes. Our AES-128 implementations achieved the best throughput-per-slice (TPS) ratios reported in the literature for fair comparisons on the same FPGA platforms. For WAES-256, our designs reached 75.73 Gbps on Spartan-7, 72.32 Gbps on Artix-7, 199.46 Gbps on Zynq UltraScale+, and 206.11 Gbps on Kintex UltraScale+. Additionally, our multi-core parallel WAES-256 designs achieved 426.66 Gbps with x2 cores and 742.63 Gbps with x4 cores on the Kintex UltraScale+ platform, demonstrating the scalability of our approach. These results highlight the efficiency and scalability of our architectures, offering high-throughput performance without relying on BRAM (Block Random Access Memory), making them well-suited for next-generation cryptographic applications. Moreover, we optimized WAES-256 on GPUs and achieved performance comparable to the best AES-256 results. For instance, we achieved 3053.5 Gbps WAES-256 encryption in counter mode of operation on an RTX 4090. Our results show that using FPGAs or GPUs as co-processors for WAES-256 render encryption-free and transition from AES-256 to WAES-256 results in no observable slowdowns.
Providing a secure hardware infrastructure is a key challenge in implementing secure cryptographic algorithms. Even a robust algorithm with suitable key lengths is not effective against differential power analysis (DPA) attacks and can cause the cryptographic key to be discovered. Today, credit cards and electronic identification cards, due to the greater scope of applications are subjected to differential power analysis attacks. As a result, a good design can help maintain the confidentiality of information. Providing a design method that balances the power consumption of the outputs and inputs of chips results a DPA secure designs. Moreover, reducing power consumption by recovering the charge stored in nodes makes power tracing more difficult. On the other hand, designing a uniform pattern in the transistor surface shape for all logic gates will make them resilient against advanced imaging techniques. In this paper a DPA resilient design method is proposed which is also robust against some other attacks such as timing attacks and advanced image processing techniques. The presented designs are simulated and compared with the state-of-the-art designs using Synopsis HSPICE with 22 nm technology node. Simulation results show that the proposed method achieves the lowest and most balanced power consumption compared to the other designs.
The concept of time-memory trade-off was introduced in 1980 by Martin Hellman to conduct brute-force attacks against DES. The method consists of an intensive precomputation phase whose results are stored in tables, and subsequently used to significantly reduce the time required by the brute-force. An important improvement is the introduction in 2003 of rainbow tables by Philippe Oechslin. However, the process of precomputing rainbow tables is rather inefficient, primarily due to the high rate of computed values that are eventually discarded. Avoine, Carpent, and Leblanc-Albarel introduced in 2023 the descending stepped rainbow tables, which consists in recycling chains during the precomputation phase. In this paper, a new variant called ascending stepped rainbow tables is introduced. Formulas to predict attack time, precomputation time, memory requirements, and coverage are provided. Through theoretical results and implementation, the analysis demonstrates that this new variant offers significant improvements over both descending stepped rainbow tables and vanilla rainbow tables for high coverage. Specifically, for the typical 99.5
The emergence of Large Language Models (LLMs) has ushered in a new era in Artificial Intelligence, showcasing exceptional capabilities in understanding natural language and generating context-specific responses. Pre-trained on extensive datasets, LLMs have shown the potential to tackle complex tasks through appropriately formatted prompts. Recent initiatives, such as OpenROAD, have aimed to harness AI to minimize human involvement in hardware design. With the advent of LLMs, the hardware design and security communities are increasingly exploring these models to address challenges in their fields. Numerous studies have employed LLMs for generating hardware designs, creating test cases, and identifying bugs, highlighting their potential to revolutionize traditional workflows in these domains. Our work is an extension of the project “Netlist Whisperer: AI and NLP Fight Circuit Leakage!" which was presented at ASHES’23. In the previous Netlist Whisperer project, we sought to harness the power of LLMs to identify side-channel vulnerabilities in a given hardware design. We trained the widely used LLM Ada from OpenAI’s GPT-3 family to determine whether a specific net is leaky or non-leaky without simulating the entire design. We also utilized LLM Curie to generate side-channel attack-resistant Domain-Oriented-Masking implemented secure designs. In this extended work, we employed OpenAI’s currently available fine-tunable models Babbage, Davinci, and GPT3.5-Turbo. We curated a larger dataset by incorporating 28 circuits from ISCAS-85, ITC-99, and commonly used cipher S-box benchmarks. Upon initial training, we observed a significant drop in precision due to the substantial imbalance of leaky and non-leaky nets in the training data. As a remedy, we proposed an ensemble-based approach which yielded a significant improvement, enhancing the precision value to 44
A fixed length tweakable enciphering scheme (TES) is the appropriate cryptographic functionality for low level disk encryption. Research on TES over the last two decades have led to a number of proposals, some of which have been implemented using field programmable gate arrays (FPGAs). This paper considers FPGA implementations targeted at disks supporting 4096-byte sectors. We choose two schemes, namely AEZ and FAST, for implementation and provide detailed rationale for our choice. The relevant architectures are described and simulation results on the Xilinx Virtex 5 and Virtex 7 FPGAs are presented. For comparison, we consider previous implementation of the IEEE standard EME2. The results indicate that FAST outperforms the other schemes.
The guaranteed number of activations (GNA) is an important characteristic to determine the effectiveness of differential crypt- analysis of a given XS-circuit. In this paper, we propose an approach to optimize the known algorithm for GNA computation based on the branch and bound method. We also analyze special matrices that define XS-circuit. The experiments show that the proposed algorithm significantly outperforms the existing approach. In this paper, we prove that canonical forms of XS-circuit and its dual coincide, providing the strict connection between the guaranteed number of linear and differential activations. The circuits with the extremal values of GNA are studied. We made several hypotheses based on computational experiments. One of the hypotheses is that there are no XS-circuits of dimension greater than 2, which achieve an optimal GNA on every round.
