Recently, the number of publicized attacks on IoT devices has noticeably grown. This is in part due to the increasing deployment of embedded systems into various domains, including critical infrastructure, which makes them a valuable asset and a compromise can cause significant damages. In this case, it is often required to send an engineer to manually recover the devices, as the attack leaves them out of reach of standard remote management solutions. To avoid this costly process, the concept of cyber resilience has gained traction in recent years in both academia and industry. Its core idea is to enable compromised devices to recover themselves to a trusted state without human intervention. Initial guidelines and architectures to realize cyber resilience have been published by standardization entities like NIST and TCG, and in multiple academic papers. While the initial works focused on guaranteed recovery, recent proposals included attack detection to speed up the recovery process. In this work, we build on top of these ideas and present an extended resilience architecture. We present new implementations of resilience engines with a focus on secure and reliable data acquisition for attack detection and classification. Our attack classification engine enables tailored, more efficient recovery responses.

Modern embedded IoT devices are an attractive target for cyber attacks. For example, they can be used to disable entire factories and ask for ransom. Recovery of compromised devices is not an easy task, because malware can subvert the original software and make itself persistent. In addition, many embedded devices do not implement remote recovery procedures and, therefore, require manual intervention.Recent proposals from NIST and TCG define concepts and building blocks for cyber resilience: protection, detection and recovery. In this paper, we describe a system which allows implementing cyber resilient IoT devices that can be recovered remotely and timely. The proposed architecture consists of trusted data monitoring, local and remote attack detection, and enforced connections to remote services as building blocks for attack detection and recovery. Further, hardware- and software-based implementations of such a system are presented.

Masking schemes represent a well-researched and successful option to follow when considering side-channel countermeasures. Still, such measures increase the implementation cost in terms of power consumption, clock cycles, and random numbers generation. In fact, the higher the order of protection against side-channel adversaries, the higher the implementation cost of countermeasures. S-boxes represent the most vulnerable part in an implementation when considering side-channel adversary. In this paper, we investigate how to generate S-boxes that have improved resilience against varying orders of side-channel attacks while having minimal implementation costs. We examine whether S-boxes generated against a certain order of attack also represent a good solution when considering different order of attacks. We demonstrate that we successfully generated S-boxes resilient against a certain physical attack order but the improvements are small. As a result, S-boxes that are resilient against first order attacks stay resilient against higher-order attacks, which saves computational power during the design of higher-order side-channel attacks resilient S-boxes.

Side-channel attacks are among the most powerful and cost-effective attacks on cryptographic systems. Simulators that are developed for side-channel analysis are very useful for preliminary analysis of new schemes, in depth analysis of existing schemes as well as for analysis of products on early stages of development. The contribution of this paper is three-fold. We present a first survey of existing simulators that were build for side-channel analysis. We present a new open-source simulator SAVRASCA that can generate simulated power traces based on compiled binary files for many popular AVR microcontrollers. We show how to use our simulator on the example of DPA Contest 4 and we find a new vulnerability that allows an attacker to mount a differential power analysis (or even simple electro-magnetic analysis) attack on the scheme. Our simulator can be used during development of new products in order to test their resistance against side-channel analysis. We also focus the attention of readers on questions of why and how simulators are useful in this domain and try to highlight main issues related to simulators that were developed by the community.

Side-channel attacks exploit physical characteristics of implementations of cryptographic algorithms in order to extract sensitive information such as the secret key. These physical attacks are among the most powerful attacks against real-world crypto-systems. In recent years, there has been a number of proposals how to increase the resilience of ciphers against side-channel attacks. One class of proposals concentrates on the intrinsic resilience of ciphers and more precisely their S-boxes. A number of properties has been proposed such as the transparency order, the confusion coefficient and the modified transparency order. Although results with those properties confirm that they are (to some extent) related with the S-box resilience, there is still much to be investigated. There, the biggest drawback stems from the fact that even S-boxes with the best possible values of those properties have only slightly improved side-channel resistance. In this paper, we propose to construct small sized S-boxes based on the results of the measurements of the actual physical attacks. More precisely, we model our S-boxes to be as resilient as possible against non-profiled and profiled physical attacks. Our results highlight that we can design \(4\times 4\) and \(5\times 5\) S-boxes that possess increased resistance against various real-world attacks.

This study presents an implementation flaw in Differential Power Analysis Contest (DPA) Contest v4. This version of DPA Contest uses Advanced Encryption Standard (AES) protected against side-channel attacks using rotating s-box masking (RSM) countermeasure. The authors identify a flaw in the masking scheme that was used in this contest. More specifically, the problem lies in an unfortunate choice of values for masks. An unbalance in the masking scheme leads to a first order leakage. This vulnerability could be used in order to mount a first order side-channel attack against AES-RSM. The attack was implemented and tested on DPA Contest v4 reference traces. The authors also provide a way to avoid the newly discovered problem and suggest new values for masks.

Cryptographic implementations are vulnerable to side-channel analysis. Implementors often opt for masking countermeasures to protect against these types of attacks. Masking countermeasures can ensure theoretical protection against value-based leakages. However, the practical effectiveness of masking is often halted by physical effects such as glitches and distance-based leakages, which violate the independent leakage assumption (ILA) and result in security order reductions. This paper aims to address this gap between masking theory and practice in the following threefold manner. First, we perform an in-depth investigation of the device-specific effects that invalidate ILA in the AVR microcontroller ATMega163. Second, we provide an automated tool, capable of detecting ILA violations in AVR assembly code. Last, we craft the first (to our knowledge) “hardened” 1st-order ISW-based, masked Sbox implementation, which is capable of resisting 1st-order, univariate side-channel attacks. Enforcing the ILA in the masked RECTANGLE Sbox requires 1319 clock cycles, i.e. a 15-fold increase compared to a naive 1st-order ISW-based implementation.

In 2015, Kalyna has been chosen as the new Ukrainian standard block cipher. Kalyna is an AES-like block cipher with a non-invertible key schedule. In this paper we perform the first side-channel analysis of Kalyna by performing a CPA attack on the round keys of Kalyna 128/128. Our work is based on simulations and real experiments performed on a software implementation on a micro-controller. Our attack extracts the round keys with probability 0.96 using 250 measurements.

In this work, we present the experimental assessment of a parallel framework that allows to reduce the energy consumption of MPSoC platforms running hard real-time systems. We use a power-aware Fork-Join task model based on primitives of the OpenMP library, a scheduling algorithm to execute such model and a schedulability test from the literature to ensure that all timing requirements are met while the energy consumption of the whole system is reduced. Practical experiments involving the deployment of OpenMP applications on a parallel embedded real-time operating system and power measurements on a MPSoC board through an oscilloscope probe show that intra-task parallelism helps to reduce the total energy consumption of the system in a realistic setting.

IoT devices have very strong requirements on all the resources such as memory, randomness, energy and execution time. This paper proposes a number of scalable shuffling techniques as countermeasures against side channel analysis. Some extensions of an existing technique called Random Start Index (RSI) are suggested in this paper. Moreover, two new shuffling techniques Reverse Shuffle (RS) and Sweep Swap Shuffle (SSS) are described within their possible extensions. Extensions of RSI, RS and SSS might be implemented in a constrained environment with a small data and time overhead. Each of them might be implemented using different amount of randomness and thus, might be fine-tuned according to requirements and constraints of a cryptographic system such as time, memory, available number of random bits, etc. RSI, RS, SSS and their extensions are described using SubBytes operation of AES-128 block cipher as an example, but they might be used with different operations of AES as well as with other algorithms. This paper also analyses RSI, RS and SSS by comparing their properties such as number of total permutations that might be generated using a fixed number of random bits, data complexity, time overhead and evaluates their resistance against some known side-channel attacks such as correlation power analysis and template attack. Several of proposed shuffling schemes are implemented on a 8-bit microcontroller that uses them to shuffle the first and the last rounds of AES-128.

Side-channel attacks exploit physical characteristics of implementations of cryptographic algorithms in order to extract sensitive information such as the secret key. These physical attacks are among the most powerful attacks against real-world crypto-systems. This paper analyses the non-linear part (called Sboxes) of ciphers, which is often targeted by implementation attacks. We analyse Sboxes of several candidates that were submitted to the competition on authenticated encryption (CAESAR) as well as several other ciphers. We compare theoretical metrics with results from simulations and with real experiments. In this paper, we demonstrate that, in some contexts, the theoretical metrics provide no information on the resiliency of the Sboxes against side-channel attacks.

This paper proposes a new way of simulating leakage traces using high level of abstraction models and presents a proof of concept implementation simulator called SILK -- a tool for leakage simulation for side channel analysis of microcontrollers and microprocessors. SILK is a high level of abstraction simulator that builds a leakage trace based on a source code of an algorithm and several user-defined parameters. One of the main purposes of SILK is data generation for quick analysis of new attacks, countermeasures or preprocessing methods. SILK might also be used to compare different types of attacks, analysis techniques or software countermeasures. This paper presents general structure and parameters of SILK and a typical example of use case. Our experiments were done with two algorithms that run on a microcontroller in order to compare our simulations with real power traces. We compared simulated traces with real power traces using Dynamic Time Warping technique with two different distance metrics. We also compared our simulations with real power traces using Correlation Power Analysis (CPA). We were also able to show that using a high level of abstraction simulation we are able to produce datasets that might be used for side channel analysis.

Side channel attacks take advantage of information leakages in cryptographic devices. Template attacks form a family of side channel attacks which is reputed to be extremely effective. This kind of attacks assumes that the attacker fully controls a cryptographic device before attacking a similar one. In this paper, we propose to relax this assumption by generalizing the template attack using a method based on a semi-supervised learning strategy. The effectiveness of our proposal is confirmed by software simulations, by experiments on a 8-bit microcontroller and by a comparison to a template attack as well as to two supervised machine learning methods.

This paper discusses the impact of a simple strategy in block cipher design: rearranging the internal cipher components. We report on a test case in which we observed a significant upgrade on a cipher's security. We applied this approach in practice and report on an updated design of the IDEA block cipher, in which we swapped all exclusive-or operations for multiplications. The consequences of these modifications are far reaching: there are no more weak multiplicative subkeys (because multiplications are not keyed anymore) and overall diffusion improves sharply in the encryption framework. The unkeyed multiplication is novel in itself since it did not exist in IDEA as a primitive operation and it alone guarantees stronger diffusion than the exclusive-or operation. Moreover, our analysis so far indicate that the new cipher resists better than IDEA and AES against old and new attacks such as the recent biclique technique and the combined Biryukov-Demirci meet-in-the-middle attack. Experiments on an 8-bit microcontroller indicate the new design has about the same performance as IDEA. A theoretical analysis also suggests the new design is more resistant to power analysis than IDEA.