Abstract:In recent years a new class of side-channel attacks has emerged. Instead of targeting device emissions during dynamic computation, adversaries now frequently exploit the leakage or response behaviour of integrated circuits in a static state. Members of this class include Static Power Side-Channel Analysis (SCA), Laser Logic State Imaging (LLSI) and Impedance Analysis (IA). Despite relying on different physical phenomena, they all enable the extraction of sensitive information from circuits in a static state with high accuracy and low noise -- a trait that poses a significant threat to many established side-channel countermeasures. In this work, we point out the shortcomings of existing solutions and derive a simple yet effective countermeasure. We observe that in order to realise their full potential, static side-channel attacks require the targeted data to remain unchanged for a certain amount of time. For some cryptographic secrets this happens naturally, for others it requires stopping the target circuit's clock. Our proposal, called Borrowed Time, hinders an attacker's ability to leverage such idle conditions, even if full control over the global clock signal is obtained. For that, by design, key-dependent data may only be present in unprotected temporary storage when strictly needed. Borrowed Time then continuously monitors the target circuit and upon detecting an idle state, securely wipes sensitive contents. We demonstrate the need for our countermeasure and its effectiveness by mounting practical static power SCA attacks against cryptographic systems on FPGAs, with and without Borrowed Time. In one case we attack a masked implementation and show that it is only protected with our countermeasure in place. Furthermore we demonstrate that secure on-demand wiping of sensitive data works as intended, affirming the theory that the technique also effectively hinders LLSI and IA.

A Hardware-Based Countermeasure to Reduce Side-Channel Leakage: Design, Implementation, and Evaluation

Power Side Channels in Security ICs: Hardware Countermeasures

PATHFINDER: Side Channel Protection through Automatic Leaky Paths Identification and Obfuscation

Energy-Efficient Side-Channel Attack Countermeasure with Awareness and Hybrid Configuration Based on It

On Borrowed Time -- Preventing Static Side-Channel Analysis

Lightweight Countermeasures Against Static Power Side-Channel Attacks

Power Supply Noise Aware Evaluation Framework for Side Channel Attacks and Countermeasures

A New Countermeasure Against Scan-Based Side-Channel Attacks

Hardware/software co-design to secure crypto-chip from side channel analysis at design time

A Study of Side-Channel Effects in Reliability-Enhancing Techniques

Side-Channel Hardware Trojan for Provably-Secure SCA-Protected Implementations

Machine Learning Assisted Side-Channel-Attack Countermeasure and Its Application on a 28-Nm AES Circuit.

Side-Channel Information Leakage Analysis And Countermeasures In An Embedded Cpu Microarchitecture

Mitigating Power Side Channels during Compilation

Co-Designing Hardware/Software to Protect Crypto-Chip Side Channel Analysis at Design Time

Side-Channel Analysis-Based Detection Approach of Hardware Trojans

Fight Hardware with Hardware: System-wide Detection and Mitigation of Side-Channel Attacks using Performance Counters

Energy Efficient Obfuscation of Side-Channel Leakage for Preventing Side-Channel Attacks

Leveraging on-chip voltage regulators as a countermeasure against side-channel attacks

Design for EM Side-Channel Security through Quantitative Assessment of RTL Implementations

SoC It to EM: ElectroMagnetic Side-Channel Attacks on a Complex System-on-Chip