Abstract:In recent years a new class of side-channel attacks has emerged. Instead of targeting device emissions during dynamic computation, adversaries now frequently exploit the leakage or response behaviour of integrated circuits in a static state. Members of this class include Static Power Side-Channel Analysis (SCA), Laser Logic State Imaging (LLSI) and Impedance Analysis (IA). Despite relying on different physical phenomena, they all enable the extraction of sensitive information from circuits in a static state with high accuracy and low noise -- a trait that poses a significant threat to many established side-channel countermeasures. In this work, we point out the shortcomings of existing solutions and derive a simple yet effective countermeasure. We observe that in order to realise their full potential, static side-channel attacks require the targeted data to remain unchanged for a certain amount of time. For some cryptographic secrets this happens naturally, for others it requires stopping the target circuit's clock. Our proposal, called Borrowed Time, hinders an attacker's ability to leverage such idle conditions, even if full control over the global clock signal is obtained. For that, by design, key-dependent data may only be present in unprotected temporary storage when strictly needed. Borrowed Time then continuously monitors the target circuit and upon detecting an idle state, securely wipes sensitive contents. We demonstrate the need for our countermeasure and its effectiveness by mounting practical static power SCA attacks against cryptographic systems on FPGAs, with and without Borrowed Time. In one case we attack a masked implementation and show that it is only protected with our countermeasure in place. Furthermore we demonstrate that secure on-demand wiping of sensitive data works as intended, affirming the theory that the technique also effectively hinders LLSI and IA.

Breaking real-world COTS USIM cards with unknown side-channel countermeasures

A Secure Scan Method for Crypto Chips

Software Hardware Co-design for Side-Channel Analysis Platform on Security Chips.

Small Tweaks Do Not Help: Differential Power Analysis of MILENAGE Implementations in 3G/4G USIM Cards

Power Side Channels in Security ICs: Hardware Countermeasures

Power analysis attacks on wireless sensor nodes using CPU smart card

Adaptive Side-Channel Analysis Model and Its Applications to White-Box Block Cipher Implementations.

Automatic Extraction of Secrets from the Transistor Jungle using Laser-Assisted Side-Channel Attacks

On Borrowed Time -- Preventing Static Side-Channel Analysis

Authenticated encryption chip implementation against side-channel attack

An Embedded System Design for Practical Security Analysis of Contact Smartcards

Efficient Hamming weight-based side-channel cube attacks on PRESENT

Research on Side-Channel Analysis Based on Deep Learning with Different Sample Data

Side-Channel Analysis and Countermeasure Design on ARM-Based Quantum-Resistant SIKE

Research on Side Channel Attack for USB Key

SoC It to EM: ElectroMagnetic Side-Channel Attacks on a Complex System-on-Chip

Side-Channel Cube Attacks on EPCBC

A Novel SPA Countermeasure for SM2 Hardware Implementation with FPGA

Design and Implementation of an Electromagnetic Analysis System for Smart Cards.

Power Analysis Based Side Channel Attack

A Review and Comparison of AI Enhanced Side Channel Analysis