Many IoT circuits are under the threat of side-channel attacks such as power analysis attacks. Among the side-channel attacks, power analysis attacks are serious threat to security. Therefore, security measures are necessary to ensure the safe use of IoT devices. However, there are a wide variety of IoT devices, and the allowable cost, power, and required security strength vary depending on the system application. Therefore, in this study, we conduct an empirical study on masking for adders on FPGAs, and explore the trade-off between cost and safety by changing the bit length of the mask. The experimental results show that masking improves power analysis attack resistance, and series-connected masked adder is particularly effective in resisting power analysis attacks.
Internet of things (IoT) devices which have become increasingly popular in recent years are
vulnerable to side-channel attacks due to their exposure to the physical environment. Typical
sidechannel attacks include power analysis attacks, timing attacks [1], electromagnetic analysis attacks [2],
and so on [3]. In particular, the power analysis attack, which infers security key from power
consumption, is the most popular for side-channel attacks since an instrument is not expensive to
analyze the power. According to the work [
This paper presents empirical studies on masking for adders on FPGA, focusing on adders as one of the most basic components of circuits. The contributions of this paper are two-fold. First, we compare two types of masked adders, i.e., a series-connected masked adder and a compression-based masked adder. We also evaluate the impacts of the mask bit-length on the power analysis attack resistance. Specifically, we explore the trade-off between cost and security by changing the bit-length of masking.
The rest of this paper is organized as follows. In Section 2, we describe the two circuits used in our study and introduce the masking methods in these circuits. In Section 3, we present the experimental scenario and the results of the side-channel attack resistance. Section 4 gives a summary of this paper.
In this section, we compare the power analysis attack resistance of two types of masked adders. In this paper, we make the following assumptions. An attacker inputs augend A to the adder and tries to identify the addend B through observing a side-channel leakage of the power consumption. Note that we assume the attacker cannot observe B and the sum C. 2.1.
2.2.
We compare two types of masked adders. The number of bits is 128-bits. We synthesize with AMD Xilinx Vivado 2019.2. The target device is assumed to be Airtix-7 FPGA. Our synthesis has been performed with enabling a couple of optimization options to the performance. In addition, we use the tool introduced in the work [9] for power analysis. This tool can observe dynamic temporal changes in power. Table 1 shows the synthesis results. However, this table does not include the area and delay of the pseudo-random number generator.
Next, we evaluate the power consumption. Figure 3 shows the power consumptions on the compare circuits. The X-axis represents a hundred of testbenches of which each contains 2000 test vectors, and the Y-axis represents the power consumption. In the results, we focus on only the logic and signal power consumption. Table 1 also shows the average power consumption for each circuit. The results show the non-masked circuit consumes the least power since due to none of additional computation for masking. The power consumption on series-connected masked adder looks almost the same as that on compression-based masked adder.
Finally, for the evaluation of the resistance towards the side-channel leakage, we employ T-test to the results of the power analysis. It is a statistic methodology to evaluate the difference between the means of two sets of data [10-11]. T-test is expressed in the following equation: (1)
Here, and represent the mean power consumption for random and fixed inputs, and are the standard deviation, and and represent the number of samples. The T-value is desire to be less than 4.5 to meet security criteria. The results of the T-test for the two types of adders are shown in Figure 4 and Table 2. Figure 4 shows the T-value for each testbench, and the red lines represent the security criteria. Figure 4 indicates that T-values are frequently exceeded over 4.5 without masking. The T-values of series-connected masked adder are obviously ranged within the security criteria. The T-values of compression-based masked adder are seemingly larger than that of series-connected masked adder. The results show that the series-connected masked adder shows a high tolerance. Also, Table 2 shows the series-connected masked adder seems safe against power analysis attacks since T-value stays between -4.5 and 4.5 in any case, while the compression-based masked adder still exceeds the security criteria in eight testbenches.
In the previous section, we have compared the circuits with non-masked and full-masked. In this section, unlike the previous section, we utilize the masks whose bit-widths are different. The experiments aim to explore the trade-off between the cost, power consumption, and side-channel attack resistance. 3.1.
The results of the number of look-up-tables (LUTs) and delay for each circuit are shown in Table 3. If the number of LUTs for the masked circuits are larger than that for the non-masked circuit shown Table 1 since the masked circuits require to mystify the intermediate variable by masking. In addition, the number of LUTs is increased as increasing the number of bits to mask. We highlight the circuits with the smallest number of LUTs and the shortest delay. In the case of 32-bit masks, the seriesconnected masked adder by the lower 32-bit mask uses 288 LUTs. In terms of the delay, the compression-based masked adder by the lower 32-bit mask takes 10.268 ns. As shown in the table, it is found that the trend has been observed in any case. Overall, the series-connected masked adder uses the smallest number of LUTs, and the compression-based masked adder take the shortest delay. 3.3.
The results of the power consumption are shown in Tables 3. Due to the larger circuit area, the compression-based masked adder is larger power consumption than the series-connected masked adder. Compared to the masks, the lower-bit masking shows the smaller power consumption than the distributed-bit masking. Thus, masking for the upper bits results in enlarging the dynamic power consumption, and the power consumption also tends to increase if the number of bits for masking is large. 3.4.
Using the results of the power analysis, the T-test has been conducted with the power traces, and the results are shown in Table 4. Table 4 shows that the total number of times the T-values exceed 4.5 and the maximum T-value for each circuit. If a T-value exceeds 4.5, the case indicates that the circuit is vulnerable to power analysis side-channel attacks.
According to Table 4, the circuits masked for the lower 32-bit may spoil the security since the Tvalues of the lower and distributed 32-bits exceed the security criteria 32 and 28 times for the seriesconnected masked adder. However, the vulnerability decreases as the number of bits for masking increases. The results show that the masked circuits for series-connected masked adder are safer towards power side-channel attacks than the masked compression-based masked adder.
In this paper, we have investigated the resistance of masked adders against power side-channel attacks. The results show that the larger number of bits for masking presents the advantage in the masked adders. In addition, the masked series-connected masked adder achieves safer than the compression-based masked adder and they are superior in terms of the circuit area, while the compression-based masked adder is superior in terms of delay time.
In future, we plan to conduct a more detailed analysis of the relationship between the internal structure of masked circuits and their resistance to power analysis attacks.
This work is supported partly by KAKENHI 20H00590, and 21K19776. [1] J. F. Dhem, F. Koeune, P. A. Leroux, P, Mestré, J. J. Q
International Conference on Smart Card Research and
Advanced Applications, pp. 167-182, 1998. [2]
Cryptographic Hardware and Embedded Systems - CHES2001, LNCS, vol. 2162, pp. 251-261, 2001. [3] P. Annual International Conference Cryptology, pp. 388-397, 1999.
Workshop on Cryptographic Hardware and Embedded Systems, pp. 198-212, 2002.
International Conference on Field Programmable Logic