The emergence of deep learning has revolutionized side-channel attacks, making them a serious threat to cryptographic systems. Clock randomization is a well-established mitigation technique against side-channel attacks that, when combined with duplication, has been shown to effectively protect FPGA implementations of block ciphers and post-quantum KEMs. In this paper, we present two deep-learning-based side-channel attacks on an FPGA implementation of AES protected with the clock randomization and duplication countermeasure. The attacks are based on identifying sporadic synchronicity in the execution of the encryption rounds of the two AES cores. We remedy this vulnerability by presenting three modular additions to the original design of the countermeasure that restores its security and increases its robustness.

CRYSTALS-Kyber has been selected by the NIST as a post-quantum public-key encryption and key establishment algorithm to be standardized. This makes it important to develop side-channel attack resistant implementations of CRYSTALS-Kyber. In this paper, we propose utilizing duplication combined with clock randomization as a means of protecting CRYSTALS-Kyber FPGA implementations from side-channel attacks. Such a countermeasure has been proven effective in ensuring side-channel resistance of AES FPGA implementations. It has the benefits of universal coverage, glitch immunity, and zero clock cycle overhead. We present a protected version of CRYSTALS-Kyber built on the top of the lightweight unprotected implementation by Xing el al. Our security evaluation shows that the protected implementation is resistant to deep learning-based side-channel attacks.

Field-programmable gate arrays (FPGAs) are used across various industries due to their high performance, energy efficiency, and reconfigurability. However, the major advantage of reconfigurability is also a source of security challenges.The present doctoral thesis investigates the security vulnerabilities of the FPGA configuration file, i.e. the bitstream, focusing on the exploration and mitigation of targeted bitstream modification attacks. The results outlined in the seven chapters of the thesis are based on the appended collection of twelve papers. Out of those papers, seven present novel research on the topic of bitstream modification attacks and countermeasures, with the majority of contributions being on attacks. Four present novel research on the topic of FPGA-based countermeasures against side-channel analysis. The final paper presents a survey on bitstream modification attacks and countermeasures. The motivation behind the papers on side-channel countermeasures is to enhance the FPGA encryption schemes, as strong encryption can thwart targeted bitstream modification attacks. 

The attack vector of targeted bitstream modification is explored through a series of attacks against cryptographic FPGA implementations. The targets are popular stream ciphers (SNOW 3G, ACORN, and Trivium) and cryptographic primitives (an arbiter-based physical unclonable function and multi-ring-oscillator-based true random number generator). In the attacks on stream ciphers, the bitstream is modified to introduce faults that weaken the keystream by linearizing its generation process. A subsequent analysis of that faulty keystream reveals the secret key of the implementations. In the attacks on cryptographic primitives, the goal of the bitstream modification attack is to lower the bar or enable a side-channel analysis. The aim of the side-channel analysis is to predict the random output values produced by the primitives. To facilitate that, the bitstream modification attack identifies components in the bitstream that produce exploitable information leakage and creates multiple copies of them. The copies have the same values as the targets, but their outputs are not connected, thus having no impact on the functionality of the design. The study on bitstream modification is complemented with the introduction of low-cost obfuscation countermeasures and a general-purpose methodology against obfuscation based on constants. The methodology is able to defeat all the countermeasures we have previously defined, and its application extends to the general field of hardware design obfuscation.

On the topic of side-channel analysis countermeasures, the popular methodology of clock randomization is evaluated. The assumed side-channel analysis aims to extract the secret key of the advanced encryption standard (AES) block cipher. The evaluation reveales that clock randomization cannot offer protection when the side-channel measurements are sampled at a frequency significantly higher than the operational frequency of the device. In response to that, the clock randomization technique is coupled with encryption core duplication to form, a novel countermeasure called CRCD (clock randomization with encryption core duplication). The countermeasure is shown to effectively protect implementations of block ciphers such as AES, and post-quantum key encapsulation mechanisms such as CRYSTALS-Kyber. Further analysis of the countermeasure reveals a weakness that is exploited and finally patched in an updated implementation of CRCD.

Field-Programmable Gate Arrays (FPGAer) används inom olika branscher på grund av deras höga prestanda, energieffektivitet och omkonfigurerbarhet. Dock är den stora fördelen med omkonfigurerbarhet också en källa till säkerhetsutmaningar.Denna doktorsavhandling undersöker säkerhetsbristerna i FPGA-konfigurationsfilen, d.v.s. bitströmmen, med fokus på utforskning och mildring av riktade bitströmsmodifieringsattacker. Resultaten som redogörs i avhandlingens sju kapitel baseras på en bilagd samling av tolv artiklar. Av dessa artiklar presenterar sju ny forskning om ämnet bitströmsmodifieringsattacker och motåtgärder, med majoriteten av bidragen om attacker. Fyra presenterar ny forskning om ämnet FPGA-baserade motåtgärder mot sidokanalsanalys. Den sista rapporten presenterar en översikt över bitströmsmodifieringsattacker och motåtgärder. Motivationen för rapporterna om sidokanalmotåtgärder är att förbättra FPGA-krypteringsscheman, eftersom stark kryptering kan förhindra riktade bitströmsmodifieringsattacker.

Attackvektorn för riktade bitströmsmodifieringsattacker utforskas genom en serie attacker mot kryptografiska FPGA-implementationer. Målen är populära flödes-chiffer (SNOW 3G, ACORN och Trivium) och kryptografiska primitiv (en arbiter-baserad fysiskt oklonbar funktion och en multi-ring-oscillator-baserad sann slumpmässig nummergenerator). I attackerna på strömkrypteringar modifieras bitströmmen för att introducera fel som försvagar keystreamen genom att linjärisera dess genereringsprocess. En efterföljande analys av den felaktiga keystreamen avslöjar den hemliga nyckeln för implementationerna. I attackerna på kryptografiska primitiv är målet med bitströmsmodi-\\fieringsattacken att sänka ribban eller möjliggöra en sidokanalsanalys. Målet med sidokanalsanalysen är att förutsäga de slumpmässiga utvärdena som produceras av primitiverna. För att underlätta detta identifierar bitströmsmodifieringsattacken komponenter i bitströmmen som producerar utnyttjbar informationsläckage och skapar fler kopior av dem. Kopiorna har samma värden som målen, men deras utgångar är inte anslutna, vilket inte påverkar designens funktionalitet. Studien om bitströmsmodifiering kompletteras med införandet av lågkostnadsförvirringsmotåtgärder och en allmän metodik mot förvirring baserad på konstanter. Metodiken kan besegra alla de motåtgärder vi tidigare definierat, och dess tillämpning sträcker sig till det allmänna området för hårdvarudesignförvirring.

På ämnet motåtgärder mot sidokanalsanalys utvärderas den populära metoden för klockslumpning. Den antagna sidokanalsanalysen syftar till att extrahera den hemliga nyckeln för blockkryptoalgoritmen advanced encryption standard (AES). Utvärderingen visar att klockslumpning inte kan erbjuda skydd när sidokanalsmätningarna samplas med en frekvens som är avsevärt högre än enhetens driftfrekvens. Som svar på detta kombineras tekniken för klockslumpning med duplication av krypteringskärnan för att bilda en ny motåtgärd som kallas CRCD (clock randomization with encryption core duplication). Motåtgärden har visat sig effektivt skydda implementationer av blockkrypteringar som AES och postkvantum nyckelinkapslingsmekanismer som CRYSTALS-Kyber. Ytterligare analys av motåtgärden avslöjar en svaghet som utnyttjas och slutligen åtgärdas i en uppdaterad implementation av CRCD.

Deep learning transformed side-channel analysis and made many conventional countermeasures obsolete. This brings the need for more effective, deep learning-resistant defense mechanisms. We propose a method for protecting hardware implementations of cryptographic algorithms that combines clock randomization with duplication. The presented method ensures that the duplicated block generates algorithmic noise that is dependent on the input of the primary block and has a similar power profile. In addition, the duplicated block does not create any secret key-related leakage. We evaluate the presented method on the example of the Advanced Encryption Standard (AES) algorithm implemented in FPGA. Our experimental results show that the protected AES implementation is resistant to deep learning-based power analysis.

Clock randomization is one of the oldest countermeasures against side-channel attacks. Various implementations have been presented in the past, along with positive security evaluations. However, in this paper we show that it is possible to break countermeasures based on a randomized clock by sampling side-channel measurements at a frequency much higher than the encryption clock, synchronizing the traces with pre-processing, and targeting the beginning of the encryption. We demonstrate a deep learning-based side-channel attack on a protected FPGA implementation of AES which can recover a subkey from less than 500 power traces. In contrast to previous attacks on FPGA implementations of AES which targeted the last round, the presented attack uses the first round as the attack point. Any randomized clock countermeasure is significantly weakened by an attack on the first round because the effect of randomness accumulated over multiple encryption rounds is lost.

Advances in Field-Programmable Gate Array (FPGA) technology in recent years have resulted in an expansion of its usage in a very wide spectrum of applications. Apart from serving the traditional prototyping purposes, FPGAs are currently regarded as an integral part of embedded systems used in many industries, including communication, medical, aerospace, automotive, and military. Moreover, the emerging trend of AI has found FPGAs to be at the technological forefront with their use as deep learning acceleration platforms. The demand for FPGAs has grown to the point that major companies (e.g. Amazon) are offering cloud-based access to FPGAs, known as FPGA-as-a-Service. In many applications, FPGAs handle sensitive data and/or host cryptographic algorithm implementations. These FPGAs are not always located in a tamper-resistant environment, which makes their security a major concern, especially in light of the ever-growing number of publications demonstrating effective attacks specifically tailored to exploit the physical traits of FPGA implementations. In this survey, we cover the subset of those attacks that involve tampering with the FPGA configuration bitstream. We start by discussing how the FPGA vendors attempt to protect their products and how malicious parties try to overcome this protection. We then proceed to present the different bitstream modification attacks that can be found in the literature organized according to their targets. Finally, we present various countermeasures that can be deployed, drawing on bibliographic references from works specifically focused on FPGA bitstream protection, as well as those initially proposed for different purposes or devices that can be adapted for bitstream protection.

Hardware obfuscation is a well-known countermeasure against reverse engineering. For FPGA designs, obfuscation can be implemented with a small overhead by using underutilised logic cells; however, its effectiveness depends on the stealthiness of the added redundancy. In this paper, we show that it is possible to deobfuscate an SRAM FPGA design by ensuring the full controllability of each instantiated look-up table input via iterative bitstream modification. The presented algorithm works directly on bitstream and does not require the possession of a flattened netlist. The feasibility of our approach is verified on the example of an obfuscated SNOW 3G design implemented on a Xilinx 7-series FPGA.

We present an algorithm capable of defeating SRAM FPGA design obfuscation methods based on hardware opaque predicates. This is achieved by ensuring the full controllability of each instantiated look-up table input via iterative bitstream modifications. Unlike many previous deobfuscation approaches, the presented method does not require the possession of a netlist. It is applied directly to the FPGA bitstream. The feasibility of our approach is verified on the example of an obfuscated SNOW 3G design implemented in a Xilinx Artix-7 FPGA.

With the growth of popularity of Field-Programmable Gate Arrays (FPGAs) in cloud environments, new paradigms such as FPGA-as-a-Service (FaaS) emerge. This challenges the conventional FPGA security models which assume trust between the user and the hardware owner. In an FaaS scenario, the user may want to keep data or FPGA configuration bitstream confidential in order to protect privacy or intellectual property. However, securing FaaS use cases is hard due to the difficulty of protecting encryption keys and other secrets from the hardware owner. In this paper we demonstrate that even advanced key provisioning and remote attestation methods based on Physical Unclonable Functions (PUFs) can be broken by profiling side-channel attacks employing deep learning. Using power traces from two profiling FPGA boards implementing an arbiter PUF, we train a Convolutional Neural Network (CNN) model to learn features corresponding to “0” and “1” PUF’s responses. Then, we use the resulting model to classify responses of PUFs implemented in FPGA boards under attack (different from the profiling boards). We show that the presented attack can overcome countermeasures based on encrypting challenges and responses of a PUF.

True Random Number Generators (TRNGs) create a hardware-based, non-deterministic noise that is used for generating keys, initialization vectors, and nonces in a variety of applications requiring cryptographic protection. A compromised TRNG may lead to a system-wide loss of security. In this brief, we show that an attack combining power analysis with bitstream modification is capable of classifying the output bits of a TRNG implemented in FPGAs from a single power measurement. We demonstrate the attack on the example of an open source AIS-20/31 compliant ring oscillator-based TRNG implemented in Xilinx Artix-7 28nm FPGAs. The combined attack opens a new attack vector which makes possible what is not achievable with pure bitstream modification or side-channel analysis.