1 Authors: MILENA STANOJLOVIĆ PREDRAG PETKOVIĆ LABORATORY FOR ELECTRONIC DESIGN AUTOMATION Faculty of Electronic Engineering University of Nis.

1

Authors:MILENA STANOJLOVIĆ PREDRAG PETKOVIĆ

LABORATORY FOR ELECTRONIC DESIGN AUTOMATIONFaculty of Electronic Engineering University of Nis

2

IntroductionStrategies against SCAHardware protection of DPAResistance to SCA WDDL and NSDDL

cellsConclusion

3

Data protection is very important in everyday life and for that reason cryptography received a significant position. Important information and secret keys can be obtained by analyzing consumption encrypted hardware. Some of the methods that allow easier breaking of codes known as SPA (Simple Power Analysis), DPA (Differential Power Analysis) and EMA (Electromagnetic Analysis).

Common to all these methods is analysis of information that leaks from physically implemented hardware.

4

Attacks which make use of such inherent physical leak-age are called side-channel attacks (SCA). SCA pose a major threat because the physical implementations of the cryptographic devices are difficult to control and often result in unplanned leakage of information.

Typically, side-channel attacks do not require the device to be opened or access to internal parts of the system.

5

The countermeasures proposed against DPA can be grouped into three categories: randomizing, masking, and blinding.

We are use a blinding method. One class of this method is known as Dual-rail with Pre-charge Logic (DPL). All signals are duplicated and have true and false representations. Good representatives of DPL are WDDL (Wave Dynamic Differential Logic) and NSDDL (No Short-circuit current Dynamic Differential Logic).

6

Using De-Morgan's laws it can be shown that OR cell is complementary to AND cell. This concept of complementary cells is used in WDDL method. The first picture shows an encrypted AND cell.

During pre-charge phase all signals are set to low level.

During evaluating phase only exactly one of outputs goes to the high level.

Therefore only one load capacitance will charge from VDD.

7

The main difference between NSDDL and WDDL is in the control logic. In addition to pre-charge phase and evaluating phase, phase of capacitor discharge (dis-charge phase) is introduced to.

During pre-charge phase signals PRE and DIS are set to low logic level.

Evaluating phase occurs when the PRE signal reaches a high logic level.

Dis-charge phase lasts as long as both PRE and DIS signals are at high logic level.

8

Resistance to SCA WDDL and NSDDL cellsResistance to SCA WDDL and NSDDL cells

Three types of cells are simulated. First two cells are designed using WDDL method. The first cell is designed based on standard cells. This cell gave worse results compared to second cell in which the dimensions of transistors are optimized. Therefore the first cell will be excluded from further consideration.The third cell is designed using NSDDL metod. In this case similar results are obtained as with the second cell. Also power consumption increased as it was expected.

AND/NAND pri VDD=3.3V, T=300K, Tr=Tf=1ns, Ct/Cf=1Metod SC WDDL oWDDL NSDDL

1.Average energy consumption E*

1.02pJ 0.96pJ 2.28pJ

2.Maximum relative deviation of energy

10.14% 3.29% 2.92%

3. Standard deviation 35.53fJ 10.98fJ 20.73fJ

4.Normalized standard

deviation3.47% 1.14% 0.91%

9

Resistance to SCA WDDL and NSDDL cellsResistance to SCA WDDL and NSDDL cells

Resistance to SCA is tested for following conditions: mismatched loads, extremly increased temperature, different duration of falling and rising edges of inputs signals extreme changes of power supply voltage (Vdd)

10

optimizovana WDDL AND ćelijaVdd=3.3V, T=300K, Tr=Tf=1ns

-0.06

-0.04

-0.02

0.00

0.02

0.04

0.06

1 2 3 4 5 6 7 8 9 10

Kombinacija ulaznih signala

Rel

ativ

na p

rom

ena

ener

gije

Ct/Cf=1

Ct/Cf=0.85

Ct/Cf=1.15

Ct/Cf=0.95

Ct/Cf=1.05

NSDDL AND ćelijaVdd=3.3V, T=300K, Tr=Tf=1ns

-0.025

-0.02

-0.015

-0.01

-0.005

0

0.005

0.01

0.015

1 2 3 4 5 6 7 8 9 10

Kombinacija ulaznih signala

Rela

tivn

a p

rom

en

a

en

erg

ije

Ct/Cf=1

Ct/Cf=0.85

Ct/Cf=1.15

Ct/Cf=0.95

Ct/Cf=1.05

optimizovana WDDL AND ćelija Vdd=3.3V Ct/Cf=1

-0.03

-0.02

-0.01

0.00

0.01

0.02

0.03

1 2 3 4 5 6 7 8 9 10

Kombinacija ulaznih signala

Rel

ativ

na

pro

men

a en

erg

ije T=300K, Tr=Tf=1ns

T=425K, Tr=Tf=1ns

T=300K, Tr=Tf=4ns

NSDDL AND ćelijaVdd=3.3V, Ct/Cf=1

-0.025

-0.02

-0.015

-0.01

-0.005

0

0.005

0.01

0.015

1 2 3 4 5 6 7 8 9 10

Kombinacija ulaznih signalaR

elat

ivn

a p

rom

ena

ener

gij

e T=300K, TR=1ns

T=425K, TR=1ns

T=300K, TR=4ns

Influence of mismatched loads to relative change in energy for a) oWDDL i b) NSDDL AND cells

Influence of extreme temperature and signal dinamics to relative change in energy for a) oWDDL i b) NSDDL AND cells

11

Influence of extreme values of Vdd to relative change in energy for a) oWDDL i b) NSDDL AND cells

All results indicate that the NSDDL cell is more resistant to SCA than optimized WDDL cell.

optimizovana WDDL AND ćelijaT=300K, Ct/Cf=1, Tr=Tf=1ns

-0.04

-0.03

-0.02

-0.01

0

0.01

0.02

0.03

0.04

1 2 3 4 5 6 7 8 9 10

Kombinacija ulaznih signala

Rel

ativ

na

pro

men

a en

erg

ije Vdd=3.3V

Vdd=4.2V

Vdd=2.4V

NSDDL AND ćelijaT=300K, Ct/Cf=1, Tr=Tf=1ns

-0.025

-0.02

-0.015

-0.01

-0.005

0

0.005

0.01

0.015

1 2 3 4 5 6 7 8 9 10

Kombinacija ulaznih signala

Rel

ativ

na

pro

men

a en

erg

ije Vdd=3.3V

Vdd=4.2V

Vdd=2.4V

12

Cryptography hardware methods for DPA protection are based on designing structures with power consumption independent of input signals dynamic.

Physical implementation of WDDL method is very hard to achieve because it requires perfectly matched loads.

This problem is resolved in NSDDL method by introducing Dnor circuitry.

13