1
Authors:MILENA STANOJLOVIĆ PREDRAG PETKOVIĆ
LABORATORY FOR ELECTRONIC DESIGN AUTOMATIONFaculty of Electronic Engineering University of Nis
2
IntroductionStrategies against SCAHardware protection of DPAResistance to SCA WDDL and NSDDL
cellsConclusion
3
Data protection is very important in everyday life and for that reason cryptography received a significant position. Important information and secret keys can be obtained by analyzing consumption encrypted hardware. Some of the methods that allow easier breaking of codes known as SPA (Simple Power Analysis), DPA (Differential Power Analysis) and EMA (Electromagnetic Analysis).
Common to all these methods is analysis of information that leaks from physically implemented hardware.
4
Attacks which make use of such inherent physical leak-age are called side-channel attacks (SCA). SCA pose a major threat because the physical implementations of the cryptographic devices are difficult to control and often result in unplanned leakage of information.
Typically, side-channel attacks do not require the device to be opened or access to internal parts of the system.
5
The countermeasures proposed against DPA can be grouped into three categories: randomizing, masking, and blinding.
We are use a blinding method. One class of this method is known as Dual-rail with Pre-charge Logic (DPL). All signals are duplicated and have true and false representations. Good representatives of DPL are WDDL (Wave Dynamic Differential Logic) and NSDDL (No Short-circuit current Dynamic Differential Logic).
6
Using De-Morgan's laws it can be shown that OR cell is complementary to AND cell. This concept of complementary cells is used in WDDL method. The first picture shows an encrypted AND cell.
During pre-charge phase all signals are set to low level.
During evaluating phase only exactly one of outputs goes to the high level.
Therefore only one load capacitance will charge from VDD.
7
The main difference between NSDDL and WDDL is in the control logic. In addition to pre-charge phase and evaluating phase, phase of capacitor discharge (dis-charge phase) is introduced to.
During pre-charge phase signals PRE and DIS are set to low logic level.
Evaluating phase occurs when the PRE signal reaches a high logic level.
Dis-charge phase lasts as long as both PRE and DIS signals are at high logic level.
8
Resistance to SCA WDDL and NSDDL cellsResistance to SCA WDDL and NSDDL cells
Three types of cells are simulated. First two cells are designed using WDDL method. The first cell is designed based on standard cells. This cell gave worse results compared to second cell in which the dimensions of transistors are optimized. Therefore the first cell will be excluded from further consideration.The third cell is designed using NSDDL metod. In this case similar results are obtained as with the second cell. Also power consumption increased as it was expected.
AND/NAND pri VDD=3.3V, T=300K, Tr=Tf=1ns, Ct/Cf=1Metod SC WDDL oWDDL NSDDL
1.Average energy consumption E*
1.02pJ 0.96pJ 2.28pJ
2.Maximum relative deviation of energy
10.14% 3.29% 2.92%
3. Standard deviation 35.53fJ 10.98fJ 20.73fJ
4.Normalized standard
deviation3.47% 1.14% 0.91%
9
Resistance to SCA WDDL and NSDDL cellsResistance to SCA WDDL and NSDDL cells
Resistance to SCA is tested for following conditions: mismatched loads, extremly increased temperature, different duration of falling and rising edges of inputs signals extreme changes of power supply voltage (Vdd)
10
optimizovana WDDL AND ćelijaVdd=3.3V, T=300K, Tr=Tf=1ns
-0.06
-0.04
-0.02
0.00
0.02
0.04
0.06
1 2 3 4 5 6 7 8 9 10
Kombinacija ulaznih signala
Rel
ativ
na p
rom
ena
ener
gije
Ct/Cf=1
Ct/Cf=0.85
Ct/Cf=1.15
Ct/Cf=0.95
Ct/Cf=1.05
NSDDL AND ćelijaVdd=3.3V, T=300K, Tr=Tf=1ns
-0.025
-0.02
-0.015
-0.01
-0.005
0
0.005
0.01
0.015
1 2 3 4 5 6 7 8 9 10
Kombinacija ulaznih signala
Rela
tivn
a p
rom
en
a
en
erg
ije
Ct/Cf=1
Ct/Cf=0.85
Ct/Cf=1.15
Ct/Cf=0.95
Ct/Cf=1.05
optimizovana WDDL AND ćelija Vdd=3.3V Ct/Cf=1
-0.03
-0.02
-0.01
0.00
0.01
0.02
0.03
1 2 3 4 5 6 7 8 9 10
Kombinacija ulaznih signala
Rel
ativ
na
pro
men
a en
erg
ije T=300K, Tr=Tf=1ns
T=425K, Tr=Tf=1ns
T=300K, Tr=Tf=4ns
NSDDL AND ćelijaVdd=3.3V, Ct/Cf=1
-0.025
-0.02
-0.015
-0.01
-0.005
0
0.005
0.01
0.015
1 2 3 4 5 6 7 8 9 10
Kombinacija ulaznih signalaR
elat
ivn
a p
rom
ena
ener
gij
e T=300K, TR=1ns
T=425K, TR=1ns
T=300K, TR=4ns
Influence of mismatched loads to relative change in energy for a) oWDDL i b) NSDDL AND cells
Influence of extreme temperature and signal dinamics to relative change in energy for a) oWDDL i b) NSDDL AND cells
11
Influence of extreme values of Vdd to relative change in energy for a) oWDDL i b) NSDDL AND cells
All results indicate that the NSDDL cell is more resistant to SCA than optimized WDDL cell.
optimizovana WDDL AND ćelijaT=300K, Ct/Cf=1, Tr=Tf=1ns
-0.04
-0.03
-0.02
-0.01
0
0.01
0.02
0.03
0.04
1 2 3 4 5 6 7 8 9 10
Kombinacija ulaznih signala
Rel
ativ
na
pro
men
a en
erg
ije Vdd=3.3V
Vdd=4.2V
Vdd=2.4V
NSDDL AND ćelijaT=300K, Ct/Cf=1, Tr=Tf=1ns
-0.025
-0.02
-0.015
-0.01
-0.005
0
0.005
0.01
0.015
1 2 3 4 5 6 7 8 9 10
Kombinacija ulaznih signala
Rel
ativ
na
pro
men
a en
erg
ije Vdd=3.3V
Vdd=4.2V
Vdd=2.4V
12
Cryptography hardware methods for DPA protection are based on designing structures with power consumption independent of input signals dynamic.
Physical implementation of WDDL method is very hard to achieve because it requires perfectly matched loads.
This problem is resolved in NSDDL method by introducing Dnor circuitry.
13