R-STELLAR: A Resilient Synthesizable Signature Attenuation SCA Protection on AES-256 with built-in Attack-on-Countermeasure Detection

TL;DR

This paper tackles the vulnerability of AES-256 hardware to side-channel attacks by delivering a scalable, synthesizable countermeasure, R-STELLAR, that achieves an MTD exceeding $>200\,M$ traces through a digital cascoded current source. It further reveals a novel Voltage-drop Linear-region Biasing (VLB) attack that can drastically reduce the MTD to roughly $105\,K$ traces, and it proposes an attack detector with a sub-ms response to constrain leakage windows. Experimental results on a 65 nm chip show strong attenuation of power and EM signatures under CPA/CEMA, with substantial TVLA improvements, and demonstrate robust detection of VLB attacks within 0.8 ms. The work argues that such a digital, synthesizable countermeasure is practical for industry and can be cascaded with other defenses to raise security against evolving SCA threats.

Abstract

Side channel attacks (SCAs) remain a significant threat to the security of cryptographic systems in modern embedded devices. Even mathematically secure cryptographic algorithms, when implemented in hardware, inadvertently leak information through physical side channel signatures such as power consumption, electromagnetic (EM) radiation, light emissions, and acoustic emanations. Exploiting these side channels significantly reduces the search space of the attacker. In recent years, physical countermeasures have significantly increased the minimum traces to disclosure (MTD) to 1 billion. Among them, signature attenuation is the first method to achieve this mark. Signature attenuation often relies on analog techniques, and digital signature attenuation reduces MTD to 20 million, requiring additional methods for high resilience. We focus on improving the digital signature attenuation by an order of magnitude (MTD 200M). Additionally, we explore possible attacks against signature attenuation countermeasure. We introduce a Voltage drop Linear region Biasing (VLB) attack technique that reduces the MTD to over 2000 times less than the previous threshold. This is the first known attack against a physical side-channel attack (SCA) countermeasure. We have implemented an attack detector with a response time of 0.8 milliseconds to detect such attacks, limiting SCA leakage window to sub-ms, which is insufficient for a successful attack.

Figures (17)

• Figure 1: a) Prior state-of-the-art using signature attenuation techniques. b) Unprotected AES can be attacked using power SCA. c) This work protects against power SCA using digitally cascoded current source. d) A Voltage drop-based Linear-region Biasing attack is explored using a signature attenuation countermeasure. e) The implemented attack detectors can detect this attack for the resilience of signature attenuation countermeasure. Key contributions are tabulated below.
• Figure 2: State-of-the-art circuit level countermeasures. This work brings the benefit of cascoded current sources in the digital domain for high security, even being scalable.
• Figure 3: a) The full system architecture of R-STELLAR. b) Parallel AES-256 archirecture. c) Load characterization of AES.
• Figure 4: Progression of signature attenuation circuit from analog to digital domain: a) analog cascoded CS b) digital source degenerated CS which is scalable but provides low attenuation c) digital cascoded current source providing very high attenuation in digital domain d) attenuation by using architecture (a)-(c).
• Figure 5: Created biasing voltage by NAND structure when the number of on NAND gate at the top r is a) 1, b) 8, and c)15, respectively. We create variable voltage by biasing the top PMOS of the CS slices using this structure.