Paper accepted at CHES 2024. “Static Leakage in Dual-Rail Precharge Logics”
by Bijan Fadaeinia, Thorben Moos and Amir Moradi
2024/08/15

In recent research studies, an observable dependency has been found between the static power consumption of a CMOS chip and its internally stored and processed data. For the most part, these studies have focused on utilizing the leakage currents as a side channel to conduct key-recovery attacks on cryptographic devices. There are two main reasons why information leakage through the static power side channel is considered particularly harmful for the security of implementations, namely 1) the low influence of noise due to averaging over time and 2) the ability to target secrets even outside of the time window that they are actively computed upon (data is leaked for as long as it is saved anywhere in the circuit). Hence, developing effective countermeasures against this threat is of significant importance for the security of cryptographic hardware. Hiding techniques known as DRP logic have been proposed and studied in literature as an instrument to equalize a circuit's dynamic power consumption irrespective of the processed data. The specific instance called iMDPL is -- despite its high overhead -- known as one of the most potent and attractive DRP-based SCA countermeasures. While its ability to prevent data extraction through the dynamic power consumption is well studied and documented, we thoroughly analyze its susceptibility to SPSCA attacks in this work. To conduct our study we have taped-out a custom ASIC prototype in 65 nm CMOS technology which contains multiple cryptographic co-processors protected by iMDPL, partially combined with other countermeasures. Additionally, it contains circuits protected by a new variant of iMDPL that we specifically hardened against SPSCA, which we call SRiMDPL. Our careful experiments performed in a controlled environment under exploitation of voltage and temperature dependencies show that SRiMDPL circuits combined with modern hardware masking offer an extremely high level of security against both dynamic and static power SCA attacks. While the cost of such combinations is admittedly significant (~ 108 kGE post-layout area for a corresponding PRESENT core), we obtain the strongest combined resistance to both power side channels that has been experimentally demonstrated on real silicon so far. In summary, we believe that our analysis can assist hardware designers in making important decisions on the trade-offs between cost and security that such countermeasures facilitate.
