diff --git a/docs/publications/bake-it-heat-leakage-eprint23.md b/docs/publications/bake-it-heat-leakage-eprint23.md deleted file mode 100644 index ea0a7b8..0000000 --- a/docs/publications/bake-it-heat-leakage-eprint23.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -title: "Bake It Till You Make It: Heat-induced Leakage from Masked Neural Networks" -paper_url: "https://eprint.iacr.org/2023/076" -year: 2023 ---- - -![Bake paper image](/img/papers/bake.png) - -Masking has become one of the most effective approaches for securing hardware designs against side-channel attacks. Irrespective of the effort put into correctly implementing masking schemes on a field programmable gate array (FPGA), leakage can be unexpectedly observed. This is due to the fact that the assumption underlying all masked designs, i.e., the leakages of different shares are independent of each other, may no longer hold in practice. In this regard, extreme temperatures have been shown to be an important factor in inducing leakage, even in correctly-masked designs. This has previously been verified using an external heat generator (i.e., a climate chamber). In this paper, we examine whether the leakage can be induced using the circuit components themselves. Specifically, we target masked neural networks (NNs) in FPGAs, with one of the main building blocks being block random access memory (BRAM) and flip-flops (FFs). - -*Dev M Mehta, Mohammad Hashemi, David S Koblah, Domenic Forte, Fatemeh Ganji* - -**[Cryptology ePrint Archive, 2023](https://eprint.iacr.org/2023/076)** \ No newline at end of file diff --git a/docs/publications/chypnosis.md b/docs/publications/chypnosis.md new file mode 100644 index 0000000..4a58716 --- /dev/null +++ b/docs/publications/chypnosis.md @@ -0,0 +1,13 @@ +--- +title: "Chypnosis: Undervolting-based Static Side-channel Attacks" +paper_url: "https://ieeexplore.ieee.org/abstract/document/11573501" +year: 2026 +--- + +![Chypnosis paper logo](/img/research/Chypnosis.jpeg) + +Chypnosis is an undervolting attack that indirectly stops a target circuit's clock while preserving its stored data. By rapidly dropping the supply voltage, it can prevent both clock-monitoring defenses and voltage-sensor response mechanisms from clearing sensitive state. Demonstrations across multiple FPGAs, the OpenTitan alert handler, laser logic state imaging, and impedance analysis show that secrets can still be recovered from protected cryptographic hardware. The work also proposes and validates an improved FPGA-compatible clock-detection countermeasure. + +*Mitard, K., Monfared, S.K., Dana, F.K., Dumitru, R., Yarom, Y., and Tajik, S.* + +**[Read the paper](https://ieeexplore.ieee.org/abstract/document/11573501)** diff --git a/docs/publications/gate-level-sca-ranking-tetc23.md b/docs/publications/gate-level-sca-ranking-tetc23.md deleted file mode 100644 index ac6887c..0000000 --- a/docs/publications/gate-level-sca-ranking-tetc23.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -title: "Gate-Level Side-Channel Leakage Ranking with Architecture Correlation Analysis" -paper_url: "https://ieeexplore.ieee.org/abstract/document/10179450" -year: 2023 ---- - -![Gate paper image](/img/papers/gate.png) - -While side-channel leakage is traditionally evaluated from a fabricated chip, it is more time-efficient and cost-effective to do so during the design phase of the chip. We present a methodology to rank the gates of a design according to their contribution to the side-channel leakage of the chip. The methodology relies on logic synthesis, logic simulation, gate-level power estimation, and gateleakage assessment to compute a ranking. The ranking metric can be defined as a specific test by correlating gate-level activity with aleakage model, or else as a non-specific test by evaluating gate-level activity in response to distinct test vector groups. Our results show that only a minority of the gates in a design contribute most of the side-channel leakage. We demonstrate this property for several designs, including a hardware AES coprocessor and a cryptographic hardware/software interface in a five-stage pipelined RISC processor - -*Pantea Kiaei, Yuan Yao, Zhenyuan Liu, Nicole Fern, Cees-Bart Breunesse, Jasper Van Woudenberg, Kate Gillis, Alex Dich, Peter Grossmann, Patrick Schaumont* - -**[IEEE Transactions on Emerging Topics in Computing 2023](https://ieeexplore.ieee.org/abstract/document/10179450)** \ No newline at end of file diff --git a/docs/publications/goblin-acns24.md b/docs/publications/goblin-acns24.md deleted file mode 100644 index d52c571..0000000 --- a/docs/publications/goblin-acns24.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -title: "Goblin: Time is money, friend! Timing Side-channel Attack against Garbled Circuit Constructions" -paper_url: "https://eprint.iacr.org/2023/001.pdf" -year: 2024 ---- - -![Goblin paper image](/img/papers/goblin.png) - -With the advent of secure function evaluation (SFE), distrustful parties can jointly compute on their private inputs without disclosing anything besides the results. Yao's garbled circuit protocol has become an integral part of secure computation thanks to considerable efforts made to make it feasible, practical, and more efficient. For decades, the security of protocols offered in general-purpose compilers has been assured with regard to sound proofs and the promise that during the computation, no information on parties' input would be leaking. In a parallel effort, nevertheless, the vulnerability of garbled circuit frameworks to timing attacks has, surprisingly, never been discussed in the literature. This paper introduces Goblin, the first timing attack against commonly employed garbled circuit frameworks. Goblin is a machine learning-assisted, non-profiling, single-trace timing SCA, which successfully recovers the garbler's input during the computation under different scenarios, including various GC frameworks, benchmark functions, and the number of garbler's input bits. In doing so, Goblin hopefully paves the way for further research in this matter. - -*Mohammad Hashemi, Domenic Forte, Fatemeh Ganji* - -**[Applied Cryptography and Network Security, (ACNS 24)](https://eprint.iacr.org/2023/001.pdf)** \ No newline at end of file diff --git a/docs/publications/leakyohm-ccs23.md b/docs/publications/leakyohm-ccs23.md deleted file mode 100644 index d4c8aff..0000000 --- a/docs/publications/leakyohm-ccs23.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -title: "LeakyOhm: Secret Bits Extraction using Impedance Analysis" -paper_url: "https://eprint.iacr.org/2023/693" -year: 2023 ---- - -![LeakyOhm paper image](/img/papers/leaky.png) - -The threat of physical side-channel attacks and their countermeasures is a widely researched field. Most physical side-channel attacks rely on the unavoidable influence of computation or storage on voltage or current fluctuations. Such data-dependent influence can be exploited by, for instance, power or electromagnetic analysis. In this work, we introduce a novel non-invasive physical side-channel attack, which exploits the data-dependent changes in the impedance of the chip. Our attack relies on the fact that the temporarily stored contents in registers alter the physical characteristics of the circuit, which results in changes in the die's impedance. To sense such impedance variations, we deploy a well-known RF/microwave method called scattering parameter analysis, in which we inject sine wave signals with high frequencies into the system's power distribution network (PDN) and measure the echo of the signals. We demonstrate that according to the content bits and physical location of a register, the reflected signal is modulated differently at various frequency points enabling the simultaneous and independent probing of individual registers. - -*Saleh Khalaj Monfared,Tahoura Mosavirik, Shahin Tajik* - -**[ACM Conference on Computer and Communications Security 2023, (CCS 23)](https://eprint.iacr.org/2023/693)** \ No newline at end of file diff --git a/docs/publications/telescope.md b/docs/publications/telescope.md new file mode 100644 index 0000000..959996f --- /dev/null +++ b/docs/publications/telescope.md @@ -0,0 +1,13 @@ +--- +title: "Telescope: Top-Down Hierarchical Pre-silicon Side-channel Leakage Assessment in System-on-Chip Design" +paper_url: "https://dl.acm.org/doi/full/10.1145/3708821.3736216" +year: 2025 +--- + +![Telescope paper logo](/img/research/Telescope.png) + +Telescope is a top-down framework for assessing side-channel leakage before silicon is available. It traces leakage across architecture, microarchitecture, and gate levels to reveal how software-level behavior propagates into hardware—and where leakage progressively appears, emerges, or disappears. Evaluations on the PicoRV32 and IBEX RISC-V processors demonstrate how this cross-level view can scale to practical leakage debugging and verification. + +*Liu, Z., Malnicof, A., Roy, A., and Schaumont, P.* + +**[Read the paper](https://dl.acm.org/doi/full/10.1145/3708821.3736216)** diff --git a/docs/publications/uncertainty-estimation.md b/docs/publications/uncertainty-estimation.md new file mode 100644 index 0000000..9ee81d5 --- /dev/null +++ b/docs/publications/uncertainty-estimation.md @@ -0,0 +1,13 @@ +--- +title: "Uncertainty Estimation in Neural Network-enabled Side-channel Analysis and Links to Explainability" +paper_url: "https://tches.iacr.org/index.php/TCHES/article/view/12908" +year: 2026 +--- + +![Uncertainty estimation paper logo](/img/research/Uncertainty.png) + +This work introduces a Rényi entropy-based framework for measuring uncertainty in neural network-assisted side-channel analysis and explaining its effect on key recovery. It separates model-related and data-related uncertainty, uses matrix-based Rényi measures to approximate high-dimensional leakage distributions, and combines Shapley-value explanations with uncertainty estimates to identify influential trace features. Experiments show that predictive uncertainty strongly correlates with established attack metrics such as key rank. + +*Nouraniboosjin, S., and Ganji, F.* + +**[Read the paper](https://tches.iacr.org/index.php/TCHES/article/view/12908)** diff --git a/news/2022-12-09-ches-impedance-sensing.md b/news/2022-12-09-ches-impedance-sensing.md deleted file mode 100644 index 5a62f17..0000000 --- a/news/2022-12-09-ches-impedance-sensing.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -title: 'CHES 2023 Publishes Work on On-chip Impedance Sensing' -date: 2022-12-09 -authors: vernamlab -tags: [hello, docusaurus] -hide_table_of_contents: true ---- - -CHES 2023 published our work on "[On-chip Impedance Sensing for System Tampering Detection](https://tches.iacr.org/index.php/TCHES/article/view/9954)". - \ No newline at end of file diff --git a/news/2023-05-25-jolt-rowhammer-ieeesp.md b/news/2023-05-25-jolt-rowhammer-ieeesp.md deleted file mode 100644 index 3ca0ab0..0000000 --- a/news/2023-05-25-jolt-rowhammer-ieeesp.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -title: 'Jolt Rowhammer Attack Presented at IEEE S&P 2023' -date: 2023-05-25 -authors: ['vernamlab'] -tags: [publication, conference, attack] -hide_table_of_contents: true ---- - -Our new Rowhammer Attack, "[Jolt: Recovering TLS Signing Keys via Rowhammer Faults](https://ieeexplore.ieee.org/abstract/document/10179450)," was presented at IEEE S&P 2023. - diff --git a/news/2023-10-23-goblin-timing-attack.md b/news/2023-10-23-goblin-timing-attack.md deleted file mode 100644 index 28646c5..0000000 --- a/news/2023-10-23-goblin-timing-attack.md +++ /dev/null @@ -1,12 +0,0 @@ ---- -title: 'New Timing Side-channel Attack: Goblin' -date: 2023-10-23 -authors: ['vernamlab'] -tags: [research, attack, publication] -hide_table_of_contents: true ---- - -Check out Goblin, our new timing side-channel attack against Garbled Circuit constructions. - -For more info, take a look at the [Goblin project page](https://vernamlab.org/Goblin). - diff --git a/news/2023-11-10-leakyohm-ccs-2023.md b/news/2023-11-10-leakyohm-ccs-2023.md deleted file mode 100644 index 4dcf3d0..0000000 --- a/news/2023-11-10-leakyohm-ccs-2023.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -title: 'LeakyOhm Published at ACM CCS 2023' -date: 2023-11-10 -authors: ['vernamlab'] -tags: [publication, conference] -hide_table_of_contents: true ---- - -Our paper, "[LeakyOhm: Secret Bits Extraction using Impedance Analysis](https://eprint.iacr.org/2023/693)," has been published at ACM CCS 2023. - \ No newline at end of file