From theory to practice of private circuit: A cautionary note

Abstract

Private circuits, from their publication, have been really popular among the researchers. They also form the basis for provable masking schemes. There are several works which try to improve the results of bit-level private circuits based on 2-input gates for the combinational logic. However, strangely, no practical side-channel analysis of private circuits has been presented so far, which is the focus of the present paper. In this paper, we have tried to identify the 'ambush' or hidden dangers in the implementation of private circuits, which can compromise its security in practical scenarios. We have implemented block cipher SIMON with private circuit and have performed sidechannel analysis on it. The result shows that, in practice, there is significant amount of information leakage which can be exploited by adversaries. Some leakage comes from practical optimization applied by standard CAD tools, if they restructure the netlists. But even with immutable netlists, we identify leakage caused by a kind of glitch known as early evaluation. Lastly, we demonstrate how to translate theoretically secure private circuit to practically secure private circuit with added overhead, by clocking every combinational gate. Leakage detection tests are applied to attest the security of considered variants of private circuits.

More Efficient Private Circuits II through Threshold Implementations

“…Previous work has shown that applying PC-I or PC-II is not trivial and prone to many subtle mistakes that can lead to insecure designs. As the traps and pitfalls of PC-I were covered in the work of Roy et al [29], we direct our focus on PC-II.…”

“…the operation order by inserting registers. In [29], a secure AND gadget was proposed by inserting registers behind every gate of a manually encoded PC-I AND. The resulting impact on the area and performance is significant.…”

“…The resulting implementations were later shown to have security flaws [28]. At ICCD 2015, Roy et al [29], pointed out the reasons for the existent side-channel leakage. Undesired circuit optimization by the design flow tools, glitches and early propagation of signal values all had a noticeable impact on the security of the masked implementations.…”

“…Additionally, a strategy for secure Private Circuits implementations in the presence of glitches is given by inheriting the noncompleteness property from TI. Their strategy provides a cheaper and more efficient PC-I implementation compared to the fully sequential realization of [29].…”

Spin Me Right Round Rotational Symmetry for FPGA-Specific AES: Extended Version

“…In Table 3, we do this first for various masked S-box implementations. The results from other works are obtained by synthesis, translate and map using Xilinx default settings apart from the KEEP HIERARCHY constraint which is turned on to prohibit optimization across shares [50], as is common practice with masked implementations [22, §2.4.1]. We stress that no optimization for FPGA has been done for these designs.…”