MOLES: Malicious Off-Chip Leakage Enabled by Side-Channels

Transcription

1 MOLES: Maliious Off-Chip Leakage Enabled by Side-Channels Lang Lin*, Wayne Burleson*, Christof Paar* *Department of Eletrial and Computer Engineering, University of Massahusetts Amherst, USA Horst Görtz Institute for IT Seurity Ruhr University Bohum, Germany ABSTRACT Eonomi inentives have driven the semiondutor industry to separate design from fabriation in reent years. This trend leads to potential vulnerabilities from untrusted iruit foundries to overtly implant maliious hardware Trojans into a genuine design. Hardware Trojans provide bak doors for on-hip manipulation, or leak seret information off-hip one the ompromised IC is deployed in the field. This paper explores the design spae of hardware Trojans and proposes a novel tehnique, Maliious Off-hip Leakage Enabled by Side-hannels (MOLES), whih employs power side-hannels to onvey seret information off-hip. An experimental MOLES iruit is designed with fewer than 5 gates and is embedded into an Advaned Enryption Standard (AES) ryptographi iruit in a preditive 45nm CMOS tehnology model. Engineered by a spread-spetrum tehnique, the MOLES tehnique is apable of leaking multi-bit information below the noise power level of the host IC to evade evaluators detetions. In addition, a generalized methodology for a lass of MOLES iruits and design verifiation by statistial orrelation analysis are presented. The goal of this work is to demonstrate the potential threats of MOLES on embedded system seurity. Nevertheless, MOLES ould be onstrutively used for hardware authentiation, fingerprinting and IP protetion. 1. INTRODUCTION Hardware seurity modules (HSMs) are speial-purpose ryptoproessors that exeute ryptographi algorithms and store seret keys for embedded systems or general-purpose omputers. They provide both logial and physial protetions against unauthorized key tampering and various maliious attaks. However, the general trend of separating design from fabriation in the semiondutor industry auses the vulnerabilities of HSMs to untrusted integrated iruit (IC) foundries [1]. Maliious foundries an overtly embed hardware Trojans into the HSMs during the IC fabriation proess to leak seret information or even ompletely destroy a rypto module [2]. Hardware Trojans an be ategorized into a funtional lass and a parametri lass, both of whih have a large design spae of size, struture and distribution methods [3]. Reently, the first exploration of the design spae of hardware Trojans in [4] proposes a maliious ore embedded into a general-purpose miroproessor to implement two Trojan mehanisms. These Trojans are diffiult to detet by traditional Automati Test Pattern Generation (ATPG) tests and IC layout inspetions [5], beause they only introdue less than.1% additional gate ount. Some reently proposed funtion tests and fault analysis methods have deteted the unusual behaviors of similar funtional Trojans Copyright 29 ACM /9/11...$1. [6, 7]. However, it is still very hallenging to detet more advaned Trojans with rare trigger patterns [8]. Side-hannels are the inherent physial properties of a running IC, inluding timing, power onsumption, eletromagneti radiation and even sound wave. Attaks based on side-hannel information an impair the ryptographi routines of various embedded ryptosystems [9, 1, 11, 12]. General ountermeasures against side-hannel attaks inlude using seletively re-sized transistors [13], non-standard gate libraries [14] and multi-ore arhitetures [15]. In the ontext of hardware Trojans, side-hannel analysis is also proposed for positive use of Trojan detetions. A key work in [16] uses the side-hannel information as a physial fingerprint to distinguish the ompromised ICs from the genuine ones. Other Trojan detetion shemes based on power side-hannels and path delay profiles are desribed in [17, 18]. Using side-hannels as building bloks to implement hardware Trojans is a novel and promising onept reently proposed by us [19] and others [2]. Unlike other Trojan mehanisms, information leakage onveyed by side-hannels is not diret digital information, but omposed of analog signals that must be interpreted through advaned off-hip signal analyses. In this paper, we elaborate this onept through the design of Maliious Off-hip Leakage Enabled by Side-hannels (MOLES). MOLES employs lightweight ustom iruits to reate additional sidehannels that an ompletely ompromise HSMs by leaking seret ryptographi keys. Inspired by spread-spetrum tehniques in digital ommuniations, we engineer MOLES to ommuniate with potential attakers below the noise power level of the ompromised IC. Also, we generalize the design methodology of MOLES iruits and propose a verifiation proess to determine the required efforts for multi-bit key extrations under different noise levels. By adopting the lightweight implementation and hidden ommuniation tehniques, we expet that no single Trojan detetion sheme existing in the literature an detet MOLES. This paper is organized as follows: Setion 2 introdues the basi onepts and detetion theories. Setion 3 generalizes the design method and verifiation proess of MOLES implementations. Setion 4 demonstrates the effetiveness of an experimental MOLES, and Setion 5 draws onlusions. 2. BASICS OF MOLES The threat model of an untrusted semiondutor manufaturing and supply hain involves two parties. The attaker is the maliious party who designs and overtly embeds hardware Trojans into the host IC to leak seret information. More importantly, only the attaker knows how to extrat the information leakage from the ompromised IC deployed in the field. The evaluator is the party who endeavors to detet hardware Trojans through standard IC tests and seurity evaluations.

2 Throughout the rest of this paper, we will play the role of attakers to design hardware Trojans through MOLES tehniques. To overtly hide in a ompromised IC and evade most traditional IC funtion tests and hardware Trojan detetion shemes, MOLES should be able to fulfill several design goals. First, the implementation of MOLES should use the minimum gate ount to evade the IC mask inspetions. Modern ICs ontain large bloks of unused iruitry, whih may be left from previous versions of the design or used for temporary testing purposes. These useless bloks may be ignored by standard IC inspetions due to a high testing ost. MOLES ould thus be distributed on suh unused areas aross the die, as long as it is small enough (e.g., implemented with.1% additional gate ount) to fit in. Seond, to survive both the time-domain and frequeny-domain IC funtion tests, MOLES should not disturb the original funtionality and I/O behaviors of the host IC and should synhronize with the IC global lok. Finally, MOLES tehniques employ side-hannels to onvey information leakage. However, they should also inorporate a mehanism to evade the evaluator s detetion sheme of side-hannel analyses. Although both attakers and evaluators an aess to the side-hannel information, we will demonstrate later that MOLES an be designed with spread-spetrum tehniques to enable only attakers exploitability on side-hannel leakage. Note that the onept of MOLES to intentionally indue sidehannels an also be used onstrutively to enhane hardware seurity. For instane, IC manufaturing variability differentiating eah hip an be harnessed as a physial unloneable funtion (PUF) for hip identifiation [21, 22]. In similar ways, MOLES an at as a unique hip identifiation iruit beause only the MOLES designer an exploit the hip identifiation information onveyed by side-hannel leakage. If designed with fewer responsibilities to evade various detetion shemes, MOLES ould be more robust and seure than variability-based PUFs. 2.1 MOLES Implementation A generi MOLES an be implemented by different sidehannels, suh as power onsumption, eletromagneti radiation and path delay. In this work, we speifially engineer a MOLES iruit to onsume data-dependent power as a power side-hannel to leak multi-bit seret keys. A ritial feature of MOLES is the signal-to-noise ratio (SNR), defined as the power level of sidehannel leakage to that of the host IC. An effetive MOLES requires a low SNR to evade evaluators detetion, but a high enough SNR for the attaker to extrat the seret key bits through long observation time. To meet suh ends, we use spreadspetrum tehniques to distribute the power of side-hannel leakage to multiple lok yles. The SNR for eah lok yle is suffiiently low to evade evaluators detetion, while the attaker an still exploit the side-hannel information by averaging over a large number of lok yles. To implement suh a tehnique, we modulate eah key bit with a long pseudo-random number (PN) sequene by an XOR operation. As shown in Figure 1, a binary pseudo-random number generator (PRNG) an generate a PN sequene r K (t). The multi-bit key bus is overtly hardwired to the XOR gates by the attaker (only the key bit K is shown in the figure). The output node of eah XOR gate, with no onnetion to any I/O pin, is onneted to a apaitive load that leaks a small amount of power P ->1 (t) when a 1 logi transition ours. The size of the load apaitor is an adjustable design parameter for MOLES, whih determines the amount of side-hannel information leakage and thus the SNR. For a spread-spetrum system in ommuniations, SNR is also affeted by the proess gain (the ratio of the spread bandwidth to the unspread bandwidth). In the ontext of MOLES, the proess gain is the ratio of the PN sequene duration period to the 1 transition period of the key. A larger proess gain an help overome the low SNR for demodulating the side-hannel information. For the attaker exploiting side-hannel leakage by measuring the power onsumption of a running ompromised IC, the PN sequene duration period is equal to the observation (measurement) time. The transition period of the key depends on the rypto algorithm performed by the ompromised IC. Sine this work demonstrates a MOLES iruit embedded in a symmetrikey rypto-proessor, the seret key is fixed with onstant transition period. Consequently, the proess gain is linearly proportional to the attaker s observation time. This suggests that the attaker an measure numerous power traes for ahieving a large SNR to extrat the seret keys. Figure 1: MOLES iruit embedded in a ryptoproessor (iruit size not to sale) In order to leak multiple key bits, we use the ode division method, whih is fundamental to many ode division multiple aess (CDMA) ommuniation systems [23]. Essentially, we modulate eah key bit with a different PN sequene so that the modulated power side-hannels are orthogonal to eah other. Then, multi-bit keys an be leaked simultaneously and eah key bit an be extrated from the power traes by statistial orrelation demodulation approahes, suh as differential power analysis (DPA) [9]. Sine the attaker hooses the PN sequenes, no evaluator an demodulate the side-hannel leakage without knowing the PN sequene orresponding to eah key bit. 2.2 Detetion Theory The detetion of side-hannel information leakage and the extration of multi-bit keys are based on the orrelation demodulation theory. Assume that the attaker is able to measure the total power S(t) of a ompromised IC with N lok yles. N is also known as the number of power traes in DPA. Let us first onsider the simple ase of leaking one key bit. The attaker an make a key guess and lassify the power traes into two groups (group and group 1) based on the XOR result X i of the key guess and the PN sequene. Then the attaker performs a traditional DPA to examine the orrelation between the power traes and X i. To render a better result, eah power trae is integrated over the entire lok yle before statistial analyses. Then the overall differential power is alulated by summing the integrated power values for all power traes in group 1 and subtrating the sum of those in group. Consequently, the orret

3 key guess will have a positive differential power value, while the wrong key guess will have a negative one. In the exemplary MOLES shown in Figure 1, we assume that the seret key is the eight key bits K to K 7 involved in an AES substitution box. The PRNG, implemented with a linear feedbak shift register (LFSR), generates PN sequenes that are synhronized with the lok of the AES (e.g., the lok period is T ). The key bits K to K 7 are XORed with the orresponding PN sequenes of r K (t) to r K7 (t). The PN sequenes are orrelated by the following time shifts: r K (nt ) = r K1 ((n-1)t ) = = r K7 ((n- 7)T ). The autoorrelation property of the LFSR guarantees the orthogonality of the eight PN sequenes. Assume that the attaker measures the transient power onsumption of the ompromised AES with N T time duration. The attaker-indued power omponent that leaks side-hannel information of one key bit K i is: N P ( t) = [ K ( r ( n) r ( n1))] P ( t nt ), i =..7 Ki i Ki Ki 1 n= 2 The total power of the ompromised IC an be modeled as the sum of P MOLES (t) and P noise (t), thus the SNR is the ratio of P MOLES (t) to P noise (t): St () = PMOLES () t + Pnoise () t 7 = PK () t + P () () () i PRNG t + PAES t + PAWGN t i= [ ] In the above equation, the power of the MOLES iruit is omposed of the power of the LFSR-based PRNG and the eight XOR gates leaking side-hannel information. Only the attaker an exploit the side-hannel leakage by knowing the initial state and the struture of the LFSR. An evaluator even having the skill to perform side-hannel analysis will take the side-hannel information as noise power without knowing the implementation details of MOLES. Alternatively, the evaluator an make further efforts to onjeture the struture of LFSR (in order to detet the MOLES) by side-hannel ryptanalysis. However, the attaker an reat by using a non-linear LFSR (NLFSR) to defeat the evaluator s linear ryptanalysis. The design omplexity of PRNG is another design spae of MOLES, whih is determined by the Trojan detetion sheme of evaluators. Both the power of AES rypto ore and on-hip noise ontribute to the noise power for MOLES. The on-hip noise power omes from power grid flutuations, proess variations, and thermal noise, whih an be modeled as additive white Gaussian noise (AWGN). The noise power level signifiantly impats the SNR and thus the detetion of side-hannel information leakage. The noise power profile ould be muh more omplex than Gaussian noise if we also onsider the power onsumption of non-rypto omponents on the host IC. To deal with power side-hannel analyses under different noise power profiles, advaned methods suh as template attaks [24] an be applied, whih are beyond the sope of this work. The extration of multi-bit keys an follow a bit-by-bit fashion. Sine the SNR is very low in every lok yle, the attak must observe enough power traes to exploit the side-hannel information leakage. When extrating a single bit key from the power traes, the power side-hannels of all other key bits beome the noise power. However, this does not signifiantly affet the (1) (2) key extration. The attaker an start by making a key guess K * of key bit K. Based on the key guess and the known PN sequene, the attaker an predit X = K * [r K (nt )- r K ((n- 1) T )] for a ertain time point nt. The power traes are then grouped based on whether X is logi 1 or logi. After grouping N power traes, let us assume that m power traes are in group 1 whih is assoiated with the predited logi 1, so N- m power traes are in group. Then the differential power (DP) for the N power traes an be alulated by the mean of m group 1 power traes minus the mean of N-m group power traes: 1 1 nt 1 1 nt DP( N) = Stdt ( ) Stdt ( ) m ( n 1) T ( n 1) T n grp1t N m n grpt (3) Sine the PN sequenes are pseudo-random binaries, we an assume that m.5n when N is large enough. To derive Equation (3), the four power terms in Equation (2) have to be determined respetively. First of all, the orrelation of P PRNG (t) and P AWGN (t) to the key bits is near zero, whih will not ontribute to the result. Seondly, the term P AES (t) ould have some orrelation with the key bits sine the 8-bit keys are proessed in the non-linear AES substitution box. However, HSM designers should have minimized this orrelation by side-hannel-resistant methods to avoid diret power analysis attaks on the AES rypto ore. Besides, sine the attaker groups the power traes by the PN sequenes, the inherent power side-hannel of AES is weak during the MOLES detetion proess. Finally, for the first term in Equation (2), let us onsider the single term P K (t) and other 7 terms separately. For P K (t), if the key is orretly guessed (i.e., K = K *), exatly m power traes in group 1 onsume the power P 1(t), while the power traes in group do not. As a result, DP(N) for a orretly guessed K beomes: 1 1 nt 1 1 nt 1 P ( 1) 1( t) dt P ( 1) 1( t) dt m n T n T n grp1t N m n grpt 1 T = P 1( t) dt = onstant > (4) T On the other hand, if the key is wrongly guessed, the grouping is exatly opposite. As a result, DP(N) for a wrongly guessed K beomes: 1 1 nt 1 1 nt 1 P ( 1) 1( ) ( 1) 1( ) n T tdt P n T tdt N m n grpt m n grp1t 1 T = P 1( t) dt =onstant < (5) T No matter how K is guessed, eah term in 7 PK i () t gives a i= 1 result to DP(N) by: 1 1 nt M n grp1t 1 1 N M T n grp ( n1) T [ K ( r ( n) r ( n1))] P ( t) dt nt ( n1) T i Ki Ki 1 [ K ( r ( n) r ( n1))] P ( t) dt i Ki Ki 1 (6)

4 Sine the grouping for K is non-orrelated with K i * [r Ki (nt )- r Ki ((n-1)t )], there will be m i power traes assigned to group 1 instead of m. Thus, the resulting DP(N) beomes: m 1 T 1 T i N mi P 1() t dt P 1() t dt m T N m T (7) Nm ( i m) mi / m 1 = onstant = onstant m ( N m ) 1 m / N When N is large enough, the above result is lose to beause both m and m i will be suffiiently lose to.5 N. To sum up, we will get DP (N) > if the key bit K is orretly guessed. Otherwise, we will get a resulting DP (N) less or equal to zero. Similarly, other key bits an be extrated as long as the power traes are grouped by the orret key guess. The inrease of key bits will not affet the extration of a single key bit, due to the orthogonality of the PN sequenes to modulate eah key bit. 3. EXPERIMENTAL MOLES DESIGN MOLES iruits an be implemented and optimized through a ustom IC design flow. Then they an be inorporated into the host IC design in iruit simulation tools to generate the power traes of the ompromised IC. Next, a design verifiation proess is required to analyze the simulated power traes of the ompromised IC under appropriate noise power models. After onfirming the effetiveness of key extration, the attaker an finally implant MOLES iruits into the genuine IC. In a real sidehannel analysis, the attaker atually performs a similar verifiation proess through the measurement of real transient power traes and off-hip statistial analyses for information extrations. A generalized design methodology is desribed below. At the first design stage, several design spaes of MOLES should be determined, suh as the size of load apaitane, the type of PRNG and the number of key bits to leak. Then the transistorlevel netlist of ustom MOLES iruit is implemented with realisti devie models. After embedding MOLES into a low-level netlist of the host IC, the power traes of the ompromised IC are simulated by HSPICE to make a power profile. Pragmatially, the designer should be ready to simulate at least 1s power traes, so that the SNR is low enough to evade a simple side-hannel analysis detetion by the evaluator. The verifiation proess to extrat the seret key an be performed by signal proessing tools, suh as MATLAB. To address the onhip noise impats on MOLES iruits, different noise power profiles an be also generated. The verifiation proess an adjust the power level of both the ompromised IC power profile and noise power profile to ahieve a realisti on-hip SNR. The two power profiles are added up as a final simulated measurement power (SMP) profile. This SMP profile is then exeuted by a statistial orrelation demodulation engine to verify a key extration. If the key annot be extrated, the designer should simulate more power traes at the simulation stage to inrease the proess gain. If the key still annot be extrated, the MOLES iruits should be modified at the earliest design stage to onvey more side-hannel leakage. The entire design and verifiation proess follows a heuristi approah. In this work, we implement an experimental MOLES and an AES rypto ore with the 45nm preditive tehnology model (PTM) [25]. We synhronize the lok of MOLES and AES to be 1 MHz. We simulate the power traes of the ompromised IC with 1 sampling points in eah lok yle. Sine a typial SPICE simulation with aurate power models for a large iruit an take days, we only simulate 2, power traes as a starting point. As shown in Figure 2, the PRNG in MOLES is implemented by an LFSR of degree 2, with a maximum length primitive polynomial of x 2 +x 13 +x 9 +x Eight XOR gates are employed to leak 8-bit keys. By applying the ring generator arhiteture [26] for the LFSR, the design only ontains 49 equivalent gates. We initially set the load apaitane of eah XOR gate as.1 pf to leak as muh side-hannel information as possible. To validate the onsistene of the ideal side-hannel leakage model and the power with the realisti devie model, we simulate the power traes of the MOLES iruit alone, as shown in Figure 3. For simpliity, we only use two XOR gates to leak two key bits. The orresponding bit sequenes of the two XORs (X and X1) are shown on top of the 15 power traes. We an see that the power traes during 5T to 7T, 8T to 1T and 11T to 13T are almost onsistent with the side-hannel leakage model: a small amount of power is onsumed when a 1 logi transition ours. Note that the inonsistent power is aused by the unorrelated power onsumed by the registers of the LFSR iruit. Figure 2: Diagram of an experimental MOLES Figure 3: Consistene of the side-hannel leakage model and the simulated power traes In the verifiation proess, we perform two verifiation phases to demonstrate the key extration and study the SNR impats on the required number of power traes (RPT) : 1) Verifiation of key independeny: the key extration should be independent on key value. In this phase, we onfigure the MOLES to leak only 2 key bits and simulate 4 sets of power profiles by setting the seret key as all possible values (i.e.,, 1, 1 and 11). Then we try to extrat the seret key for all four ases. For eah ase, we first set SNR = -1 db to examine the RPT to extrat both the two key bits. Then we modify the SMP profile by linearly (in db) dereasing the SNR to determine the relation between SNR and RPT. 2) Verifiation of design salability: the key extration should be effetive with the inrease of key bits (at least 8-bit key for an

5 AES substitution box). In this phase, we onfigure the MOLES to leak 8 key bits by setting an arbitrary key of Then we study the RPT with SNR variations in the same way as before. 4. RESULTS The results of the verifiation phase 1 are shown in Table 1. For different keys with a given SNR, the RPT varies slightly due to the unertainty of noise power. Besides, Figure 4 illustrates the near inverse-linear relation between the log-sale SNR and the RPT. As a showase, Figure 5 plots the differential power urves for key= at SNR = -2dB. With the inrease of power traes, the differential power urves of the orret key guesses (represented by solid lines) gradually stand out from those of the wrong key guesses (represented by dash lines). We highlight the point 424 (reognized as the RPT), when both the urves of K = and K 1 = stand out above zero to indiate the orret key guess. Although the extration of K 1 is slightly earlier than that of K, we ount the RPT by the larger number of power traes. Table 1: SNR vs. RPT for different keys SNR(dB) Key = Key = 1 Key = 1 Key = RPT x 14 key key1 key1 key SNR (db) Figure 4: RPT as a funtion of SNR The result of the verifiation phase 2 for the ase of SNR=-2dB is shown in Figure 6. To extrat the 8-bit key bit-by-bit, we plot 16 differential power urves. The eight orret-key-guess urves are represented by solid lines. The RPT is highlighted as 13, where the orret key 1111 is aurately extrated. Compared with the phase 1, the inrease of key bits leads to an inreasing RPT. The reason is that additional key bits an ompromise the SNR for extrating a single key bit. Besides, we also verify the ase of SNR = -1dB that results an RPT of 32. For the ase of SNR= -3dB, our initial 2 power traes are not enough to extrat all key bits. This indiates that the interpretation of side-hannel leakage onveying a large key size (e.g., 256-bit key) under extremely low SNR requires signifiation omputation efforts during the off-hip side-hannel analyses. 5. CONCLUSIONS In this work, we demonstrate a novel lass of hardware Trojans, the MOLES, whih an intentionally leak seret information through side-hannels. We formulate the mehanism and detetion methods of MOLES in theory. To emphasize the threats on embedded system seurity, we expose a wide design spae of MOLES iruits and provide a verifiation proess for multi-bit key extrations. Simulations of a ompromised rypto ore demonstrate the effetiveness of MOLES to leak seret keys under different noise power levels. By minimizing the gate ount and applying spread-spetrum tehniques, MOLES is very promising to evade most detetion strategies, suh as optial inspetions, advaned funtion tests and physial fingerprinting analyses. We are aware that the silion implementation of MOLES tehniques faes several ritial issues, suh as the proess variation impats on side-hannels and the omputation overhead of detetion in low signal-to-noise ratio. However, these issues an be addressed through design optimizations or advaned signal proessing methods, whih will diret our future researh. ACKNOWLEDGMENTS We thank Kevin Fu, the members of SPQR and the anonymous reviewers for laboratory assistane and onstrutive suggestions. This work was supported in part by the NSF Grant CNS REFERENCES [1] High Performane Mirohip Supply, annul report by Defense Siene Board, [2] S. Adee: The hunt for the kill swith. In: IEEE Spetrum, Vol. 45, Issue 5, pp , 28. [3] X. Wang, M. Tehranipoor, J. Plusquelli: Deteting Maliious Inlusions in Seure Hardware: Challenges and Solutions. In: 1st IEEE International Workshop on Hardware-Oriented Seurity and Trust (HOST), pp , 28. [4] S. T. King, J. Tuek, A. Cozzie, C. Grier, W. Jiang, Y. Zhou: Designing and implementing maliious hardware. In: Proeedings of the 1st USENIX Workshop on Large-Sale Exploits and Emergent Threats (LEET), pp. 1-8, 28. [5] J. M. Soden, R. E. Anderson, C. L. Henderson: IC Failure Analysis: Magi, Mystery, and Siene. In: IEEE Design & Test of Computers, Vol. 14, pp , [6] M. Banga, M. S. Hsiao: A Region Based Approah for the Identifiation of Hardware Trojans. In: IEEE HOST, pp. 4-47, 28. [7] R. Chakraborty, S. Paul, S. Bhunia: On-Demand Transpareny for Improving Hardware Trojan Detetability. In: IEEE HOST, pp. 48-5, 28. [8] Y. Jin, N. Kupp, Y. Makris: Experienes in hardware Trojan design and implementation. In: IEEE HOST, pp. 5-57, 29. [9] P. Koher, J. Jaffe, B. Jun: Differential Power Analysis. In: Proeedings of the 19th Annual International Cryptology Conferene on Advanes in Cryptology (CRYPTO), LNCS 1666, pp , [1] P. Koher: Timing Attaks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems. In: CRYPTO, LNCS 119, pp , [11] A. Shamir, E. Tromer: Aousti ryptanalysis. [12] M. Hutter, S. Mangard, M. Feldhofer: Power and EM attaks on passive MHz RFID devies, In: Workshop on Cryptographi Hardware and Embedded Systems (CHES), LNCS 4727, pp , 27. [13] L. Lin, W. Burleson: Analysis and mitigation of proess variation impats on power-attak tolerane, In: Proeedings of ACM/IEEE Design Automation Conferene (DAC), pp , 29.

6 [14] K. Tiri, I. Verbauwhede: A logi level design methodology for a seure DPA resistant ASIC or FPGA implementation. In: Design, Automation and Test in Europe (DATE), pp , 24. [15] J. Ambrose, S. Parameswaran, A. Ignjatovi: MUTE-AES: a multiproessor arhiteture to prevent power analysis based side hannel attak of the AES algorithm. In: ACM/IEEE International Conferene on Computer-Aided Design (ICCAD), pp , 28. [16] D. Agrawal, S. Baktir, D. Karakoyunlu, P. Rohatgi, B. Sunar: Trojan Detetion using IC Fingerprinting. In: IEEE Symposium on Seurity and Privay, pp , 27. [17] R. M. Rad, X. Wang, M. Tehranipoor, J. Plusquelli: Power supply signal alibration tehniques for improving detetion resolution to hardware Trojans. In: ACM/IEEE ICCAD, pp , 28. [18] Y. Jin, Y. Makris: Hardware Trojan Detetion Using Path Delay Fingerprint. In: IEEE HOST, pp , 28. [19] L. Lin, M. Kasper, T. Güneysu, C. Paar, W. Burleson: Trojan sidehannels: lightweight hardware Trojans through side-hannel engineering. In: CHES, LNCS 5747, pp , 29. [2] Y. Alkabani, F. Koushanfar: Extended Abstrat: Designer s Hardware Trojan Horse, In: IEEE HOST, pp , 28. [21] G. Suh, S. Devadas: Physial Unlonable Funtions for Devie Authentiation and Seret Key Generation, In: ACM/IEEE DAC, pp. 9-14, 27. [22] D. Holomb, W. Burleson, K. Fu: Initial SRAM state as a fingerprint and soure of true random numbers for RFID tags, In: Proeedings of the Conferene on RFID Seurity, 27. [23] J. Proakis: Digital ommuniations, 4th edition, MGraw-Hill, 2. [24] S. Chari, J. R. Rao, P. Rohatgi: Template attaks, In: CHES, LNCS 2523, pp , 22. [25] Preditive Tehnology Model (PTM), [26] J. Rajski, J. Tyszer: Primitive polynomials over GF(2) of degree up to 66 with uniformly distributed oeffiients. In: Journal of Eletroni Testing: theory and appliations, pp , 23. Figure 5: Differential power urves indiating the orret key (SNR = -2dB) Figure 6: Differential power urves indiating the orret key 1111 (SNR = -2dB)