Impedance Side-Channel Analysis of ASICs: An investigation of measurement factors
摘要
A substantial body of research has been conducted on the subject of physical side-channel analysis attacks and the measures that can be employed to counteract them. These attacks typically exploit the impact of computation or storage on current consumption or voltage drop on a chip, which is an unavoidable consequence of the underlying physical processes. This data-dependent influence can be exploited through analytical techniques such as power or electromagnetic analysis. Recently, a novel target for side-channel analysis adversaries has emerged, based on the data dependency between the chip’s power delivery network impedance and the temporarily stored content in registers. There are two principal reasons why information leakage through the Impedance Side Channel (IMSC) compromises the security of the implementations. First, this method can target the secret even outside the time window, provided that the sensitive data is stored somewhere in the circuit; and second, the simultaneous and independent probing of particular registers challenges the t-probing security model used in masking proofs, a primary side-channel countermeasure. It is crucial to highlight that the interdependence between the die impedance and the temporarily stored data in registers is revealed through scattering parameter analysis. Consequently, the precise measurement of data-dependent impedance, or equivalently, the Scattering (S)- parameter, is essential for its use as a side-channel, which is our focus in this study. In this study, we examine the impact of environmental factors on the IMSC, which are controlled by a classical side-channel adversary. Such factors include temperature and supply voltage. Due to the similarity between the measurement procedures of IMSC and Static Power Side- Channel Analysis (SPSCA), we further provide a fair comparison of these two side-channels in terms of their exploitability and ease of measurement. Most of the previously published studies on the IMSC have been conducted using Field Programmable Gate Arrays (FPGAs). This provides a high level of control over the placement of design components, which can, in turn, affect analysis results. In this work, we use a dedicated Application-Specific Integrated Circuit (ASIC) chip fabricated in 28nm Complementary Metal-Oxide-Semiconductor (CMOS) technology to conduct our study in a more realistic setting. We demonstrated the significant impact of the aforementioned environmental factors on the exploitability of such a side channel. In conclusion, an IMSC adversary can influence the device to leak more information by regulating its operational environment.