Abstract
Physically unclonable functions (PUFs) are assumed to provide high tamper resistance against counterfeiting and hardware attacks since PUFs extract inherent physical properties from random and uncontrollable variations in manufacturing. Recent studies have reported on the vulnerabilities of PUFs to physical and mathematical attacks. This paper focuses on the security evaluation of a ring-oscillator PUF (RO PUF) against electromagnetic analysis (EMA) attacks. We designed an RO PUF with a 180-nm CMOS process to evaluate the threats of EMA attacks. The power consumption of this RO PUF is reduced as much as possible to reduce EM leaks, and EMA resistance is enhanced in the layout design. We present the results of EMA attacks on our RO PUF and discuss the threats of such attacks on the application-specific integrated circuit implementation of RO PUFs. We also propose an EMA attack based on geometric leak (Sugawara in: Cryptographic Hardware and Embedded Systems-CHES 2013—15th International Workshop, Santa Barbara, CA, USA, August 20–23, 2013, Proceedings, 2013. https://doi.org/10.1007/978-3-642-40349-1_10) for RO PUFs. All components of an RO PUF are usually arranged in a matrix or array. The geometric periodicity in the layout of RO PUFs leaks secret PUF responses. Though previous studies required identifying oscillation frequency of each RO from measured EMA traces, the proposed attack, called simple EMA attack based on geometric leak, reveals a PUF response from one measured EM trace directly. This attack correctly predicted 94.2% of PUF responses of our RO PUF. We present how a PUF response is revealed from a measured EM trace, suggesting that such an attack poses a serious threat to RO PUFs.
Similar content being viewed by others
References
Dodis, Y., Reyzin, L., Smith, A.D.: Fuzzy extractors: how to generate strong keys from biometrics and other noisy data. In: Advances in Cryptology-EUROCRYPT 2004, International Conference on the Theory and Applications of Cryptographic Techniques, Interlaken, Switzerland, May 2–6, 2004, Proceedings, pp. 523–540 (2004). https://doi.org/10.1007/978-3-540-24676-3_31
Gandolfi, K., Mourtel, C., Olivier, F.: Electromagnetic analysis: concrete results. In: Cryptographic Hardware and Embedded Systems-CHES 2001, Third International Workshop, Paris, France, May 14–16, 2001, Proceedings, Generators, pp. 251–261 (2001). https://doi.org/10.1007/3-540-44709-1_21
Gassend, B., Clarke, D.E., van Dijk, M., Devadas, S.: Silicon physical random functions. In: Proceedings of the 9th ACM Conference on Computer and Communications Security, CCS 2002, Washington, DC, USA, November 18–22, 2002, pp. 148–160 (2002). https://doi.org/10.1145/586110.586132
Guajardo, J., Kumar, S.S., Schrijen, G.J., Tuyls, P.: FPGA intrinsic pufs and their use for IP protection. In: Cryptographic Hardware and Embedded Systems-CHES 2007, 9th International Workshop, Vienna, Austria, September 10–13, 2007, Proceedings, pp. 63–80 (2007). https://doi.org/10.1007/978-3-540-74735-2_5
Helfmeier, C., Boit, C., Nedospasov, D., Seifert, J.: Cloning physically unclonable functions. In: 2013 IEEE International Symposium on Hardware-Oriented Security and Trust, HOST 2013, Austin, TX, USA, June 2–3, 2013, pp. 1–6 (2013). https://doi.org/10.1109/HST.2013.6581556
Hori, Y., Kang, H., Katashita, T., Satoh, A.: Pseudo-lfsr PUF: a compact, efficient and reliable physical unclonable function. In: 2011 International Conference on Reconfigurable Computing and FPGAs, ReConFig 2011, Cancun, Mexico, November 30–December 2, 2011, pp. 223–228 (2011). https://doi.org/10.1109/ReConFig.2011.72
Langer EMV-Technik.: Near-field microprobes. https://www.langer-emv.de/en/category/near-field-microprobes-icr-hh-h-field/26
Lee, J.W., Lim, D., Gassend, B., Suh, G.E., Van Dijk, M., Devadas, S.: A technique to build a secret key in integrated circuits for identification and authentication applications. In: 2004 Symposium on VLSI Circuits. Digest of Technical Papers (IEEE Cat. No. 04CH37525), pp. 176–179. IEEE (2004)
Liu, C.Q., Cao, Y., Chang, C.H.: Acro-puf: a low-power, reliable and aging-resilient current starved inverter-based ring oscillator physical unclonable function. IEEE Trans. Circuits Syst. I Regul. Pap. 64(12), 3138–3149 (2017)
Machida, T., Yamamoto, D., Iwamoto, M., Sakiyama, K.: A new mode of operation for arbiter PUF to improve uniqueness on FPGA. In: Proceedings of the 2014 Federated Conference on Computer Science and Information Systems, Warsaw, Poland, September 7–10, 2014, pp. 871–878 (2014). https://doi.org/10.15439/2014F140
Maes, R.: Physically Unclonable Functions-Constructions. Properties and Applications. Springer, New York (2013). https://doi.org/10.1007/978-3-642-41395-7
Merli, D., Heyszl, J., Heinz, B., Schuster, D., Stumpf, F., Sigl, G.: Localized electromagnetic analysis of RO pufs. In: 2013 IEEE International Symposium on Hardware-Oriented Security and Trust, HOST 2013, Austin, TX, USA, June 2–3, 2013, pp. 19–24 (2013). https://doi.org/10.1109/HST.2013.6581559
Merli, D., Schuster, D., Stumpf, F., Sigl, G.: Semi-invasive EM attack on FPGA RO PUFS and countermeasures. In: Proceedings of the Workshop on Embedded Systems Security, pp. 1–9 (2011)
Merli, D., Schuster, D., Stumpf, F., Sigl, G.: Side-channel analysis of pufs and fuzzy extractors. In: Trust and Trustworthy Computing-4th International Conference, TRUST 2011, Pittsburgh, PA, USA, June 22–24, 2011, Proceedings, pp. 33–47 (2011). https://doi.org/10.1007/978-3-642-21599-5_3
Oren, Y., Sadeghi, A., Wachsmann, C.: On the effectiveness of the remanence decay side-channel to clone memory-based pufs. In: Cryptographic Hardware and Embedded Systems-CHES 2013-15th International Workshop, Santa Barbara, CA, USA, August 20–23, 2013, Proceedings, pp. 107–125 (2013). https://doi.org/10.1007/978-3-642-40349-1_7
Pappu, R., Recht, B., Taylor, J., Gershenfeld, N.: Physical one-way functions. Science 297(5589), 2026–2030 (2002)
Quisquater, J., Samyde, D.: Electromagnetic analysis (EMA): measures and counter-measures for smart cards. In: Smart Card Programming and Security, International Conference on Research in Smart Cards, E-smart 2001, Cannes, France, September 19-21, 2001, Proceedings, pp. 200–210 (2001). https://doi.org/10.1007/3-540-45418-7_17
Rührmair, U., Sehnke, F., Sölter, J., Dror, G., Devadas, S., Schmidhuber, J.: Modeling attacks on physical unclonable functions. In: Proceedings of the 17th ACM Conference on Computer and Communications Security, CCS 2010, Chicago, Illinois, USA, October 4–8, 2010, pp. 237–249 (2010). https://doi.org/10.1145/1866307.1866335
Shiozaki, M., Fu**o, T.: Simple electromagnetic analysis attacks based on geometric leak on an ASIC implementation of ring-oscillator PUF. In: Proceedings of the 3rd ACM Workshop on Attacks and Solutions in Hardware Security Workshop, ASHES@CCS 2019, London, UK, November 15, 2019, pp. 13–21 (2019). https://doi.org/10.1145/3338508.3359569
Shiozaki, M., Kubota, T., Nakai, T., Takeuchi, A., Nishimura, T., Fu**o, T.: Tamper-resistant authentication system with side-channel attack resistant AES and PUF using MDR-ROM. In: 2015 IEEE International Symposium on Circuits and Systems, ISCAS 2015, Lisbon, Portugal, May 24–27, 2015, pp. 1462–1465 (2015). https://doi.org/10.1109/ISCAS.2015.7168920
Sugawara, T., Suzuki, D., Saeki, M., Shiozaki, M., Fu**o, T.: On measurable side-channel leaks inside ASIC design primitives. In: Cryptographic Hardware and Embedded Systems-CHES 2013—15th International Workshop, Santa Barbara, CA, USA, August 20–23, 2013, Proceedings, pp. 159–178 (2013). https://doi.org/10.1007/978-3-642-40349-1_10
Suh, G.E., Devadas, S.: Physical unclonable functions for device authentication and secret key generation. In: Proceedings of the 44th Design Automation Conference, DAC 2007, San Diego, CA, USA, June 4–8, 2007, pp. 9–14 (2007). https://doi.org/10.1145/1278480.1278484
Yoshimoto, Y., Katoh, Y., Ogasahara, S., Wei, Z., Kouno, K.: A reram-based physically unclonable function with bit error rate \(<\) 0.5% after 10 years at 125\(^{\circ }\)c for 40 nm embedded application. In: 2016 IEEE Symposium on VLSI Technology, pp. 1–2. IEEE (2016)
Acknowledgements
This work is based on results obtained from a project commissioned by the New Energy and Industrial Technology Development Organization (NEDO).
Author information
Authors and Affiliations
Corresponding author
Additional information
Publisher's Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Rights and permissions
About this article
Cite this article
Shiozaki, M., Fu**o, T. Simple electromagnetic analysis attack based on geometric leak on ASIC implementation of ring-oscillator PUF. J Cryptogr Eng 11, 201–212 (2021). https://doi.org/10.1007/s13389-020-00240-9
Received:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1007/s13389-020-00240-9