@phdthesis{Dyka2013, author = {Dyka, Zoya}, title = {Analyse und Vorhersage des Fl{\"a}chen- und Energieverbrauches optimaler Hardware Polynom-Multiplizierer f{\"u}r GF(2ⁿ) f{\"u}r elliptische Kurven Kryptographie}, url = {http://nbn-resolving.de/urn:nbn:de:kobv:co1-opus-27240}, school = {BTU Cottbus - Senftenberg}, year = {2013}, abstract = {Die Anwendung asymmetrischer Kryptosysteme, z.B. elliptische Kurven Kryptographie (ECC), erfordert große Rechenkapazit{\"a}t die normalerweise auf von mobilen Ger{\"a}ten bzw. drahtlosen Sensorknoten nicht zur Verf{\"u}gung steht. Die Implementierung der ECC in Hardware reduziert den Zeit- und Energie-Aufwand. Die Optimierung der Hardware-Implementierungen dient nicht nur der weiteren Reduktion des Zeit- und Energieverbrauches sondern hilft dar{\"u}ber hinaus die Herstellungskosten zu verringern, so dass solche L{\"o}sungen auch f{\"u}r kosteng{\"u}nstige Ger{\"a}te einsetzbar werden. Im Rahmen dieser Dissertation wurden Optimierungsm{\"o}glichkeiten f{\"u}r die Multiplikation der Polynome, die f{\"u}r EC-Operationen eingesetzt werden, untersucht. Ziel der Optimierungen war, dass die Multiplikation mit einer minimalen Anzahl von Additionen (also XOR-Gattern) und Multiplikationen (also AND-Gattern) durchgef{\"u}hrt werden kann. Im Rahmen dieser Arbeit wurde die iterative Bearbeitung von 10 Multiplikations-Methoden (MM) im Gegensatz zur {\"u}blichen rekursiven Bearbeitung untersucht. Dabei wurde eine Reihenfolge der Operationen f{\"u}r jede der untersuchten MM ermittelt, die zu einer reduzierten Anzahl von XOR-Operationen f{\"u}hrt. Der Einsatz der optimierten Reihenfolge kann die Komplexit{\"a}t der MM wesentlich reduzieren. Zum Beispiel bei der generalisierten Karatsuba-MM [18] betr{\"a}gt die Reduktion des XOR-Aufwandes durchschnittlich 39 \% f{\"u}r Polynom-L{\"a}ngen bis 600 Bits. F{\"u}r die IHP 0,13μ-Technologie entspricht diese Reduktion des XOR-Aufwandes einer durchschnittlichen Fl{\"a}chen-Reduktion der Polynom-Multiplizierer um 35 \%. Bei der 4-Segment-Karatsuba-MM wird nicht nur der XOR-Aufwand, sondern auch die Signal-Verz{\"o}gerung im Vergleich zur rekursiven Anwendung der originalen Karatsuba-MM reduziert. Außerdem wurde ein Algorithmus zur Bestimmung einer fl{\"a}chen- und/oder energieoptimalen Kombination der Multiplikations-Methoden entwickelt. Mit dem vorgeschlagenen Algorithmus wurden die fl{\"a}chen- und die energie-optimalen Kombinationen der MM f{\"u}r Polynom-L{\"a}ngen bis 600 Bits bestimmt. Alle ECC-relevanten Polynom-L{\"a}ngen liegen in diesem Bereich. Die durchschnittliche Reduktion der Fl{\"a}chen im Vergleich zu den rekonstruierten Daten aus [30] betr{\"a}gt 12 \%. Zus{\"a}tzlich wurde ein energieoptimaler serieller Mehr-Takt-Multiplizierer f{\"u}r 233-Bits Polynome auf Basis Karatsuba-{\"a}hnlicher Multiplikations-Methoden entwickelt. Dieser Multiplizierer nutzt die Winograd-MM und basiert auf einen fl{\"a}chenoptimierten 78-Bits-Teil-Multiplizierer. Die theoretischen Ergebnisse wurden mit Hilfe von Synthesedaten f{\"u}r die IHP Technologie erfolgreich verifiziert. Der Energieverbrauch und die Ausf{\"u}hrungszeit des Designs sind um 24 \% bzw. 28 \% kleiner als die des Vergleichsdesigns aus [28].}, subject = {Hardwareentwurf; Kryptologie; Elliptische Kurven Kryptographie; GF(2ⁿ); Polynom-Multiplikation; Optimierung; Hardware Implementierung; Elliptic curve cryptography; GF(2ⁿ); Polynomial multiplication; Optimization; Hardware implementation}, language = {de} } @phdthesis{Brzozowski2012, author = {Brzozowski, Marcin}, title = {Energy-efficient means to support short end-to-end delays in wireless sensor networks}, url = {http://nbn-resolving.de/urn:nbn:de:kobv:co1-opus-25299}, school = {BTU Cottbus - Senftenberg}, year = {2012}, abstract = {This work addresses tough challenges of sensor network applications with Quality of Service requirements. That is, nodes must work with batteries for a long time, support short end-to-end delays and robust communication in multi-hop networks. It starts with presenting previous research efforts that address such challenges. For instance, many Medium Access Control (MAC) protocols keep nodes mostly sleeping to save energy and synchronize wake-up times for communication. Although such protocols offer short end-to-end delays, they still suffer from long idle listening and shortened lifetimes. The main reasons are the long time needed to detect an idle channel and inefficient ways of dealing with clock drift. This work introduces novel solutions to these problems, mainly at Layer 2 of the OSI model, that significantly reduce idle listening. First, nodes predict future drift and reduce the time needed to compensate clock uncertainty among neighbors. Second, they quickly detect an idle channel and power down the transceiver. In some scenarios, nodes work 30\% longer owing to these solutions. To tackle problems with unreliable wireless links, sensor nodes may apply various solutions at Layer 2. For example, with Automatic Repeat reQuest (ARQ) protocol they send retries on frame losses, resulting in extra energy consumption. This work examines the impact of ARQ on the lifetime and on the reception rate. Several indoor and outdoor experiments showed that with only 1-2 retries nodes can handle many communication problems. Besides, owing to the idle-listening reduction, mentioned previously, ARQ shortens the lifetime by 10\% only. Although this work addresses particular applications, the solutions presented here can be used in other scenarios and with different protocols. For instance, the energy-efficient drift compensation approach can be directly used in any schedule-based MAC protocols, like the one based on the IEEE 802.15.4 standard. Besides, any protocol can benefit from the solution to the idle-listening reduction based on the early detection of idle channel. Finally, owing to the analytical model that estimates the lifetime of nodes, researches and developers can early evaluate MAC protocols running on various hardware platforms.}, subject = {Rechnernetz; Drahtloses Sensorsystem; Verteiltes System; Kommunikationsprotokoll; Drahtlose Kommunikation; Sensornetze; Kurze Latenzen; Uhrendrift; Medienzugriff; Wireless communication; Sensor networks; Short delay; Clock drift; MAC}, language = {en} } @misc{Vogel2018, type = {Master Thesis}, author = {Vogel, Elisabeth}, title = {Analyse von EM-Kartographie als Mittel zur Bestimmung von Leakage-Quellen sowie des Effektes geeigneter Gegenmaßnahmen}, doi = {10.26127/BTUOpen-6454}, url = {http://nbn-resolving.de/urn:nbn:de:kobv:co1-opus4-64545}, school = {BTU Cottbus - Senftenberg}, year = {2018}, abstract = {The Internet of Things (IoT) and Wireless Sensor Networks (WSNs) are essential for today's global information society, relying on small wireless devices for networking. When these devices' functionalities or data are manipulated, the potential damage is significant. Hence, securing data transmission between these devices using cryptography is crucial. However, the security of cryptographic algorithms depends on the secrecy of cryptographic keys, which can be vulnerable due to physical accessibility. Side-channel analysis attacks can exploit this vulnerability by using physical parameters associated with the operation of cryptographic chips, such as electromagnetic radiation during cryptographic operations. In response to this challenge, the Leakage Source Cartography Tool (LSC-Tool) was developed in this thesis to expedite the analysis of electromagnetic radiation in IHP's elliptic curve cryptography designs. The LSC-Tool enables automated evaluation of sets of electromagnetic traces, obtained from different measurement positions across a cryptographic chip. The analysis results in a leakage source map (LS-map) that displays the success of electromagnetic analysis attacks at each measurement point. This tool offers a cost-effective and rapid means to assess the resistance of cryptographic designs against attacks, providing designers with insights into the most vulnerable areas of the chip and information about leakage per clock cycle. By applying the LSC-Tool, the resistance of two IHP ECC designs against horizontal differential electromagnetic analysis attacks was tested across 25 measurement positions. The statistical analysis of traces can be conducted using three methods: the least squares method, the difference-of-means-test, or the difference-of-the-mean method. The generated LS-maps show that using different methods yields distinct leakage source indications. Combining these maps enhances the attack's success rate. Notably, during this research, it became evident that the LSC-Tool could be adapted to create LS-maps for the functional blocks of ECC designs, enabling the analysis of simulated power traces for IHP ECC designs.}, subject = {EM-Kartographie; Elliptische Kurven; Power Analysis Angriffe; Seitenkanalattacke; Fehleranalyse; Kryptosystem; Elektromagnetische Strahlung; Elliptische Kurve; Side-channel-analysis; Countermeasures; Power analysis}, language = {de} } @misc{AlpirezBock2015, type = {Master Thesis}, author = {Alpirez Bock, Estuardo}, title = {SCA resistent implementation of the Montgomery kP-algorithm}, url = {http://nbn-resolving.de/urn:nbn:de:kobv:co1-opus4-36288}, school = {BTU Cottbus - Senftenberg}, year = {2015}, abstract = {Mathematically, cryptographic approaches are secure. This means that the time an attacker needs for finding the secret by brute forcing these approaches is about the time of the existence of our world. Practically, an algorithm implemented in hardware is a device that generates a lot of additional data during the calculation process. Its power consumption, electromagnetic radiation, etc. can be measured, saved and analysed for key extraction. Such attacks are called side channel analysis attacks and are significant threats when applying cryptographic algorithms. By considering these attacks when implementing a cryptographic algorithm, it is possible to design an implementation that is more resistant against them. The goal of this thesis was to design a methodology to securely implement the Montgomery kP-operation using an IHP implementation as a starting point. In addition, the area and energy consumption of the secure Montgomery kP-multiplier should still be highly efficient. The resistance against power analysis attacks of two different IHP ECC implementations was analysed in this thesis. A horizontal power analysis attack using the difference-of-means test was performed with the goal of finding potential leakage sources exploited in side channel analysis attacks, i.e. finding the reasons of a correct extraction of the cryptographic key. For both analysed ECC designs, four key candidates were extracted with a correctness of 90\% or more. Through analysis of the implemented Montgomery kP-algorithm's functionality and its power consumption, it was established that the algorithm's operation execution flow was the main cause of the implementations' vulnerability. Thus, a design methodology consisting in changing the Montgomery kP-algorithm operation flow was developed. As a result, the re-designed implementations do not deliver any correctly extracted key candidates whenever the difference-of-means test is performed on them. These re-designs implied an increase on the chip area by about 5\% for each implementation. The execution time needed for performing a complete kP-operation was reduced for both designs. Thereby one implementation's execution time was reduced by 12\% in comparison to its original version and even though its power consumption was increased by 9\%, its energy consumption per kP-operation was reduced by 4.5\%.}, subject = {Side channel analysis; Elliptic curve cryptography; Power analysis; Difference-of-means test; Elliptic curve point multiplication; Elliptische Kurve; Kryptologie}, language = {en} } @phdthesis{SojkaPiotrowska2016, author = {Sojka-Piotrowska, Anna}, title = {On the applicability of short key asymmetric cryptography in low power wireless sensor networks}, url = {http://nbn-resolving.de/urn:nbn:de:kobv:co1-opus4-39453}, school = {BTU Cottbus - Senftenberg}, year = {2016}, abstract = {The growing popularity of Wireless Sensor Networks (WSN) makes the spectrum of their applications very wide. A great number of the application areas like health monitoring or military applications require a high level of security and dependability from the wireless sensor network. Solving these issues can be supported by providing cryptographic solutions into WSN applications. Since the WSNs mainly consist of low power devices, cryptographic solutions ideal for WSNs should provide computationally lightweight security mechanisms producing small data packets and ensuring confidentiality. Cryptographic mechanisms that have both these features are considered in this thesis, which main objective is the analysis of the applicability of the short key elliptic curve cryptography in WSN environments. Reduced key lengths require modification of the standard ECC security algorithms to provide authentication and also a novel solution for a cryptographic secure pseudo-random number generator. The proposed solution is based on the standard ECC, but it differs in several aspects. The main difference is that the parameters of the used elliptic curve have to be kept secret. This is due to the fact that solving the Discreet Logarithm Problem (DLP) for such short parameters can be done in short time. Additionally, using shorter parameters for the underlying elliptic curves excludes also the use of standard hash functions, what mainly influences the mechanisms for generating the digital signature. Hash functions require large input values and produce relatively large output data that is inapplicable in the shortECC environment. Thus, within this thesis a modified version of standard Elliptic Curves Digital Signature Algorithm is proposed, which does not require any hash function. The shortECC needs pseudo-random numbers in the encryption and the digital signature protocols, but since it operates on numbers that are significantly shorter than the ones used by other cryptographic approaches, pseudo-random number generators for standard approaches are not suitable for shortECC. Thus, the new pseudo-random number generator not involving any additional hardware besides the modules available on the used test platform and operating on 32-bit long integers, is proposed. The randomness of the numbers generated by the proposed algorithm and their applicability for cryptographic purposes was evaluated using the NIST test suites. The shortECC approach was also subjected to cryptanalysis in order to proof its security and determine the circumstances and constraints for its application.}, subject = {ECC; Sensor Networks; PRNG; Lightweight cryptography; Elliptische Kurven; Drahtlose Sensornetze; Zufallszahl Generator; Drahtloses Sensorsystem; Zufallsgenerator}, language = {en} } @phdthesis{Stecklina2016, author = {Stecklina, Oliver}, title = {A secure isolation of software activities in Tiny Scale Systems}, url = {http://nbn-resolving.de/urn:nbn:de:kobv:co1-opus4-40362}, school = {BTU Cottbus - Senftenberg}, year = {2016}, abstract = {With the introduction of the Internet at the end of the last century the modern society was fundamentally changed. Computer systems became an element of nearly all parts of our daily live. Due to the interconnection of these systems local borders are mostly vanished, so that information is accessible and exchangeable anywhere and at anytime. But this increased connectivity causes that physical fences are no longer an adequate protection for computer systems. Whereas the security of commodity computer systems was improved continuously and similarly with their increased connectivity, deeply embedded systems were then and now mostly protected by physical fences. But the ubiquitous availability of embedded systems in personal and commercial environments makes these systems likewise accessible and moves them strongly into the focus of security investigations. Deeply embedded systems are usually equipped with tiny scale micro controllers, which are limited in their available resources and do not feature secure mechanisms to isolate system resources. Hence, a single error in a local software component is not limited to the component itself, instead the complete system may be influenced. The lack of resource isolation makes tiny scale systems prone for accidental errors but in particular vulnerable for a broad variety of malicious software. For a safe and secure operation of computer systems it is strongly recommended that software components are isolated in such a manner that they have access only to those resources, which are assigned to them. Even though a substantial number of approaches in the context of embedded system's safety were investigated during the last fifteen years, security was mostly neglected. This thesis is focused on security aspects where malicious software wittingly tries to bypass available protection mechanisms. The thesis introduces a security platform for tiny scale systems that enforces an isolation of software components considering security aspects. Due to the limited resources of tiny scale systems the proposed solution is based on a co-design process that takes the static and predefined nature of deeply embedded systems into account and includes hardware, compile-time, and run-time partitions to reduce the number of additional run-time components, to avoid performance drawbacks, and to minimize the memory as well as the components footprint overhead. To prove the applicability of the presented platform it was applied and evaluated with two real applications. In addition, an investigation of technologies of commodity computer systems that are suitable to build secure systems is presented. The thesis analyzes their enforcement based on the features provided by the introduced security platform. The contributions of this thesis include an enforcement of a security isolation of system resources on tiny scale systems and enable the development of a broad variety of secure tiny scale system applications.}, subject = {Security; Embedded systems; Memory protection; Hardware software co-design; Role-based access control; Eingebettete Systeme; Sicherheit; Speicherschutz; Rollen-basierte Zugriffskontrolle; Hardware-Software Co-Design; Eingebettetes System; Speicherzugriff; Zuverl{\"a}ssigkeit}, language = {en} } @phdthesis{Vater2017, author = {Vater, Frank}, title = {Secure Scan Chain and Debug Interface}, url = {http://nbn-resolving.de/urn:nbn:de:kobv:co1-opus4-42932}, school = {BTU Cottbus - Senftenberg}, year = {2017}, abstract = {Cryptographic operations are more and more popular because unencrypted information is a security leakage in many application areas. Possible ways to get the secret key is the misuse of test and debug facilities. These interfaces allow a reading and writing access to all internals of the ASIC. Typically they are not protected against a misuse by a third party. In this thesis a new countermeasure against side channel attacks on scan chain and debug interfaces is proposed. The countermeasure for the scan chain interface, as well as the one for the debug interface, use the same approach, but every interface has its own security component. The approach designed and investigated in this thesis is based on a key matching method, which is resistant against reverse engineering. It is necessary from the user side, to test and debug the device, to write the secret key in an OTP. The "golden" key is embedded in specially designed units, which are used to compare the golden key with one provided in the OTP. After testing or the debugging, the key in the OTP is deleted. Even if this key is known to an attacker, it is not possible to rewrite the value into the OTP. The unit which contains golden key and compare logic is made of digital standard cells. The cells are not modified, but the wiring has a novelty. Small isolation elements from the analog circuit design are used to implement a "0" or a "1" as value for the golden key. The security feature is the resistance against optical reverse engineering because both types of the golden key and compare unit have the same footprint. Finally 128 of these units compose the 128 bit golden key. The scan chain solution is suitable for any IP core, independent of whether it is a standalone cryptographic component, a microcontroller or a very complex system on a chip. For the scan chain test the test pattern generated by the scan pattern generator can be used without any modification. The only requirement is that before the test, the secret key has to be written into the device, and after the test, the secret key has to be deleted. For a debug interface the same problem exists as for the scan chain interface. An access to the device is an open door for an attacker. As the debug interface is used in different development stages the approach is to implement several OTP lines - one per development stage for example. Additionally a mechanism for different access levels is offered. Depending of the access level different address spaces are unlocked. As shown in this thesis, the solutions for a secure scan and debug interface are easy to integrate into an existing design, while area, timing and power is not influenced significantly. The scan or debug process have to be changed only slightly and the test coverage is not affected and defect analysis is possible. To summarize in this thesis a novel and innovative approach to protect scan and debug interfaces against side channel attacks was designed and evaluated.}, subject = {Scan chain; Debug interface; Secure; Testschnittstelle; Debugschnittstelle; Sicher; Kryptoanalyse; Schnittstelle; Chiffrierung}, language = {en} } @techreport{BockDyka2015, author = {Bock, Estuardo Alpirez and Dyka, Zoya}, title = {Vulnerability assessment of an IHP ECC implementation}, url = {http://nbn-resolving.de/urn:nbn:de:kobv:co1-opus4-34908}, year = {2015}, abstract = {Mathematically, cryptographic approaches are secure. This means that the time an attacker needs for finding the secret by brute forcing these approaches is about the time of the existence of our world. Practically, an algorithm implemented in hardware is a device that generates a lot of additional data during calculation. Its power consumption, electromagnetic radiation etc. can be measured, saved and analysed for the key extraction. Such attacks - the side channel analysis attacks (SCA attacks) - are significant threats when applying cryptographic algorithms. By taking the issue of physical attacks into consideration when implementing a cryptographic algorithm, it is possible to design an implementation that is resilient - at least to a certain extend - against side channel analyses. In this report, we give implementation details of the IHP accelerator for the elliptic curve point multiplication. We analysed the implemented algorithm ow and its power consumption using simulated power traces for the 130nm CMOS IHP technology. We made a horizontal power analysis attack using the difference-of-means test with the goal of finding potential SCA leakage sources, i.e. finding the operations in the algorithmic ow that are responsible for the correct extraction of the cryptographic key.}, subject = {Elliptic curve cryptography; Side channel analysis; Power analysis; Difference of means test; Hardware; CMOS-Schaltung; Kryptologie}, language = {en} }