TY - CHAP A1 - Renner, Sebastian A1 - Pozzobon, Enrico A1 - Mottok, Jürgen ED - Meng, Weizhi T1 - A Hardware in the Loop Benchmark Suite to Evaluate NIST LWC Ciphers on Microcontrollers T2 - Information and Communications Security: 22nd International Conference, ICICS 2020, Copenhagen, Denmark, August 24-26, 2020, Proceedings N2 - The National Institute of Standards and Technology (NIST) started the standardization process for lightweight cryptography algorithms in 2018. By the end of the first round, 32 submissions have been selected as 2nd round candidates. NIST allowed designers of 2nd round submissions to provide small updates on both their specifications and implementation packages. In this work, we introduce a benchmarking framework for evaluating the performance of NIST Lightweight Cryptography (LWC) candidates on embedded platforms. We show the features and application of the framework and explain its design rationale. Moreover, we provide information on how we aim to present up-to-date performance figures throughout the NIST LWC competition. In this paper, we present an excerpt of our software benchmarking results regarding speed and memory requirements of selected ciphers. All up-to-date results, including benchmarking different test cases for multiple variants of each 2nd round algorithm on five different microcontrollers, are periodically published to a public website. While initially only the reference implementations were available, the ability of automatically testing the performance of the candidate algorithms on multiple platforms becomes especially relevant as more optimized implementations are developed. Finally, we show how the framework can be extended in different directions: support for more target platforms can be easily added, different kinds of algorithms can be tested, and other test metrics can be acquired. The focus of this paper should rather lay on the framework design and testing methodology than on the current results, especially for reference code. KW - Lightweight cryptography KW - Benchmarking KW - Embedded systems KW - RISC-V Y1 - 2020 U6 - https://doi.org/10.1007/978-3-030-61078-4_28 SP - 495 EP - 509 PB - Springer CY - Cham ER - TY - JOUR A1 - Weiss, Nils A1 - Pozzobon, Enrico A1 - Mottok, Jürgen A1 - Matoušek, Václav T1 - Automated Reverse Engineering of CAN Protocols JF - Neural Network World N2 - Car manufacturers define proprietary protocols to be used inside their vehicular networks, which are kept an industrial secret, therefore impeding independent researchers from extracting information from these networks. This article describes a statistical and a neural network approach that allows reverse engineering proprietary controller area network (CAN)-protocols assuming they were designed using the data base CAN (DBC) file format. The proposed algorithms are tested with CAN traces taken from a real car. We show that our approaches can correctly reverse engineer CAN messages in an automated manner. Y1 - 2021 U6 - https://doi.org/10.14311/NNW.2021.31.015 SN - 1210-0552 VL - 31 IS - 4 SP - 279 EP - 295 ER - TY - CHAP A1 - Pozzobon, Enrico A1 - Renner, Sebastian A1 - Mottok, Jürgen A1 - Matoušek, Václav T1 - An optimized Bitsliced Masked Adder for ARM Thumb-2 Controllers T2 - 27th International Conference on Applied Electronics (AE): Sep 6, 2022 - Sep 7, 2022, Pilsen, Czech Republic N2 - The modular addition is used as a non-linear operation in ARX ciphers because it achieves the requirement of introducing non-linearity in a cryptographic primitive while only taking one clock cycle to execute on most modern architectures. This makes ARX ciphers especially fast in software implementations, but comes at the cost of making it harder to protect against side-channel information leakages using Boolean masking: the best known 2-shares masked adder for ARM Thumb micro-controllers takes 83 instructions to add two 32-bit numbers together. Our approach is to operate in bitsliced mode, performing 32 additions in parallel on a 32-bit microcontroller. We show that, even after taking into account the cost of bitslicing before and after the encryption, it is possible to achieve a higher throughput on the tested ciphers (CRAX and ChaCha20) when operating in bitsliced mode. Furthermore, we prove that no first-order information leakage is happening in either simulated power traces and power traces acquired from real hardware, after sufficient countermeasures are put into place to guard against pipeline leakages. KW - ARM Thumb KW - bitsliced KW - side-channel KW - Boolean masking Y1 - 2022 U6 - https://doi.org/10.1109/AE54730.2022.9919884 PB - IEEE ER - TY - JOUR A1 - Pozzobon, Enrico A1 - Weiß, Nils A1 - Mottok, Jürgen A1 - Matoušek, Václav T1 - An evolutionary fault injection settings search algorithm for attacks on safe and secure embedded systems JF - Neural Network World (NNW) Y1 - 2023 U6 - https://doi.org/10.14311/NNW.2023.33.020 VL - 33 IS - 5 SP - 357 EP - 374 PB - Czech Technical University in Prague ER -