Hardware Security Midterm, Conceptual Questions

Security of the Hardware

Is the chip itself trustworthy? Does it leak, can it be faulted, was it built as designed, is it authentic? Here the hardware is the asset under attack.

Example: side channels, fault injection, trojans, counterfeits, reverse engineering

Security from the Hardware

Using hardware to make the rest of the system safer, because hardware can enforce properties software cannot enforce on itself. Here the hardware is the defense.

Example: PUFs, TRNGs, secure enclaves, memory tagging, crypto accelerators, roots of trust

How are Security of the Hardware and Security from the Hardware related?

The two are entangled. A secure enclave is a defense built from hardware and it has been broken repeatedly by attacks on the hardware it is built from. You cannot reason about one without the other

What Do We Mean by “Hardware”?

Levels: System/PCB (where interposers and implants live), Package and interposer (surfaces) , SoC (cores, caches, memory controllers, accelerators), IP blocks (third-party soft, firm and hard IP), Gates and cells (where trojans hide), devices and physics (transistors, wires and power delivery network).

Root of Trust

a component that must be trusted because nothing beneath it can vouch for it. It has to be secure by construction.

Examples: Apple Secure Enclave, OpenTitan, Caliptra, Microsoft Pluton

Why are Hardware Bugs worse than Software Bugs?

You can not usually patch it, the fix will cost the performance, deployment lifetimes are long, it sits under everything

Vulnerability

A weakness in the system. It exists whether or not anyone knows about it.

Example: a cache whose access latency depends on secret-dependent addresses.

Threat

A set of circumstances with the potential to cause loss or harm.

Example: an adversary who can run code on the same physical core as your process.

Attack

The act of exploiting a vulnerability.

Example: Prime+Probe against that cache to recover an AES key.

Stored Secrets

Keys in fuses, one-time programmable memory, or flash. Durable and readable: which is exactly the problem. Vulnerable to invasive probing and reverse engineering.

Derived Secrets

Keys generated from device physics rather than stored. This is the PUF idea: manufacturing variation as an unclonable identity. We devote a full lecture to it.

Temporary Secrets

Session keys and nonces from a true random number generator. Their security depends entirely on the quality of an analog entropy source.

Structural Secrets

Not keys at all: a proprietary netlist, a trained model’s weights, a process recipe. Increasingly the most valuable thing on the die.

Side Channels

Attacks: Power, Electromagnetic, Timing, Frequency and poser reporting, thermal and acoustic

Covert Channels

An intentional communication path where two or more parties (or processes) actively collaborate to transfer information in a way that violates system security policies. It deliberately encodes and leaks restricted data to an unauthorized receiving process.

Fault Injections

Used to Push the device outside its specified operating envelope until it misbehaves in a way you can predict and use .

Gives bit flips, byte or word faults, instruction skip, instruction corruption, stuck-at/set-reset, voltage and timing glitches

Types: Voltage Glitching, Clock Glitching, Electromagnetic Injections, Optical/ Laser (photon absorption produces node upset), Software Induced.

Hardware Trojans and Backdoors

malicious or unauthorized alterations built directly into the physical components—such as microchips, integrated circuits (ICs), and firmware—of a computer or electronic system.

Reverse Engineering

Legitimate Uses: Trojan detection (comparing a fabricated die against the intended layout), Counterfeit identification and failure analysis, Competitive analysis and patent enforcement, Independent security evaluation of a product you rely on, Interoperability and repair.

Hostile Uses: Extracting a netlist to clone the design, Locating and reading out keys stored on the die, Finding the exact point to target with a fault injection, Identifying and removing a protection mechanism before overproducing, Recovering a proprietary neural network architecture and its weights

Rowhammer

a hardware-level computer security and reliability vulnerability in Dynamic Random-Access Memory (DRAM)

repeatedly accessing ("hammering") a specific memory row (the aggressor row) electrical charges to leak into physically adjacent rows (victim rows), causing stored data bits to flip from 0 to 1 or vice versa

Attackers exploit Rowhammer to escape sandboxes, corrupt kernel memory, escalate privileges, or manipulate machine learning models.

Trust in Supply Chain

Vertical (One Company, not common), or Horizontal (most common today). Any step can be untrusted (IP Vender, System integrator, Foundry, assembly and test, distribution)

Cryptology

The whole field. Cryptography plus cryptanalysis. The two halves advance by attacking each other

Cryptography

Designing schemes that keep information secure against a defined adversary. “Secure” is meaningless without naming that adversary — the theme of this section.

Cryptanalysis

Breaking those schemes, or bounding how hard breaking them is. A cipher is not “proven secure”; it is unbroken so far under public scrutiny

Plaintext P

the message

Ciphertext C

the encrypted message

Basic Sequence for Cryptography

Plaintext→ encryption→ cipher text→ decryption→ Plaintext

Symmetric Keys

Kₑ = Kᴅ, or one is trivially derived from the other. One shared secret. Fast

Asymmetric Keys

Kₑ ≠ Kᴅ and deriving one from the other is computationally infeasible. Slow, but solves distribution.

Kerckhoffs Principle

Security must rely strictly on keeping the secret key safe, never on the secrecy of the algorithm or hardware design (rejecting "security through obscurity")

A cryptosystem should remain secure even if everything about it — except the key — is public knowledge

What “Secure” Actually means..

Confidentiality (only receiver can know), Integrity(modifications in transit are detected), Authenticity (message came from claimed sender), Non-repudiation (sender cannot later deny message), freshness (message cannot be repeated), availability (service keeps running)

Attack Models

Ciphertext-only (The attacker sees only C. Weakest model. Our Caesar frequency attack in)

Known-plaintext (Some (P, C) pairs are known. Realistic: file headers, protocol fields, and standard greetings are all predictable. This model broke Enigma via cribs.)

Chosen-plaintext (The attacker picks P and obtains C. Realistic whenever the target will encrypt attacker-supplied data — which any server does. This is the baseline modern ciphers must survive.)

Chosen-ciphertext (The attacker submits C and learns something about D(C) — even just “valid” or “invalid.”)

Caesar Cipher

Key space: 26

One fixed substitution alphabet for the whole message. Each plaintext letter always maps to the same ciphertext letter.

Letter frequencies, doubled letters, and word lengths all survive unchanged. That is the fatal property, not the small key space.

One-time Pad

For any ciphertext c and any two plaintexts, Pr[P = m₀ | C = c] = Pr[P = m₀]. The ciphertext is statistically independent of the plaintext — unlimited computing power does not help, because every plaintext of the right length is equally consistent with what was observed.

Key as long as the message, Uniformly random, Used exactly once.

Polyalphabetic Substitution

Two alphabets, applied to alternating plaintext characters. Key1 starts at 'a' and steps by 3; Key2 starts at 'n' and steps by 5 (both circular).

n alphabets means the attacker runs n separate frequency analyses instead of one. Recovering n is the whole game — and it is not hard.

Vigenere Cipher

The natural generalization: a keyword of length n, repeated to cover the message. Row = plaintext letter, column = key letter, entry = ciphertext.

Transposition Ciphers

Do not replace letters — reorder them. Frequencies are perfectly preserved, so single-letter statistics are useless; but diagram and trigram statistics give it away instead.

Attack: Anagramming, Try each plausible column count, score the result on English digram frequencies (TH, HE, IN, ER). The correct width produces readable pairs; every other width produces noise. Fully automatable.

Product Ciphers: Confusion and Diffusion

Confusion:

The relationship between key and ciphertext must be complex. Changing one key bit should change the ciphertext in a way no simple equation captures.

Diffusion:

Plaintext statistics must be dissipated across the ciphertext. One plaintext bit should influence many ciphertext bits.

Stream Cipher

Generates a pseudorandom keystream from the key and a nonce, then XORs it with the plaintext, one bit or byte at a time.

Block Cipher

A keyed permutation on fixed-size blocks. AES maps 128 bits to 128 bits, invertedly, under a 128/192/256-bit key.

AES vs DES

AES (Advanced Encryption Standard) and DES (Data Encryption Standard) are both symmetric block ciphers, meaning they use the same secret key for both encryption and decryption. However, AES is the modern, secure global standard, while DES is obsolete and easily broken

How DES Works

• Symmetric Encryption: The sender and receiver use the same secret key for both encryption and decryption.

• Block Size: It divides plaintext into 64-bit blocks.

• Key Size: It uses a 64-bit input key, though 8 bits are reserved for parity, leaving an effective key length of 56 bits.

• Feistel Network: The algorithm processes data through 16 identical rounds of substitution, permutation, expansion, and XOR operations.

• Reversibility: Decryption uses the exact same algorithm structure, applying the round keys in reverse order.

Differential Cryptanalysis

Feed in pairs of plaintexts with a fixed difference ΔP and track how that difference propagates. If some ΔP → ΔC occurs far more often than chance, the bias reveals key bits in the final round.

• Requires about 2⁴⁷ chosen plaintexts against full DES — impractical, but faster than brute force in theory.

• Breaks 8-round DES easily. The full 16 rounds were chosen precisely to put it out of reach.

• The S-boxes were tuned against it in 1974 — sixteen years before the public knew the attack existed.

Linear Cryptanalysis

Find a linear approximation relating some plaintext bits, ciphertext bits, and key bits that holds slightly more often than half the time. Accumulate enough samples and the bias becomes decisive.

• About 2⁴³ known plaintexts against full DES — the best published classical attack on it.

• Known plaintext, not chosen, which makes it a strictly weaker requirement on the attacker.

• DES was not hardened against this one, because it was discovered after the design. AES was.

How AES Works

• Symmetric Encryption: The exact same key is used to both encrypt plaintext into ciphertext and decrypt ciphertext back into plaintext.

• Block Size: AES always processes data in 128-bit (16-byte) blocks, arranged in a 4 × 4 grid called the state.

• Rounds: The number of transformation cycles depends on the key size:

  • 10 rounds for 128-bit keys

  • 12 rounds for 192-bit keys

  • 14 rounds for 256-bit keys

Rounds of AES

SubBytes (a non-linear byte substitution layer that replaces every byte in the 16-byte state matrix independently using a pre-defined substitution box (S-box))

ShiftRows (a transposition (permutation) phase that cyclically shifts the bytes in the last three rows of the 4x4 state array to the left)

Mix Columns (provides diffusion by mixing the bytes of each column independently)

AddRoundKey (combines the 128-bit state matrix with a 128-bit round key using a bitwise XOR (exclusive OR) operation)

Hash Function

any function that can be used to map data of arbitrary size to fixed-size values, though there are some hash functions that support variable-length output

Key derivation — from high entropy

You already hold something with plenty of entropy — a Diffie–Hellman shared secret, a PUF response, a master key — and need several independent keys from it.

Password hashing — from low entropy

A human-chosen password has perhaps 20–30 bits of entropy. A plain hash of it is enumerable: an attacker who steals the database simply tries every candidate.

Diffie–Hellman Key Exchange

a mathematical method that lets two people create a shared secret key over an open, unsafe network without ever sending the key itself

RSA

a widely used public-key (asymmetric) cryptography system published in 1977. It uses a mathematically linked pair of keys—a public key for encryption and a private key for decryption.

SPA

Simple power analysis.

Read the key directly from one trace when the operations themselves differ — the classic case is a square-and-multiply RSA exponentiation, where the bits of the exponent are visible as a pattern.

Defend SPA by using constant behavior; Same operations, same data, RSA, Comparisons, make instruction stream independent of the secret

Countermeasures

Boolean Masking, Threshold Implementation, Hiding, shuffling, noise and randomized clocking

EM

Electro-magnetic. The same information from a near-field probe, with no electrical contact and with spatial selectivity — you can aim at one region of the die and cut out the noise from everything else.

Counter Measures at Power Delivery Network

• Integrated Voltage Regulators (IVRs): Placing voltage regulators on-chip or on-package helps smooth local power fluctuations and isolates the internal switching activity from local physical probes. (Note: Remote grid/on-chip leakage can still sometimes bypass IVRs).

• Distributed On-Chip Regulation & Shorter Interconnects: Shortening conducting wires and distributing regulators reduces the amplitude of electromagnetic (EM) radiation and power side-channel leakage.

• Voltage Noise Injection: Deliberately introducing controlled noise or scrambling voltage levels on the power rail masks actual cryptographic or processing current signatures.

• Decoupling Capacitor Tailoring: Carefully placing and tuning on-package and on-chip capacitors filters out high-frequency leakage profiles.

• Buried Power Rails (BPR): Advanced node designs utilize BPRs, which alter power-delivery-network routing and impact how side-channel information propagates.

CMOS

Complementary Metal-Oxide-Semiconductor- a type of semiconductor technology used to build integrated circuits, microprocessors, memory chips, and digital logic components

Only consumes power when it switches

Two Types which form a variety of logic gates:

NMOS - helps pull an output toward ground (pull output down)

PMOS- helps pull an output toward the supply voltage (pull output up)

Moore’s Law

is the empirical observation that the number of transistors on a microchip doubles roughly every two years, leading to exponentially cheaper, faster, and more energy-efficient computing power but right now more transistors doesn’t mean cheaper transistors (this is what pushed designers to outsource manufacturing and reuse IP)

Dennard Scaling

The traditional idea was that transistors could shrink while their voltage and power also decreased, allowing more transistors without a major increase in power density.

Why did Dennard scaling stop working well?

• Supply voltage could not keep decreasing safely.

• Lower threshold voltages caused more unwanted leakage current.

• Heat and power consumption became major limitations.

• Clock speeds stopped increasing as quickly as before.

Planar MOSFET

Gate on one face of the channel. Below 22 nm the gate loses electrostatic control and off-state leakage becomes unmanageable.

FinFET

Channel raised into a fin; gate wraps three sides. Intel 22 nm first, then industry-wide. Drive current set in quantised fin counts.

Nanosheet GAA

Stacked horizontal sheets, gate on all four sides. Samsung SF3, TSMC N2, Intel 18A RibbonFET. Width is continuously tunable again.

CFET

n- and p-devices stacked vertically on top of each other, halving standard-cell footprint. Research and early development.

Backside Power Delivery - Why

Why: Decoupling power from signal removes the widest wires from the signal stack: less routing congestion, lower IR drop, less supply droop, higher frequency at the same voltage.

Die Area

the total physical surface area of a single functional integrated circuit (IC) or semiconductor chip cut from a larger silicon wafer

Relationship between power, capacitance, supply voltage, and switch frequency:

• Voltage- has a floor at 0.7V because it cannot go below the threshold voltage without current leakage

• Power - rising in magnitude which means that according to I =P/V, current is enormous, power is at a hard limit because it is dictated by heat removal

Why NOR and NAND are used the most:

Functionally complete

Either gate on its own can build any Boolean function — NOT, AND and OR are all expressible in NAND alone, and likewise in NOR alone. A whole processor can be made of one cell type.

Cheapest in silicon

Four transistors each, versus six for AND or OR. Static CMOS inverts for free and pays extra to un-invert, so libraries are built around the inverting forms.

But they are not electrically equal:

NAND stacks NMOS in series and NOR stacks PMOS in series. Because PMOS is the weaker device, NOR gates are slower and are used more sparingly — a small asymmetry that leaves a signature in timing and power

CMOS inverter

No static current path

In either steady state one device is off, so there is no path from Vᴅᴅ to ground. Standby power is leakage only — nanowatts in 1963, and the reason CMOS displaced everything else.

Full rail-to-rail swing

The PMOS passes a strong 1 and the NMOS a strong 0, so the output reaches both rails exactly. Noise margins are as large as the supply allows.

Power Delivery Network

Clock edge must arrive everywhere at the same instant (but because it reaches everywhere, it is easy to identify in a layout)

Board VRM (12→1) →Package →C4 bumps → Global grid (thick upper metal, carries current and must have low R) → Local grid (thin lower metal) →Transistors (actual load)

On-Chip Voltage Regulation

Switched-capacitor

Charge-transfer between on-die capacitors. Fully integrable, no inductor, but efficiency peaks only at particular conversion ratios.

Buck with integrated inductor

Higher efficiency across a wide range; needs an inductor in the package or on an interposer. Used in several production processors.

Digital low-dropout (LDO)

Small, fast and fully synthesisable, at the cost of efficiency proportional to the voltage ratio. Common for fine-grained per-block domains

Matters because it is a control loop with a software visible interface, and sits between loads and pins

Abstraction Levels

Yield

Number of good die/total die manufactured

Testing is necessary but some test features can become security risks if attackers can use them to access internal state or bypass protections

Clustering raises yield but several defects on one die doesn’t cost extra

Categories of attacks

Passive (observe device without changing its operation) or Active (interfere with the device or physically modify it)

Non-Invasive (package is intact), Semi-Invasive(chip exposed but internal wires are not directly contacted ie. optical, thermal or electromagnetic), Invasive (directly accesses internal circuit connections, like using probe tips)

Chemical Decapsulation

Mill Cavity, apply hot acid, rinse and clean, then inspect

Removes epoxy compound while leaving die

Back-side Access

Working from substrate side of chip

Default route because silicon is a window with no metal in the way

Is transparent to near-infrared light

Ways to open a package

Manual wet etch(nitric/sulphuric acid applied to cavity), automated wet etch (recover acid under program control), plasma/dry etch(oxygen or flourine ashes the mold compound), laser ablation (pulsated laser removes mold compound)

Deprocessing

Fabrication in reverse

Isotropic

Anisotropic

Planar

Reverse Engineering

Imaging Modality

Best method is x-ray ptychography because it can image but is also non destructive. No delayering, good resolution

design obfuscation and camouflage cells assume the attacker's view of the die is degraded by the destructive process. An imaging method that never disturbs the die weakens that assumption considerably.

Classical Microprobing

A probe tip is landed on an exposed metal wire inside a running chip. It violates confidentiality when you read the wire, and integrity when you drive it

Typically targeting the internal CPU data bus

Front-side probing doesn’t work because you could accidentally short several nets, may have to remove layers which are crucial to the device, and a probe adds capacitance to the net

Countermeasures (shields, mesh probe attempt protection) has lots of limits

Bus and Memory encryption

standard in every server processor, attackers can see the bus but do not know how to decrypt it

Bus Scrambling

not encryption, permutes the order of the bus, (security through obscurity)

Modern Faults

The physical layer became remotely reachable. Rowhammer and the energy-management attacks deliver a physical fault through software, so physical access control is no longer a sufficient defense against physical attacks.

Removing a software interface does not remove the underlying capability. The undervolting MSR was closed; the SVID bus, the PMBus and the board-level rail were not, and each in turn was used to reproduce the attack.

Isolation drawn in the digital domain does not exist in the analogue domain. Enclaves, trusted worlds and privilege rings share a power delivery network, a clock tree and a substrate.

The defense has to be designed into the power delivery network, not bolted onto the interfaces that happen to control it. That is a circuits problem as much as an architecture problem.

• Rowhammer: Repeatedly accessing memory can disturb nearby memory cells.

• CLKSCREW: Manipulating voltage or frequency can affect security-sensitive computation.

• Plundervolt: Reducing CPU voltage can cause faults in protected computations.

• VoltPillager and PMFault: Exploit weaknesses in power-management or power-delivery controls.

Hamming Weight vs Hamming Distance

Hamming weight is the number of non-zero symbols (or 1s) in a string, while Hamming distance is the number of positions where two equal-length strings differ.

Software leaks weight, hardware leaks distance

Example Leaks

Memory load/ store - Moves a whole byte or word across a precharged bus — a strong HW leak of the value moved.

Register overwrite - Datapath register goes from one value to the next — a clean HD leak of the transition.

Table lookup (S-box) Address and fetched value both leak; the S-box output is the classic attack target.

Arithmetic /logic -Operand-dependent switching in the ALU — leaks, but the model is harder to pin down.

Conditional branch - Control flow depends on the secret — leaks through timing and a distinct power signature (SPA).

DPA

Differential Power Analysis

Process:

Step 1: Collect traces

Run encryption many times with different known inputs.

Step 2: Guess part of the key

For AES, try possible values for one key byte.

Step 3: Predict intermediate data

Use each key guess and the known plaintext to calculate a predicted value.

Step 4: Compare the traces

Use statistics to see whether the measured power matches the prediction.

Step 5: Identify likely key values

A strong statistical difference can indicate the correct guess.

When you guess the key the prediction takes less time

Weakness: Ghost Peaks if DPA predicts one bit but device leaks all 8 at once

Divide and Conquer Attack

AES is a common target because for each key-byte guess, an attacker can calculate a predicted S-Box output, byte has 256 possible values so the attacker can guess all guesses for that byte

Correlation Power Analysis

Method is closely related to DPA

• Predicting power consumption for each possible key guess.

• Using a leakage model, often Hamming weight or Hamming distance.

• Calculating the correlation between predicted power and measured traces.

• Ranking the guesses based on the strength of the correlation.

• Number of traces needed needs to increase as leakage becomes noisier

Need to find separation in the graph

Timing Attacks

If execution time depends on secret information, an attacker may infer something about that information by measuring repeated operations.

Examples: RSA operations with secret-depended control flow, CPU frequency changes related to the work being performed

Defense: make execution time independent of secret values where possible, avoid early exits

Electromagnetic Attacks

Switching currents cause changes in the electromagnetic field

Defending against Power Analysis

Hiding

– Amplitude: noise generators, balanced/dual-rail logic, current smoothing.

– Time: random delays, clock jitter, shuffling the order of operations.

– Power delivery: on-chip regulators that decorrelate supply from load current.

-Gate-Level: make every bit cost the same

Masking

– Split every secret value into random shares; compute on the shares.

– First-order masking removes any single-sample key dependence.

– Provable, but costly — and vulnerable to higher-order and glitch attacks if done carelessly.

Imperfections that may cause power leakage

Capacitance Mismatch and Delay Mismatch

TVLA

Testing for Leakage without Attacking

An evaluator often cannot try every attack. The test vector leakage assessment asks a simpler question: does the device behav e differently for different data at all?

Fixed vs random t-test

compare the two means

Profiling Attacks

– On a clone device with keys you control, capture many traces for every value of the target intermediate.

– Build a statistical model of the leakage for each value

— classically a Gaussian template: a mean trace and covariance per value.

– This captures the real leakage shape, not an assumed HW/HD model

Then perform attack on victim