BACHELOR- AND MASTER THESES
We are always interested in students who would like to write a bachelor or master thesis at our chair. No special previous knowledge is required, i.e. basics of cryptography, algorithmic or VHDL fundamentals can be learned during the work. The call is equally addressed to students of ET, IT, AI, ITS, and computer science.If you are interested, contact seceng+thesis@rub.de. Please include your current transcript of records and your preferred topics/topic areas.
In addition, our chair currently offers the following topics for bachelor and master theses. Detailed descriptions can be found below.
Overview
GASYN - Secure Gadget Synthesizer and Logic Optimizer
MOTIVATION. Secure implementation of cryptographic algorithms in software or hardware is a challenging problem. Extensive research has been devoted to the development of efficient countermeasures against physical Side-Channel Analysis (SCA). Lately, masking has been established as promising concept due to its theoretically sound foundations allowing to model and prove its security guarantees. Still, correct and secure implementation of masking schemes is a mostly manual, delicate, complex, and error-prone task. This motivates the need for automated tools that assist designers and engineers to securely implement cryptographic operations in hardware.
BACKGROUND. Experience has shown that new masking schemes often have a short retention time, mostly due to inaccuracies and design flaws. As a consequence, a new line of research emerged, investigating the masking of atomic and reusable components, often considered as gadgets in literature, to limit the engineering complexity and error susceptibility [8, 7, 6, 5, 2, 1, 3].
RESEARCH PROBLEM. The supplementary material of [4] presents different latency-optimized S-boxes using a custom 2-input AND gadget. However, neither different gadget layouts and variants, nor alternative optimization objectives (e.g., area or randomness reduction) have been addressed.
YOUR TASK. In this project, you will a gadget-oriented logic synthesizer allowing to generate secure and optimized hardware circuits (area, latency, or randomness) using a custom set of masked gadgets. More precisely, this project requires the following tasks:
- Literature study (10%)
- Requirement analysis and concept definition (10-20%)
- Implementation and debugging (40-50%)
- Implementation of a custom gadget library
- Construction of a SAT/SMT-based gadget synthesizer
- Integration of optimization strategies for area, latency, or randomness reduction
- Testing and writing (30%)
REQUIREMENTS. Digital logic, hardware design, C/C++ programming, basics on SAT & SMT solvers.
CONTACT. If you are interested in this topic, please contact: Dr.-Ing. Pascal Sasdrich (pascal.sasdrich@rub.de).
LITERATURE
| [1] | Gilles Barthe et al. “Strong Non-Interference and Type-Directed Higher-Order Masking”. In: SIGSAC. ACM, 2016. DOI: 10.1145/ 2976749.2978427 |
| [2] | Gilles Barthe et al. “Verified Proofs of Higher-Order Masking”. In: EUROCRYPT. LNCS. Springer, 2015. DOI: 10.1007/978- 3- 662-46800-5\_18 |
| [3] | Gaëtan Cassiers and François-Xavier Standaert. “Trivially and Efficiently Composing Masked Gadgets With Probe Isolating Non- Interference”. In: IEEE TIFS (2020). DOI: 10.1109/TIFS.2020.2971153 |
| [4] | Gaëtan Cassiers et al. “Hardware Private Circuits: From Trivial Composition to Full Verification”. In: IEEE TC (2021). DOI: 10. 1109/TC.2020.3022979 |
| [5] | Hannes Groß, Rinat Iusupov, and Roderick Bloem. “Generic Low-Latency Masking in Hardware”. In: IACR TCHES 2 (2018). DOI: 10.13154/tches.v2018.i2.1-21. |
| [6] | Hannes Groß and Stefan Mangard. “A unified masking approach”. In: JCEN (2018). DOI: 10.1007/s13389-018-0184-y |
| [7] | Hannes Groß, Stefan Mangard, and Thomas Korak. “Domain-Oriented Masking: Compact Masked Hardware Implementations with Arbitrary Protection Order”. In: TIS@CCS. ACM, 2016. DOI: 10.1145/2996366.2996426. |
| [8] | Oscar Reparaz et al. “Consolidating Masking Schemes”. In: CRYPTO. LNCS. Springer, 2015. DOI: 10.1007/978-3-662-47989- 6\_37 |
NTT with Arbitrary Polynomial Degrees
MOTIVATION. For lattice-based cryptography, the number theoretic transform (NTT) is an essential operation for efficient multiplication of polynomials. Usually, these polynomials use a power-of-two degree such that the NTT is fully splitting. With arbitrary polynomial degrees however, the NTT is not fully splitting and thus has performance implications [1].
RESEARCH PROBLEM. Your task is to investigate the memory-time tradeoff that non power-of-two degree polynomials have with the NTT. For this, a formula should be derived that allows the application of the NTT to non power-of-two degree polynomials. Additionally, a performance evaluation with code should be performed.
REQUIREMENTS. Basics in number theory, C programming.
CONTACT. If you are interested in this topic, please contact: Johannes Mono (johannes.mono@rub.de).
LITERATURE
| [1] | Chung, Chi-Ming Marvin, et al. "NTT multiplication for NTT-unfriendly rings: New speed records for Saber and NTRU on Cortex-M4 and AVX2." IACR Transactions on Cryptographic Hardware and Embedded Systems (2021): 159-188. |
Microarchitectural Side Channel Attacks and Countermeasures
MOTIVATION. The internal hardware of modern CPUs, i.e., the microarchitecture, has long been considered a trust anchor that works as a foundation for higher level system security. While this assumption has been challenged time and again, only recent attacks including Spectre [1] and Meltdown [2] saw the industry taking this problem seriously. There are many aspects of microarchitectural vulnerabilities, ranging from cache side channel attacks [3] over Rowhammer [4] to speculative execution attacks [5].
RESEARCH PROBLEM. Aiding current research projects at the Chair for Security Engineering, your thesis will review and advance the current state of research. This may include the design and/or evaluation of attacks and countermeasures. In many cases these attacks directly operate on the CPU hardware. Especially for the evaluation of countermeasures, we often use the gem5 simulator [6].
REQUIREMENTS. C/C++ programming skills, basics of x86 assembly, basic understanding of CPU designs (pipeline, caches, etc.)
CONTACT. If you are interested in this field of research, we can discuss potential topics suited to your prior knowledge and interests. If you already have a specific topic in mind, feel free to propose it directly. Please contact Jan Philipp Thoma, jan.thoma@rub.de and include a recent transcript or records.
LITERATURE
| [1] | Kocher, Paul, et al. "Spectre attacks: Exploiting speculative execution." 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019. |
| [2] | Lipp, Moritz, et al. "Meltdown: Reading kernel memory from user space." 27th USENIX Security Symposium (USENIX Security 18). 2018. |
| [3] | Yarom, Yuval, and Katrina Falkner. "{FLUSH+ RELOAD}: A High Resolution, Low Noise, L3 Cache {Side-Channel} Attack." 23rd USENIX security symposium (USENIX security 14). 2014. |
| [4] | Mutlu, Onur, and Jeremie S. Kim. "Rowhammer: A retrospective." IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems 39.8 (2019): 1555-1571. |
| [5] | Canella, Claudio, et al. "A systematic evaluation of transient execution attacks and defenses." 28th USENIX Security Symposium (USENIX Security 19). 2019. |
| [6] | Lowe-Power, Jason, et al. "The gem5 simulator: Version 20.0+." arXiv preprint arXiv:2007.03152 (2020). |
Security-Oriented Electronic Design Automation
MOTIVATION. With ever increasing complexity of Integrated Circuits and Electronic Systems, manual design and development processes are becoming more difficult and cumbersome. Instead, designers and developers are assisted by modern and computer-aided Electronic Design Automation (EDA) tools that handle complex and labor-intensive tasks automatically in order to allow rapid and high-quality development of complex ICs. In addition, these tools provide automatic optimization for various metrics, including area, latency, performance, or power and energy consumption to increase efficiency and quality of the final electronic systems. However, security as an optimization aspect is mostly neglected when addressing classical metrics as area and performance. In fact, authenticity, integrity, and confidentiality of modern ICs is becoming more and more important in recent years. However, integration and evaluation of security features still is a manual and downstream process and since many security goals including secure data flow (non-interference), side-channel resistance, fault tolerance, and hardware obfuscation can only be addressed at certain stages of the manufacturing chain, security is often neglected or rejected as it would interrupt tight and efficient manufacturing processes.
RESEARCH PROBLEM. As this is a very broad topic and certainly exceeds the scope of a single thesis, we offer multiple theses with focus on different aspects, including (but not limited to):
- Automated integration of security features
- Formal verification of security properties
- Optimization of security features
- Development of security extensions for (existing) EDA tools
- Secure High-Level Synthesis (HLS)
REQUIREMENTS. Digital logic, hardware design and security, physical attacks and countermeasures, solid programming skills, hardware description languages, formal verification, etc. (depending on the specific thesis topic and tasks).
CONTACT. If you are interested in this field of research, we can discuss potential topics suited to your prior knowledge and interests. If you already have a specific topic in mind, feel free to propose it directly. Please contact Dr.-Ing. Pascal Sasdrich (pascal.sasdrich@rub.de) and include a recent transcript or records.
Secure Computation
MOTIVATION. Over the last decade and especially in recent years, many new attacks have been developed that target both desktop- as well as embedded-grade hardware. For example, it has been shown multiple times that caches can leak information by purposefully manipulating their contents and causing exploitable timing differences. Furthermore, SPECTRE and MELTDOWN showed that oversights in the implementation of speculative execution as well as predictions can have severe security considerations. Lastly, with the increasing number of IoT devices adversaries started focusing on exploiting these low-performance devices, thus prompting for solutions that require low overhead.
RESEARCH PROBLEM AND YOUR TASK. We have developed different countermeasures against the threats mentioned above. To provide a more in-depth evaluation we still require some implementations. This includes, for example:
- Implementing a TLB countermeasure into a softcore OOO-CPU
- Implementing an ISA Extension against fault in a softcore embedded-grade CPU (with compiler support)
- Researching fault-free ISA designs and evaluating them in HW
REQUIREMENTS. Depending on the direction you aim at: Experience with hardware description languages, high-level languages if you aim to provide compiler support
CONTACT. If you are interested in this topic, please contact: M.Sc. Florian Stolz (florian.stolz@rub.de)
Compiler Analysis on Constant-Time
MOTIVATION. The constant-time programming discipline is an effective countermeasure against timing attacks, which pose a serious threat to software systems. Tools for automated verification of constant-time security have been developed for various programming languages. An open problem however is to maintain the security guarantees of the source code during compilation, as studies have shown, that compilers sometimes translate constant-time code into insecure binaries.
RESEARCH PROBLEM. While this problem is generally understood and problematic code patterns have been identified, there has been so far only little research on the exact translation passes, where the compiler introduces leakage. Your task is to identify the compilation passes in the LLVM compiler framework with automated testing using existing constant-time verifiers on the LLVM intermediate language.
REQUIREMENTS. C/C++/Rust programming skills, assembly basics, basic understanding of compilers.
CONTACT. If you are interested in this research topic, please contact Markus Krausz (markus.krausz@rub.de) and include a recent transcript or records.
Implementation and Side-Channel Security of Multivariate Quadratic Signature Schemes.
MOTIVATION. In the light of the potential threat of large-scale quantum computers breaking today's deployed cryptography, NIST has launched standardization efforts for post-quantum secure KEMs and Signature schemes. Recently, NIST has announced several schemes to be standardized. Additionally, a fourth round will be opened soon for signature schemes that are not based on lattice assumptions. For this round, it is expected that several signature schemes based on multivariate quadratic assumptions are submitted.
RESEARCH PROBLEM AND YOUR TASK. here are very few works on several topics related to implementation issued. This includes:
- Embedded Software Implementations
- Hardware Implementations
- Side-Channel Attacks and Countermeasures
REQUIREMENTS. Depending on the direction you aim at: VHDL, embedded C and Assembly, and/or side-channel analysis.
CONTACT. If you are interested in this research topic, please contact Georg Land (georg.land@rub.de) and include a recent transcript or records.
LITERATUR:
| [1] | MAYO: Practical Post-Quantum Signatures from Oil-and-Vinegar Maps |