- »
- Security Engineering
- »
- Lehre
- »
- Abschlussarbeiten
Abschlussarbeiten
BACHELOR- UND MASTERARBEITEN
Wir sind immer an Studierenden interessiert, die bei uns eine Bachelor- oder Masterarbeit schreiben möchten. Es sind keine besonderen Vorkenntnisse erforderlich, d.h. Grundlagen der Kryptographie, algorithmische oder VHDL Grundlagen können während der Arbeit erlernt werden. Die Ausschreibung richtet sich darüber hinaus gleichermaßen an Studenten der ET, IT, AI und ITS. Bei Interesse einfach Prof. Güneysu oder einen Mitarbeiter kontaktieren.
Unser Lehrstuhl bietet aktuell folgende Themen zur Bearbeitung für Bachelor- und Masterarbeiten an. Ausführliche Beschreibung befinden sich weiter unten.
KURZE ÜBERSICHT
- Fully Homomorphic Encryption
- Attacks on the CPU Microarchitecture
- Microarchitectural Countermeasures
- Security-Aware Hardware Design at the Architectural Level
- Computer-Aided Security
- Implementation of Lattice Co-Processor for RISCV CPU
- Software Implementation of Lattice-based Techniques for Anonymous Credentials
- Leakage Simulation using Machine Learning
- Countermeasures against Combined Side-Channel Analysis and Fault-Injection Attacks
- Combined Fault-Injection and Side-Channel Analysis
- Fault Propagation and Fault Severity in Hardware Circuits
- Efficient Hardware Implementation of BIKE
- Automatic Error Detection in High Level Synthesis Design
- Advanced Laser Fault Injection
- Cycle accurate processor simulation in Gem5
- Electromagnetic Fault Injection (EMFI)
- Adiabatic Logic as a countermeasure against side-channel analysis attack
- Nano-Scale Side-Channel Analysis
- Efficient Hardware Implementation of DILITHIUM
- Unsupervised Learning on PUFs
- Physical Unclonable Functions on FPGAs
- Side-Channel Measurement Board
Fully Homomorphic Encryption
(Master – immediately – 6 months)
Motivation
With fully homomorphic encryption (FHE), encrypted data is not only secured when stored, but also during computations. Since Gentry’s seminal work in 2009, multiple schemes have been developed that focus on different areas of computing. However, using FHE is still very expensive with respect to development and runtime costs. Thus, there are still lots of open research problems in improving the performance of existing schemes as well as advancing the FHE ecosystem as a whole for users and developers.
Research Ideas
As fully homomorphic encryption in itself exceeds the scope of a single thesis, we list some ideas for your inspiration. Additionally, you can always contact us for more ideas or if you have any questions.
- Automatic creation of fully homomorphic encryption circuits
- Optimization of low-level lattice operations in software or hardware
- …
Contact
SCA-protect designs in software platforms
(Bachelor / Master – immediately – 3/6 months)
Motivation:
Being based on a sound theoretical basis, masking schemes are commonly applied to protect cryptographic implementations against Side-Channel Analysis (SCA) attacks. Software platforms are popular both in the research area and industry. So developing secure software implementations has gotten a lot of attention. As a matter of fact, it is important to consider all components of the software platforms, e.g., piplining, cache, etc., to design a real secure software implementations. Hence, several thought-secure implementations exhibit leakage in practice even though their mathematical backgrounds seem sound.Being based on a sound theoretical basis, masking schemes are commonly applied to protect cryptographic implementations against Side-Channel Analysis (SCA) attacks. Software platforms are popular both in the research area and industry. So developing secure software implementations has gotten a lot of attention. As a matter of fact, it is important to consider all components of the software platforms, e.g., piplining, cache, etc., to design a real secure software implementations. Hence, several thought-secure implementations exhibit leakage in practice even though their mathematical backgrounds seem sound.
Research Question:
The goal of this thesis is to compare the approaches in the literature in software platforms and ideally construct a more efficient design. Constructing SCA-protected AES, as the most widely deployed block cipher, has been trivially the focus of several research projects, with a direct use in industry. So basically concentrating on AES as a case study would be the best in this work.
Requirements
Ideally, the student has good programming skills and some basic understanding of hardware security.
References
[1] H. Gross, et al. “First-Order Masking with Only Two Random Bits” (2019)[2] A.R. Shahmirzadi, et al. “Re-Consolidating First-Order Masking Schemes – Nullifying Fresh Randomness” (2020)
Contact:
Advisor: Aein Rezaei Shahmirzadi
Mail: aein.rezaeishahmirzadi@rub.de
Security-Aware Hardware Design at the Architectural Level
(Master – immediately – 6 months)
Motivation:
Security-aware Electronic Design Automation (EDA) is a promising solution for bridging the gap between system architects and security experts by automatically implementing state-of-the-art defense mechanisms in modern hardware. For this, security analysis and transformations are done at different levels of design abstraction, to create secure-by-design hardware for digital systems. One such abstraction level is the architectural level, where the interaction of different modules and system parts can be analyzed, customized, and secured. Together with analysis at other abstraction levels, this might allow the detection of vulnerabilities in the microarchitecture early in the design process. To enable analysis across different design stages a unified Intermediate Representation (IR) for the entire design stack is necessary, where different abstraction levels are supported through different language features.
Research Question:
As part of this thesis, you will extend LLHD [1] to include an architectural level, as proposed in [2], using the MLIR framework [3]. Further, you will investigate security analyses and security transformations that target the resulting architectural design level.
Requirements
Ideally, the student has good programming skills and some basic understanding of hardware design.
References
[1] F. Schuiki, et al. “LLHD: A Multi-level Intermediate Representation for Hardware Description Languages” (2020)[2] A. Sharifian, et al. “μIR -An Intermediate Representation for Transforming and Optimizing the Microarchitecture” (2019)
[2] C. Lattner, et al. “MLIR: A Compiler Infrastructure for the End of Moore’s Law” (2020)
Contact:
Advisor: Jakob Feldtkeller
Mail: jakob.feldtkeller@rub.de
Computer-Aided Security
(Bachelor / Master – immediately – 3 / 6 months)
Motivation
With ever increasing complexity of Integrated Circuits and Electronic Systems, manual design and development processes are becoming more difficult and cumbersome. Instead, designers and developers are assisted by modern and computer-aided Electronic Design Automation (EDA) tools that handle complex and labor-intensive tasks automatically in order to allow rapid and high-quality development of complex ICs. In addition, these tools provide automatic optimization for various metrics, including area, latency, performance, or power and energy consumption to increase efficiency and quality of the final electronic systems.
However, security as an optimization aspect is mostly neglected when addressing classical metrics as area and performance. In fact, authenticity, integrity, and confidentiality of modern ICs is becoming more and more important in recent years. However, integration and evaluation of security features still is a manual and downstream process and since many security goals including secure data flow (non-interference), side-channel resistance, fault tolerance, and hardware obfuscation can only be addressed at certain stages of the manufacturing chain, security is often neglected or rejected as it would interrupt tight and efficient manufacturing processes.
Research Question
As this is a very broad topics and certainly exceeds the scope of a single thesis, we offer multiple theses with focus on different aspects, including (but not limited to):
- Automated integration of security features
- Formal verification of security properties
- Optimization of security features
- Development of security extensions for (existing) EDA tools
- Secure High-Level Synthesis (HLS)
- …
Contact
Advisor: Pascal Sasdrich
Mail: pascal.sasdrich@rub.de
Implementation of Lattice Co-Processor for RISCV CPU
(Masterthesis – immediately – 6 Months)
Motivation
In the current NIST standardization [1] for post quantum secure algorithms, many lattice-based schemes are among the most promising candidates. There are plenty software implementations of these schemes, however, a broad adoption of new encryption standards requires efficient hardware accelerators to efficiently use them on constrained devices, i.e. embedded systems.
The RISCV instructions set poses the first completely open source instruction set architecture (ISA). In particular, the VexRiscv processor [2] is a good platform to implement modular extensions to a RISCV processor. The goal of this thesis is, to develop a generic lattice accelerator as an extension to the VexRiscv CPU. The accelerator should be able to run different lattice-based schemes.
Research Question
You will implement a modular lattice extension to the VexRiscv CPU in SpinalHDL [3] and optimize it as much as possible. Some design concepts of a modular lattice accelerator can be seen in [4].
References
[1] NIST PQC
[2] VexRiscv
[3] SpinalHDL
[4] Banerjee, U., Ukyab, T. S., & Chandrakasan, A. P. (2019). Sapphire: A Configurable Crypto-Processor for Post-Quantum Lattice-based Protocols. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2019(4)
Requirements
Ideally, you should have made first experiences with VHDL (e.g., by having attended Cryptography on Hardware-based Platforms). SpinalHDL is a high-level language that is easy to learn and that simplifies development compared to VHDL significantly.
Contact
Advisor: Jan Philipp Thoma and Georg Land
Mail: jan.thoma@rub.de or georg.land@rub.de
Software Implementation of Lattice-based Techniques for Anonymous Credentials
(Bachelor / Master – immediately – 3 / 6 months)
Motivation
With anonymous credentials [1], users can identify themselves to service providers and prove the possession of a credential in a zero-knowledge manner. To achieve this, many theoretical, probably practically inefficient approaches have been proposed in the past.
Lattice-based cryptography offers a wide range of potential applications that go beyond classic primitves like encryption and signatures. Recent work has shown that lattice-based systems can be used to implement anonymous credentials efficiently, utilizing advanced cryptographic techniques like zero-knowledge proofs of knowledge [2][3][4] or attribute-based signatures [5]. However, these proposals mostly lack practical implementations.
Research Question
You will implement advanced lattice-based schemes like a zero-knowledge proof or an attribute-based signature in C or C++.
References
[1] SECURITY WITHOUT IDENTIFICATION: TRANSACTION SYSTEMS TO MAKE BIG BROTHER OBSOLETE
[2] Lattice-Based Group Signatures and Zero-Knowledge Proofs of Automorphism Stability
[3] Efficient Lattice-Based Zero-Knowledge Arguments with Standard Soundness: Construction and Applications
[4] Practical Exact Proofs from Lattices: New Techniques to Exploit Fully-Splitting Rings
[5] Group Signatures without NIZK: From Lattices in the Standard Model
Requirements
Ideally, some experience with software implementation in C/C++ and the willingness to learn.
Contact
Advisor: Georg Land
Mail: georg.land@rub.de
Countermeasures against Combined Side-Channel Analysis and Fault-Injection Attacks
(Masterthesis – immediately – 6 Months)
Motivation
Cryptographic hardware implementations are generally vulnerable against physical attacks like Side-Channel Attacks (SCA) and Fault-Injections Attacks (FIA). Over the last decades, researchers from academia and industry proposed many countermeasures to thwart these attacks individually. However, since it is insufficient to protect a target implementation only against one of these attack vectors, combined approaches, which can counteract SCA and FIA, gained more and more interest in the last years [1, 2, 3]. Especially the combination of Threshold Implementation (TI) [4] and linear Error-Correcting Codes (ECCs) [5] is a popular approach to achieve increased security against physical attacks. Nevertheless, a simultaneous protection cannot be ensured and most of the proposed schemes are vulnerable against combined attacks.
Research Question
As part of this thesis, you first should investigate possible vulnerabilities of a hardware implementation of a cryptographic algorithm protected by TI and ECCs. This specific implementation is designed to correct occurring errors achieving an increased security against FIA. However, these correction modules offer a possible attack vector which should be exploited by a combined attack using SCA and FIA. Subsequently, you should design and develop suitable countermeasure to thwart such combined countermeasures.
References
[1] Schneider, Tobias, et al. „ParTI: Towards Combined Hardware Countermeasures against Side-Channel and Fault-Injection Attacks.“
[2] De Meyer, Lauren, et al. „M&M: Masks and Macs against physical attacks.“
[3] Reparaz, Oscar, et al. „CAPA: the spirit of beaver against physical attacks.“
[4] Nikova, Svetla, et al. „Threshold implementations against side-channel attacks and glitches.“
[5] Aghaie, Anita, et al. „Impeccable circuits.“
Requirements
Ideally, the student has some basic background of SCA, FIA and VHDL and attended the lecture on Cryptography on Programmable Hardware.
Contact
Advisor: Jan Richter-Brockmann and Pascal Sasdrich
Mail: jan.richter-brockmann@rub.de or pascal.sasdrich@rub.de
Leakage Simulation using Machine Learning
(Bachelorthesis – immediately – 3 Months
Motivation
Since the 1st discovery of Side-Channel Analysis (SCA) in 1999, many novel attack techniques have been invented and shown to be effective. Fortunately, many security-critical cryptographic implementations nowadays already consider the threat of SCA during the design phase and implement appropriate mechanisms and countermeasures to protect against revelation of sensitive and secret information. However, although many secure masking schemes have been proposed to protect against SCA, practical implementation of these schemes is a dicult and sophisticated task for most designers. Since even small imperfections in the implementation of a masking scheme can result in an entirely insecure design, security validation processes are required and performed to evaluate and assess the overall security of the nal device. Usually, these security validation processes are performed after implementation on a testing device using a physical test setup and empirical leakage assessment methodology resulting in a complex, lengthy, tedious and manual task.
Background
In 2016, Oscar Reparaz [1] addressed the problem of simplifying, improving and accelerating the security validation process using on-the-fly trace simulation before performing a leakage evaluation based on state-of-the-art leakage detection tests. In particular, this work presents an approach based on simulated traces generated from high-level source code which are analyzed using leakage detection tests based on Welsh’s t-test. Further, the simulated traces are generated based on a preselected power model chosen by the designer.
Research Question
As part of this thesis, you will investigate the following research question: Can we use Machine Learning (ML) techniques to generate simulated power traces based on a more realistic power model? In particular, you will select and implement an appropriate ML algorithm that can be trained and improved using practically generated traces measured on a real physical device. Eventually, your framework should be able to automatically analyze and validate novel (untested) implementations for flaws and potential problems of incorporated side-channel protection mechanisms.
References
[1] Oscar Reparaz. Detecting Flawed Masking Schemes with Leakage Detection Tests. FSE 2016.Requirements
Ideally, the student has some basic knowledge on SCA and ML and has good skills in writing efficient software.
Contact
Advisor: Pascal Sasdrich
Mail: pascal.sasdrich@rub.de
Combined Fault-Injection and Side-Channel Analysis
(Masterthesis – immediately – 6 Months)
Motivation
Physical and implementation attacks, including Side-Channel Analysis (SCA) and Fault-Injection Analysis (FIA) have gained a lot of attention by academic and industrial research during the last two decades. Rather than addressing flaws in cryptographic schemes to reveal and extract secret information, those attack vectors exploit vulnerabilities and flaws in physical implementations of algorithms that are considered to be cryptographically secure.
However, since techniques to advert SCA and FIA usually are of completely different nature and follow design strategies that often are incompatible, combining both countermeasures in the same design is a challenging tasks that only gained attention recently. Still, ensuring that the combination and interplay of both approaches does not lever the protection mechanism and does not reduce the security of the cryptographic implementation is an open problem. In particular, from an adversary perspective, using both attack vectors simultaneously could help to reveal secret information although appropriate countermeasures against both attack vectors are in place.
Background
In 2016, Schneider et al. [1] addressed the problem of achieving resistance against SCA and FIA simultaneously using Error-Correcting Codess (ECCs) for Concurrent Error Detection (CED) in combination with a provable 1st-order secure Threshold Implementations (TIs) for side-channel protection. This seminal work has been extended by others, including Reparaz et al. [2] and De Meyer et al. [3]. While the approach of Reparaz et al. was inspired by Multi-Party Computation (MPC) protocols and masking techniques to simultaneously implement protection against SCA and FIA, De Meyer et al. combined Message Authentication Code (MAC) tags (originating from information theory) with masking to extend the protection against SCA and FIA.
Research Question
As part of this thesis, you will investigate the following research question: Do all those approaches, designed to withstand both SCA and FIA, protect against simultaneous attacks? In particular, you will investigate if we can use fault-injection attacks to lever the protection against SCA or if we can use side-channel analysis to lever the protection against FIA in order to eventually reveal secret information although countermeasures are implemented.
References
[1] Tobias Schneider, Amir Moradi, and Tim Güuneysu. ParTI: Towards Combined Hardware Countermeasures against Side-Channel and Fault-Injection Attacks. CRYPTO 2016.[2] Oscar Reparaz, Lauren De Meyer, Begül Bilgin, Victor Arribas, Svetla Nikova, Ventzislav Nikov, Nigel P. Smart. CAPA: The Spirit of Beaver Against Physical Attacks. CRYPTO 2018.
[3] Lauren De Meyer, Victor Arribas, Svetla Nikova, Ventzislav Nikov, Vincent Rijmen. M&M: Masks and Macs against Physical Attacks. TCHES 2019.
Requirements
This topic requires some solid background on SCA, FIA, and hardware development. Ideally, the student should have completed the courses on Physical Attacks and Countermeasures and Cryptography on Programmable Hardware.
Contact
Advisor: Pascal Sasdrich
Mail: pascal.sasdrich@rub.de
Fault Propagation and Fault Severity in Hardware Circuits
(Masterthesis – immediately – 6 Months)
Motivation
Active physical attacks, particularly Fault-Injection Analysis (FIA), pose a serious and often underestimated threat to physical implementations of cryptographic algorithms. Often, disturbing the execution of cryptographic operations through precisely injected faults allows to reveal and extract secret information eventually allowing to break the security of the overall system. Most of all, since necessary tools and equipment to precisely inject faults have been improved dramatically over the last years, attackers are becoming increasingly powerful. To this end, designers of cryptographic implementations are obliged to consider protection against FIA as early as during the design and implementation phase. For this, various Concurrent Error Detection (CED) schemes have been proposed as countermeasures based on redundancy in area or time. However, analysis and evaluation of the effectiveness of a chosen CED during the design and implementation phase is still an open problem.
Background
Formal verification of hardware countermeasures against physical attacks (including Side-Channel Analysis (SCA) and FIA) based on analysis of the Hardware Description Language (HDL) or gate-level netlist is a tedious and time consuming tasks that only recently gained some attention. Due to the complexity and size of modern, security-critical hardware circuits, the scale and complexity of physical attacks, and the required knowledge and expertise, tool-supported analysis and verifi cation of the circuit is becoming increasingly important.
Research Question
As part of this thesis, you will investigate the following research question: Can we identify and de fine properties that characterize the fault propagation and fault severity for a combinational hardware circuit. In particular, you will investigate approaches to reduce the complexity of an exhaustive fault simulation for analysis of the fault propagation behavior by finding sensitive locations which allow to inject faults with high impact (i.e., higher severity). Eventually, you should develop a framework that can automate the analysis and simulation of the fault behavior of an arbitrary hardware circuit.
Requirements
Ideally, the student is familiar with the basic concepts of some HDL (e.g., VHDL or Verilog) and has basic knowledge on C/C++ and Python programming.
Contact
Advisor: Pascal Sasdrich
Mail: pascal.sasdrich@rub.de
Efficient Hardware Implementation of BIKE
(Masterthesis – immediately – 6 Months)
Abstract:
In 2017 the National Institute of Standards and Technology (NIST) announced a standardization process to develop post-quantum resistant cryptography. Recently, the NIST selected and published the remain candidates for the second round. One submission from the public-key encryption algorithms is BIKE which is a code-based approach [1]. Since now, the authors concentrated their work on efficient software implementations only. As part of the round two submission, they provided first hardware implementations for the key generation (KeyGen) and the encapsulation (Encaps) algorithm to set first benchmarks regarding speed and hardware utilization. However, results for efficient decapsulation implementations and constant time approaches for KeyGen and Encaps are still missing.
As part of a master thesis, the missing encapsulation algorithm should be implemented for an Artix 7 FPGA. After surmounting the difficulties in the underlying bit-flipping algorithm, an adaptation of KeyGen and Encaps should be accomplished to realize a constant time implementation. Finally, the implemented designs should be evaluated regarding speed and area consumption.
References
[1] Aragon, Nicolas, et al. „BIKE: bit flipping key encapsulation.“ (2017).Requirements
Knowledge of VHDL and FPGAs is preferable.
Contact:
Advisor: Jan Richter-Brockmann
Mail: jan.richter-brockmann@rub.de
Automatic Error Detection in High Level Synthesis Design
(Bachelor – immediately – 3 months)
Motivation:
High-Level Synthesis (HLS) allows the design of hardware at an abstract, algorithmic level without dealing with the specific implementation at the gate or register transfer level. As such, HLS is comparable to high-level programming languages and offers similar benefits. Comparable to software, it is possible to introduce security features automatically during the synthesis process and, hence, support the designer in the task of building a secure system. Since contemporary HLS tools do not support any notion of security today, this is an open and promising research field.
Research Question:
One class of attacks against hardware implementations are fault attacks [1], where an attacker exploits a faulty computation of a device to recover some secret information. As part of this thesis, you should investigate the option of introducing automatic countermeasures against fault attacks into a hardware design during high-level synthesis. As a starting point, you will look into impeccable circuits [2] and analyze their applicability and constraints for high-level synthesis.
Requirements
Ideally, the student has good programming skills and some basic understanding of hardware design (Verilog/VHDL).
References
[1] D. Boneh, et al. “On the Importance of Checking Cryptographic Protocols for Faults” (1997)[2] A. Aghaie, et al. “Impeccable Circuits” (2019)
Contact:
Advisor: Jakob Feldtkeller
Mail: jakob.feldtkeller@rub.de
Advanced Laser Fault Injection
(Bachelor / Master – immediately – 3 / 6 months)
Background
Fault Injection Attacks allow to break mathematically secure cryptographic schemes by disturbing the execution of the actual implementation, e.g., on a microcontroller or a smartcard. In the past, semi-invasive techniques based on the exposure of an IC to laser light have proven to be particularly successful. Our group built an advanced lab setup for performing laser fault injection attacks. The setup features two independent laser diodes to overcome certain countermeasures, e.g., redundant computation in two independent parts of the IC. The setup is proven to work very well and code to operate the lasers and stages was already developed.
What can you do?:
During this thesis, you will design and perform practical experiments on a previously selected target. For example, one possible target is an ASIC implementing various countermeasures against fault injection. It was developed at SECENG, i.e., we have the implementation and its layout to identify potential targets quickly. The exact details and goals will be discussed individually in person. The topic is well suited both for students of ITS and ET/IT. To practically implement the experiments, it is useful that you are familiar either with at least one suitable PC programming language, e.g., C or C++. However, this is not a strict requirement, as most concepts base on simple ideas that are quickly understood.
Contact
Advisor: Aein Rezaei Shahmirzadi and David Knichel
Mail: Aein.RezaeiShahmirzadi@rub.de or David.Knichel@rub.de
Countermeasures against Side-channel attack and statistical ineffective fault attack (SIFA)
(Bachelor / Master – immediately – 3 / 6 months)
Motivation
Recently, Statistical Ineffective Fault Attack (SIFA) [1] was proposed that used only fault free ciphertexts to reveal the information. In [2] has been shown that how to attack implementations protected with both masking and detection-based fault countermeasures using a single fault induction per execution by SIFA. It shows that SIFA pose a threat for many practical implementations of symmetric cryptography. In particular, countermeasures against both power analysis and fault attacks typically do not prevent straightforward SIFA attacks that require very limited knowledge about the concrete attacked implementation.
Research Question
As part of this thesis, you will investigate the following research question: Are the proposed schemes really secure? How can we reduce their overhead? In addition, can we identify new countermeasures against both power side-channel attacks and SIFA?
Requirements
Ideally, the student is familiar with the basic concepts of some HDL (e.g., VHDL or Verilog) and has basic knowledge on C/C++ programming. In addition, the student should have some basic background on physical attacks and countermeasures.
References
[1] Dobraunnig, et al. „SIFA: Exploiting Ineffective Fault Inductions on Symmetric Cryptography“[2] Dobraunnig, et al. „Statistical Ineffective Fault Attacks on Masked AES with Fault Countermeasures“
[3] RezaeiShahmirzadi, et al. „Impeccable Circuits II“
[4] Daemen, et al. „Protecting against Statistical Ineffective Fault Attacks“
[5] Ramezanpour, et al. „A Statistical Fault Analysis Methodology for the Ascon Authenticated Cipher“
Contact
Advisor: Aein Rezaei Shahmirzadi
Mail: Aein.RezaeiShahmirzadi@rub.de
Cycle accurate processor simulation in Gem5
(Bachelor / Master – immediately – 3 / 6 months)
Motivation
In recent years, attacks targeting microarchitectural properties of modern CPUs became a hotly debated topic in the research field of cybersecurity. With novel attack vectors like Meltowon [4] and Spectre [3], attackers can efficiently bypass higher level security mechanisms such as memory safety. Since the microarchitectural state of a CPU is not normally transparent to attackers – as well as any legitimate user – data is usually extracted via a timing side channel. Common side channels are based on caches or memory controllers.
The investigation of microarchitectural properties is no easy as dumping the microarchitectural state is normally not feasible. Therefore, we need a powerful simulator. Gem5 [1,2] is a simulation framework that lets you define CPUs in higher level languages (Python and C++) and then run cycle accurate simulations from it. It is possible to run real world programs and produce (graphical) output of internal CPU properties during runtime.
Research Question
As part of this thesis, you should first familiarize with the Gem5 simulation framework. The goal is to build a cycle accurate simulator of a simple 5-7 stage RISC-V [5] CPU which allows dynamic configuration of hardware properties such as cache layout and branch prediction. As part of your thesis, you should evaluate your processor against existing RISC-V CPUs.
Requirements
The student is required to have good programming skills in C++ and Python. Basic knowledge of CPU internals will be helpful.
References
[1] Gem5 Project Page[2] Learning Gem5
[3] Paul Kocher et. al, Spectre Attacks: Exploiting Speculative Execution, 40th IEEE Symposium on Security and Privacy 2019
[4] Moritz Lipp et. al Meltdown: Reading Kernel Memory from User Space, 27th {USENIX} Security Symposium 2018
[5] Andrew Waterma, Design of the RISC-V Instruction Set Architecture
Contact
Advisor: Jan Philipp Thoma
Mail: jan.thoma@rub.de
Electromagnetic Fault Injection (EMFI)
(Bachelor / Master – immediately – 3 / 6 months)
Background
Fault attacks aim to jeopardize the security of a cryptographic implementation by forcing the device to run outside its specification. This misbehavior possibly causes faults when processing sensitive data and can lead to successful secret extraction even if the underlying cryptographic primitives are mathematically secure. Faults can be caused by clock glitches and voltages spikes, but also by exposing the device’s circuit to laser beams and electromagnetic (EM) pulses [1]. EM pulses create a sudden current flow in the power/ ground networks of an IC, causing voltage drops and/or ground bounces. As laser beams have high spatial and temporal resolution, most of the research was done in this area. Nonetheless, EMFI is expected to have some advantages over laser fault injection [2] and is thus a promising topic for further exploration.
What can you do?:
Our group recently acquired up-to-date equipment for EM pulse injection. During this thesis you will use this equipment to perform practical evaluations on previously selected targets. Possible questions to be answered are: What faults can be caused on the target? Which areas of the chip are sensitive to EMFI? What is the size of the affected area? Can we change the data flow? Can we manipulate the program flow? If you are interested in this topic, we will together determine the scope of your thesis in more detail.
Requirements:
The topic is well suited both for students of ITS and ET/IT. To practically implement the experiments, it is useful that you are familiar either with at least one suitable PC programming language, e.g., C or C++. However, this is not a strict requirement, as most concepts base on simple ideas that are quickly understood.
References
[1] Quisquater JJ., Samyde D. (2001) „ElectroMagnetic Analysis (EMA): Measures and Counter-measures for Smart Cards“[2] Maurine, et al. „EM Injection: Fault Model and Locality“
Contact
Advisor: David Knichel
and Aein Rezaei Shahmirzadi
Mail: David.Knichel@rub.de or Aein.RezaeiShahmirzadi@rub.de
Adiabatic Logic as a countermeasure against side-channel analysis attack
(Bachelor / Master – 3 / 6 months)
Background
Adiabatic Logic actually is a methodology to design low-power applications. But their ability to balance the consumed power can make them a good countermeasure against power-analysis side-channel attacks [1–4].The main reason to consider adiabatic logics in physical security domain is their ability to soften energy dissipation profile by reducing the amplitude of the current of the power supply. Furthermore, adiabatic logic cells have dual-rail structure. Hence, they inherently satisfy the goal of DPA-resistant logic styles, i.e. achieving a constant number of transitions per working cycle [5], [6]. Basic concept of adiabatic is charging/discharging a capacitor by a constant current instead of a constant voltage, but in practical cases due to difficulty of using a constant current source, the current source is replaced by a ramp-type voltage source. Every adiabatic logic at least has two main working phases, ”Evaluation” and ”Recovery”, although most recently proposed works have 4 working phases. All adiabatic cells should be designed based on these key-rules [7]: 1) Turning on a transistor which has a non-zero potential difference between its drain and source is forbidden. 2) Turning off a transistor which current is still passing through it, is not permitted.
What can you do?:
This thesis can be defined in two basic and advanced modes: In basic phase, which is suitable for bachelor students, we want to do a comparative study on all previous adiabatic families which has been introduced as a countermeasure against power-analysis side-channel attacks. The aim of advanced mode, which is suitable for Master students, is to design a new adiabatic family.
Requirements:
Although in Basic mode, simulation and analysis of circuits is not necessary, by the way knowledge of Spice and MATLAB can be very helpful. In advanced the design should be simulated and the results should be compared with other state of the arts. So it is necessary for students to know/learn one of the Spice-based simulators such as Hspice, LTspice, Ngspice, etc. A also the results should be analysed by MATLAB, C++, Python, etc
References
[1] H. S. Raghav, V. A. Bartlett, and I. Kale, “Investigating the effectiveness of without charge-sharing quasi-adiabatic logic for energy efficient and secure cryptographic implementations,” Microelectronics Journal, vol. 76, pp. 8–21, 2018.[2] B. Fadaeinia and A. Moradi, “3-phase adiabatic logic and its sound sca evaluation,” IEEE Transactions on Emerging Topics in Computing, pp. 1–1, 2020.
[3] M. Avital, H. Dagan, I. Levi, O. Keren, and A. Fish, “Dpa-secured quasi-adiabatic logic (sqal) for low-power passive rfid tags employing s-boxes,” IEEE Transactions on Circuits and Systems I: Regular Papers, vol. 62, no. 1, pp. 149–156, Jan 2015.
[4] H. S. Raghav and I. Kale, “A balanced power analysis attack resilient adiabatic logic using single charge sharing transistor,” Integration, vol. 69, pp. 147 – 160, 2019.
[5] S. Mangard, E. Oswald, and T. Popp, Power analysis attacks – revealing the secrets of smart cards. Springer, 2007.
[6] T. Popp and S. Mangard, “Masked Dual-Rail Pre-charge Logic: DPA-Resistance Without Routing Constraints,” in CHES 2005, ser. LNCS, vol. 3659. Springer, 2005, pp. 172–186..
[7] W. C. Athas, L. J. Svensson, J. G. Koller, N. Tzartzanis, and E. Y. Chou, “Low power digital systems based on adiabatic-switching principles,” IEEE Trans. VLSI Syst., vol. 2, no. 4, pp. 398–407, 1994.
Contact
Advisor: Bijan Fadaeinia
Mail: Bijan.Fadaeinia@rub.de
Nano-Scale Side-Channel Analysis
(Masterarbeit – Bachelorarbeit)
Background:
The traditional use case of cryptography, namely transferring secret messages between two distant parties, does not involve any adversarial access to the machines that execute cryptographic algorithms. Hence, for several decades, mathematical security of the applied ciphers was the only important criterion. For many of todays applications on the other hand this assumption is no longer suitable. Smart-cards, RFID tags, electronic door locks and keys as well as many further small scale devices in the IoT are in the hands of potential adversaries with a constant and non-observable physical access to them. The most prominent class of attacks that becomes important in such a setting is the side-channel analysis. Side-channel analysis attacks are based on the observation of the physical properties of a cryptographic device and try to learn information about the internal key material. These physical properties, like e.g. the power consumption or the electromagnetic emanation, vary significantly when the respective technology is scaled down as aggressively as current nanometer CMOS processes. Thus, it is crucial to keep effective countermeasures against side-channel attacks up-to-date and to generate new ones that fit the altered conditions.
What can you do?
One of the most important – technology scaling-induced – changes in the power consumption characteristics of physical devices is the rise of the static power consumption. Since many countermeasures against power analysis attacks are based on concealing the data dependency in the dynamic currents, it can be possible to circumvent these by exploiting the information leakage through the static power dissipation.
Our group has recently built a sophisticated measurement setup for static power analysis and carried out several preliminary experiments with promising results. However, it is necessary to advance the research in this area. Concrete thesis topics can include the development and test of new countermeasures against static power analysis, the study of temperature effects on the static and dynamic power consumption in different technologies and the improvement of the existing measurement setup.
The topic is well suited both for students of ITS and ET/IT. To practically implement and test the countermeasures and to work with the FPGA boards, it is necessary that you are familiar with VHDL and at least one suitable PC programming language, e.g., C or C++. It is also possible to realize smaller parts of the project as a Studien- or Bachelorarbeit.
Contact:
If this sounds interesting to you, please contact Thorben Moos (thorben.moos@rub.de)
Efficient Hardware Implementation of DILITHIUM
(Masterthesis – immediately – 6 Months)
Motivation:
Once efficient large-scale quantum computers will be available, conventional DH-based and factoring-based public key encryption and signature primitives can be broken. However, there are several schemes that are based on (presumably) quantum-resistant problems. The US-american National Institute of Standards and Technology has launched a standardization process in 2016 – similar to the AES standardization that started in 1997 – which aims to find secure and efficient replacements for currently deployed public key schemes. Even though for each proposed scheme at least one software implementation is provided, the efficiency of hardware implementations is not yet known for many proposals.
Research Question:
CRYSTALS-DILITHIUM [1,2] is a signature scheme from the group of schemes based on module lattices. In the thesis, the scheme should be implemented efficiently for an Artix-7 FPGA and evaluated regarding speed and area consumption.
References
[1] Ducas, Léo, et al. „Crystals–dilithium: Digital signatures from module lattices.“ (2018).[2] https://pq-crystals.org/dilithium/index.shtml
Requirements
Knowledge of VHDL and FPGAs
Contact:
Advisor: Georg Land
Mail: georg.land@rub.de
Unsupervised Learning on PUFs
(Masterarbeit – Bachelorarbeit)
Background:
One of the recent cryptographic components which are attracted to an increased interest is Physically Unclonable Functions (PUFs). PUFs have been used for various applica- tions, including anti-counterfeiting schemes, key generation algorithms, and in the design of block ciphers. However, there are several different attacks on PUFs which one of the more prevalent ones are machine learning attacks with the aim of modeling the PUFs and simulate them in the requested function by an attacker. Having PUFs mathematical mod- els would be helpful to learn the desired countermeasures against these machine learning attacks. These modeling attacks can be exemplified by Artificial Neural Networks (ANN), Logistic Regression (LR), and covariance matrix adaptation evolution strategy (CMA-ES). How- ever, all of these algorithms are learning PUFs in the supervised approach. Therefore, unsupervised networks which are also helpful to discriminate the fake PUFs from the real ones, can be useful tools in the learning of PUFs which do not have the mathematical models.
Research Question:
In this thesis, we are focusing on the common delay-based PUFs such as Arbiter PUFs and XOR Arbiter PUFs in which investigate the unsupervised learning methods. These modeled PUFs can be verified through several PUF-based authentication protocols which need the model of PUF in the server side to compensate the memory attacks and area consumptions.
Requirements:
Ideally, the student is familiar with the basic concepts of Machine Learning and python programming or another programming language for these algorithms.
Contact:
If this sounds interesting to you, please contact Anita Aghaie (anita.aghaie@rub.de)
Physical Unclonable Functions on FPGAs
(Masterarbeit – Bachelorarbeit)
Background:
Physically Unclonable Functions (PUFs) generate a „digital fingerprint“ of a device. They are based on process variations to create device-specific responses, which are often used as cryptographic keys or authentication protocols. One of the most applicable delay-based PUFs is Arbiter PUF that like all PUFs pro- duce unpredictable and unclonable responses. Nevertheless, they are threatening through various attack models including machine learning attacks, side-channel attacks, and Tro- jams. Physical learning with any modeling is recently proposed as a new physical attack against PUFs in which the adversary can measure the PUFs unpredictable and unique physical characteristics. The attack scenario can be readout circuit to measure the physi- cal characteristics of the targeted PUF primitives is embedded into the design. Here, the implementation platform is an FPGA.
Research Question:
In this thesis, we focus on a new proposed attack which can be embodied as a hardware Trojan. It can model delay-based PUFs in a cloning approach without any machine learn- ing process. In fact, there are PUF applications which boost the security of cryptographic algorithms against hardware Trojans, e.g., using partial and dynamic reconfigurability on FPGAs.
Requirements:
Ideally, the student is familiar with the basic concepts of hardware security, FPGAs and HDL programming to implement the algorithms.
Contact:
If this sounds interesting to you, please contact Anita Aghaie (anita.aghaie@rub.de)
Side-Channel Measurement Board
(Masterthesis – immediately – 6 Months)
Abstract:
Physical Side-Channel Attacks (SCA) are an important security thread to many cryptographic implementations. Therefore, many countermeasures against these attacks where proposed in the scientific community and are implemented in the industry. Although provably secure countermeasures against SCA do exist, the models which the security proofs rely on can not capture every relevant aspect of the physical world a crypto-devices lives in. For this reason, every design needs to be tested and validated with actual measurements in order to reliably determine its resistance against SCA. We have developed a high-speed SCA measurement framework which can collect the required data from microcontroller or FPGA implementations of cryptographic primitives [1]. For the most part, this framework relies on commercially available SCA-boards ([2], [3]) or microcontroller boards [4] on which the analyzed algorithm is run.
What can you do?
The goal of your thesis is the development of a new printed circuit board (PCB) for side-channel evaluation that addresses some of the shortcomings of the commercial boards. The focus in this work is mainly on achieving higher flexibility (i.e. supporting different FPGAs and microcontrollers) and high-speed measurements while producing low levels of electrical noise. You do not have to develop every part of the system yourself but can use commercially available sub components such as highly integrated FPGA-boards. You thesis should include a comparison of relevant parameters of your board with state-of-the-art equipment available at the chair.
References
[1] Florian Bache, Christina Plump, Jonas Wloka, Tim Güneysu. „Evaluation of (power) side-channels in cryptographic implementations.“ (2019).[2] Sakura-G.
[3] Sakura-X.
[4] STM32f4 Discovery.
Requirements
Some experience in PCB design and familiarity with a hardware description language (e.g. VHDL, Verilog) is necessary.
Contact:
Advisor: Florian Bache
Mail: florian.bache@rub.de