Search NASA⌕ Search

SEARCH · Search NASA

Results for “side-channel”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2021

Side-channel Leakage Assessment Metrics: A Case Study of GIFT Block Ciphers

Determination of an adequate level of security and providing subsequent mechanisms to achieve it, is one of the most pressing problems regarding embedded computing devices. While there are some solutions available for resource-rich computer systems, direct application of these solutions to resource-constrained environments are often unfeasible. The fundamental problem for such resource-constrained systems is the fact that current cryptographic algorithms utilize significant energy consumption and storage overhead. Both the cryptographic algorithm and its physical implementation affect the resilience of a cryptosystem against side-channel attacks. A side-channel attack represents a process that exploits leakages in order to extract sensitive information such as the key. This paper focuses on Correlation Power Analysis (CPA) which is side-channel attack based on the power consumption leakage. In 2016 the U.S. Commerce Department’s National Institute of Standards and Technology (NIST) initiated the call for proposals of new cryptographic algorithms to strengthen the cryptographic defense of networked devices against cyberattacks and to protect the data created by those innumerable device. This work evaluates S-boxes used by NIST candidates PICCOLO, GIFT, and PRESENT, as well as several S-box variants that demonstrated sufficient weaknesses against classical cryptanalysis, for a quantitative comparison in terms of resiliency to CPA attack. Three well-known theoretical metrics are evaluated: transparency order (TO and RTO), nonlinearity, and signal-to-noise (SNR) ratio, aiming to characterize the resistance of these S-boxes against adversaries exploiting physical leakages. Experimental results from attacks on an 8- bit XMEGA were obtained via the ChipWhisperer platform and of all the S-boxes evaluated, GIFT64 with a PICCOLO S-box was found to be the most susceptible to CPA. Results showed that variations in TO and RTO were not sufficient to ensure practical CPA resistance and that among S-boxes with equal non-linearity there were no significant differences in the TO and SNR variants.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2021

Side-channel Leakage Assessment Metrics: A Case Study of GIFT Block Ciphers

Determination of an adequate level of security and providing subsequent mechanisms to achieve it, is one of the most pressing problems regarding embedded computing devices. While there are some solutions available for resource-rich computer systems, direct application of these solutions to resource-constrained environments are often unfeasible. The fundamental problem for such resource-constrained systems is the fact that current cryptographic algorithms utilize significant energy consumption and storage overhead. Both the cryptographic algorithm and its physical implementation affect the resilience of a cryptosystem against side-channel attacks. A side-channel attack represents a process that exploits leakages in order to extract sensitive information such as the key. This paper focuses on Correlation Power Analysis (CPA) which is side-channel attack based on the power consumption leakage. In 2016 the U.S. Commerce Department’s National Institute of Standards and Technology (NIST) initiated the call for proposals of new cryptographic algorithms to strengthen the cryptographic defense of networked devices against cyberattacks and to protect the data created by those innumerable device. This work evaluates S-boxes used by NIST candidates PICCOLO, GIFT, and PRESENT, as well as several S-box variants that demonstrated sufficient weaknesses against classical cryptanalysis, for a quantitative comparison in terms of resiliency to CPA attack. Three well-known theoretical metrics are evaluated: transparency order (TO and RTO), nonlinearity, and signal-to-noise (SNR) ratio, aiming to characterize the resistance of these S-boxes against adversaries exploiting physical leakages. Experimental results from attacks on an 8- bit XMEGA were obtained via the ChipWhisperer platform and of all the S-boxes evaluated, GIFT64 with a PICCOLO S-box was found to be the most susceptible to CPA. Results showed that variations in TO and RTO were not sufficient to ensure practical CPA resistance and that among S-boxes with equal non-linearity there were no significant differences in the TO and SNR variants.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2026

DISARM: Target Electronic Device Informed Mitigation of Software Runtime Side-Channel Vulnerabilities

Program runtime/timing attacks exploit variations in a program’s execution times to extract sensitive information from the program (e.g. encryption keys, sensitive variable data, intellectual property). State-of-the-art solutions to runtime side-channel attacks attempt to balance the execution time of the sensitive code for different control flow paths to eliminate the timing leakage. However, during the mitigation process, most techniques do not consider the underlying hardware/device on which the target program is supposed to run on. This can lead to over-fixing (unnecessary extra operations), under-fixing (not solving the imbalance properly), and even failures. Here, we propose DISARM, a joint hardware-software methodology (unlike any existing solution) for mitigating runtime side-channel vulnerabilities that utilizes timing values from real embedded devices to generate targeted software fixes. We implement DISARM to support C/C++/Java source codes and validate it across 22 standard benchmarks. DISARM outperforms state-of-the-art solutions such as PENDULUM and DifFuzzaR in terms of execution time overhead, code size overhead, and correctness on five different embedded/edge devices.

Timing/runtime side-channel↗
DOE OSTI2026

Hardware Aware Mitigation of Timing Side-Channel Vulnerabilities in Critical Infrastructure Software

Program runtime/timing attacks exploit variations in a program’s execution times to extract sensitive information from the program (e.g. encryption keys, sensitive variable data, intellectual property). State-of-the-art solutions to runtime sidechannel attacks attempt to balance the execution time of the sensitive code for different control flow paths to eliminate the timing leakage. However, during the mitigation process, most techniques do not consider the underlying hardware/device on which the target program is supposed to run on. This can lead to over-fixing (unnecessary extra operations), under-fixing (not solving the imbalance properly), and even failures. We propose DISARM, a joint hardware-software methodology (unlike any existing solution) for mitigating runtime side-channel vulnerabilities that utilizes timing values from real embedded devices to generate targeted software fixes. We implement DISARM to support C/C++/Java source codes and validate it across 22 standard benchmarks. DISARM outperforms state-of-the-art solutions such as PENDULUM and DifFuzzAR in terms of execution time overhead (up to −46%), code size overhead (up to −10%), and correctness (no failures) on five different embedded/edge devices.

Suha, Tasneem [University of Maine]↗
DOE OSTI2020

Side Channel Considerations for SHA-512

We consider a theoretical side-channel attack on SHA-512; the attack should easily generalize to other algorithms in the SHA-2 family. Rather than looking at a side-channel attack on an HMAC, which has been done in various papers, we assume that the targeted device is applying the hash function as a pseudo-random function (prf) in order to generate a secret key from a secret seed, as recommended by NIST. The analyst uses side-channel information to try to recover the secret seed. We use entropy/information theory to show how one might judge whether or not a side-channel attack might be possible and/or feasible, and we show how the design of the implementation can affect the feasibility of an attack.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2021

Evaluation of Interior Cellular Shades in a Residential Building

Windows are major contributors to energy demand in residential homes because of their inferior thermal resistance compared with the opaque envelope and sometimes from unwanted solar heat gain. Window attachments can help to mitigate this demand by controlling the solar heat gains and enhancing the thermal resistance of the windows. In this study, the energy savings potential of cellular shades in residential homes is studied using experimental testing and energy simulations. The energy performance of the shading devices was experimentally tested during the heating season from December 2019 to May 2020 with a focus on cellular shades. Five shading devices—three single and two double cellular/cell-in-cell shades—were used to compare the performance with generic horizontal (venetian) blinds using two nearly identical sideby-side rooms in a residential building with their exterior window facing east. Another objective of the experimental testing was to evaluate any impact of the side-channel of the shading device on energy savings. To observe the impact of the side-channels on energy savings, from shades in two of the test cases, cellular shades with side-channels were used. From the experimental testing, daily energy savings in the range of 9% to 23% were observed by considering data from 6 p.m. until 6 a.m. of the next day.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗
DOE OSTI2024

Beyond the Bridge: Contention-Based Covert and Side Channel Attacks on Multi-GPU Interconnect

Recently, high-speed interconnects like NVLink have become a standard integration in modern multi-GPU systems, serving as a crucial bridge between CPUs and GPUs. This study highlights the vulnerability of multi-GPU systems to covert and side-channel attacks arising from congestion on these interconnects. An adversary, operating without special permissions, can extract private information about a victim's activities by monitoring NVLink congestion. Specifically, we leverage this insight to develop a covert channel attack across two GPUs, achieving a respectable bandwidth of 33 Kbps. Additionally, we introduce a side-channel attack that allows attackers to fingerprint applications on a remote GPU by probing the shared NVLink interconnect. We underscore the urgent nature of the threats posed by these attacks and advocate for heightened awareness within both industry and academia to implement multi-GPU interconnects with enhanced security measures.

Zhang, Yicheng↗
DOE OSTI2026

Cybersecurity Center for Offshore Wind Energy (Final Project Report)

This project establishes a Cybersecurity Center for Offshore Wind Energy with the objective of designing and operating a cyber-physical testbed for wind energy farms (WEFs) that enables comprehensive cybersecurity research. The testbed incorporates a Supervisory Control and Data Acquisition (SCADA) system connected to turbine models via industrial-grade programmable logic controllers (PLCs) and remote terminal units (RTUs). It supports side-channel data acquisition, implementation and analysis of various cyberattack scenarios, and development of attack detection, mitigation, and best-practice guidance tailored to wind energy systems. During the project, the team expanded the number and fidelity of mathematical turbine models (MTMs), integrated these models with SCADA infrastructure, and deployed a scaled physical turbine and associated sensors. High-resolution operational and side-channel data streams were collected and used to refine machine-learning (ML)-based attack detection systems and to extend the WindCRAFT framework to multi-turbine threat scenarios. The project demonstrated a realistic, scalable environment for evaluating cyber threats, validated attack detection approaches using enriched datasets, and identified new multi-turbine and inter-turbine communication attack vectors. The resulting testbed, models, and security mechanisms provide a foundation for ongoing R&D and deployment of cyber-resilient offshore wind energy systems.

17 WIND ENERGY↗
DOE OSTI2020

A secure measurement unit for an inspection system used in nuclear arms-control verification

Verification of arms control treaties may require information barriers to protect sensitive data acquired during the verification process. These information barriers are commonly implemented in software, but must store and operate on data that are vulnerable to attack and tampering. Here, we present a new Secure Measurement Unit based on a modified pipeline SAR ADC architecture. The idea is to move the information barrier back into the digitization process so that prohibited data is never created. A prototype 65nm CMOS Secure Measurement Unit (SMU) was tested using U-235, U-238, Co-60, Cs-137 and Am-241 sources. Here, the prototype accurately digitized allowable signals while being immune to side-channel attacks on signals within preset forbidden regions.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2024

Field test of continuous-variable quantum key distribution with a true local oscillator

A continuous-variable quantum key distribution (CV QKD) using a true local (located at the receiver) oscillator (LO) has been proposed to remove any possibility of side-channel attacks associated with transmission of the LO as well as reduce the cross-pulse contamination. Here we report an implementation of true LO-CV QKD using “off-the-shelf” components and conduct QKD experiments using the fiber optical network at Oak Ridge National Laboratory. A phase reference and quantum signal are time multiplexed and then wavelength division multiplexed with the classical communications that “coexist” with each other on a single optical network fiber. Importantly, this is the first demonstration of CV QKD with a receiver-based true LO over a deployed fiber network, a crucial step for its application in real-world situations.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

PRISTINE: An Emulation Platform for PCB-Level Hardware Trojans

Printed circuit Boards (PCBs) are becoming increasingly vulnerable to malicious design alteration, also known as Trojan attacks, due to a distributed business model that often involves various untrusted parties. Such attacks can be mounted at various stages in the PCB life cycle. The relative ease of alteration of PCB hardware even after fabrication (due to physical access to surface-mounted critical components and traces) makes them attractive for an adversary to manipulate their functional/physical behavior for malicious intent. There is a growing need to explore viable Trojan attacks in a PCB, analyze their functional and physical characteristics (e.g., impact on power or delay), and study the effectiveness of countermeasures against these attacks. While simulation-based approaches for PCB Trojan insertion are effective at creating a large population of possible Trojans, they fail to provide functional feasibility analysis with a realistic workload for a trigger circuit. Also, they cannot estimate a Trojan’s side-channel footprint due to the unavailability of physical models of diverse PCB components. To address these deficiencies, in this paper, we present PRISTINE, a PCB-level emulation system for any integrity or physical tampering issues, specifically, hardware Trojan insertion. The need for building such an emulation platform to resolve PCB trust issues in the supply chain is also surveyed and discussed. Both custom Hardware Hacking (HaHa) boards and multiple commercial PCBs are then used to test the ability of the proposed system to emulate various hardware Trojans specially designed to exploit board-specific hardware characteristics. Experimental results on emulated board-level Trojans show that a wide range of Trojans can be successfully activated, thus enabling the expected payload effects on both types of boards to be studied and quantified. The resulting data are further analyzed to create PCB-level Trojan benchmarks. In particular, a comparative evaluation of the experimental results is used to propose a risk level metric that quantifies the probability of detection and degree of payload impact of each Trojan on a given commercial PCB.

47 OTHER INSTRUMENTATION↗
DOE OSTI2022

Vulnerability of a VOC-Based Inverter Due to Noise Injection and Its Mitigation

Even though virtual oscillator control (VOC)-based inverters do not communicate with each other, they need to make local measurements for control. The impact of tampering with these measured or sensed signals on the performance of a VOC-based inverter and synchronization of multiple such inverters is an important but open-ended issue. As such, this letter explores the impact of intentional side-channel noise intrusion (SNI) on the synchronization of VOC-based communication-free self-synchronizing inverters (CFSIs). Two different scenarios are investigated via experimental and analytical studies using a half-bridge neutral point clamped (NPC) single-phase CFSI. Furthermore, they address the impact of SNI on the ability of a CFSI to ensure a stable 60-Hz limit cycle and on the parallel operation of two such CFSIs to ensure synchronism to a common 60-Hz load frequency.

42 ENGINEERING↗
DOE OSTI2020

Side Channel Considerations for AES Intermediate Rounds

We illustrate a theoretical side-channel analysis on the intermediate rounds of AES, using only the Hamming weights of the bytes registered after the S-box operation. Input and output state values are unknown. Simulations and a blind test were used to show the feasibility of the analysis under ideal conditions. General applicability of the idea and possible extensions are discussed, as well as limiting assumptions. Some implementation approaches are described in Appendix A, in the case of constrained computing capabilities (desktop or laptop).

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2021

Hydrologic Evaluation of Smallmouth Bass Spawning Sites in the Upper Green River Using LiDAR

The smallmouth bass has been considered one of the most problematic invasive species in the upper Colorado River basin. As a predator of larval fish and juveniles, this nonnative species is an impediment to conservation efforts for endangered fish species of the Colorado River basin including Colorado pikeminnow (Ptychocheilus lucius), razorback sucker (Xyrauchen texanus), humpback chub (Gila cypha), and bonytail chub (Gila elegans). Several measures have been recommended to control smallmouth bass populations to conserve the endangered fish species. Among these measures are efforts to control flows during the spawning season to disrupt smallmouth bass reproduction. Previous work has suggested that smallmouth bass spawning in areas of the Green River could be inhibited during higher flows from the Flaming Gorge Dam due to lack of suitable habitat. Little research has been conducted to evaluate an optimal range of flow increases (“flow spikes”) needed to disrupt smallmouth bass reproduction in the Green River. Current research proposals to evaluate the effectiveness of flow spikes on controlling smallmouth bass reproduction target post-spawning flows of 4,500 cfs, maintained for three days, to inundate side-channel spawning habitats. In this report, we present results of a topographic study of smallmouth bass spawning sites in the upper Green River to characterize flow levels needed to inundate spawning habitats. This study used remotely sensed Light Detection and Ranging (LiDAR) data collected along the entire Green River, including channel margins and floodplain areas, to model water surface elevations and flow spikes needed to connect and inundate smallmouth bass spawning sites.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2023

An Integrated Testbed for Trojans in Printed Circuit Boards with Fuzzing Capabilities

This paper showcases an all-in-one testing environment that combines Trojan detection and fuzzing capabilities for printed circuit boards using the OpenPLC “NYU Trojan Edition” and a dedicated Trojan detection framework. The demo system is self-contained and equipped with two OpenPLC-based boards (one with a Trojan and one without), and automated tools for inserting the Trojan and collecting side-channel data. We developed a graphical user interface for interactive Trojan selection, data visualization, and anomaly detection analysis.

Trojan detection, anomaly detection, PCB, timing l↗