@article {18482,
	title = {Automatic Application of Power Analysis Countermeasures},
	journal = {IEEE Transactions on Computers },
	volume = {64},
	issue = {2},
	year = {2015},
	month = {02/2015},
	pages = {329-341},
	type = {journal},
	chapter = {329},
	abstract = {We introduce a compiler that automatically inserts software countermeasures to protect cryptographic algorithms against power-based side-channel attacks. The compiler first estimates which instruction instances leak the most information through side-channels. This information is obtained either by dynamic analysis, evaluating an information theoretic metric over the power traces acquired during the execution of the input program, or by static analysis. As information leakage implies a loss of security, the compiler then identifies (groups of) instruction instances to protect with a software countermeasure such as random precharging or Boolean masking. As software protection incurs significant overhead in terms of cryptosystem runtime and memory usage, the compiler protects the minimum number of instruction instances to achieve a desired level of security. The compiler is evaluated on two block ciphers, AES and Clefia; our experiments demonstrate that the compiler can automatically identify and protect the most important instruction instances. To date, these software countermeasures have been inserted manually by security experts, who are not necessarily the main cryptosystem developers. Our compiler offers significant productivity gains for cryptosystem developers who wish to protect their implementations from side-channel attacks},
	keywords = {cryptographic algorithms protection, cryptography, data protection, power analysis attacks, program compilers, side-channel attacks},
	issn = {0018-9340},
	doi = {10.1109/TC.2013.219},
	url = {http://dx.doi.org/10.1109/TC.2013.219},
	author = {Bayrak, Ali Galip and Regazzoni, Francesco and Novo, David and Brisk, Philip and Standaert, Fran{\c c}ois-Xavier and Ienne, Paolo}
}
@conference {18477,
	title = {Challenges in designing trustworthy cryptographic co-processors},
	booktitle = {IEEE International Symposium on Circuits and Systems (ISCAS) 2015},
	year = {2015},
	month = {09/2015},
	pages = {2009-2012},
	publisher = {IEEE},
	organization = {IEEE},
	address = {Lisbon, Portugal},
	abstract = {Security is becoming ubiquitous in our society. However, the vulnerability of electronic devices that implement the needed cryptographic primitives has become a major issue. This paper starts by presenting a comprehensive overview of the existing attacks to cryptography implementations. Thereafter, the state-of-the-art on some of the most critical aspects of designing cryptographic co-processors are presented. This analysis starts by considering the design of asymmetrical and symmetrical cryptographic primitives, followed by the discussion on the design and online testing of True Random Number Generation. To conclude, techniques for the detection of Hardware Trojans are also discussed},
	keywords = {asymmetrical cryptographic primitives, cryptography, hardware Trojan detection techniques},
	issn = {0271-4302 },
	doi = {10.1109/ISCAS.2015.7169070},
	url = {http://dx.doi.org/10.1109/ISCAS.2015.7169070},
	author = {Regazzoni, Francesco and Graves, Ricardo and Di Natale, Giorgio and Batina, Lejla and Bhasin, Shivam and Ege, Baris and Fournaris, Apostolos P. and Mentens, Nele and Picek, Stjepan and Rozic, Vladimir and Sklavos, Nicolas and Yang, Bohan}
}
@conference {18475,
	title = {Exploring the energy consumption of lightweight blockciphers in FPGA},
	booktitle = {International Conference on ReConFigurable Computing and FPGAs, ReConFig 2015},
	year = {2015},
	month = {02/2016},
	pages = {1-6},
	publisher = {IEEE},
	organization = {IEEE},
	edition = {2015},
	address = {Rivera Maya, Mexico City},
	abstract = {Internet of things and cyber-physical systems requiring security functionality has pushed for the design of a number of block ciphers and hash functions specifically developed for being implemented in resource constrained devices. Initially the optimization was mainly on area and power consumption, but, nowadays the attention is more on the energy consumption. In this paper, for the first time, we look at energy consumption of lightweight block ciphers implemented in reconfigurable devices, and we analyze the effects that round unrolling might have on the energy consumed during the encryption. Concentrating on applications that require a number of parallel encryptions, we instantiate several designs on the target FPGA and we analyze how the energy consumption varies in each algorithm when changing the amount of unrolled rounds. Our results, obtained on the Xc6slx45t device of the Spartan6 family, demonstrate that Present is the most energy efficient algorithm and that the relation between the energy consumption and the number of unrolled rounds measured on FPGA is similar to the one measured on dedicated hardware.},
	keywords = {cryptography, cyber-physical systems, encryption, lightweight block cipher},
	isbn = {978-1-4673-9406-2},
	doi = {10.1109/ReConFig.2015.7393308},
	url = {http://ieeexplore.ieee.org/xpl/mostRecentIssue.jsp?punumber=7390332},
	author = {Banik, Subhadeep and Bogdanov, Andrey and Regazzoni, Francesco}
}
@conference {18479,
	title = {Physical attacks, introduction and application to embedded processors},
	booktitle = {10th International Conference on Design Technology of Integrated Systems in Nanoscale Era DTIS 2015},
	year = {2015},
	month = {06/2015},
	pages = {1},
	publisher = {IEEE},
	organization = {IEEE},
	address = {Napoli, Italy},
	abstract = {Physical attacks exploit the physical weaknesses of cryptographic devices to reveal the secret information stored on them. Successful attacks demonstrated in the past were both active, when the adversary tampers with the device to alter its normal behavior, or passive, when the adversary monitors side channels to infer the secret key. In view of this increasingly relevant problem, this talk introduces the most powerful physical attacks presented in the past and highlights state of the art countermeasures, focusing in particular on the embedded systems{\textquoteright} scenario.},
	keywords = {cryptography, embedded processors, embedded systems, microprocessors chips, physical attacks},
	isbn = {978-1-4799-1999-4},
	doi = {10.1109/DTIS.2015.7127356},
	url = {http://ieeexplore.ieee.org/xpl/mostRecentIssue.jsp?punumber=7118811},
	author = {Regazzoni, Francesco}
}
@conference {18462,
	title = {Security Challenges for Hardware Designers of Mobile Systems},
	booktitle = {2015 Mobile Systems Technologies Workshop (MST)},
	year = {2015},
	month = {May},
	keywords = {cryptographic capabilities, cryptographic primitives, cryptography, hardware, hardware design flow, hardware designers, hardware trojan, Hardware Trojans, Integrated optics, malware, mobile communication, mobile computing, mobile device, mobile devices, Mobile handsets, mobile systems, Optical device fabrication, pervasive mobile devices, physical attack, physical attacks, security, security challenges, software malware, telecommunication security, Trojan horses},
	doi = {10.1109/MST.2015.11},
	author = {Milosevic, Jelena and Ferrante, Alberto and Regazzoni, Francesco}
}
@conference {82.BeBrFaRe08,
	title = {A 640 Mbit/s 32-bit Pipelined Implementation of the AES Algorithm},
	booktitle = {SECRYPT},
	year = {2008},
	month = {July 26},
	address = {Porto, Portugal},
	abstract = {Due to the diffusion of cryptography in real time applications, performances in cipher and decipher operations are nowadays more important than in the past. On the other side, while facing the problem for embedded systems, additional constraints of area and power consumption must be considered. Many optimized software implementations, instruction set extensions and co-processors, were studied in the past with the aim to either increase performances or to keep the cost low. This paper presents a co-processor that aims to be an intermediate solution, suitable for such applications that require a throughput in the Megabit range and where the die size is a bit relaxed as constraint. To achieve this goal, the core is designed to operate at 32 bits and the throughput is guaranteed by a 2 stage pipeline with data forwarding. The obtained results synthesizing our coprocessor by means of the CMOS $0.18$ $μ$m standard cell library show that the throughput reaches 640 Mbit/s while the circuit size is of only 20 K equivalent gates. },
	keywords = {cryptography, security},
	author = {Bertoni, Guido Marco and Breveglieri, Luca and Farina, Roberto and Regazzoni, Francesco}
}
@conference {67.ReEiGr07,
	title = {Power Attacks Resistance of Cryptographic S-boxes with added Error Detection Circuits},
	booktitle = {proceedings of: {\textquoteright}22nd IEEE International Symposium on Defect and Fault Tolerance in VLSI Systems (DFT{\textquoteright}07)},
	year = {2007},
	month = {September 26-28},
	address = {Rome, Italy},
	abstract = {Many side-channel attacks on implementations of cryptographic algorithms have been developed in recent years demonstrating the ease of extracting the secret key. In response, various schemes to protect cryptographic devices against such attacks have been devised and some implemented in practice. Almost all of these protection schemes target an individual side-channel attack and consequently, it is not obvious whether a scheme for protecting the device against one type of side-channel attacks may make the device more vulnerable to another type of side-channel attacks. We examine in this paper the possibility of such a negative impact for the case where fault detection circuitry is added to a device (to protect it against fault injection attacks) and analyze the resistance of the modified device to power attacks. To simplify the analysis we focus on only one component in the cryptographic device (namely, the S-box in the AES and Kasumi ciphers), and perform power attacks on the original implementation and on a modified implementation with an added parity check circuit. Our results show that the presence of the parity check circuitry has a negative impact on the resistance of the device to power analysis attacks.},
	keywords = {cryptography, fault tolerance, reliable applications, side channel attacks},
	author = {Regazzoni, Francesco and Eisenbarth, Thomas and Gro{\ss}sch{\"a}dl, Johann and Breveglieri, Luca and Ienne, Paolo and Koren, Israel and Paar, Christof}
}
@conference {39.1169233,
	title = {Speeding Up AES By Extending a 32 bit Processor Instruction Set},
	booktitle = {ASAP {\textquoteright}06: Proceedings of the IEEE 17th International Conference on Application-specific Systems, Architectures and Processors (ASAP{\textquoteright}06)},
	year = {2006},
	pages = {275-282},
	publisher = {IEEE Computer Society},
	organization = {IEEE Computer Society},
	address = {Washington, DC, USA},
	abstract = {Nowadays the need of speed in cipher and decipher operations is more important than in the past. This is due to the diffusion of real time applications, which fact involves the use of cryptography. Many co-processors for cryptography were studied and presented in the past, but only few works were addressed to the enhancement of the instruction set architecture (ISA) of the embedded processor. This paper presents an extension of the ISA of a 32 bit processor, that aims at speeding up the software implementations of the AES algorithm. After the identification of the most frequently executed and the most time consuming sections of the algorithm, a set of dedicated instructions is designed in order to improve the performances of the cipher operations. We validate our instruction set extension by measuring the speed up for different optimized implementations of AES using an ARM processor simulator, but the enhancements we propose are general enough to be applied to almost all 32 bit processors.},
	keywords = {cryptography, HW/SW co-design, instruction set extension},
	isbn = {0-7695-2682-9},
	doi = {http://dx.doi.org/10.1109/ASAP.2006.62},
	author = {Bertoni, Guido Marco and Breveglieri, Luca and Farina, Roberto and Regazzoni, Francesco}
}
