You are here: Start » Research » Implementation Attacks » IMPA Lab Infrastructure

IMPA Lab Infrastructure

In order to perform implementation attacks, the IMPA Lab uses different controlling, manipulation, and analysis equipment. Special software toolsets have been developed to control and simulate implementation attacks and to analyze the obtained data. Furthermore, a semi-custom design flow has been extended to design and implement IMPA-resistant cryptographic devices.

Attack (controlling and measurement) Setups for PA and EMA

	Microcontroller board "DPA Demo Board" (is available from IAIK) PCB with an 8052-compatible microcontroller from Atmel for basic PA and EMA experiments with cryptographic software implementations.
	Smart card board (is available from IAIK) Basic smart-card reader for PA and EMA attacks on smart cards. The reader software allows to send an receive arbitrary APDUs.
	FPGA board "DPA20K" (is available from IAIK) FPGA board to evaluate FPGA-implementations of cryptographic hardware in the context of PA and EMA.
	Chip tester from National Instruments™
	RFID HF-readers (Tagnology, NXP) and UHF-readers (CAEN)

Measurement Equipment for PA

Digital storage oscilloscopes

Stand-alone scope from LeCroy
PCI-card scope for PCs from GaGe

Differential probe for scopes from LeCroy

Measurement Equipment for EMA

	EMI receiver (spectrum analyzer) from Rohde & Schwarz
	Near-field EM-probes with amplifier
	Self-made EM shielding box with broadband antenna
	Far-field bar antenna

Inspection Equipment for FA

Microscope

with motorized scanning stage

Fault-Induction Equipment for FA

	Power-spike generator
	Light-puls generator
	EM-puls generator

Mechanical Manipulation Equipment for FA

	Drills, milling cutters, etc.
	Chemicals for decapsulation (Acetone, fuming nitric acid, etc.)
	Heating plate
	Ultrasonic bath

Software Toolsets

Matlab "SCA Toolbox"

Matlab® toolbox to control and simulate SCA attacks and to analyze the obtained data (is available from IAIK)

Due to the spreading, flexibility, and functional richness (statistical func., signal processing func., device controling func.) of Matlab, we use it whenever the performance allows it. In other cases we source out functions into C/C++, Java, ..., which can be easily accessed via Matlab.

The main features of the "SCA Toolbox" are:

Attack functions based on different statistical tests for all types of SCA attacks (e.g. DPA, DEMA, template attacks)
Functions that calculate cryptographic algorithms (AES, DES, etc.) for hypotheses calculation
Functions to control the measurement equipment (e.g. digital oscilloscope, EMI receiver)
Functions to control the attacked devices (e.g. smart cards, ASICs, FPGA designs, microcontrollers, RFID tags over serial ports, parallel ports, RFID readers, etc.)
Side-channel trace management functions (e.g. trace importing also from simulation, trace storage)
Functions to (pre-)process side-channel traces (e.g. filtering, aligning, windowing, compressing, pattern matching, higher-order preprocessing)
Functions to display and print side-channel traces and analysis results (e.g. Trace Analyst, highlight-plots, fft-plots, grid-plots)
Various other useful functions (e.g. creation of best-practice folder structures for attacks, calculation of SCA attack related values like SNR or number of needed measurements for successful attacks, calculation of confidence intervals).

The Matlab SCA Toolbox is available for Windows and Linux platforms (32/64-bits).

CAD Tools for IMPA-Resistant Cryptographic Devices

Extended semi-custom design flow for IMPA-resistant design and implementation of cryptographic circuits

Mainly Cadence® and Synopsys® tools