hardware security engineers

Abstract: Despite their theoretical quantum attack resistance, practical implementations of post-quantum cryptography (PQC) algorithms remain susceptible to side-channel attacks. This includes all standard algorithms selected the National Institute of Standards and Technology (NIST) such as Kyber/ML-KEM, Dilithium/ML-DSA, Falcon/FN-DSA and SPHINCS+/SLH-DSA. This paper proposes an alternative defense for side-channel resilience based on 3D integration that uses 3D hardware to shield the underlying cryptographic activity by introducing decoy keys and physical shielding through stacking. The proposed approach can complement other security measures (such as masking and shuffling) on protecting Number Theoretic Transform (NTT) that move computation to dedicated NTT chips. We outline the construction of our approach and validate the effectiveness on a generic attack targeting intermediate computation inside an NTT butterfly.

Abstract: Untrusted third-party entities throughout the semiconductor supply chain expose proprietary hardware intellectual property to reverse engineering, piracy, and overproduction. While logic locking counters this threat by embedding key-dependent logic, conventional static key-gates remain vulnerable to both oracle-guided SAT attacks and structural removal attacks due to their time-invariant netlist signatures. Dynamic schemes such as STREAMLOCK mitigate oracle attacks by continuously masking signals with cryptographic keystream, achieving near 50\% Hamming distance output corruption under incorrect keys with low hardware overhead. However, confining key-gates to primary outputs leaves internal combinational cones vulnerable to single-tap structural bypasses. This work extends dynamic logic locking by distributing key-gates within internal paths prioritized via fault-propagation analysis. The original and internally-hardened architectures are evaluated against structural removal attacks and a bounded, unrolling-based SAT-style attack across three ISCAS'85 benchmarks. Distributing masking internally raises the uninformed attacker's brute-force search space from 6 candidate node subsets to over $10^{45}$ for the largest benchmark. Crucially, empirical analysis reveals that topological relocation alone does not prevent algebraic key extraction when wide circuits expose numerous keystream bits per clock cycle. To eliminate this leak, a keystream-bit reuse cap is introduced to restrict per-cycle exposure independent of circuit width. Under this constraint, SAT-solver tractability encounters an immediate computational cliff, transitioning sharply from rapid under-constrained solving to timeout thresholds without disclosing the secret key. Integrating fault-aware internal placement with keystream reuse capping delivers joint resilience against structural bypasses and bounded SAT attacks.

Abstract: Data memory-dependent prefetchers (DMPs) are a microarchitectural optimization recently introduced in mainstream desktop and server CPUs. Although DMPs offer performance improvements, they have been shown to enable side-channel leakage of secrets, even from constant-time code that has been hardened against Spectre attacks. Unfortunately, existing defenses either incur significant performance overhead or, as we show, fail to prevent all DMP leakage. In this work, we address this gap by designing a defense that is both secure and efficient. First, we propose a classification of DMP leakage, categorize existing and novel attacks, and analyze which leakage classes are mitigated by existing defenses. We validate this analysis empirically by implementing the first open-source DMPs on a RISC-V processor, showing that the only existing defense that aims to preserve DMP performance fails to protect against entire leakage classes. Next, we propose SecDMP, a provably secure and efficient hardware-based defense. SecDMP requires secrets to be marked in memory and ensures that DMPs never encode these secrets in the microarchitecture---without compromising performance for public data. We formally prove that SecDMP introduces no leakage beyond a baseline semantics without DMPs. Notably, when combined with speculative-execution defenses, SecDMP restores complete microarchitectural security for constant-time code. Finally, our empirical evaluation shows that SecDMP prevents all DMP leakage while incurring minimal performance overhead and hardware cost.

Abstract: Hardware malware detectors (HMDs) classify hardware performance-counter measurements to identify malicious execution. Faults in their decision logic or parameters can weaken detection and allow malware to be classified as benign. We investigate this vulnerability through structural fault injection across a design space comprising 18 classifiers, four counter budgets, and AdaBoost and Bagging ensembles. The simulation evaluates 453,174 decision stuck-at and selected parameter bit-flip events on a 7,400-instance. Primary comparisons use 128 completed configurations. These completed-subset results are distinguished from the simulation summaries covering 140 configurations with enumerable fault sites. Fault outcomes are classified by their security consequences, including evasion, false-alarm increases, and metric silence. A fault is critical when malware recall decreases by at least five percentage points. Tree-based models exhibit a lower mean critical-fault fraction than function-based models, 5.3% versus 14.3%; exhaustive-only analysis preserves this ordering. Moreover, 72.3% of evaluated tree faults are metric-silent, changing both recall and false-positive rate by less than 0.1 percentage points without necessarily preserving individual predictions. Among the 27 completed matched comparisons, Bagging reduces criticality in 26, whereas AdaBoost increases it in two. Finally, an exact minimax selection method identifies protection candidates under additive unit costs and ideal correction. For a representative J48 detector, protecting 16 of 115 structural units reduces predicted maximum recall loss from 60.1 to 3.3 percentage points. These results characterize structural-model sensitivity and potential protection benefits; faulted RTL correspondence and physical hardening overhead remain unvalidated.

Abstract: Hyperdimensional computing (HDC) offers efficient learning and inference for resource-constrained systems, yet ownership verification of its models remains underexplored. We present the first systematic investigation of model watermarking in HDC by adapting backdoor-based embedding to three classifiers with different prototype-learning mechanisms. Across four benchmarks, with conventional neural networks as references, we examine whether watermarks can be learned without compromising task accuracy and whether they survive subsequent model modification and replication. The error-driven classifiers, AdaptHD and OnlineHD, support verification at a nominal trigger exposure of 1% with at most 0.58 percentage points of mean accuracy loss, whereas single-pass Vanilla HDC requires greater exposure and can incur substantial accuracy costs. The error-driven models retain verification under native continued training, but extraction produces surrogates that reproduce much of the task behavior without verifiable watermarks. Watermark overwriting readily embeds attacker watermarks into HDC prototypes and erodes the owner's watermark more strongly than in the neural network references, although the strongest erosion coincides with large accuracy losses. We further deploy watermarked AdaptHD on an FPGA and stress its execution through undervolting and overclocking. Verification survives substantial computation errors, whereas more severe stress either causes verification failure together with accuracy collapse or results in inference timeouts. These findings establish the feasibility of watermarking in HDC while identifying limitations in retention under extraction and sensitivity to overwriting.

Abstract: NIST standardised ML-KEM and ML-DSA in 2024 for post-quantum key establishment and digital signatures. Both compute forward number-theoretic transforms (NTTs) on secret polynomials. Published attacks zero every fixed multiplier, or twiddle, during Kyber key generation with a single fault, or individual twiddles in one Dilithium signing variant; countermeasures detect or mask these faults. Nonzero replacements preserve invertibility, but the uncompressed correct-minus-faulted transform difference can still expose input information. This paper characterises the linear map from a secret polynomial to this difference under arbitrary static twiddle replacements, including bit-flips. For one fault, rank equals the number of butterflies sharing its twiddle, halving by layer from 128 to 2 for ML-KEM and to 1 for ML-DSA. Known positions, replacement values and the difference determine that many independent linear combinations of input coefficients. With one fault per layer, all but the constant and linear coefficients for ML-KEM, or the constant for ML-DSA, are determined; Lean 4 certifies this rank-and-kernel result. Those coefficients cancel for every fault set and choice of replacement values. NIST permits seed storage, motivating comparison of a known correct key with a released faulty key from the same seed. If only one ML-KEM secret-polynomial NTT is faulted, the key difference is a known matrix column times the transform difference; an invertible column entry reconstructs the latter. For ML-DSA, neither reconstruction nor the number of secret-polynomial candidates from compressed key differences is established. The per-layer ranks give a closed-form measure of raw exposure for countermeasure design.

Abstract: We revisit DM-RSA, an RSA variant that uses two independent moduli, whose original version was broken by Håstad's attack and contained an incorrect compromise-tolerance claim. We give a formal treatment of its repaired variant, DM-RSA-OAEP: (i) a complete IND-CCA2 security proof in the random-oracle model via a two-step hybrid argument, upper-bounding the security of the scheme by that of the weaker underlying RSA-OAEP instance, with an explicit simulation loss; (ii) a fault-detection theorem in an explicit adversary model that covers computation, key, and verification faults, including safe-error attacks, under a clearly stated physical-diversity assumption; (iii) an explicit analysis of why the countermeasure degrades to uselessness when the diversity assumption is violated (common-mode faults on a single chip). We position the scheme against the countermeasure landscape and against the broken dual-modulus literature. The contribution is deliberately framed as a fault countermeasure with a provable detection guarantee, not as a computationally stronger RSA. We conclude with a concrete instantiation and a detailed measurement protocol.

Abstract: The stream cipher Espresso was designed by E. Dubrova and M. Hell as a hardware-efficient candidate for 5G security. It has two components - a 256-bit binary non-linear feedback shift register (NFSR), with 14 feedback taps, and a 20-variable non-linear output function. However, the security of Espresso with regard to several standard cryptanalytic attacks are estimated using an alternate NFSR, which has only two feedback taps. The above analysis is based on the claim that this alternate NFSR is obtained using a transformation algorithm which preserves the output sequence of the original NFSR. This issue has become all the more significant in the light of recent results on hardware performance evaluations, which assume that the stated equivalence holds. This article presents the first successful attempt in settling the above question of Espresso NFSR equivalence. We arrive at our main result by a careful analysis of existing transformation methods relevant to the question. In doing so, we first identify and correct a critical flaw in the proof of a foundational result of E. Dubrova. Next, in the context of Espresso equivalence, we analyze and unify the transformation framework of Dubrova and the one proposed by Yao and Parampalli. Based on our analysis, we have succeeded in transforming the LFSR in an Espresso-equivalent design reported by Yao and Parampalli to the Espresso alternate NFSR. Further, we have obtained a corresponding non-linear output function which achieves output-equivalence with the LFSR design, and hence, with Espresso.

Abstract: Threat analysis and risk assessment (TARA) according to ISO/SAE 21434 treats implementation-level hardware attacks inconsistently. We show that two of the three attack-feasibility approaches exemplified in the standard rate every attack path that requires physical access as very low by construction, independent of the implementation, while the third can assign the same path any of the four ratings, depending on the assumed state of attacker knowledge and on the attacker profile. This paper presents a hardware-aware extension of the TARA that covers side-channel analysis (SCA), fault-injection attacks (FIA), and abuse of debug and test interfaces. It adds an attacker model for physical access over the vehicle lifecycle; a path-dominance relation on the attack-potential factors that identifies when a simpler path makes a sophisticated one irrelevant; a three-level hardware relevance gate (H0 to H2) with an explicit decision rule that fixes whether resistance of a hardware step may be argued, must be documented, or must be demonstrated by test; and a rating rule under which a hardware step receives no credit for implementation-specific resistance until the required evidence exists. The gate is positioned relative to cybersecurity assurance levels and targeted attack feasibility. The method is applied to a reference gateway architecture, and its structural inputs are examined on ten published attacks on automotive components. In seven of the ten studies, the demonstrated attack included a debug, programming, boot, diagnostic, or update mechanism, whereas only four studies included an attack on a cryptographic computation.

Abstract: Hardware reverse engineering supports competitive analysis and hardware assurance by recovering information about an integrated circuit (IC) from its physical implementation. While existing techniques primarily recover the gate-level netlist, which represents logical functionality, they often overlook physical design decisions such as placement, routing, delay insertion, and interconnect optimization. The clock distribution network encapsulates many of these decisions; however, no prior published work has recovered this network from a fabricated IC to infer design intent. We present a layout-aware methodology that recovers and analyzes the clock distribution network by integrating a recovered gate-level netlist with layout information extracted from scanning electron microscope imagery. Our four-phase pipeline recovers clock-tree topology, buffering, gating and switching, interconnect delay, and crosstalk-mitigation measures. We demonstrate our methodology on a commercial 450 nm IC, recovering a global H-tree backbone with local X-tree-like branching, identifying an independent clock tree and global clock gating, quantifying latency, skew, and routing lengths, and confirming the absence of dedicated crosstalk mitigation. Together, these findings let us reason about the designer's intent. To encourage further research and support reproducibility, we release our clock tree recovery algorithm as open source.

Abstract: Quantum Fourier sampling may help audit the spectral learnability of delay-based physical unclonable functions (PUFs). We ask whether that promise survives access matching, a strong classical comparator, and oracle synthesis. Three gates structure the evaluation. Structure: low degree is not small support at reachable challenge lengths; for 4-XOR at $n=14$, degree $\le d_f(0.1)$ admits $91\%$ of all $2^n$ characters and the median $90\%$-mass set spans a third of the spectrum. Algorithmics: constructing the phase oracle logically implies classical membership access, making Kushilevitz--Mansour the correct baseline; across 45 tasks it exhausts each finite domain, and no 4-XOR ideal-sampling case reaches $90\%$ mass within $2^n$ calls. A quantum-kernel diagnostic appears more favorable, with geometric difference rising to $2.151$ at $N=512$ challenges, but it correlates $0.991$ with $1/\sqrt{λ_{\min}(K_C)}$ for the classical Gram matrix $K_C$, and the 4-XOR label-complexity ratio does not exceed a balance-preserving permutation null ($p=0.930$). Trace-normalized geometric difference can therefore grow through classical ill-conditioning alone, without task-label alignment. Implementation: a simulator-validated fixed-point phase oracle based on the quantum Fourier transform admits an $18.9\%$ routed-depth reduction, yet the least certified precisions have estimated durations of $1.18$--$1.55\times$ the median dephasing time $T_2$ of the mapped qubits on a static backend snapshot, without hardware execution. We find no end-to-end advantage in the evaluated regime, although ideal sampling does use fewer coherent calls on the thresholded task. The contribution is the Three-Gate Quantum Audit Protocol: a reproducible procedure separating an ideal query advantage from a realizable security benefit. This is not a claim about deployed silicon and not an impossibility result.

Abstract: Major FPGA manufacturers have incorporated bitstream encryption to protect sensitive configuration data. However, for the most widely used FPGA families, multiple attacks against unpatchable protection schemes hard-wired into the devices can bypass or fully break them, making patchable schemes desirable. In this work, we present a proof-of-concept implementation of an AMD-proposed asymmetric key encryption scheme for bitstream protection for 7-Series FPGAs, using partial reconfiguration from the Programmable Logic. We analyze the security implications and hardware overhead of this implementation. We then propose and demonstrate an optical side-channel attack that is able to recover plain-text configuration data during the dynamic reconfiguration process. This attack leverages Photon Emission Microscopy and Electro-Optical Probing to first locate and then contactlessly extract the plain-text data from the ICAP interface, which internally connects the Programmable Logic with the configuration logic. We located the ICAP buses in an AMD XC7A200T device and show that the data on it can be extracted with Electro-Optical Probing. We claim that even advanced encryption schemes utilizing Partial Reconfiguration and custom cryptographic engines are vulnerable to optical attacks, as reconfiguration is only possible via hard-wired, vulnerable configuration interfaces.

Abstract: Pseudo-random number generation often requires trade-offs among quality, power consumption, and bandwidth to produce unpredictable sequences of numbers. The brain, on the other hand, efficiently generates unpredictable output complex network dynamics occurring in a high-dimensional state. This state, which is hypothesized to be chaotic, relies on the balance between excitation and inhibition. Here, we investigated if computational models of these chaotic balanced states can be harnessed for Neuromorphic Pseudo-Random Number Generators (NPRNGs) in low power hardware. We successfully constructed a balanced spiking neural network model consisting of leaky-integrate-and-fire neurons that could be readily implemented in low power FPGAs and used as a NPRNG. The prototyped NPRNG consumed 3.24 mW during operation and produced pseudo-random numbers at 120kbps. In both hardware and software instantiations, NPRNGs produce high-quality random numbers as validated by standard metrics for testing RNG quality.

Abstract: Electromagnetic side channels have been extensively utilized in non-invasive attacks or analyses to extract critical information from deployed systems. Most of the attacks or analyses are typically executed on cryptographic algorithms under the assumption that the underlying implementation remains fixed. The assumption is valid in the context of fixed hardware, where modifications to the circuit are not made after manufacturing. However, in the case of adaptive hardware, including field-programmable gate arrays (FPGAs), the assumption no longer holds as modifications to the configuration of the array are permitted post-manufacturing. Consequently, this study introduces a methodology for the analysis of electromagnetic side channels of an FPGA through the study of deterministic finite state machines (DFSMs), where the effects of placement, routing, and operating frequency on the EM emanations of the FPGA due to the utilized clocking resources are characterized. To analyze the impact of frequency, device placement, and resource allocation on the EM emanations from the FPGA, statistical analysis including mean difference and variance difference calculations of measured EM fields were utilized to identify points of high EM activity on a set grid of sampled points. A 1.32x increase in flagged grid points was observed in the analysis of the mean difference when the percentage of utilized clock resources was increased from 25% to 90%. Similarly, a 1.39x increase in flagged grid points was observed when the variance difference was calculated for the same increase in clock resources.

Abstract: Experiments have shown that modifications in communication hardware can enable unauthorized exfiltration of data from transmitters. We study the resulting Transmitter Trojan channel, in which a malicious encoder embedded within a legitimate transmitter perturbs the transmitted codeword on a symbol-by-symbol basis. The model reflects the limited footprint, delay, and computational complexity available to such hardware modifications. We derive achievable rogue message rate and achievable rates for the legitimate message under the mismatch induced by the Trojan. We also analyze decoding error exponents for the legitimate and rogue receivers, including operational exponent lower bounds obtained through channel-resolvability transfer arguments. Finally, we study Trojan detection at the legitimate receiver under different levels of statistical knowledge, including likelihood-ratio detection when the ensemble-averaged induced channel is known and goodness-of-fit detection when only the nominal channel is known. The resulting detection error exponents, together with the achievable rate and decoding error exponents, quantify tradeoffs among rogue message rate, legitimate message rate, decoding reliability, and Trojan detectability. We specialize the analysis to the binary symmetric channel and the additive white Gaussian noise channel, and illustrate the resulting tradeoffs numerically.

Abstract: Hardware trojan (HT) attacks against CPUs typically assume threat scenarios where an attacker targeting a system with a trojanized CPU is able to execute arbitrary code (i.e. machine-level instructions) to reliably interact with the implanted trojan. On end-user devices (i.e., mobiles, laptops), achieving arbitrary code execution in practice requires software exploits tailored to each specific target. Such strong adversarial premises reduce the generality of existing threat models casting doubt on CPU trojan attacks as a pragmatic threat vector. To push the envelope on HT attacks against client devices, we introduce the SURF class of CPU-trojans that can be activated without arbitrary code execution. Our key insight is that integer operations expressed in a high-level language can be mapped to microarchitectural side-effects distinguishable by a SURF trigger circuit. This observation unlocks HT activation via runtime engines, constrained environments executing untrusted high-level code. We demonstrate a SURF trojan inside a RISC-V processor and exploit JavaScript-level memory indexing operations inside Google's V8 engine to perform a code injection attack. Importantly, we show that SURF trojans remain effective across multiple JavaScript engine versions, enabling long-term compromise of endpoint devices. To facilitate research, we opensource SURF's design and supporting software.

Abstract: Mixed-signal SoCs rely on nominally input-only analog pins to acquire off-chip signals, but the directionality of these interfaces is generally treated as a functional property rather than explicitly verified as a security property. This work identifies and experimentally demonstrates a directionality-based class of analog and mixed-signal (AMS) exfiltration attacks in which data-dependent circuit-offset modulation converts a nominally input-only pin into an outbound information channel. We analytically model the attack mechanism and identify three enabling host conditions: a closed-loop amplifier, an exposed amplifier input, and sufficiently high impedance at that pin. This attack class is validated through a representative silicon case study using a photoplethysmography (PPG) analog front-end (AFE) fabricated in a commercial 55-nm CMOS process. The payload incurs $<$0.001\% area overhead relative to typical biosensing AFEs. Under the evaluated conditions, payload activation reduces the filtered PPG-output SNR by only 0.03~dB, while the maximum HT-induced perturbation of 5.9\% of the PPG amplitude remains within the 34.3\% benign variation at the exposed sensor-input pin across process and temperature. The raw exfiltration SINR remains below -20~dB, while targeted filtering increases it above 14~dB and enables signal recovery. Silicon measurements demonstrate data exfiltration through the input pin at bit rates up to 10~kbps and error-free recovery of a PRBS message. These results expose a conventional test-observability gap and establish analog pin directionality as an AMS security property requiring explicit verification, test coverage, and defense rather than being inferred from nominal signal flow.

Abstract: Linear complementary pairs (LCPs) and linear complementary dual (LCD) codes have important applications in orthogonal direct-sum masking (ODSM), which provides effective countermeasures against side-channel attacks and fault-injection attacks. While LCD codes have been extensively investigated, comparatively fewer results are available for general LCPs. In this paper, we further investigate LCPs of twisted Reed--Solomon (TRS) codes. We derive necessary conditions for two TRS codes to form an LCP and establish several sufficient conditions and explicit constructions. We also study LCD codes constructed from TRS codes and investigate the security parameters of the resulting LCPs. Furthermore, under suitable conditions, we obtain MDS LCPs of TRS codes.