Smart Card Research and Advanced Applications : 22nd International Conference, CARDIS 2023, Amsterdam, The Netherlands, November 14–16, 2023, Revised Selected Papers

This book constitutes the proceedings of the 22nd International Conference on Smart Card Research and Advanced Applications, CARDIS 2023, held in Amsterdam, The Netherlands, during November 14–16, 2023. The 13 full papers presented in this volume were carefully reviewed and selected from 28 submissions. They were organized in topical sections as follows: fault attacks; side-channel analysis; smartcards & efficient Implementations; and side-channel & neural networks. Preface Organization Contents Fault Attacks Microarchitectural Insights into Unexplained Behaviors Underpg Clock Glitch Fault Injection 1 Introduction 1.1 Fault Injection Effects 1.2 Contributions 1.3 Outline 2 Fault Model Inference 3 Partial Update Fault Model 3.1 Partial Update from the Precharge Value 3.2 Partial Update from the Previous Value 3.3 Discussion 4 Experimental Setup 4.1 Clock Glitch Fault Injection 4.2 Target Device 5 Experimental Results 5.1 Partial Update from the Precharge Value 5.2 Partial Update from the Previous Value 6 Program Counter Modification 6.1 Misaligned Code 6.2 Aligned Code 6.3 Countermeasure: Register Substitution 6.4 Trojan 7 Conclusion and Future Works References An In-Depth Security Evaluation of the Nintendo DSi Gaming Console 1 Introduction 1.1 Contributions 1.2 Responsible Disclosure 2 Background and Related Work 2.1 The Nintendo DSi Gaming Console 2.2 Fault Injection 2.3 Earlier Work on the DSi 3 ARM7 ROM Extraction 3.1 Method 3.2 Practical Considerations 3.3 Results and Analysis 4 ARM9 ROM Extraction 4.1 Method 4.2 Practical Considerations 4.3 Results 5 Fault Model Analysis 5.1 Method 5.2 Observations 5.3 Explanation 6 ARM9 ROM Analysis 6.1 Method 6.2 Functional Description 6.3 Vulnerabilities 7 Practical Exploitation 7.1 Method 7.2 Design 7.3 Evaluation 8 Conclusion References A Differential Fault Attack Against Deterministic Falcon Signatures 1 Introduction 1.1 Previous Work 1.2 Contributions 1.3 Outline 2 Preliminaries 3 Falcon 4 The Fault Attack Against Deterministic Falcon 4.1 Fault Attack in a Suitable Sublattice 4.2 The PRNG of Deterministic Falcon 4.3 Combining the Fault Attack with Exhaustive Search 4.4 Extending the Attack to Falcon 5 Practical Evaluation 5.1 Simulations on a PC 5.2 Simulations on ARM Cortex-M4 6 Countermeasures 7 Conclusion and Future Work References Fault Attacks Sensitivity of Public Parameters in the Dilithium Verification 1 Introduction 2 Preliminaries 2.1 Presentation of Dilithium 2.2 Fault Models 2.3 Related Works 3 Public Parameters Sensitivity Analysis of Verify 3.1 Main Idea 3.2 Preliminary Analysis 3.3 Scenario 1: Sampling of 3.4 Scenario 2: Shift by d 3.5 Scenario 3: Subtraction 3.6 Experimental Validation 4 Countermeasures 5 Conclusion References Side-Channel Analysis Attacking at Non-harmonic Frequencies in Screaming-Channel Attacks 1 Introduction 2 Related Works 2.1 Side-Channel Attacks 2.2 Screaming-Channel Attacks 3 The Attack Scenario and Setup 3.1 Leakage Collection 3.2 Trace Segmentation 3.3 Time Diversity 4 Searching for Leakage at Non-harmonic Frequencies 4.1 Leakage Localization Using T-Test Method 4.2 Leakage Localization Using Pattern Detection Method 5 Attacking at Non-harmonics 5.1 The Attack and Score 5.2 Experiment and Results 6 Attacking in Challenging Conditions 6.1 Attacking at a Distance in a Noisy Environment 6.2 Attacking with Fewer Traces 6.3 Attacking at a Further Distance 7 Discussion and Conclusion References Bernoulli at the Root of Horizontal Side Channel Attacks 1 Introduction 1.1 Background 1.2 Contributions 1.3 Paper Organization 2 Related Works and Remarks 3 A Bernoulli Distribution Based Leakage Model 3.1 Notation 3.2 Leakage Model 4 Identification of PoI 4.1 From Bernoulli Distribution to Gaussian Mixtures 4.2 Homogeneous Effect of Gaussian Noise 4.3 Ranking PoI 4.4 Additional Components Due to Outlier Behaviors and Noise 4.5 Final PoI Selection Procedure 5 Completing the Set of PoI 6 Experimental Results 6.1 Datasets 6.2 Supervised Approach 6.3 Unsupervised Approach 7 Conclusion References Blind Side Channel Analysis Against AEAD with a Belief Propagation Approach 1 Introduction 2 Authenticated Encryption with Associated Data (AEAD) 2.1 NIST Competition 2.2 Elephant 2.3 Sparkle 3 BSCA Context 4 Description of the Attacks 4.1 Simulated Leakage Model 4.2 Belief Propagation (BP) 5 Attack on Elephant 5.1 Attack Path 5.2 Tanner Graph 5.3 Results 6 Attack on Sparkle 6.1 Attack Path 6.2 Tanner Graph 6.3 Results 7 Conclusion References Leveraging Coprocessors as Noise Engines in Off-the-Shelf Microcontrollers 1 Introduction 2 Background 2.1 Notations 2.2 Signal-to-Noise Ratio 2.3 Regression-Based Linear Discriminant Analysis 2.4 Perceived Information 2.5 Boolean Masking 2.6 Soft Analytical Side-Channel Attacks 3 Noise Generation 4 Evaluation Setup 4.1 Description of the Target 4.2 Measurement Setup 5 Side-Channel Metrics 5.1 SNR Comparison 5.2 PI Comparison 6 Attack Results 7 Conclusions References Smartcards and Efficient Implementations The Adoption Rate of JavaCard Features by Certified Products and Open-Source Projects 1 Introduction 1.1 Related Work 2 JavaCard in Common Criteria and FIPS140 2.1 Analysis of Certification Documents 3 JavaCard Open-Source Ecosystem 3.1 Database of Open-Source Projects 3.2 Activity of JavaCard Open-Source Ecosystem in Time 3.3 Open-Source Applets Compatibility and Portability 4 Resources Required by JavaCard Applets 4.1 JavaCard Packages and Cryptographic Algorithms Required 4.2 Memory Requirements Analysis 5 Discussion and Limitations 5.1 Known Limitations 6 Conclusions References PQ.V.ALU.E: Post-quantum RISC-V Custom ALU Extensions on Dilithium and Kyber-12pt 1 Introduction 2 Preliminaries 2.1 Number-Theoretics Transformations (NTTs) 2.2 Barrett Reduction 2.3 RISC-V 2.4 Related Work 3 Extensions for Polynomial Arithmetic 3.1 Single-Cycle Modular Arithmetic 3.2 Single-Cycle Butterflies 3.3 Integration and Additional Instructions 3.4 PQVALUE: NTTs 4 Results 4.1 Setup 4.2 Hardware Cost of PQVALUE 4.3 PQVALUE in Pulpino: NTTs 4.4 PQVALUE in Pulpino: Dilithium 4.5 Comparison References Side-Channel and Neural Networks Keep It Unsupervised: Horizontal Attacks Meet Simple Classifiers 1 Introduction 2 Background 2.1 Supervised vs Unsupervised Learning 2.2 T-Test and Sum of Squared T-Statistics (SOST) 2.3 Principal Components Analysis (PCA) 2.4 Clustering Algorithms, Voronoi Diagrams and k-Means 2.5 Perceptrons and Deep Neural Networks 3 Overview of ch11Perinspschessps21 4 Corrective Framework Fitting the Decision Boundaries 4.1 Simplification of the Neural Network 4.2 Experimental Results Obtained on Attacked Datasets 4.3 Comparison of the Two Approaches and Discussion 5 Correction Capability of the Iterative Framework 5.1 Experiments 5.2 Results 6 Deep Learning Free Approach 6.1 Alternative Attack: Overview 6.2 Alternative Attack: Experimental Results 7 Conclusion References Deep Stacking Ensemble Learning Applied to Profiling Side-Channel Attacks 1 Introduction 1.1 Related Works 1.2 Contributions and Paper Organization 2 Introduction to Profiling Side-Channel Attacks and Ensemble Learning 2.1 Notations 2.2 Profiling Side-Channel Attacks and Evaluation Metrics 2.3 Ensemble Learning 2.4 Datasets 3 Experiments 3.1 Weak Models 3.2 Stacking Implementation and Results 4 Discussion 4.1 Stacking Aggregation: Pros and Cons 4.2 Relieving Hyperparameterization Effort 4.3 Generalizable Meta-model 5 Conclusion and Future Works A Weak models References Like an Open Book? Read Neural Network Architecture with Simple Power Analysis on 32-Bit Microcontrollers 1 Introduction 2 Background 2.1 Neural Network Models 2.2 Model Deployment on Cortex-M Platforms 2.3 Model Extraction 3 Related Works and Contributions 4 Experimental Setup 4.1 Models and Datasets 4.2 Target Device and Setup 5 Threat Model 6 Layers Analysis 6.1 Convolutional Layer 6.2 Pooling Layer: Output Dimensions (Hout) and Kernel Size (Zpool) 6.3 Dense Layer: Number of Neurons (Ne) 6.4 Activation Layer 7 Architecture Extraction Methodology 8 Discussions and Perspectives 9 Conclusion References Correction to: PQ.V.ALU.E: Post-quantum RISC-V Custom ALU Extensions on Dilithium and Kyber Correction to: Chapter 10 in: S. Bhasin and T. Roche (Eds.): Smart Card Research and Advanced Applications, LNCS 14530, https://doi.org/10.1007/978-3-031-54409-5_10 Author Index