static power sca of sub 100 nm cmos asics and the
play

Static Power SCA of Sub-100 nm CMOS ASICs and the Insecurity of - PowerPoint PPT Presentation

Sep 26, 2023 •170 likes •735 views

RUHR-UNIVERSITT BOCHUM Static Power SCA of Sub-100 nm CMOS ASICs and the Insecurity of Masking Schemes in Low-Noise Environments Thorben Moos Ruhr University Bochum, Horst Grtz Institute for IT Security, Germany August 28th, 2019 Section 1

  1. RUHR-UNIVERSITÄT BOCHUM Static Power SCA of Sub-100 nm CMOS ASICs and the Insecurity of Masking Schemes in Low-Noise Environments Thorben Moos Ruhr University Bochum, Horst Görtz Institute for IT Security, Germany August 28th, 2019

  2. Section 1 Introduction Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 1

  3. RUHR-UNIVERSITÄT BOCHUM What’s known? Introduction • CMOS logic gates and memory elements have a data dependent static power consumption Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 2

  4. RUHR-UNIVERSITÄT BOCHUM What’s known? Introduction • CMOS logic gates and memory elements have a data dependent static power consumption • Leakage currents increase significantly by down-scaling the physical feature size of transistors Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 2

  5. RUHR-UNIVERSITÄT BOCHUM What’s known? Introduction • CMOS logic gates and memory elements have a data dependent static power consumption • Leakage currents increase significantly by down-scaling the physical feature size of transistors • Attacks on crypto primitives exploiting this data dependency have been demonstrated in practice for FPGAs [CHES 2014] and ASICs [DATE 2015/2017] Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 2

  6. RUHR-UNIVERSITÄT BOCHUM What’s known? Introduction • CMOS logic gates and memory elements have a data dependent static power consumption • Leakage currents increase significantly by down-scaling the physical feature size of transistors • Attacks on crypto primitives exploiting this data dependency have been demonstrated in practice for FPGAs [CHES 2014] and ASICs [DATE 2015/2017] • When clock control is obtained by an adversary, measurements with a very low noise influence can be recorded Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 2

  7. RUHR-UNIVERSITÄT BOCHUM What’s known? Introduction • CMOS logic gates and memory elements have a data dependent static power consumption • Leakage currents increase significantly by down-scaling the physical feature size of transistors • Attacks on crypto primitives exploiting this data dependency have been demonstrated in practice for FPGAs [CHES 2014] and ASICs [DATE 2015/2017] • When clock control is obtained by an adversary, measurements with a very low noise influence can be recorded • Control over the operating conditions significantly enhances the ability to extract secrets, even though it accelerates device degradation Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 2

  8. RUHR-UNIVERSITÄT BOCHUM Setup Introduction Climate Chamber Temp.: 90 °C Humid.: 10 % Oscilloscope DC Amplifier + + - - Board + ASIC Low-Pass Filter Vdd ASIC Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 3

  9. RUHR-UNIVERSITÄT BOCHUM Setup Introduction Climate Chamber Temp.: 90 °C Humid.: 10 % Oscilloscope DC Amplifier + + - - Board + ASIC Low-Pass Filter Vdd ASIC Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 3

  10. RUHR-UNIVERSITÄT BOCHUM Setup Introduction Climate Chamber Temp.: 90 °C Humid.: 10 % Oscilloscope DC Amplifier + + - - Board + ASIC Low-Pass Filter Vdd ASIC Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 3

  11. RUHR-UNIVERSITÄT BOCHUM Setup Introduction Climate Chamber Temp.: 90 °C Humid.: 10 % Oscilloscope DC Amplifier + + - - Board + ASIC Low-Pass Filter Vdd ASIC Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 3

  12. RUHR-UNIVERSITÄT BOCHUM Setup Introduction Climate Chamber Temp.: 90 °C Humid.: 10 % Oscilloscope DC Amplifier + + - - Board + ASIC Low-Pass Filter Vdd ASIC Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 3

  13. RUHR-UNIVERSITÄT BOCHUM Setup Introduction Climate Chamber Temp.: 90 °C Humid.: 10 % Oscilloscope DC Amplifier + + - - Board + ASIC Low-Pass Filter Vdd ASIC Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 3

  14. RUHR-UNIVERSITÄT BOCHUM Setup Introduction Climate Chamber Temp.: 90 °C Humid.: 10 % Oscilloscope DC Amplifier + + - - Board + ASIC Low-Pass Filter Vdd ASIC Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 3

  15. RUHR-UNIVERSITÄT BOCHUM ASICs Introduction (a) 65nm ASIC layout (b) 90nm ASIC layout Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 4

  16. Section 2 Influence of Operating Conditions Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 5

  17. RUHR-UNIVERSITÄT BOCHUM Target 1024-bit HF Register To evaluate the influence of operating conditions, choose an instance that leaks a lot: Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 6

  18. RUHR-UNIVERSITÄT BOCHUM Target 1024-bit HF Register To evaluate the influence of operating conditions, choose an instance that leaks a lot: 1024-bit HF Input Register - filled either with 0s or 1s - average fanout of 11 Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 6

  19. RUHR-UNIVERSITÄT BOCHUM Target 1024-bit HF Register ... 0 SET SET D Q D Q CLK Q Q To evaluate the influence of CLR CLR ... operating conditions, choose SET D Q an instance that leaks a lot: Q CLR ... D SET Q Q 1024-bit HF Input Register CLR ... - filled either with 0s or 1s - average fanout of 11 ... SET D Q Q CLR Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 6

  20. RUHR-UNIVERSITÄT BOCHUM Target 1024-bit HF Register ... ... 0 1 SET SET SET SET D Q D Q D Q D Q CLK CLK Q Q Q Q To evaluate the influence of CLR CLR CLR CLR ... ... operating conditions, choose SET SET D Q D Q an instance that leaks a lot: Q Q CLR CLR ... ... D SET D SET Q Q Q Q 1024-bit HF Input Register CLR CLR ... ... - filled either with 0s or 1s - average fanout of 11 ... ... SET SET D Q D Q Q Q CLR CLR Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 6

  21. Subsection 1 90 nm ASIC Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 7

  22. t RUHR-UNIVERSITÄT BOCHUM 90 nm ASIC – Normal Operating Conditions 5,000 Measurements at 1.2 V and 20 ◦ C 11...1 Frequency of occurrence 300 00...0 200 100 0 75 80 85 90 95 100 105 110 115 Leakage current [µA] Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 8

  23. t RUHR-UNIVERSITÄT BOCHUM 90 nm ASIC – Normal Operating Conditions 5,000 Measurements at 1.2 V and 20 ◦ C 2000 11...1 Frequency of occurrence 300 00...0 1500 t-statistics 200 1000 100 500 0 0 75 80 85 90 95 100 105 110 115 0 1000 2000 3000 4000 5000 Leakage current [µA] Number of measurements Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 8

  24. RUHR-UNIVERSITÄT BOCHUM 90 nm ASIC – Normal Operating Conditions 5,000 Measurements at 1.2 V and 20 ◦ C 2000 11...1 Frequency of occurrence 300 00...0 1500 t-statistics 200 1000 100 500 0 0 75 80 85 90 95 100 105 110 115 0 1000 2000 3000 4000 5000 Leakage current [µA] Number of measurements Difference of Means 4.1353 µA Average Total Current 96.5 µA t -value (after 5,000 Traces) 480 Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 8

  25. RUHR-UNIVERSITÄT BOCHUM 90 nm ASIC – Increased Supply Voltage 5,000 Measurements at 1.6 V and 20 ◦ C 2000 11...1 Frequency of occurrence 300 00...0 1500 t-statistics 200 1000 100 500 0 0 450 455 460 465 470 475 480 485 0 1000 2000 3000 4000 5000 Leakage current [µA] Number of measurements Difference of Means 18.7822 µA × 4.5419 gain Average Total Current 467.3 µA × 4.8424 gain t -value (after 5,000 Traces) 1938 × 4.0375 gain Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 9

  26. RUHR-UNIVERSITÄT BOCHUM 90 nm ASIC – Increased Temperature 5,000 Measurements at 1.2 V and 90 ◦ C 2000 11...1 Frequency of occurrence 00...0 1500 t-statistics 100 1000 500 0 0 750 755 760 765 770 775 780 785 790 0 1000 2000 3000 4000 5000 Leakage current [µA] Number of measurements Difference of Means 14.4754 µA × 3.5004 gain Average Total Current 771.1 µA × 7.9907 gain t -value (after 5,000 Traces) 526 × 1.0958 gain Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 10

  27. RUHR-UNIVERSITÄT BOCHUM 90 nm ASIC – Increased Voltage and Temperature 5,000 Measurements at 1.6 V and 90 ◦ C 2000 11...1 Frequency of occurrence 00...0 1500 100 t-statistics 1000 500 0 0 1850 1855 1860 1865 1870 1875 1880 1885 0 1000 2000 3000 4000 5000 Leakage current [µA] Number of measurements Difference of Means 32.3217 µA × 7.8160 gain Average Total Current 1,867.3 µA × 19.3503 gain t -value (after 5,000 Traces) 867 × 1.8063 gain Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 11

  28. Subsection 2 65 nm ASIC Thorben Moos | Static Power SCA of Sub-100 nm CMOS ASICs | August 28th, 2019 12

Recommend

CMOS Inverter: Power Dissipation and Sizing CMOS Inverter Power Dissipation Professor Chris H.

CMOS Inverter: Power Dissipation and Sizing CMOS Inverter Power Dissipation Professor Chris H.

CMOS Inverter: Power Dissipation and Sizing CMOS Inverter Power Dissipation Professor Chris H. Kim University of Minnesota Dept. of ECE chriskim@umn.edu Dynamic Power Consumption Where Does Power Go in CMOS? V DD Switching power i L

183 views • 7 slides
UMBC A B M A L T F O U M B C I M Y O R T 1 (November 27, 2000 6:34 pm) I E S

UMBC A B M A L T F O U M B C I M Y O R T 1 (November 27, 2000 6:34 pm) I E S

Advanced VLSI Design CMOS Circuit Design CMSC 491C/691C CMOS Logic Structures Full complementary static CMOS gates may be undesirable because: The area overhead. Their speed may be too slow. The function may not be feasible as a

772 views • 37 slides
Designing Logic Gates Low Swing Signals Note: The tree is reduced CMOS Logic Families Static

Designing Logic Gates Low Swing Signals Note: The tree is reduced CMOS Logic Families Static

Advanced Digital IC-Design Content Logic Families Designing Logic Gates Low Swing Signals Note: The tree is reduced CMOS Logic Families Static v.s. Dynamic CMOS Design CMOS Logic Families Static - Each gate output have a low Non Clocked

465 views • 12 slides
Modeling Frequency Response of 65 nm CMOS RF Power Devices CMOS RF P D i i 1 J Usha Gogineni 1

Modeling Frequency Response of 65 nm CMOS RF Power Devices CMOS RF P D i i 1 J Usha Gogineni 1

Modeling Frequency Response of 65 nm CMOS RF Power Devices CMOS RF P D i i 1 J Usha Gogineni 1 , Jesus del Alamo 1 , U h G i d l Al 1 Christopher Putnam 2 , David Greenberg 3 1 Massachusetts Institute of Technology, Cambridge, MA 2 IBM

551 views • 18 slides
CMOS Inverter Two Inverters N Well VDD Share power and ground V DD PMOS is wider Abut cells

CMOS Inverter Two Inverters N Well VDD Share power and ground V DD PMOS is wider Abut cells

The CMOS Inverter: A First Glance V CMOS Inverter DD V in V out Professor Chris H. Kim C L University of Minnesota Dept. of ECE chriskim@umn.edu www.umn.edu/~chriskim/ 2 CMOS Inverter Two Inverters N Well VDD Share power and ground V

240 views • 9 slides
A 1.2V Low-Power 2.4GHz 0.18 m CMOS Quadrature VCO X. Redondo, J. Pallars, F. Vila , L.

A 1.2V Low-Power 2.4GHz 0.18 m CMOS Quadrature VCO X. Redondo, J. Pallars, F. Vila , L.

DCIS08: A 1.2V Low-Power 2.4GHz QVCO 1/ 26 A 1.2V Low-Power 2.4GHz 0.18 m CMOS Quadrature VCO X. Redondo, J. Pallars, F. Vila , L. Ters and F. Serra-Graells System Integration Department Institut de Microelectrnica de Barcelona

355 views • 24 slides
ESA-ESTEC GSTP - Analog Silicon Compiler for Mixed Signal ASICs Irradiation of CSA-PSA &

ESA-ESTEC GSTP - Analog Silicon Compiler for Mixed Signal ASICs Irradiation of CSA-PSA &

ESA-ESTEC GSTP - Analog Silicon Compiler for Mixed Signal ASICs Irradiation of CSA-PSA & Design of a CMOS High-Speed 8-bit 100MS/S ADC core Outline ! Irradiation of CSA-PSA chip [designed and fabricated in ASTP4 project] " Objectives

531 views • 52 slides
Switch-Less Frequency-Domain Multiplexing of GFET Sensors and Low-Power CMOS Frontend for

Switch-Less Frequency-Domain Multiplexing of GFET Sensors and Low-Power CMOS Frontend for

Switch-Less FDM GFET Sensors LP CMOS Frontend 1024-Ch ECOG Intro FDM ROIC CMOS Chip Conclusions Switch-Less Frequency-Domain Multiplexing of GFET Sensors and Low-Power CMOS Frontend for 1024-Channel ECOG J.Cisneros-Fernndez 1 , M.Dei

517 views • 25 slides
Si CMOS for RF Power Applications J. A. del Alamo MIT Workshop on Advanced Technologies for

Si CMOS for RF Power Applications J. A. del Alamo MIT Workshop on Advanced Technologies for

Si CMOS for RF Power Applications J. A. del Alamo MIT Workshop on Advanced Technologies for Next Generation of RFIC 2005 RFIC Symposium June 12, 2005 Sponsors: DARPA, IBM, SRC RF power applications Power vs. frequency GaAs HEMT 50 InP

699 views • 42 slides
Power management styles Static power management: does not depend on activity. Example:

Power management styles Static power management: does not depend on activity. Example:

Power management styles Static power management: does not depend on activity. Example: user-activated power-down mode. Dynamic Power Management (DPM): automatic action based on activity. Example: automatically disabling

431 views • 18 slides
When NOT to Use ASICs When NOT to Use ASICs Rick Van Berg HEPIC2013 When NOT to Use ASICs When

When NOT to Use ASICs When NOT to Use ASICs Rick Van Berg HEPIC2013 When NOT to Use ASICs When

When NOT to Use ASICs When NOT to Use ASICs Rick Van Berg HEPIC2013 When NOT to Use ASICs When NOT to Use ASICs Rick Van Berg HEPIC2013 When not to Put Effort Into ASICs When not to Put Effort Into ASICs Rick Van Berg HEPIC2013 Hieronymus Bosch

352 views • 14 slides
S E E . F E E L . T O U C H . CMOS type imagers became the default imaging means in consumer

S E E . F E E L . T O U C H . CMOS type imagers became the default imaging means in consumer

CMOS Imaging TODAY Power vs. Resolution PixArt Imaging Technology Call to Action S E E . F E E L . T O U C H . CMOS type imagers became the default imaging means in consumer electronics Dominated by Capture and

268 views • 12 slides
ECON ASICs Gregory Deptuch, Zoltan Gecse, Jim Hirschauer, Sandeep Miryala, Paul Rubinov ASICs

ECON ASICs Gregory Deptuch, Zoltan Gecse, Jim Hirschauer, Sandeep Miryala, Paul Rubinov ASICs

ECON ASICs Gregory Deptuch, Zoltan Gecse, Jim Hirschauer, Sandeep Miryala, Paul Rubinov ASICs PMG 10 May 2019 Reminders Two Endcap Concentrator (ECON) ASICs on independent data paths: ECON-TRG : select and compress interesting data for

273 views • 10 slides
Digital Integrated Circuits Chapter 6 The CMOS Inverter EEL7312 INE5442 1 Digital

Digital Integrated Circuits Chapter 6 The CMOS Inverter EEL7312 INE5442 1 Digital

Digital Integrated Circuits Chapter 6 The CMOS Inverter EEL7312 INE5442 1 Digital Integrated Circuits Contents Introduction (MOST models) 0, 1 st , 2 nd order The CMOS inverter : The static behavior: o DC transfer

571 views • 25 slides
Outline A Brief History CMOS Gate Design Pass Transistors CMOS Latches &

Outline A Brief History CMOS Gate Design Pass Transistors CMOS Latches &

Introduction to CMOS VLSI Design Lecture 1: Circuits & Layout David Harris Harvey Mudd College Spring 2004 Outline A Brief History CMOS Gate Design Pass Transistors CMOS Latches & Flip-Flops Standard Cell Layouts

439 views • 23 slides
ECON ASICs Jim Hirschauer, Ralph Wickwire ASICs PMG 11 Nov 2019 DOE CD-1 IPR and CERN P2UG

ECON ASICs Jim Hirschauer, Ralph Wickwire ASICs PMG 11 Nov 2019 DOE CD-1 IPR and CERN P2UG

ECON ASICs Jim Hirschauer, Ralph Wickwire ASICs PMG 11 Nov 2019 DOE CD-1 IPR and CERN P2UG CD-1 / IPR went well on Oct 22-24. Reviewers clearly concerned about ECON: The ECON ASIC is a critical component for which the US has sole

376 views • 14 slides
1 Low-power Techniques Power-aware Architecture Designs Physical (CMOS) level Utilize low-power

1 Low-power Techniques Power-aware Architecture Designs Physical (CMOS) level Utilize low-power

Importance of Low-power Designs Cost factor for high-end systems High-end systems Lecture 24: Power-efficient Cooling and package cost > 40 W: 1 W $1 Designs Air-cooled techniques: reaching limits Electricity bill

311 views • 4 slides
CMOS technologies in the 1 0 0 nm range CMOS technologies in the 1 0 0 nm range for rad-hard

CMOS technologies in the 1 0 0 nm range CMOS technologies in the 1 0 0 nm range for rad-hard

CMOS technologies in the 1 0 0 nm range CMOS technologies in the 1 0 0 nm range for rad-hard front-end electronics in future collider experim ents p V. Re a,c , L. Gaioni b,c , M. Manghisoni a,c , L Ratti b c V Speziali b c G Traversi a c L.

433 views • 31 slides
Get to ASICs Faster Get to ASICs Faster A Novel Mixed Signal Design Methodology Dr Greg

Get to ASICs Faster Get to ASICs Faster A Novel Mixed Signal Design Methodology Dr Greg

February 24-26, 2009 Get to ASICs Faster Get to ASICs Faster A Novel Mixed Signal Design Methodology Dr Greg Tumbush: Tumbush Enterprises Dr. Greg Tumbush: Tumbush Enterprises ON Semiconductor: Gareth Weale, Dustin Griesdorf, , , Alaa

447 views • 20 slides
Integration, Architecture, and Applications of 3D CMOS Memristor Circuits K. T. Tim Cheng

Integration, Architecture, and Applications of 3D CMOS Memristor Circuits K. T. Tim Cheng

Integration, Architecture, and Applications of 3D CMOS Memristor Circuits K. T. Tim Cheng and Dimitri Strukov Univ. of California, Santa Barbara ISPD 2012 1 3D Hybrid CMOS/NANO add-on nanodevices layer top nanowire level CMOS

831 views • 67 slides
Static Metering Technology Mr. B. M. Vyas Power Finance Corporation Ltd. (A Govt. of India

Static Metering Technology Mr. B. M. Vyas Power Finance Corporation Ltd. (A Govt. of India

DRUM TRAINING PROGRAM A U.S. Agency for International Development (USAID) Funded Program Static Metering Technology Mr. B. M. Vyas Power Finance Corporation Ltd. (A Govt. of India Undertaking) Static Metering Technology YMPL, Udaipur 3

567 views • 41 slides
Working Around the Limits of Working Around the Limits of CMOS CMOS CMOS CMOS Mary Jane

Working Around the Limits of Working Around the Limits of CMOS CMOS CMOS CMOS Mary Jane

Working Around the Limits of Working Around the Limits of CMOS CMOS CMOS CMOS Mary Jane Irwin, Penn State Mary Jane Irwin, Penn State NSF Workshop: Electronic Design Automation Past, Present, and Future Past, Present, and Future

231 views • 20 slides
GE Critical Power Static Transfer Switches for source redundancy UL Listed Version GE Series

GE Critical Power Static Transfer Switches for source redundancy UL Listed Version GE Series

GE Critical Power Static Transfer Switches for source redundancy UL Listed Version GE Series STS-3 Three Phase GE Product Portfolio for the Datacenter . now enhanced with Static Transfer Switches .thus providing end-to-end

784 views • 19 slides
A CMOS Potentiostatic Delta-Sigma for Electrochemical Sensors Joan

A CMOS Potentiostatic Delta-Sigma for Electrochemical Sensors Joan

Low-power potentiostat 2 nd Order CT ADC for ECS 1/26 A CMOS Potentiostatic Delta-Sigma for Electrochemical Sensors Joan Aymerich, Michele Dei, Llus Teres and Francisco Serra-Graells

1.37k views • 30 slides

More recommend