Whip the Whisperer: Simulating Side Channel Leakage

Overview: Hardware security researcher Jasper van Woudenberg presents an analysis of side-channel leakage simulation, focusing on eliminating cryptographic information leakage during pre-silicon chip design. The talk contrasts traditional post-silicon physical testing with pre-silicon simulation on netlists to identify and remediate hardware vulnerabilities before fabrication. By modeling the fundamental switching behaviors of standard digital logic, engineers can detect power and electromagnetic side channels without waiting for physical silicon tape-outs.

Key Topics: - Physical side-channel leakage mechanisms in digital flip-flops - Correlation Power Analysis (CPA) on AES hardware implementations - Limitations of post-silicon physical testing vs. pre-silicon simulation - Simulating power traces using gate-level design netlists

Technical Details: The presentation examines the primary source of physical side-channel leakage in integrated circuits: the standard digital flip-flop. Functioning as a 1-bit memory cell with data (D) and clock inputs driving an output (Q), a flip-flop consumes distinct dynamic power spikes whenever its state transitions between zero and one or one to zero. In symmetric cryptographic engines like AES-128, 128 flip-flops typically maintain internal state during initial operations such as the round key addition (where plaintext bytes are XORed with key bytes). If an attacker can isolate or statistically correlate state transitions against known plaintexts, differing power signatures directly betray individual key bits.

Because direct physical measurement of individual nanoscale flip-flops across complex power distribution networks is impractical, attackers collect thousands of power or electromagnetic (EM) traces using oscilloscopes, current probes, and near-field EM probes. By executing Correlation Power Analysis (CPA), an analyst predicts power consumption for 256 possible subkey byte values across varying plaintexts, correlating predicted switching activity against measured traces across all 16 subkeys to recover the full 128-bit key. The speaker demonstrates these concepts using a real test chip fabricated on a legacy 150nm process containing PicoRV32 RISC-V cores, 1 KB SRAM, and AES acceleration blocks.

To solve the economic and engineering challenge where post-silicon leakage identification is too late and requires multi-generation chip respins, the speaker advocates pre-silicon simulation. By utilizing the chip's design netlist—which defines the interconnected standard cells, logic gates, and power distribution network—security architects can simulate electrical switching behavior and power consumption. Simulating these operations prior to tape-out allows teams to run virtual CPA attacks and patch microarchitectural leakage in the active design cycle.

Key Takeaways: Hardware design teams cannot rely solely on post-silicon testing to discover cryptographic side-channel leakage, as silicon respins are costly and delay remediation. Incorporating pre-silicon power and electromagnetic simulation using gate-level netlists allows security engineers to model flip-flop transitions and evaluate Correlation Power Analysis (CPA) resistance prior to manufacturing. Hardware security verification must shift left into the electronic design automation (EDA) pipeline to prevent vulnerabilities in deployed silicon.

(AI summary — Gemini Flash)