{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,8]],"date-time":"2026-05-08T21:34:52Z","timestamp":1778276092867,"version":"3.51.4"},"reference-count":36,"publisher":"International Association for Cryptologic Research","license":[{"start":{"date-parts":[[2024,7,4]],"date-time":"2024-07-04T00:00:00Z","timestamp":1720051200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IACR CiC"],"accepted":{"date-parts":[[2024,9,2]]},"abstract":"<jats:p>This paper presents a new side-channel attack (SCA) on unrolled implementations of stream ciphers, with a particular focus on Trivium. Most conventional SCAs predominantly concentrate on leakage of some first rounds prior to the sufficient diffusion of the secret key and initial vector (IV). However, recently, unrolled hardware implementation has become common and practical, which achieves higher throughput and energy efficiency compared to a round-based hardware. The applicability of conventional SCAs to such unrolled hardware is unclear because the leakage of the first rounds from unrolled hardware is hardly observed. In this paper, focusing on Trivium, we propose a novel SCA on unrolled stream cipher hardware, which can exploit leakage of rounds latter than 80, while existing SCAs exploited intermediate values earlier than 80 rounds. We first analyze the algebraic equations representing the intermediate values of these rounds and present the recursive restricted linear decomposition (RRLD) strategy. This approach uses correlation power analysis (CPA) to estimate the intermediate values of latter rounds. Furthermore, we present a chosen-IV strategy for a successful key recovery through linearization. We experimentally demonstrate that the proposed SCA achieves the key recovery of a 288-round unrolled Trivium hardware implementation using 360,000 traces. Finally, we evaluate the performance of unrolled Trivium hardware implementations to clarify the trade-off between performance and SCA (in)security. The proposed SCA requires 34.5 M traces for a key recovery of 384-round unrolled Trivium implementation and is not applicable to 576-round unrolled hardware. <\/jats:p>","DOI":"10.62056\/angy11zn4","type":"journal-article","created":{"date-parts":[[2024,10,7]],"date-time":"2024-10-07T15:13:33Z","timestamp":1728314013000},"update-policy":"https:\/\/doi.org\/10.62056\/adfjwm02dj","source":"Crossref","is-referenced-by-count":1,"title":["Side-Channel Linearization Attack on Unrolled Trivium Hardware"],"prefix":"10.62056","author":[{"given":"Soichiro","family":"Kobayashi","sequence":"first","affiliation":[{"name":"Tohoku University","place":["2\u20131\u20131 Katahira, Aoba-ku, Sendai, 980-8577, Japan"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9754-6792","authenticated-orcid":false,"given":"Rei","family":"Ueno","sequence":"additional","affiliation":[{"name":"Kyoto University","place":["Yoshidahommachi, Kyoto, 606\u20138501, Japan"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6839-4777","authenticated-orcid":false,"given":"Yosuke","family":"Todo","sequence":"additional","affiliation":[{"name":"NTT Social Informatics Laboratories","place":["3\u20139\u201311 Midori-cho, Musashino-shi, Tokyo, 180-8535, Japan"]}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0864-3126","authenticated-orcid":false,"given":"Naofumi","family":"Homma","sequence":"additional","affiliation":[{"name":"Tohoku University","place":["2\u20131\u20131 Katahira, Aoba-ku, Sendai, 980-8577, Japan"]}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"48349","published-online":{"date-parts":[[2024,10,7]]},"reference":[{"key":"ref1:de2008trivium","doi-asserted-by":"crossref","first-page":"244","DOI":"10.1007\/978-3-540-68351-3_18","article-title":"Trivium","author":"Christophe De Canniere","year":"2008","journal-title":"New Stream Cipher Designs: The eSTREAM Finalists"},{"key":"ref2:canniere2006trivium","volume-title":"Trivium specifications","author":"Christophe De Canniere","year":"2006"},{"key":"ref3:iso","volume-title":"ISO\/IEC 29192-3:2012 Information technology\u2014Security\n  techniques\u2014Lightweight cryptography\u2014 Part 3: Stream ciphers"},{"key":"ref4:eSTREAM","volume-title":"The eSTREAM portfolio\u2014eSTREAM: the ECRYPT Stream\n  Cipher Project"},{"key":"ref5:ePrint:CMM+23","volume-title":"Randomness Generation for Secure Hardware Masking - Unrolled\n  Trivium to the Rescue","author":"Ga\u00ebtan Cassiers","year":"2023"},{"key":"ref6:banik2018towards","doi-asserted-by":"publisher","first-page":"1","DOI":"10.13154\/tosc.v2018.i2.1-19","article-title":"Towards low energy stream ciphers","author":"Subhadeep Banik","year":"2018","journal-title":"IACR Transactions on Symmetric Cryptology"},{"key":"ref7:caforio2021perfect","doi-asserted-by":"publisher","first-page":"36","DOI":"10.46586\/tosc.v2021.i4.36-73","article-title":"Perfect Trees: Designing Energy-Optimal Symmetric Encryption\n  Primitives","author":"Andrea Caforio","year":"2021","journal-title":"IACR Transactions on Symmetric Cryptology"},{"key":"ref8:fischer2006differential","doi-asserted-by":"publisher","first-page":"257","DOI":"10.1007\/11967668_17","article-title":"Differential Power Analysis of Stream Ciphers","author":"Wieland Fischer","year":"2006"},{"key":"ref9:strobel2009side","article-title":"Side channel analysis attacks on stream ciphers","author":"Daehyun Strobel","year":"2009","journal-title":"Masterarbeit Ruhr-Universit\u00e4t Bochum, Lehrstuhl Embedded\n  Security"},{"key":"ref10:jia2012correlation","doi-asserted-by":"publisher","first-page":"479","DOI":"10.1002\/sec.329","article-title":"Correlation power analysis of Trivium","volume":"5","author":"Yanyan Jia","year":"2012","journal-title":"Security and Communication Networks"},{"key":"ref11:tena2015dpa","doi-asserted-by":"publisher","first-page":"1846","DOI":"10.1109\/ISCAS.2015.7169016","article-title":"DPA vulnerability analysis on Trivium stream cipher using\n  an optimized power model","author":"Erica Tena-S\u00e1nchez","year":"2015"},{"key":"ref12:tena2015optimized","first-page":"1","article-title":"Optimized DPA attack on Trivium stream cipher using\n  correlation shape distinguishers","author":"Erica Tena-S\u00e1nchez","year":"2015"},{"key":"ref13:sim2021dapa","doi-asserted-by":"publisher","first-page":"169","DOI":"10.46586\/tches.v2021.i1.169-191","article-title":"DAPA: Differential Analysis aided Power Attack on\n  (Non-)Linear Feedback Shift Registers","author":"Siang Meng Sim","year":"2021","journal-title":"IACR Transactions on Cryptographic Hardware and Embedded\n  Systems"},{"key":"ref14:kumar2022side","doi-asserted-by":"publisher","first-page":"166","DOI":"10.46586\/tches.v2022.i2.166-191","article-title":"Side Channel Attack On Stream Ciphers: A Three-Step Approach\n  To State\/Key Recovery","author":"Satyam Kumar","year":"2022","journal-title":"IACR Transactions on Cryptographic Hardware and Embedded\n  Systems"},{"key":"ref15:CTRSA:BGSD10","doi-asserted-by":"publisher","first-page":"195","DOI":"10.1007\/978-3-642-11925-5_14","article-title":"Unrolling Cryptographic Circuits: A Simple Countermeasure\n  Against Side-Channel Attacks","author":"Shivam Bhasin","year":"2010"},{"key":"ref16:LightSec:YHA16","doi-asserted-by":"publisher","first-page":"148","DOI":"10.1007\/978-3-319-29078-2_9","article-title":"Improved Power Analysis on Unrolled Architecture and Its\n  Application to PRINCE Block Cipher","author":"Ville Yli-M\u00e4yry","year":"2016"},{"key":"ref17:AC:MS16","doi-asserted-by":"publisher","first-page":"517","DOI":"10.1007\/978-3-662-53887-6_19","article-title":"Side-Channel Analysis Protection and Low-Latency in Action","author":"Amir Moradi","year":"2016"},{"key":"ref18:TIFS:YUM+21","doi-asserted-by":"publisher","first-page":"1351","DOI":"10.1109\/TIFS.2020.3033441","article-title":"Diffusional Side-Channel Leakage From Unrolled Lightweight\n  Block Ciphers: A Case Study of Power Analysis on PRINCE","volume":"16","author":"Ville Yli-M\u00e4yry","year":"2021","journal-title":"IEEE Transactions on Information Forensics and Security"},{"key":"ref19:CHES:MPO05","doi-asserted-by":"publisher","first-page":"157","DOI":"10.1007\/11545262_12","article-title":"Successfully Attacking Masked AES Hardware\n  Implementations","author":"Stefan Mangard","year":"2005"},{"key":"ref20:TCHES:Moos20","doi-asserted-by":"publisher","first-page":"416","DOI":"10.13154\/tches.v2020.i4.416-442","article-title":"Unrolled Cryptography on Silicon: A Physical Security\n  Analysis","volume":"2020","author":"Thorben Moos","year":"2020","journal-title":"IACR Transactions on Cryptographic Hardware and Embedded\n  Systems"},{"key":"ref21:ISSITC:SA15","doi-asserted-by":"publisher","first-page":"253","DOI":"10.1007\/978-3-319-27179-8_18","article-title":"Secure Implementation of Stream Cipher: Trivium","author":"Dillibabu Shanmugam","year":"2015"},{"key":"ref22:ICECS:MHBM+18","doi-asserted-by":"publisher","first-page":"393","DOI":"10.1109\/ICECS.2018.8617892","article-title":"Energy-efficient Masking of the Trivium Stream Cipher","author":"Maxime Montoya","year":"2018"},{"key":"ref23:COSADE:HHN+13","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"169","DOI":"10.1007\/978-3-642-40026-1_11","article-title":"Chosen-IV Correlation Power Analysis on KCipher-2 and a\n  Countermeasure","volume":"7864","author":"Takafumi Hibiki","year":"2013"},{"key":"ref24:SEMS:KUH+2017","first-page":"113","article-title":"Practical Power Analysis on KCipher-2 Software on Low-End\n  Microcontrollers","author":"Wataru Kawai","year":"2017"},{"key":"ref25:WOOT:BZD+16","series-title":"WOOT'16","first-page":"15","article-title":"Nonce-disrespecting adversaries: practical forgery attacks\n  on GCM in TLS","author":"Hanno B\u00f6ck","year":"2016"},{"key":"ref26:TCHES:UHIM23","doi-asserted-by":"publisher","first-page":"264","DOI":"10.46586\/tches.v2024.i1.264-308","article-title":"Fallen Sanctuary: A Higher-Order and Leakage-Resilient\n  Rekeying Scheme","volume":"1","author":"Rei Ueno","year":"2023","journal-title":"IACR Transactions on Cryptographic Hardware and Embedded\n  Systems"},{"key":"ref27:Z3:dMB08","first-page":"337","article-title":"Z3: An Efficient SMT Solver","author":"Leonardo de Moura","year":"2008"},{"key":"ref28:Z3","volume-title":"Z3 API in Python","author":"Microsoft","year":"2023"},{"key":"ref29:CHES:FPS12","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"213","DOI":"10.1007\/978-3-642-33027-8_13","article-title":"Practical Leakage-Resilient Symmetric Cryptography","volume":"7428","author":"Sebastian Faust","year":"2012"},{"key":"ref30:FSE:Prouff05","doi-asserted-by":"publisher","first-page":"424","DOI":"10.1007\/11502760_29","article-title":"DPA Attacks and S-Boxes","author":"Emmanuel Prouff","year":"2005"},{"key":"ref31:JCEN:FDLZ15","doi-asserted-by":"publisher","DOI":"10.1007\/s13389-015-0107-0","article-title":"A statistics-based success rate model for DPA and CPA","volume":"5","author":"Yunsi Fei","year":"2015","journal-title":"Journal of Cryptographic Engineering"},{"key":"ref32:EC:DS09","doi-asserted-by":"publisher","first-page":"278","DOI":"10.1007\/978-3-642-01001-9_16","article-title":"Cube Attacks on Tweakable Black Box Polynomials","author":"Itai Dinur","year":"2009"},{"key":"ref33:EC:HHLW24","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-58716-0_13","article-title":"Massive Superpoly Recovery with a Meet-in-the-middle\n  Framework: Improved Cube Attacks on Trivium and Kreyvium","author":"Jiahui He","year":"2024"},{"key":"ref34:Picek-TCHES-2019","doi-asserted-by":"publisher","first-page":"209","DOI":"10.13154\/tches.v2019.i1.209-237","article-title":"The Curse of Class Imbalance and Conflicting Metrics with\n  Machine Learning for Side-channel Evaluations","author":"Stjepan Picek","year":"2019","journal-title":"IACR Transactions on Cryptographic Hardware and Embedded\n  Systems"},{"key":"ref35:ito-tifs-2021","doi-asserted-by":"publisher","first-page":"3790","DOI":"10.1109\/TIFS.2021.3092050","article-title":"Imbalanced Data Problems in Deep Learning-Based Side-Channel\n  Attacks: Analysis and Solution","volume":"16","author":"Akira Ito","year":"2021","journal-title":"IEEE Transactions on Information Forensics and Security"},{"key":"ref36:Ito-eprint-2021","volume-title":"Toward Optimal Deep-Learning Based Side-Channel Attacks:\n  Probability Concentration Inequality Loss and Its Usage","author":"Akira Ito","year":"2021"}],"container-title":["IACR Communications in Cryptology"],"original-title":[],"language":"en","deposited":{"date-parts":[[2024,12,10]],"date-time":"2024-12-10T21:28:15Z","timestamp":1733866095000},"score":1,"resource":{"primary":{"URL":"https:\/\/cic.iacr.org\/p\/1\/3\/14"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,10,7]]},"references-count":36,"URL":"https:\/\/doi.org\/10.62056\/angy11zn4","archive":["Internet Archive","Internet Archive"],"relation":{},"ISSN":["3006-5496"],"issn-type":[{"value":"3006-5496","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,10,7]]},"assertion":[{"value":"2024-07-04","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2024-09-02","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}}],"article-number":"cc1-3-41"}}