Experiments in Attacking FPGA-Based Embedded

Systems using Differential Power Analysis

Song Sun Zijun Yan Joseph Zambreno
Dept. of Electrical and Computer Engineering
Iowa State University
Ames, IA 50011
Email: {sunsong, zijunyan, zambreno}@iastate.edu

Abstract—In the decade since the concept was publicly intro- research into their susceptibility to power analysis attacks.
duced, power analysis attacks on cryptographic systems have be- Indeed, much previous effort has gone into applying DPA
come an increasingly studied topic in the computer security com- attacks on FPGA platforms [4], [5], [6], [7], and on developing
munity. Research into countermeasures for these cryptographic
systems has intensified as well. Experiments have been conducted corresponding anti-attack methods [8], [9], [10], [11], [12].
showing the potential effectiveness of power analysis attacks and Unfortunately, in all of the previous research on this topic,
preventative techniques on both software (e.g. smartcard, DSP) the experimental results and analysis were based on either
and hardware (e.g. ASIC, FPGA) processing elements. One key simulated power consumption models or synthetic hand-made
observation that motivates our work is that the majority of FPGA boards. As a result, little is known as to the practical
the research into power analysis on FPGA-based cryptographic
systems has been a) theoretical in nature, b) evaluated through impact that DPA attacks can have on commercial FPGA
simulation, or c) experimented using custom hardware that does boards. In our opinion this may lead to a disconnect between
not closely mirror real-world systems. In this paper, we look the theory and practice of protecting FPGA-based embedded
to bridge this gap between theory and practice by detailing systems.
our experience in performing a Differential Power Analysis In this paper, we describe an automated data acquisition
(DPA) attack on a commercial FPGA development board. We
present an automated data acquisition and analysis design for an and analysis system for applying a DPA attack on an FPGA
FPGA-based implementation of the Data Encryption Standard executing a cryptographic algorithm. Using this system, we
(DES), and discuss some of the challenges and obstacles that mounted an attack on a Xilinx Virtex-II Pro FPGA running
we encountered when performing the DPA attack on our chosen a Data Encryption Standard (DES) core. Our choice of both
commercial platform. FPGA board and cryptographic algorithm are driven by their
respective popularity; the Virtex-II Pro was the first Xilinx
I. I NTRODUCTION
FPGA that was capable of running hardware/software designs
Power analysis attacks are regarded as a very powerful in an integrated reconfigurable fabric, and can commonly be
approach to cracking cryptographic systems [1]. This class of found in both academic and industrial environments. DES was
attacks make use of the power consumption information from the first standardized cryptographic implementation broken
processing elements built using CMOS circuits. Introduced by the power analysis community, and as such remains a
first by Kocher et al. [2] in 1998, there are two main flavors popular target, even after the introduction of newer, more
of power analysis attack: the Simple Power Analysis (SPA) robust private-key algorithms.
attack and the Differential Power Analysis (DPA) attack. In the Our goal in running these experiments is to provide an in-
SPA attack, by tracing the whole system power consumption depth case study to the security community describing the
information, the adversary can deduce the types of instructions challenges inherent in performing real-world DPA attacks on
running in the processing element, which in a cryptographic FPGA-based systems. One surprising result of our work is
system will often be directly influenced by the choice of that the practical impact of DPA (and other power analysis)
secret key. By comparison, the DPA attack combines this attacks on commercial FPGA boards is severely limited by
power analysis with statistical and error correction techniques, several factors not considered in previous research, and as
leading to a more powerful approach. As will be described in such we strongly suggest that many of the current efforts
Section III, due to the statistical nature of the DPA attack, an into DPA countermeasures may be misguided. At the very
attacker using DPA is not required to know any details of the least our work implies that given the physical access required
internal algorithmic implementation. by the DPA methodology, an attacker’s time would be better
Reconfigurable computing systems, such as those based spent performing other non-invasive techniques. We hope to
on Field Programmable Gate Array (FPGA) technology, are stir debate in the security community on the actual reach and
a very promising platform for designing high-performance importance of DPA attacks on real-world hardware systems.
cryptographic systems, due to their high throughput rates The remainder of this paper is organized as follows. In the
and inherent design flexibility [3]. The growing popularity of following section, we review current efforts in performing and
FPGAs as a cryptographic processing element has necessitated preventing power analysis attacks on FPGA-based embedded

978-1-4244-2030-8/08/$25.00 ©2008 IEEE. 7

systems, both of the SPA and DPA variety. In Section 3, Key
Plaintext
we describe some of the basic theory and practice of the
DPA attack, and describe how it can be applied to an FPGA 32 56
board. In Section 4, we detail our automated data acquisition
and analysis system, and describe the experimental setup and Expanded Plaintext Subkey
steps taken. We provide an analysis of the collected data
in Section 5, and discuss some of the practical implications 48 48
of our results. Finally, the paper is concluded in Section 6 +
with a summary of the direction for our future work, and an
introductory discussion of suggestions for the DPA on FPGA a0 a5 a 42 a 47
research community.
II. R ELATED W ORK S1 …… S8
Research into power analysis attacks on cryptographic sys- b0 b3 b28 b31
tems has flourished ever since the topic was first announced
by Kocher et al. [2]. Originally intended as a technique Fig. 1. Structure of the S-box in a round of DES
to use on smartcards and other portable software systems,
in recent years power analysis has been applied to FPGA-
based computing systems. The authors in [4] investigated DPA Dynamic Differential Logic (WDDL). In theory, each WDDL
attacks on FPGA platforms through the use of a simulator gate has a constant power consumption profile; a fixed charge
that counted the transitions of CLB output signals to estimate is used for each signal transition, making the consumption
power. The authors also evaluate the usefulness of various independent of the transition frequency. The same authors have
gate-level countermeasures to DPA through the use of this also presented a place-and-route methodology [11] and full
simulation infrastructure. Although the conclusions presented VLSI design flow [12] in support of their technique.
were of potential use (the authors concluded that only a few Many of these proposed anti-DPA measures are themselves
nodes in the circuit had a high relation to the bits of the secret nullified by improved attack technology. It is also important to
key), the ultimate value of this and other similar approaches is note that any imperfect masking will only serve to obfuscate
lessened by the choice of a simulator that considers the power the power consumption characteristics of a circuit, which can
consumption of the FPGA in isolation from its supporting be circumvented at the expense of additional computational or
environment. data acquisition time. Even if the DPA computational workload
An investigation into performing DPA on actual FPGA for an attacker is increased beyond reasonable limits [7],
hardware is presented in [5]. One limitation of this approach higher-order differential power analysis attacks may still be
is that the FPGA is placed on a custom board in order possible [16].
to facilitate the power analysis. Conclusions made in this
synthetic environment may not have a direct corollary when III. D IFFERENTIAL P OWER A NALYSIS P RINCIPLES
adapted to a commercial FPGA board. DPA is a passive attack that is performed by externally
The power consumption characteristics of an FPGA is not observing the power consumption of a circuit performing
fundamentally different from that of an ASIC using CMOS cryptographic computations. The theory behind DPA is that
technology [13]. The authors in [6] first generalize this power the power consumed by the computational logic is statistically
consumption model using DES transition counts, and then correlated with the internal bit transitions.
perform a DPA attack by correlating the real measurement We selected DES as the attack target since DES was the first
data to their model. algorithm used to demonstrate the practicality of DPA in [2]. In
As previously mentioned, many of the reported power anal- the following explanation, we assume that the attacker knows
ysis attacks are based on the DES encryption standard [14]. the input plaintext values (the known plaintext variety of DPA
More recently some have began the initial work required to attack). The DPA process can be described as follows:
perfom a DPA attack on implementations of AES [15], [13] First, the attacker records N plaintexts and their correspond-
and elliptic curve cryptosystems [8]. ing power traces P [N ]. In reality, the plaintext value are likely
After the initial reports of successful power analysis attacks, to be randomly distributed. The power trace for each input
many countermeasures have been proposed in response. These plaintext can be represented as P [N ][M ]. The voltage value
SPA- and DPA-resistant techniques try to solve the problem on power trace P [i] at time j is P [i][j]. The value of N and
from different angles, by looking at hardware design at the M can be determined by the attacker. The larger the value of
logic level, as well as the interaction between instruction N , the more accurate is the guess of the final extracted key.
set architecture and software. One of the first logic level A larger M implies a higher power sampling rate.
countermeasures was the transformed masking method, which Next, the attacker chooses an output bit of a S-box in the
was introduced in [9]. In [10] the authors proposed a family of first round. The structure of the S-box in DES is shown in
DPA-resistant compound standard cells, referred to as Wave Fig. 1. Typically, the first output bit b0 is chosen. Bit b0

8
 &W'>ŽŐŝĐ
yŝůŝŶdžŵďĞĚĚĞĚ W>
ĞǀĞůŽƉŵĞŶƚ<ŝƚ;<Ϳ WŽǁĞƌWϰϬϱ
sŝƌƚĞdžͲ//WƌŽ&W'
Dd>/ŶƐƚƌƵŵĞŶƚ
ŽŶƚƌŽůdŽŽůďŽdž ƉƌŽďĞϭ ƉƌŽďĞϮ

,ŽƐƚtŽƌŬƐƚĂƚŝŽŶ s/^/ŶƚĞƌĨĂĐĞ
KƐĐŝůůŽƐĐŽƉĞ

Fig. 3. Components in the experimental setup

from the average power of group B, as the number of input

plaintext values approaches infinity. The other factors which
affect the power data values (such as measurement errors,
Fig. 2. Data acquisition experimental setup electrical noise, etc.) that are not correlated to the value of bit
b0 will approach zero as the value of N approaches infinity. If
the value of M is large enough to encapsulate the power data
depends on the six bits of the secret key and plaintext. The for each of the sixteen rounds, a spike will be observed for
attacker makes an initial guess of those key bits (out of 64 the graph of the average power difference. Everywhere else in
possible values). Based on the guessed value of the six bits of the graph the value will converge to zero.
the key and the known-plaintext, one can compute the guessed 
value of b0 . Since bit b0 can only have two values (0 or 1), the j j = 0 for some j
lim (P̄A − P̄B ) (4)
attacker can divide the whole N power traces into two groups N →∞ = 0 otherwise
according to the value of b0 . For each power trace of the N
iterations using varied plaintext values, it is assigned into the There are in total eight S boxes in the DES F function.
first group A if the theoretical value of b0 is 0; otherwise, it is Finding all 48 bits of the subkey can be accomplished by
assigned into the second group B. Once all of the power traces combining all eight 6-bit keys. There are another eight bits in
values have been acquired, the average power is calculated. the 56-bit input key that can be easily found in the second
The average power is calculated at each time point j using round analysis. Once the subkey for the first round is known,
the equations: the input to the second round can be considered as a known
plaintext value. The search process can then continue in a
|A| similar fashion as for the first round.
1 
P̄Aj = P [i][j] (1)
|A| i=1 IV. E XPERIMENTAL S ETUP
|B| The goal of our experiment is to automate the data collection
1 
P̄Bj = P [i][j] (2) and analysis stages of the DPA attack targeting a commercial
|B| i=1 FPGA board. As is shown in Fig. 2, our setup consists of
If the guessed six-bit key is not correct, the computed essentially three parts: the digital oscilloscope, the FPGA-
value of bit b0 will be different from the real value with based development board and the host PC. Two kinds of
a probability of 0.5. This has the actual effect of placing a software are run on the host PC which we will explain in
power trace vector randomly into two groups A or B. The detail in the following section.
average power traces of the two groups will be the same if The oscilloscope is responsible for collecting differential
the number of different plaintext approaches to infinity. Hence power traces from the FPGA board. It is connected with the
the difference of average power traces between the two groups Xilinx Virtex-II Pro FPGA board through two probe needles.
will approximately be zero as N approaches infinity. The host PC is the control center of the whole system. It
coordinates the activity sequence of the oscilloscope and the
lim (P̄Aj − P̄Bj ) = 0, 1 ≤ j ≤ M (3) Virtex-II Pro board. The host PC and the oscilloscope are
N →∞ connected using USB. The bridge between the host PC and
However, if the guessed six-bit key is correct, the computed FPGA board is composed of two connections. One is a USB
value of bit b0 will be the same as the actual value with a connection which is used for FPGA configuration download.
probability of 1. As stated before, the power consumption of The other one is a serial connection which is used as data
the electrical device is correlated to the internal bit transition. communication between the host PC software and the software
The power traces with the value of bit b0 equal to 0 must running on the FPGA (developed using Xilinx EDK) that
be different from those with the value of bit b0 equal to 1. controls the DES module. More details of the components
In this sense, the average power of group A will diverge in the experimental setup are shown in Fig. 3.

9
 ƵƐDĂƐƚĞƌ WWϰϬϱ ^ŽƌĞ
sƐƐ ƵƐ^ůĂǀĞ KD W> W>
KDh^ W>h^
Leakage current
н

W>ͲKW
ZD/ͬ&
W>

ƌŝĚŐĞ
KD
ͺ ZD KW

Fig. 4. Probe needle connection to the oscilloscope /ŶƐƚƌƵĐƚŝŽŶ KWh^

DĞŵŽƌLJ KW KW
ĂƚĂ WƵƐŚďƵƚƚŽŶƐ

A. Oscilloscope DĞŵŽƌLJ ^ĞƌŝĂůhZd
>Ɛ
The oscilloscope is a Tektronix DPO4032 digital phosphor
oscilloscope whose sampling rate is 2.5G/s on all channels. yŝůŝŶdžsŝƌƚĞdžͲ//WƌŽ&W'
A USB 2.0 device port is used for direct PC control of the
oscilloscope using the USBTMC protocol. One probe needle Fig. 5. Architecture of our target FPGA-based cryptographic system
of the oscilloscope is connected to the trigger output of the
DES module which is running on the FPGA board. The other
probe needle is connected to the ground output of the board. parts: the DES encryption key, the input plaintext for DES,
The ground output of the oscilloscope is also connected to a and the output for each plaintext and key combination.
resistor whose other end is connected to the true ground of the D. Comprehensive Operation
oscilloscope. One probe needle connection is shown in Fig. 4.
The Vss pin is the ground of the board. Leakage current will Upon system startup, the EDK project code is downloaded
flow through the resistor load whose two ends are connected into the FPGA board, including both the hardware and soft-
to the probe needles of oscilloscope. The voltage measured ware components. The software running on the PPC sits and
varies with the activity inside the board, which includes the waits to receive data from the MATLAB interface, while the
FPGA chip operation. hardware design running in the FPGA user logic is waiting
to receive data from the PLB. The DES key information is
B. Host PC embedded in the EDK code. More precisely, the 56-bit key is
stored in the PPC software. Then it is extended and aligned
There are two kinds of software running on the host PC. to 64 bits and sent to the user logic via PLB.
One is the MATLAB Instrument Control Toolbox [17]. The After initializing all kinds of parameters, the MATLAB
other is the Xilinx Embedded Development Kit (EDK). The interface sends a plaintext value to the FPGA board via the
MATLAB instrument control toolbox interacts directly with serial port. Each plaintext is generated randomly. Although
Tektronix oscilloscopes, enabling users to acquire and analyze there exist alternative ways to obtain the plaintext for the
data, graphically visualize data, make custom measurements, known plaintext DPA attack, in our platform the randomly
generate reports, and develop automated applications. This can produced plaintext is used to simulate the real-world data
all be done through the USB port between the host PC and encryption source.
the oscilloscope. MATLAB itself also can communicate data The PPC receives the plaintext and transfers it to the user
with other devices connected to host PC by the serial port. logic over the PLB. The DES core running in the user logic
In our setup, MATLAB sends DES plaintext to the software has both the key and plaintext. After one DES computation
controller on the FPGA via the serial port. iteration, the ciphertext is made available at a shared register
location. If necessary, the ciphertext can be read by the
C. FPGA Board MATLAB interface through the serial port connecting them.
The FPGA board contains a Virtex-II Pro XC2VP30 FPGA, What is more important is the power traces measured by the
which includes two IBM PowerPC 405 processor cores [18]. oscilloscope. In the MATLAB instrument control toolbox we
The architecture of the PowerPC-based embedded system for wait for enough time (usually more than one DES cycle) to
use in running these experiments is shown in Fig. 5. In the gather the data from the oscilloscope. We must synchronize
EDK project, we divide the whole system into a hardware the starting point of the power traces to the starting point of
component and a software component. The hardware part one DES iteration. The trick is that the rising edge of the
runs in the FPGA logic while the software part runs on the trigger pulse can be aligned with the start of one DES round
PPC. The PPC swaps data with the FPGA hardware logic as shown in Fig. 6. Accordingly, the starting point of the DES
through the CoreConnect Processor Local Bus (PLB). The data transition power trace can be located at the rising edge of the
swapped between the PPC and FPGA logic consists of three trigger output.

10
 The clock frequency of the Xilinx board is set at 100 MHz.
The time to run one DES round is 10 nanoseconds. The
sampling rate of the oscilloscope is 2.5G/s. Consequently there
are 25 samples we can get from the oscilloscope for each
round. Even though we only use such a small part of the
sampled power trace data, it is on the order of megabytes of
data for each sampling operation. Transferring MBs of data
through the USB port can take several seconds. To make the
attack less time-consuming, the PPC sends m plaintext values
to the DES module running in the FPGA logic. For example,
if the plaintext value sent by the MATLAB interface is p,
the plaintext values used by DES module in one iteration is
p, p+1, p+2, p+3 for m equal to 2. That is, the MATLAB
instrument control toolbox can obtain 16*4 rounds of power
trace data each iteration. For the large number of plaintext
values required by differential power analysis, this can save
quite a bit of attack time. After collecting all of the power trace Fig. 6. Power traces for four DES iterations in one trigger pulse period
data needed, they are saved by the MATLAB interface as a
single large matrix variable. Each row in this matrix contains
the plaintext and its corresponding power trace data. There are figures for all 64 possible inputs, but still, no right key was
in total N rows and M +1 columns of power trace data. found in any one of them.
For each S-box, there are 64 possible input values. For each After thoroughly checking our code, the focus of our
input value, we divide the power traces data into two groups concern switched to the board-level circuitry. Eventually, we
according to the computed value of the first output bit. If the discovered that one main reason our DPA attack failed was
output bit value is 0, the corresponding power data is put in because there are a group of decoupling capacitors around
group A; otherwise, it is put in group B. Then we calculate the the input of the FPGA internal power supply. Decoupling
average difference value between the two the groups. In theory, capacitors can effectively prevent the internal power supply
as described in Section III, the average power difference graph from bouncing, which turns out to effectively mask the needed
with a spike corresponds to the correct subkey. However, in power leakage information. As a result, the likelihood of
reality the average power difference cannot be absolutely zero successfully mounting DPA attacks on this specific FPGA
because N is not infinite. In practice a larger value of N will board are largely reduced with the capacitors in place. It is
give less error and noise in the output. In our experimental a general rule that the decoupling capacitors are essential in
setup, N is equal to ten thousand and M is equal to 25 for maintaining a stable-working high-performance FPGA circuit
each DES round. Figure 7 shows an average power difference with signal and power integrity. In this way, the decoupling
for the first round of an S-box. capacitor itself can be a very good preventative method against
From this graph, we can see that the average power differ- a DPA attacker who does not want to physically break the
ence is very small and up to the micro-voltage scale. Thus, board.
it is extremely difficult to find a spike in such a graph in Another factor that may affect the final result is the noise
reality. To avoid this problem, we adapted the original method introduced by the functionalities, other than the DES core,
to use the average value of the average difference instead to which are also running on the FPGA. Due to the time
find the spike. The average value of the average difference is complexity of collecting and post-processing the power data,
calculated and recorded with respect to the related plaintext. Xilinx EDK was used to automate these steps. However, the
We call such an average value as the score of the input value. EDK tool itself generates a large number of interface VHDL
We select the input value with the maximum score value as codes which are eventually configured into the FPGA board.
the guessed part of the subkey. That is, the part of the subkey Due to the fact that all of the programs are sharing the same
as the input of an S-box is computed as: internal logic power supply, these logic modules may also
affect the power leakage traces. As a result, these two inherent
M
1  j obstacles prevented us from obtaining satisfactory results.
max (|P̄A − P̄Bj |) (5)
k=1,2,...,64 M
j=1 VI. C ONCLUSION
We have presented a platform to automatically perform
V. R ESULT A NALYSIS DPA on a real-world FPGA board. This platform gives us
Figure 8 shows the score for the 64 input values. From this a systematic view on how to successfully perform the DPA
figure, one can recognize the maximum score. Unfortunately, attack in a practical sense. The efficiency of analysis is critical
however, the extracted key is not correct. In order to enlarge to DPA if the attacker wants to break the FPGA cryptographic
the chance of finding out the right data, we observe the spike system. This requirement comes from two scenarios. Firstly,

11
 Voltage x 10
-6
Voltage -6
x 10
7 14

6
12

5
10

8
3

6
2

1 4

0
0 5 10 15 20 25 2
Sample 0 10 20 30 40 50 60 70 6-bit input
point value

Fig. 7. Average power difference for the first round of an S-box Fig. 8. Score for 64 input values of an S-box in DES

most modern cryptographic algorithms are based on the fact [4] Larry T. McDaniel III, “An investigation of differential power analysis
attacks on FPGA-based encryption systems,” Master’s thesis, Virginia
that they can be broken in theory, but not in practice. For Polytechnic Institute and State University, 2003.
example, it will take billions of years to break a 256-bit [5] S. B. Ors, E. Oswald, and B. Preneel, “Power-analysis attacks on an
AES system in a brute-force search. Secondly, the key of FPGA – first experimental results,” in Proceedings of the International
Workshop on Cryptographic Hardware and Embedded Systems (CHES),
cryptosystem like AES or DES is usually changed after a Sep. 2007, pp. 35–50.
variable period of time. The new key is newly negotiated by [6] F.-X. Standaert, S. B. Ors, J.-J. Quisquater, and B. Preneel, “Power anal-
the peers in a security protocol like IPSec. From this point ysis attacks against FPGA implementations of the DES,” in Proceedings
of the International Conference on Field-Programmable Logic and its
of view, DPA must be able to destroy the cryptosystem in a Applications (FPL), Aug. 2004, pp. 84–94.
limited time range. [7] C. Clavier, J.-S. Coron, and N. Dabbous, “Differential power analysis
Most previous work focuses on using a custom FPGA in the presence of hardware countermeasures,” in Proceedings of the
International Workshop on Cryptographic Hardware and Embedded
board as the target of DPA attack. While it is a great jump Systems (CHES), 2000, pp. 252–263.
from theory to practice, commercial secure embedded systems [8] J.-S. Coron, “Resistance against differential power analysis for elliptic
should be the target for all researchers in this area. As the curve cryptosystems,” in Proceedings of the International Workshop on
Cryptographic Hardware and Embedded Systems (CHES), 1999, pp.
analysis demonstrated above, the experimental result shows 292–302.
that the DPA attacks are not as powerful as expected when [9] M.-L. Akkar and C. Giraud, “An implementation of DES and AES se-
facing the commercial FPGA platform due to the decoupling cure against some attacks,” in Proceedings of the International Workshop
on Cryptographic Hardware and Embedded Systems (CHES), 2001, pp.
capacitors. The FPGA board must be physically broken before 309–318.
successfully applying DPA, making it no longer a passive [10] K. Tiri, M. Akmal, and I. Verbauwhede, “A dynamic and differential
attack. The decoupling capacitor is a natural countermeasure. CMOS logic with signal independent power consumption to withstand
differential power analysis on smart cards,” in Proceedings of the
The last obstacle limiting DPA attacks in from practice is European Solid-State Circuits Conference (ESSCIRC), Sep. 2002, pp.
that there is more than one electrical device on an FPGA board. 403–406.
In our example, the on-chip PPC processor also participated [11] K. Tiri and I. Verbauwhede, “Place and route for secure standard cell
design,” in Proceedings of the Smart Card Research and Advanced
in the power consumption. Other on-board components may Application IFIP Conference (CARDIS), 2004, p. 143.
overwhelm the power consumed by the reconfigurable logic. [12] ——, “A digital design flow for secure integrated circuits,” IEEE
It is also likely that there would be more than one module Transactions on Computer-Aided Design of Integrated Circuits and
Systems, vol. 25, no. 7, pp. 1197–1208, Jul. 2006.
concurrently running on the FPGA. All of this leads to a DPA [13] S. B. Ors, F. Gurkaynak, E. Oswald, and B. Preneel1, “Power-analysis
attack being difficult and expensive to perform on this kind of attack on an ASIC AES implementation,” in Proceedings of the Inter-
system. How to solve these challenges in a demonstrable way national Conference on Information Technology (ITCC), 2004.
[14] National Institute of Standards and Technology, “FIPS PUB 46-3, Data
is still a topic which deserves further research. Encryption Standard (DES),” available at http://www.nist.gov, Oct. 1999.
[15] A. Schuster and E. Oswald, “Differential power analysis of an AES
R EFERENCES implementation,” Institute for Applied Information Processing and Com-
munications, Graz University of Technology, Tech. Rep. IAIK-TR
[1] H. Bar-El, “Introduction to side channel attacks,” available at 2004/06/25, Jun. 2004.
http://www.discretix.com, 2007. [16] M. Joye1, P. Paillier, and B. Schoenmakers, “On second-order differ-
[2] P. Kocher, J. Jaffe, and B. Jun, “Differential power analysis,” in ential power analysis,” in Proceedings of the International Workshop
Proceedings of Advances in Cryptology (Crypto), Aug. 1999, pp. 388– on Cryptographic Hardware and Embedded Systems (CHES), 2005, pp.
397. 293–308.
[3] J. Zambreno, D. Nguyen, and A. Choudhary, “Exploring area/delay [17] The MathWorks, “Instrument control toolbox 2.4.2,” available at
tradeoffs in an AES FPGA implementation,” Proceedings of the Inter- http://www.mathworks.com, 2007.
national Conference on Field-Programmable Logic and its Applications [18] Xilinx, “Virtex-II Pro family complete data sheet,” available at
(FPL), pp. 575–585, Aug. 2004. http://www.xilinx.com, 2007.

12