@conference {18485,
	title = {Evaluating the Impact of Environmental Factors on Physically Unclonable Functions},
	booktitle = {International Symposium on Field-Programmable Gate Arrays FPGA 2016},
	series = {Proceedings of the 2016 ACM/SIGDA},
	year = {2016},
	month = {02/2016},
	pages = {279},
	publisher = {ACM New York, NY, USA},
	organization = {ACM New York, NY, USA},
	address = {Monterey, CA, USA},
	abstract = {Fabrication process introduces some inherent variability to the attributes of transistors (in particular length, widths, oxide thickness). As a result, every chip is physically unique. Physical uniqueness of microelectronics components can be used for multiple security applications. Physically Unclonable Functions (PUFs) are built to extract the physical uniqueness of microelectronics components and make it usable for secure applications.

However, the microelectronics components used by PUFs designs suffer from external, environmental variations that impact the PUF behavior. Variations of temperature gradients during manufacturing can bias the PUF responses. Variations of temperature or thermal noise during PUF operation change the behavior of the circuit, and can introduce errors in PUF responses. Detailed knowledge of the behavior of PUFs operating over various environmental factors is needed to reliably extract and demonstrate uniqueness of the chips.

In this work, we present a detailed and exhaustive analysis of the behavior of two PUF designs, a ring oscillator PUF and a timing path violation PUF. We have implemented both PUFs using FPGA fabricated by Xilinx, and analyzed their behavior while varying temperature and supply voltage. Our experiments quantify the robustness of each design, demonstrate their sensitivity to temperature and show the impact which supply voltage has on the uniqueness of the analyzed PUFs.
},
	isbn = {978-1-4503-3856-1},
	doi = {10.1145/2847263.2847308},
	url = {http://doi.acm.org/10.1145/2847263.2847308},
	author = {Bellon, Sebastien and Favi, Claudio and Malek, Miroslaw and Macchetti, Marco and Regazzoni, Francesco}
}
@article {18064,
	title = {Evaluating Resistance of MCML Technology to Power Analysis Attacks Using a Simulation-Based Methodology},
	journal = {Springer Transactions on Computational Science},
	volume = {5430},
	year = {2009},
	month = {February},
	pages = {230{\textendash}243},
	author = {Regazzoni, Francesco and Eisenbarth, Thomas and Poschmann, Axel and Groschdl, Johann and Gurkaynak, Frank and Macchetti, Marco and Toprak, Zeynep and Pozzi, Laura and Paar, Christof and Leblebici, Yusuf and Ienne, Paolo}
}
@conference {48.Giaconia2007,
	title = {Area and Power Efficient Synthesis of DPA-Resistant Cryptographic SBoxes},
	booktitle = {International Conference on VLSI Design \& Embedded Systems},
	year = {2007},
	month = {January 6-10},
	address = {Bangalore, India},
	abstract = {This paper presents a novel design methodology for the hardware implementation of non-linear bijective functions, commonly used in most symmetric-key cryptographic algorithms and known as substitution boxes (S-boxes). The proposed technique thwarts a particularly relevant class of side-channel attacks against cryptographic hardware, that of differential power analysis attacks (DPA). In the proposed approach, the cost of the countermeasure is kept low in terms of silicon process overheads (standard CMOS gates used), area requirement, power consumption and latency, when compared to existing countermeasures. Its effectiveness is proven by showing resistance to simulated DPA attacks using power curves derived with SPICE simulation.},
	keywords = {differential power analysis (DPA), low power design, side channel attacks},
	doi = {http://dx.doi.org/10.1109/VLSID.2007.44},
	author = {Giaconia, Matteo and Macchetti, Marco and Regazzoni, Francesco and Schramm, Kai}
}
@conference {55.DaFeMa,
	title = {A Memory Unit for Priority Management in IPSec Accelerators},
	booktitle = {proceedings of ICC07. Glasgow, Scotland: IEEE Communications Society},
	year = {2007},
	month = {June 24},
	address = {Glasgow, Scotland},
	abstract = {This paper introduces a hardware architecture for high speed network processors, focusing on support for Quality of Service in IPSec-dedicated systems. The effort is aimed at defining a secure system on chip environment, where the speed and security requirements are of utmost importance. In particular, a method is devised to introduce and support Quality of Service through priorities at this level. An architecture of a memory system that provides automatic priority management is proposed.},
	keywords = {accelerator, IPSec, priority, quality of service (QoS), security, system-on-chip (SoC), SystemC},
	doi = {http://dx.doi.org/10.1109/ICC.2007.257},
	author = {Dadda, Luigi and Ferrante, Alberto and Macchetti, Marco}
}
@conference {59.ReBaEi07,
	title = {Simulation-based Methodology for Evaluating DPA-Resistance of Cryptographic Functional Units with Application to CMOS and MCML Technologies},
	booktitle = {International Conference on Embedded Computer Systems: Architectures, Modeling, and Simulation (SAMOS IC 07)},
	year = {2007},
	month = {July 16-19},
	address = {Samos, Greece},
	abstract = {This paper explores the resistance of MOS Current Mode Logic (MCML) against Differential Power Analysis (DPA) attacks. Circuits implemented in MCML, in fact, have unique characteristics both in terms of power consumption and the dependency of the power profile from the input signal pattern. Therefore, MCML is suitable to protect cryptographic hardware from DPA and similar side-channel attacks. In order to demonstrate the effectiveness of different logic styles against power analysis attacks, the non-linear bijective function of the Kasumi algorithm (known as substitution box S7) was implemented with CMOS and MCML technology, and a set of attacks was performed using power traces derived from SPICE-level simulations. Although all keys were discovered for CMOS, only very few attacks to MCML were successful.},
	keywords = {current mode logic (CML), differential power analysis (DPA), power simulation, side channel attacks},
	author = {Regazzoni, Francesco and Badel, St{\'e}phane and Eisenbarth, Thomas and Gro{\ss}sch{\"a}dl, Johann and Poschmann, Axel and Toprak, Zeynep and Macchetti, Marco and Pozzi, Laura and Paar, Christof and Leblebici, Yusuf and Ienne, Paolo}
}
@conference {42.MaChen2006,
	title = {ASIC Hardware Implementation of the IDEA NXT Encryption Algorithm},
	booktitle = {IEEE International Symposium on Circuits and Systems},
	year = {2006},
	month = {May 21-24},
	address = {Kos, Greece},
	abstract = {Symmetric-key block ciphers are often used to provide data confidentiality with low complexity, especially in the case of dedicated hardware implementations. IDEA NXT is a novel block cipher family, which has many interesting features and is targeted to multimedia streaming encryption. Different values can be assigned to the hardware architecture parameters in order to scale the security and the performance of the cipher. In this paper, we implement the IDEA NXT algorithm in custom silicon, using a commercial technology library; different optimizations are applied in order to satisfy different constraints in terms of latency and area occupation, maintaining a high level of security. After giving an overview of the IDEA NXT design, a discussion of the implementation choices and trade offs is given, highlighting the similarities and the main differences with regards to other block ciphers. To the authors{\textquoteright} knowledge this is the first paper describing such work.},
	doi = {http://dx.doi.org/10.1109/ISCAS.2006.1693715},
	author = {Macchetti, Marco and Chen, Wenyu}
}
@conference {33.MacDad2005,
	title = {Quasi-Pipelined Hash Circuits},
	booktitle = {IEEE ARITH 17},
	year = {2005},
	month = {June},
	pages = {222-229},
	address = {Cape Cod},
	abstract = {Hash functions are an important cryptographic primitive. They are used to obtain a fixed-size fingerprint, or hash value, of an arbitrary long message. We focus particularly on the class of dedicated hash functions, whose general construction is presented; the peculiar arrangement of sequential and combinational units makes the application of pipelining techniques to these constructions not trivial. We formalize an optimization technique called quasi-pipelining, whose goal is to optimize the critical path and thus to increase the clock frequency in dedicated hardware implementations. The SHA-2 algorithm has been previously examined by Dadda et al, with specific versions of quasi-pipelining; a full generalization of the technique is presented, along with application to the SHA-1 algorithm. Quasi-pipelining could be as well applied to future hashing algorithms, provided they are designed along the same lines as those of the SHA family.},
	doi = {http://dx.doi.org/10.1109/ARITH.2005.36},
	author = {Macchetti, Marco and Dadda, Luigi}
}
@conference {35.MacRiv2005,
	title = {Small-scale Variants of the Secure Hash Standard},
	booktitle = {ECRYPT workshop on RFID and lightweight cryptography},
	year = {2005},
	month = {July 14-15},
	address = {Graz, Austria},
	abstract = {In this paper we present effective small scale formulations of the Secure Hash Standard; we focus on the SHA-2 family of algo- rithms, introducing new compact instances baptized SHA-16, SHA-32, and SHA-64. These may be useful for computing hashes and Message Authentication Codes (MACs) on small platforms where only 8-bit pro- cessors are available, such as in the case of Radio Frequency Identifi- cation (RFID) devices and embedded systems. To prove the soundness of our scaling approach, we analyze the cryptographic properties of the proposed constructions in terms of adherence to the Strict Avalanche Criterion (SAC) and of robustness to birthday attacks, by also compar- ing the results with the expected values from random functions. As an additional contribution, we complete the theoretical results for the bal- ance property of random functions, thereby also calculating the expected robustness of the original SHA-2 family versus birthday attacks. Keywords: hash functions, balance, SAC, small scale, RFID.},
	keywords = {balance, hash functions, RFID, SAC, small scale},
	author = {Macchetti, Marco and Rivard, Philippe}
}
@conference {29.SaMaRe2005,
	title = {Speeding Security on the Intel StrongARM},
	booktitle = {Embedded Intel Solutions},
	year = {2005},
	pages = {31-33},
	abstract = {With the increasing use of portable and wireless devices in the business and daily life, protecting sensitive information via encryption is becoming more and more crucial. ALaRI (Advanced Learning and Research Institute) has been conducting research aimed at improving the execution of security algorithms in embedded systems. Thanks to a donation from Intel, ALaRI has been able to develop several recommendations for implementing security efficiently on the Intel StrongARM architecture.},
	keywords = {embedded processors, instruction set extension, security},
	author = {Sami, Mariagiovanna and Macchetti, Marco and Regazzoni, Francesco}
}
@conference {20.989053,
	title = {An ASIC design for a high speed implementation of the hash function SHA-256 (384, 512)},
	booktitle = {GLSVLSI {\textquoteright}04: Proceedings of the 14th ACM Great Lakes symposium on VLSI},
	year = {2004},
	pages = {421{\textendash}425},
	publisher = {ACM Press, New York, USA},
	organization = {ACM Press, New York, USA},
	address = {Boston, MA, USA},
	abstract = {An implementation of the hash functions SHA-256, 384 and 512 is presented, obtaining a high clock rate through a reduction of the critical path length, both in the Expander and in the Compressor of the hash scheme. The critical path is shown to be the smallest achievable. Synthesis results show that the new scheme can reach a clock rate well exceeding 1 GHz using a 0.13?m technology.},
	isbn = {1-58113-853-9},
	doi = {http://doi.acm.org/10.1145/988952.989053},
	author = {Dadda, Luigi and Macchetti, Marco and Owen, Jeff}
}
@conference {18.969266,
	title = {The Design of a High Speed ASIC Unit for the Hash Function SHA-256 (384,512)},
	booktitle = {DATE {\textquoteright}04: Proceedings of the conference on Design, automation and test in Europe},
	year = {2004},
	pages = {30070},
	publisher = {IEEE Computer Society},
	organization = {IEEE Computer Society},
	address = {Washington, DC, USA},
	abstract = {After recalling the basic algorithms published by NIST for implementing the hash functions SHA-256 (384, 512), a basic circuit characterized by a cascade of full adder arrays is given. Implementation options are discussed and two methods for improving speed are exposed: the delay balancing and the pipelining. An application of the former is first given, obtaining a circuit that reduces the length of the critical path by a full adder array. A pipelined version is then given, obtaining a reduction of two full adder arrays in the critical path. The two methods are afterwards combined and the results obtained through hardware synthesis are exposed, where a comparison between the new circuits is also given.},
	isbn = {0-7695-2085-5-3},
	doi = {http://dx.doi.org/10.1109/DATE.2004.1269207},
	author = {Dadda, Luigi and Macchetti, Marco and Owen, Jeff}
}
@conference {21.968073,
	title = {Efficient AES implementations for ARM based platforms},
	booktitle = {SAC {\textquoteright}04: Proceedings of the 2004 ACM symposium on Applied computing},
	year = {2004},
	pages = {841{\textendash}845},
	publisher = {ACM Press, New York, USA},
	organization = {ACM Press, New York, USA},
	address = {Nicosia, Cyprus},
	abstract = {The Advanced Encryption Standard (AES) contest, started by the U.S. National Institute of Standards and Technology (NIST), saw the Rijndael [13] algorithm as its winner [11]. Although the AES is fully defined in terms of functionality, it requires best exploitation of architectural parameters in order to reach the optimum performance on specific architectures. Our work concentrates on ARM cores [1] widely used in the embedded industry. Most promising implementation choices for the common ARM Instruction Set Architecture (ISA) are identified, and a new implementation for the linear mixing layer is proposed. The performance improvement over current implementations is demonstrated by a case study on the Intel StrongARM SA-1110 Microprocessor [2]. Further improvements based on exploitation of memory hierarchies are also described, and the corresponding performance figures are presented.},
	keywords = {advanced encryption standard (AES), ARM microprocessor, cache memories, code optimisation},
	isbn = {1-58113-812-1},
	doi = {http://doi.acm.org/10.1145/967900.968073},
	author = {Atasu, Kubilay and Breveglieri, Luca and Macchetti, Marco}
}
@Patent {22.pat20040228482PATENT,
	title = {Method of implementing one-to-one binary function and relative hardware device, especially for a Rijndael S-box},
	number = {US 10/816,791 -- 	EP 20030425211},
	year = {2004},
	month = {10/2004},
	type = {Grant},
	chapter = {US 7502464 B2 -- EP 1465365 A1 },
	abstract = {A method for implementing one-to-one binary functions defined on the Galois field GF(2^8) is very useful for forming fast and low power hardware devices regardless of the binary function. The method includes decoding an input byte for generating at least one bit string that contains only one active bit, and logically combining the bits of the bit string according to the binary function for generating a 256-bit string representing a corresponding output byte. The 256-bit string is then encoded in a byte for obtaining the output byte.},
	issn = {US 7502464 B2},
	author = {Macchetti, Marco and Fragneto, Pasqualina and Bertoni, Guido Marco}
}
@conference {11.BiMaBeBreZaFra2003,
	title = {About the Performances of the Advanced Encryption Standard in Embedded Systems with Cache Memory},
	booktitle = {ISCAS 2003},
	year = {2003},
	month = {May 25-28},
	pages = {145-148},
	address = {Bangkok},
	abstract = {Modern networked embedded systems represent a growing market segment in which security is becoming an essential requirement. The Advanced Encryption Standard (AES) specification is becoming the default choice for such type of systems; however, a proper software implementation of AES is of fundamental importance in order to achieve significant performance. Current implementations presented in literature differ in terms of the amount of look-up tables used for pre-computing the functions of the encryption/decryption phase. This raises some questions regarding which AES implementation is optimal for a specific system configuration that, up to now, have been only empirically solved. In this work, we present an analytical model to study and evaluate the performance of the possible AES implementations in the early phases of system development. We then show that the proposed high-level timing model captures, with significant accuracy, the actual performance of current AES applications and thus it can be used for early evaluation of optimal AES implementations and to support the design space exploration phase. Validating experiments have been carried out on the Lx architecture, a scalable and customizable VLIW architecture developed by STMicroelectronics and HP Labs. Some final considerations are eventually reported about the relevant characteristics of the analyzed implementations and the role of the cache memory.},
	doi = {http://dx.doi.org/10.1109/ISCAS.2003.1206212},
	author = {Bircan, Aril and Macchetti, Marco and Bertoni, Guido Marco and Breveglieri, Luca and Zaccaria, Vittorio and Fragneto, Pasqualina}
}
@conference {8.752733,
	title = {Efficient Software Implementation of AES on 32-Bit Platforms},
	booktitle = {CHES {\textquoteright}02: Revised Papers from the 4th International Workshop on Cryptographic Hardware and Embedded Systems},
	year = {2003},
	pages = {159{\textendash}171},
	publisher = {Springer-Verlag},
	organization = {Springer-Verlag},
	address = {London, UK},
	abstract = {Rijndael is the winner algorithm of the AES contest; therefore it should become the most used symmetric-key cryptographic algorithm. One important application of this new standard is cryptography on smart cards. In this paper we present an optimisation of the Rijndael algorithm to speed up execution on 32-bits processors with memory constraints, such as those used in smart cards. First a theoretical analysis of the Rijndael algorithm and of the proposed optimisation is discussed, and then simulation results of the optimised algorithm on different processors are presented and compared with other reference implementations, as known from the technical literature.},
	isbn = {3-540-00409-2},
	author = {Bertoni, Guido Marco and Breveglieri, Luca and Fragneto, Pasqualina and Macchetti, Marco and Marchesin, Stefano}
}
@article {13.MaBer2003,
	title = {Hardware Implementation of the Rijndael Sbox: a Case Study},
	journal = {ST Journal of System Research},
	year = {2003},
	month = {July},
	pages = {84-91},
	abstract = {The Rijndael algorithm was officially selected as the Advanced Encryption Standard in 2001 and will replace the DES in all applications, including Smart Card based products. For this kind of platform, a compact, area efficient hardware implementation of the algorithm is highly desirable. This paper describes such an implementation, which we have based on GF(28) finite field decomposition. We present our results from mappings on the STMicroelectronics ASIC technology library and discuss area, timing and power consumption figures.},
	author = {Macchetti, Marco and Bertoni, Guido Marco}
}
@Patent {10.pat20030068036PATENT,
	title = {Method and circuit for data encryption/decryption},
	number = {US 09/974,705},
	year = {2003},
	month = {April},
	type = {Grant},
	chapter = {US7801301 B2},
	abstract = {Data are converted between an unencrypted and an encrypted format according to the Rijndael algorithm, including a plurality of rounds. Each round is comprised of fixed set of transformations applied to a two-dimensional array, designated state, of rows and columns of bit words. At least a part of said transformations are applied on a transposed version of the state, wherein rows and columns are transposed for the columns and rows, respectively.},
	issn = {US7801301B2},
	author = {Macchetti, Marco and Marchesin, Stefano and Bondi, Umberto and Breveglieri, Luca and Bertoni, Guido Marco and Fragneto, Pasqualina}
}
@conference {3.CaPoMaMaBeBreFra2001,
	title = {Efficient C implementation of the ECC and AES cryptographic systems},
	booktitle = {Technology Leadership Day - organized by the MicroSwiss Network},
	year = {2001},
	month = {October 10},
	address = {Fribourg},
	author = {Cassoli, Federico and Polloni, Flavio and Marchesin, Stefano and Macchetti, Marco and Bertoni, Guido Marco and Breveglieri, Luca and Fragneto, Pasqualina}
}
