@inbook {18062,
	title = {Interaction between Fault Attack Countermeasures and the Resistance against Power Analysis Attacks},
	booktitle = {Fault Analysis in Cryptography},
	series = {Information Security and Cryptography Series, Springer},
	year = {2012},
	pages = {257-272},
	publisher = {Springer Berlin Heidelberg},
	organization = {Springer Berlin Heidelberg},
	abstract = {Most of the countermeasures against fault attacks on cryptographic systems that have been developed so far are based on the addition of information redundancy. While these countermeasures have been evaluated with respect to their cost (implementation overhead) and efficiency (fault coverage), little attention has been devoted to the question of the impact their use has on the effectiveness of other types of side-channel attacks, in particular, power analysis attacks. This chapter presents an experimental study whose goal is to determine whether the added information redundancy can increase the vulnerability of a cryptographic circuit to power analysis attacks.},
	isbn = {978-3-642-29656-7},
	doi = {10.1007/978-3-642-29656-7_15},
	author = {Regazzoni, Francesco and Breveglieri, Luca and Ienne, Paolo and Koren, Israel},
	editor = {Joye, Marc and Tunstall, Michael}
}
@conference {18087,
	title = {Low Cost Software Countermeasures Against Fault Attacks: Implementation and Performances Trade Offs},
	booktitle = {5th Workshop on Embedded Systems Security (WESS)},
	year = {2010},
	month = {October},
	address = {Scottsdale, Arizona, USA},
	author = {Barenghi, Alessandro and Breveglieri, Luca and Koren, Israel and Pelosi, Gerardo and Regazzoni, Francesco}
}
@conference {82.BeBrFaRe08,
	title = {A 640 Mbit/s 32-bit Pipelined Implementation of the AES Algorithm},
	booktitle = {SECRYPT},
	year = {2008},
	month = {July 26},
	address = {Porto, Portugal},
	abstract = {Due to the diffusion of cryptography in real time applications, performances in cipher and decipher operations are nowadays more important than in the past. On the other side, while facing the problem for embedded systems, additional constraints of area and power consumption must be considered. Many optimized software implementations, instruction set extensions and co-processors, were studied in the past with the aim to either increase performances or to keep the cost low. This paper presents a co-processor that aims to be an intermediate solution, suitable for such applications that require a throughput in the Megabit range and where the die size is a bit relaxed as constraint. To achieve this goal, the core is designed to operate at 32 bits and the throughput is guaranteed by a 2 stage pipeline with data forwarding. The obtained results synthesizing our coprocessor by means of the CMOS $0.18$ $μ$m standard cell library show that the throughput reaches 640 Mbit/s while the circuit size is of only 20 K equivalent gates. },
	keywords = {cryptography, security},
	author = {Bertoni, Guido Marco and Breveglieri, Luca and Farina, Roberto and Regazzoni, Francesco}
}
@conference {89.ReEiBrIeKo,
	title = {Can knowledge regarding the presence of countermeasures against fault attacks simplify power attacks on cryptographic devices?},
	booktitle = {Proceedings of 23rd IEEE International Symposium on Defect and Fault Tolerance in VLSI Systems (DFTS 08)},
	year = {2008},
	month = {October 1-3},
	abstract = {Side-channel attacks are nowadays a serious concern when implementing cryptographic algorithms. Powerful ways for gaining information about the secret key as well as various countermeasures against such attacks have been recently developed. Although it is well known that such attacks can exploit information leaked from different sources, most prior works have only addressed the problem of protecting a cryptographic device against a single type of attack. Consequently, there is very little knowledge on how a scheme for protecting a device against one type of side-channel attack may affect its vulnerability to other types of side-channel attacks. In this paper we focus on devices that include protection against fault injection attacks (using different error detection schemes) and explore whether the presence of such fault detection circuits affects the resistance against attacks based on power analysis. Using the AES S-Box as an example, we performed attacks on the unprotected implementation as well as modified implementations with parity check circuits or residue check circuits (mod3 and mod7). In particular, we focus on the question whether the knowledge of the presence of error detection circuitry in the cryptographic device can help an attacker who attempts to mount a power attack on the device. Our results show that the presence of error detection circuitry helps the attacker even if he is unaware of this circuitry, and that the benefit to the attacker increases with the number of check bits used for the purpose of error detection.},
	author = {Regazzoni, Francesco and Eisenbarth, Thomas and Breveglieri, Luca and Ienne, Paolo and Koren, Israel}
}
@conference {67.ReEiGr07,
	title = {Power Attacks Resistance of Cryptographic S-boxes with added Error Detection Circuits},
	booktitle = {proceedings of: {\textquoteright}22nd IEEE International Symposium on Defect and Fault Tolerance in VLSI Systems (DFT{\textquoteright}07)},
	year = {2007},
	month = {September 26-28},
	address = {Rome, Italy},
	abstract = {Many side-channel attacks on implementations of cryptographic algorithms have been developed in recent years demonstrating the ease of extracting the secret key. In response, various schemes to protect cryptographic devices against such attacks have been devised and some implemented in practice. Almost all of these protection schemes target an individual side-channel attack and consequently, it is not obvious whether a scheme for protecting the device against one type of side-channel attacks may make the device more vulnerable to another type of side-channel attacks. We examine in this paper the possibility of such a negative impact for the case where fault detection circuitry is added to a device (to protect it against fault injection attacks) and analyze the resistance of the modified device to power attacks. To simplify the analysis we focus on only one component in the cryptographic device (namely, the S-box in the AES and Kasumi ciphers), and perform power attacks on the original implementation and on a modified implementation with an added parity check circuit. Our results show that the presence of the parity check circuitry has a negative impact on the resistance of the device to power analysis attacks.},
	keywords = {cryptography, fault tolerance, reliable applications, side channel attacks},
	author = {Regazzoni, Francesco and Eisenbarth, Thomas and Gro{\ss}sch{\"a}dl, Johann and Breveglieri, Luca and Ienne, Paolo and Koren, Israel and Paar, Christof}
}
@conference {39.1169233,
	title = {Speeding Up AES By Extending a 32 bit Processor Instruction Set},
	booktitle = {ASAP {\textquoteright}06: Proceedings of the IEEE 17th International Conference on Application-specific Systems, Architectures and Processors (ASAP{\textquoteright}06)},
	year = {2006},
	pages = {275-282},
	publisher = {IEEE Computer Society},
	organization = {IEEE Computer Society},
	address = {Washington, DC, USA},
	abstract = {Nowadays the need of speed in cipher and decipher operations is more important than in the past. This is due to the diffusion of real time applications, which fact involves the use of cryptography. Many co-processors for cryptography were studied and presented in the past, but only few works were addressed to the enhancement of the instruction set architecture (ISA) of the embedded processor. This paper presents an extension of the ISA of a 32 bit processor, that aims at speeding up the software implementations of the AES algorithm. After the identification of the most frequently executed and the most time consuming sections of the algorithm, a set of dedicated instructions is designed in order to improve the performances of the cipher operations. We validate our instruction set extension by measuring the speed up for different optimized implementations of AES using an ARM processor simulator, but the enhancements we propose are general enough to be applied to almost all 32 bit processors.},
	keywords = {cryptography, HW/SW co-design, instruction set extension},
	isbn = {0-7695-2682-9},
	doi = {http://dx.doi.org/10.1109/ASAP.2006.62},
	author = {Bertoni, Guido Marco and Breveglieri, Luca and Farina, Roberto and Regazzoni, Francesco}
}
@conference {21.968073,
	title = {Efficient AES implementations for ARM based platforms},
	booktitle = {SAC {\textquoteright}04: Proceedings of the 2004 ACM symposium on Applied computing},
	year = {2004},
	pages = {841{\textendash}845},
	publisher = {ACM Press, New York, USA},
	organization = {ACM Press, New York, USA},
	address = {Nicosia, Cyprus},
	abstract = {The Advanced Encryption Standard (AES) contest, started by the U.S. National Institute of Standards and Technology (NIST), saw the Rijndael [13] algorithm as its winner [11]. Although the AES is fully defined in terms of functionality, it requires best exploitation of architectural parameters in order to reach the optimum performance on specific architectures. Our work concentrates on ARM cores [1] widely used in the embedded industry. Most promising implementation choices for the common ARM Instruction Set Architecture (ISA) are identified, and a new implementation for the linear mixing layer is proposed. The performance improvement over current implementations is demonstrated by a case study on the Intel StrongARM SA-1110 Microprocessor [2]. Further improvements based on exploitation of memory hierarchies are also described, and the corresponding performance figures are presented.},
	keywords = {advanced encryption standard (AES), ARM microprocessor, cache memories, code optimisation},
	isbn = {1-58113-812-1},
	doi = {http://doi.acm.org/10.1145/967900.968073},
	author = {Atasu, Kubilay and Breveglieri, Luca and Macchetti, Marco}
}
@conference {11.BiMaBeBreZaFra2003,
	title = {About the Performances of the Advanced Encryption Standard in Embedded Systems with Cache Memory},
	booktitle = {ISCAS 2003},
	year = {2003},
	month = {May 25-28},
	pages = {145-148},
	address = {Bangkok},
	abstract = {Modern networked embedded systems represent a growing market segment in which security is becoming an essential requirement. The Advanced Encryption Standard (AES) specification is becoming the default choice for such type of systems; however, a proper software implementation of AES is of fundamental importance in order to achieve significant performance. Current implementations presented in literature differ in terms of the amount of look-up tables used for pre-computing the functions of the encryption/decryption phase. This raises some questions regarding which AES implementation is optimal for a specific system configuration that, up to now, have been only empirically solved. In this work, we present an analytical model to study and evaluate the performance of the possible AES implementations in the early phases of system development. We then show that the proposed high-level timing model captures, with significant accuracy, the actual performance of current AES applications and thus it can be used for early evaluation of optimal AES implementations and to support the design space exploration phase. Validating experiments have been carried out on the Lx architecture, a scalable and customizable VLIW architecture developed by STMicroelectronics and HP Labs. Some final considerations are eventually reported about the relevant characteristics of the analyzed implementations and the role of the cache memory.},
	doi = {http://dx.doi.org/10.1109/ISCAS.2003.1206212},
	author = {Bircan, Aril and Macchetti, Marco and Bertoni, Guido Marco and Breveglieri, Luca and Zaccaria, Vittorio and Fragneto, Pasqualina}
}
@conference {8.752733,
	title = {Efficient Software Implementation of AES on 32-Bit Platforms},
	booktitle = {CHES {\textquoteright}02: Revised Papers from the 4th International Workshop on Cryptographic Hardware and Embedded Systems},
	year = {2003},
	pages = {159{\textendash}171},
	publisher = {Springer-Verlag},
	organization = {Springer-Verlag},
	address = {London, UK},
	abstract = {Rijndael is the winner algorithm of the AES contest; therefore it should become the most used symmetric-key cryptographic algorithm. One important application of this new standard is cryptography on smart cards. In this paper we present an optimisation of the Rijndael algorithm to speed up execution on 32-bits processors with memory constraints, such as those used in smart cards. First a theoretical analysis of the Rijndael algorithm and of the proposed optimisation is discussed, and then simulation results of the optimised algorithm on different processors are presented and compared with other reference implementations, as known from the technical literature.},
	isbn = {3-540-00409-2},
	author = {Bertoni, Guido Marco and Breveglieri, Luca and Fragneto, Pasqualina and Macchetti, Marco and Marchesin, Stefano}
}
@Patent {10.pat20030068036PATENT,
	title = {Method and circuit for data encryption/decryption},
	number = {US 09/974,705},
	year = {2003},
	month = {April},
	type = {Grant},
	chapter = {US7801301 B2},
	abstract = {Data are converted between an unencrypted and an encrypted format according to the Rijndael algorithm, including a plurality of rounds. Each round is comprised of fixed set of transformations applied to a two-dimensional array, designated state, of rows and columns of bit words. At least a part of said transformations are applied on a transposed version of the state, wherein rows and columns are transposed for the columns and rows, respectively.},
	issn = {US7801301B2},
	author = {Macchetti, Marco and Marchesin, Stefano and Bondi, Umberto and Breveglieri, Luca and Bertoni, Guido Marco and Fragneto, Pasqualina}
}
@conference {3.CaPoMaMaBeBreFra2001,
	title = {Efficient C implementation of the ECC and AES cryptographic systems},
	booktitle = {Technology Leadership Day - organized by the MicroSwiss Network},
	year = {2001},
	month = {October 10},
	address = {Fribourg},
	author = {Cassoli, Federico and Polloni, Flavio and Marchesin, Stefano and Macchetti, Marco and Bertoni, Guido Marco and Breveglieri, Luca and Fragneto, Pasqualina}
}
