CCRI:Planning-C:SCA-in-Cloud: Infrastructure to Perform Side-Channel Attacks on Cryptographic Algorithms

该项目侧重于规划导致开发可远程访问的研究基础设施的活动，以执行和分析对加密算法的侧通道攻击(云中SCA)。投入使用后，这一基础设施将作为一个开放访问平台，供研究人员设计和评估在硬件和软件中实施的创新SCA方法(例如，计时、基于功率)。这种开放基础设施的提供还将鼓励更安全的开发实践，并开辟新的基于社区的研究途径，以开发下一代加密算法的抗SCA实施。这项计划拨款的一个关键目标是将不同的群体(密码学理论家、软件工程师、嵌入式和实时工程师以及网络安全从业者)合并到一个更明显的社区中，并征求创建这一关键基础设施所需的合作者和反馈。此规划项目有两项主要任务。第一个主要任务包括一系列外展活动，以吸引客户对云中SCA基础设施的兴趣、要求和范围。外展战略包括在会议上进行调查和举办研讨会，以便与所有其他活跃的和有抱负的密码学研究小组以及国家标准和技术研究所(NIST)进行直接互动和社区建设。此外，将成立一个咨询委员会，初步确定基础设施中包括的硬件/软件平台和已知的旁路攻击。第二项主要任务是开发基础设施的原型，其中将包括现场可编程门阵列和嵌入式开发套件。该项目将始终将项目开发与本科生和研究生的研究和教育相结合，并让学生尽早接触到安全、软件设计和硬件设计方面的最新进展。阿肯色大学的嵌入式系统安全课程将使用拟议的基础设施来执行基于电源的旁路攻击。将联系其他机构以利用此云中SCA基础设施。将鼓励女性和代表性不足的学生加入研究团队。此外，还将在相关会议上组织教程和演示，如现场可编程门阵列、主机和加密技术，以向研究社区介绍基础设施。https://sca-in-cloud.uark.edu，网站专门提供基础设施的门户和所有数据、代码、结果和报告的项目库。所有用户都将通过本网站访问基础设施，对加密算法进行旁路攻击，并获得结果。网站和所有项目文件将存储在研究小组维护的台式计算机上，为期3年。此外，GitHub项目将托管所有数据、代码结果和报告作为永久解决方案，并将从上述URL链接。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

This project focuses on planning activities leading to the development of a remotely accessible research infrastructure for performing and analyzing side-channel attacks on cryptographic algorithms (SCA-in-Cloud). When commissioned, this infrastructure is envisioned serve as an open access platform for researchers to design and evaluate innovative SCA methods (e.g., timing, power-based) implemented in both hardware and software. The availability of this open infrastructure will also encourage more secure development practices and open new community-based research avenues to develop SCA-resistant implementations of next generation cryptographic algorithms. A key objective of this planning grant is to coalesce different groups (cryptography theorists, software engineers, embedded and real-time engineers, and cybersecurity practitioners) into a more visible community and solicit collaborators and feedback that is necessary to create this critical infrastructure.There are two major tasks in this planning project. The first major task includes a series of outreach activities for soliciting the interest, requirements, and the scope of the SCA-in-Cloud infrastructure. Outreach strategies include surveys and workshops at conferences for direct interactions and community building with all other cryptography active and aspirational research groups, and the National Institute of Standards and Technology (NIST). Further, an advisory committee will be formed for the initial determination of hardware/software platforms and known side-channel attacks included in the infrastructure. The second major task is to develop a prototype of the infrastructure, which will include FPGA and embedded development kits.This project will consistently integrate the project development with undergraduate and graduate research and education, and expose students early on to recent advances in security, software design, and hardware design. The proposed infrastructure will be used by the Embedded System Security course at the University of Arkansas for performing power-based side-channel attacks. Other institutions will be contacted to take advantage of this SCA-in-Cloud infrastructure. Women and underrepresented students will be encouraged to join the research team. Further, tutorials and demos will be organized at related conferences, such as FPGA, HOST, and Crypto for introducing the infrastructure to the research community.The website, https://sca-in-cloud.uark.edu, is dedicated to the portal to the infrastructure and the project repository for all data, code, results, and reports. All users will access the infrastructure through this website to perform side-channel attacks on cryptographic algorithms and obtain the results. The website and all project files will be stored on a desktop computer maintained by the research team for 3 years. In addition, a GitHub project will host all data, code results, and reports as a permanent solution, and will be linked to from the above URL.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.