SCRIP: Secure Random Clock Execution on Soft Processor Systems to Mitigate Power-based Side Channel Attacks

Power-based side channel attacks are effective in revealing the secret keys of cryptographic algorithm implementations running on soft processor systems. This paper, for the first time, proposes a clock random execution methodology (referred to as SCRIP) to execute a soft processor core and most of the components (some components cannot be executed with a random clock frequency). An open source soft processor system (LowRISC which is based on the RISC-V Instruction Set Architecture) has been executed with the proposed SCRIP clock random execution methodology. Power analysis attacks (including preprocessing techniques to remove the effects of random execution) were carried out against the SCRIP LowRISC soft processor implementation to test the effects of random clock execution. SCRIP LowRISC implementation is shown to be secure for up to 300,000 encryptions, while the LowRISC implementation without SCRIP revealed the secret key within 1,000 encryptions. The result of information leakage test shows that the secret key cannot be recovered with 99.999% confidence level. Compared to other soft core processor countermeasures, SCRIP LowRISC implementation has the smallest complete soft processor system with 1.04× resource overhead (the smallest hardware masking countermeasure, which is applied to only the ALU of a RISC-V processor has 1.59× resource overhead, and the smallest balancing countermeasure soft processor, with the countermeasure applied only to the ALU and the memory, required 1.15× area overhead) where the security against power analysis attacks is applied to most components of the processor (including ALU, caches, Block RAM, Block RAM controller, bus interconnect and SD card interface). SCRIP LowRISC implementation is the first soft processor with a random execution-based countermeasure to withstand preprocessing methods (such as power trace alignment and noise filtering) which remove the effects of random execution.