Fault-based attack of RSA authentication
Abstract
For any computing system to be secure, both hardware and software have to be trusted. If the hardware layer in a secure system is compromised, not only it would be possible to extract secret information about the software, but it would also be extremely hard for the software to detect that an attack is underway. In this work we detail a complete end-to-end fault-attack on a microprocessor system and practically demonstrate how hardware vulnerabilities can be exploited to target secure systems. We developed a theoretical attack to the RSA signature algorithm, and we realized it in practice against an FPGA implementation of the system under attack. To perpetrate the attack, we inject transient faults in the target machine by regulating the voltage supply of the system. Thus, our attack does not require access to the victim system's internal components, but simply proximity to it. The paper makes three important contributions: first, we develop a systematic fault-based attack on the modular exponentiation algorithm for RSA. Second, we expose and exploit a severe flaw on the implementation of the RSA signature algorithm on OpenSSL, a widely used package for SSL encryption and authentication. Third, we report on the first physical demonstration of a fault-based security attack of a complete microprocessor system running unmodified production software: we attack the original OpenSSL authentication library running on a SPARC Linux system implemented on FPGA, and extract the system's 1024-bit RSA private key in approximately 100 hours.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Cites
A method for obtaining digital signatures and public-key cryptosystems
Rivest, R. L., Shamir, A., & Adleman, L. (1978) · Communications of the ACM · doi:10.1145/359340.359342 · Cited by 13,462 · see citing works
Handbook of Applied Cryptography
Menezes, A., van Oorschot, P. C., & Vanstone, S. A. (2010) · CRC Press eBooks · doi:10.1201/9781439821916 · Cited by 2,910 · see citing works
Ayers, J. E. (2003) · CRC Press eBooks · doi:10.1201/9780429258404 · Cited by 908 · see citing works
Remote timing attacks are practical
Brumley, D., & Boneh, D. (2005) · Computer Networks · doi:10.1016/j.comnet.2005.01.010 · Cited by 875 · see citing works
The Sorcerer's Apprentice Guide to Fault Attacks
Bar-El, H., Choukri, H., Naccache, D., Tunstall, M., & Whelan, C. (2006) · Proceedings of the IEEE · doi:10.1109/jproc.2005.862424 · Cited by 744 · see citing works
On the Importance of Eliminating Errors in Cryptographic Computations
Boneh, D., DeMillo, R. A., & Lipton, R. J. (2000) · Journal of Cryptology · doi:10.1007/s001450010016 · Cited by 516 · see citing works
Fault Attacks on RSA with CRT: Concrete Results and Practical Countermeasures
Aumüller, C., Bier, P., Fischer, W., Hofreiter, P., & Seifert, J. (2003) · Lecture notes in computer science · doi:10.1007/3-540-36400-5_20 · Cited by 258 · see citing works
Chinese Remaindering Based Cryptosystems in the Presence of Faults
Jóye, M., Lenstra, A. K., & Quisquater, J.-J. (1999) · Journal of Cryptology · doi:10.1007/s001459900055 · Cited by 143 · see citing works
Breaking public key cryptosystems on tamper resistant devices in the presence of transient faults
Bao, F., Deng, R. H., Han, Y., Jeng, A. B., Narasimhalu, A. D., & Ngair, T.-H. (1998) · Lecture notes in computer science · doi:10.1007/bfb0028164 · Cited by 129 · see citing works
A Practical Fault Attack on Square and Multiply
Schmidt, J.-M., & Herbst, C. (2008) · Workshop on Fault Diagnosis and Tolerance in Cryptography · doi:10.1109/fdtc.2008.10 · Cited by 108 · see citing works
Biham, E., Carmeli, Y., & Adi Shamir, Z. (2008) · Lecture notes in computer science · doi:10.1007/978-3-540-85174-5_13 · Cited by 107 · see citing works
Cryptanalysis of a provably secure CRT-RSA algorithm
Wagner, D. A. (2004) · Proceedings of the ACM Conference on Computer and Communications Security · doi:10.1145/1030083.1030097 · Cited by 82 · see citing works
Efficient construction of binary moment diagrams for verifying arithmetic circuits
Hamaguchi, K., Morita, A., & Yajima, S. (2002) · International Conference on Computer Aided Design · doi:10.1109/iccad.1995.479995 · Cited by 42 · see citing works
Attacking Right-to-Left Modular Exponentiation with Timely Random Faults
Boreale, M. (2006) · Lecture notes in computer science · doi:10.1007/11889700_3 · Cited by 14 · see citing works
Flagged first, then by citations
1 of the 15 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
A Review on the Use of Blockchain for the Internet of Things
Fernandez-Carames, T. M., & Fraga-Lamas, P. (2018) · IEEE Access · doi:10.1109/access.2018.2842685 · Cited by 1,078 · see citing works
A Review on Blockchain Technologies for an Advanced and Cyber-Resilient Automotive Industry
Fraga‐Lamas, P., & Fernández‐Caramés, T. M. (2019) · IEEE Access · doi:10.1109/access.2019.2895302 · Cited by 356 · see citing works
“…Layer Security (TLS) [46], [47]: Rivest–Shamir–Adleman (RSA) based cipher suites [48] that also make use of RSA as the key exchange algorithm [49], [50]; and Elliptic Curve Diffie-Hellman Exchange (ECDHE), which is based on Elliptic Curve Cryptography (ECC) and performs exchanges through Ephemeral…”
MethodFernández‐Caramés, T. M. (2019) · IEEE Internet of Things Journal · doi:10.1109/jiot.2019.2958788 · Cited by 340 · see citing works
“implementations were broken around 2010 [12], [13].”
Yang, K., Hicks, M., Dong, Q., Austin, T. M., & Sylvester, D. (2016) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2016.10 · Cited by 256 · see citing works
“, erroneous result leaks part of the key as in RSA attacks [29]).”
BackgroundSelf-citationHardware Designer's Guide to Fault Attacks
Karaklajić, D., Schmidt, J.-M., & Verbauwhede, I. M. R. (2013) · IEEE Transactions on Very Large Scale Integration (VLSI) Systems · doi:10.1109/tvlsi.2012.2231707 · Cited by 198 · see citing works
“turbed while performing a computation, which will cause an erroneous intermediate or final result [22], [23], [24], [25], [1], [26], [27], [28], [29], [30], [31], [32], [33], [34], [35], [36].”
BackgroundSoC It to EM: ElectroMagnetic Side-Channel Attacks on a Complex System-on-Chip
Longo, J., Mulder, E. D., Page, D., & Tunstall, M. (2015) · Lecture notes in computer science · doi:10.1007/978-3-662-48324-4_31 · Cited by 149 · see citing works
“[35] who mount voltage depletion fault attacks on RSA executing under Linux (on SPARC).”
BackgroundSuárez-Albela, M., Fernández-Caramés, T., Fraga-Lamas, P., & Castedo, L. (2017) · Sensors · doi:10.3390/s17091978 · Cited by 125 · see citing works
Sensing nanosecond-scale voltage attacks and natural transients in FPGAs
Zick, K. M., Srivastav, M., Zhang, W., & French, M. (2013) · ACM/SIGDA International Symposium on Field-Programmable Gate Arrays (FPGA) · doi:10.1145/2435264.2435283 · Cited by 114 · see citing works
“In a voltage glitch attack, an attacker with physical access injects glitches into the power grid to force a system into an invalid state that leaks information [4][5].”
BackgroundKiah, M. L. M., Abdulnabi, M. S., Zaidan, B. B., & Zaidan, A. A. (2013) · Journal of Medical Systems · doi:10.1007/s10916-013-9971-2 · Cited by 100 · see citing works
“The signature is then returned to the client, who verifies it using the server’s known public key [36].”
A Reliable Routing Architecture and Algorithm for NoCs
DeOrio, A., Fick, D., Bertacco, V., Sylvester, D., Blaauw, D. T., Hu, J., & Chen, G. (2012) · IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems · doi:10.1109/tcad.2011.2181509 · Cited by 88 · see citing works
Self-citationNartey, C., Tchao, E. T., Gadze, J. D., Keelson, E., Klogo, G. S., Kommey, B., & Diawuo, K. (2021) · Wireless Communications and Mobile Computing · doi:10.1155/2021/6672482 · Cited by 74 · see citing works
“The most common ones being the 768-bit and 1024-bit implementation (which were broken in 2010 [80, 81]) as well as the current standard which is the 2048-bit implementation.”
BackgroundThe Fault Attack Jungle - A Classification Model to Guide You
Verbauwhede, I. M. R., Karaklajić, D., & Schmidt, J.-M. (2011) · Workshop on Fault Diagnosis and Tolerance in Cryptography · doi:10.1109/fdtc.2011.13 · Cited by 69 · see citing works
“…[24], [49], [7], [17] Abstraction Level Cryptographic Primitive Level Protocol Level [3], [42], [28], [5], [24], [49], [7], [17], [38], [43] [36], [39], [4], [8], [23], [44], [11], [41], [48], [21] [12], [25], [27] At this point, it is important to emphasize that the security pyramid which…”
Low voltage fault attacks to AES
Barenghi, A., Bertoni, G., Breveglieri, L., Pellicioli, M., & Pelosi, G. (2010) · IEEE International Symposium on Hardware Oriented Security and Trust (HOST) · doi:10.1109/hst.2010.5513121 · Cited by 67 · see citing works
“…achieve this, we employ a non-invasive fault model based on underfeeding a general purpose CPU, which has been first described in [2], [3] and successfully used in [4] where the authors detailed a fault-attack on a FPGA based SPARC system and demonstrated how voltage regulations can be exploited…”
MethodShamshad, S., Riaz, F., Riaz, R., Rizvi, S. S., & Abdulla, S. (2022) · Sensors · doi:10.3390/s22218151 · Cited by 45 · see citing works
“Since the first successful encryption methods were made public in the 1970s, public-key cryptography has been critical for modern Internet communications due to its capacity to give high security [17,18].”
BackgroundQuantum cryptography: Overview, security issues and future challenges
Mitra, S., Jana, B., Bhattacharya, S., Pal, P., & Poray, J. (2017) · International Conference on Opto-Electronics and Applied Optics (Optronix) · doi:10.1109/optronix.2017.8350006 · Cited by 44 · see citing works
Image scrambling adversarial autoencoder based on the asymmetric encryption
Bao, Z., Xue, R., & Jin, Y. (2021) · Multimedia Tools and Applications · doi:10.1007/s11042-021-11043-3 · Cited by 36 · see citing works
“With the development of attack technology and the improvement of computer computing ability, many encryption algorithms could not provide the security, for example, [39] could use approximately 100 h to extract 1024-bit RSA private key.”
MethodKarakra, A., & Alsadeh, A. (2016) · 2016 SAI Computing Conference (SAI) · doi:10.1109/sai.2016.7556103 · Cited by 30 · see citing works
“The paper does not cover the chosen-ciphertext attacks (CCA) and the Hardware fault-based attack [28].”
BackgroundPower Distribution Attacks in Multitenant FPGAs
Provelengios, G., Holcomb, D. E., & Tessier, R. (2020) · IEEE Transactions on Very Large Scale Integration (VLSI) Systems · doi:10.1109/tvlsi.2020.3027711 · Cited by 30 · see citing works
Heavy-Ion Microbeam Fault Injection into SRAM-Based FPGA Implementations of Cryptographic Circuits
Li, H., Du, G., Shao, C., Dai, L., Xu, G., & Guo, J. (2015) · IEEE Transactions on Nuclear Science · doi:10.1109/tns.2015.2423672 · Cited by 25 · see citing works
“As a comparison, 8424 h were required to extract the 1024 b of the right-to-left binary RSA implementation on an FPGA, in a fault injection attack by means of power-supply glitches [22].”
MethodDifferential fault analysis of AES: Toward reducing number of faults
Kim, C. H. (2012) · Information Sciences · doi:10.1016/j.ins.2012.02.028 · Cited by 22 · see citing works
“several cryptosystems such as Triple-DES [19], RC4 [7, 20], CLEFIA [13, 37], RSA [27, 40, 15, 31], ElGamal [3], LUC and Demytko [10], ECC [6, 9, 14], AES [11, 12, 16, 18, 33, 28, 23, 39, 36, 38, 5, 29, 21], SMS4 and MacGuffin [24], and DSA [30].”
BackgroundAutomatic saboteur placement for emulation-based multi-bit fault injection
Grinschgl, J., Krieg, A., Steger, C., Weiß, R., Bock, H., & Haid, J. (2011) · International Symposium on Reconfigurable Communication-centric Systems-on-Chip (ReCoSoC) · doi:10.1109/recosoc.2011.5981521 · Cited by 21 · see citing works
“The multiplier is used because in [29] an attack on a RSA authentication process is shown by attacking the multiplication.”
MethodMavroudis, V., Cerulli, A., Švenda, P., Cvrček, D., Klinec, D., & Danezis, G. (2017) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3133956.3133961 · Cited by 19 · see citing works
Securing Circuits and Protocols against 1/poly(k) Tampering Rate
Dachman-Soled, D., & Kalai, Y. T. (2014) · Lecture notes in computer science · doi:10.1007/978-3-642-54242-8_23 · Cited by 16 · see citing works
“Indeed, physical attacks exploiting the implementation (rather than the functionality) of cryptographic schemes such as RSA have been known in theory for several years [41, 8] and recent works have shown that these attacks can be carried out in practice [9, 49].”
BackgroundModular Fault Injector for Multiple Fault Dependability and Security Evaluations
Grinschgl, J., Krieg, A., Steger, C., Weiß, R., Bock, H., & Haid, J. (2011) · Euromicro Conference on Digital System Design (DSD) · doi:10.1109/dsd.2011.76 · Cited by 15 · see citing works
“As assumed, attacks to the output of the multiplier can be used to emulate attacks as shown in [24].”
BackgroundMethodInfluentialA novel simulation approach for fault injection resistance evaluation on smart cards
Rivière, L., Bringer, J., Le, T., & Chabanne, H. (2015) · IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW) · doi:10.1109/icstw.2015.7107460 · Cited by 14 · see citing works
“With the same model, a bit, stored in a register might spontaneously produce an incorrect value, exposing secret keys with a limited amount of erroneous signatures [8].”
BackgroundImproved Differential Fault Analysis of CLEFIA
Ali, S. S., & Mukhopadhyay, D. (2013) · Workshop on Fault Diagnosis and Tolerance in Cryptography · doi:10.1109/fdtc.2013.11 · Cited by 14 · see citing works
“Later on many DFA attacks were implemented on different ciphers like RSA [4], ECC [5], and IDEA [6].”
BackgroundApplication-Aware diagnosis of runtime hardware faults
Pellegrini, A., & Bertacco, V. (2010) · doi:10.1109/iccad.2010.5653788 · Cited by 13 · see citing works
“However, the effects on these applications can be dramatic when hardware infallibility is questioned, as shown in [21].”
BackgroundSelf-citationA Comprehensive Survey on Pre Versus Post Quantum Security Schemes for 5G-Enabled IoT Applications
Choudhury, B., Hota, A., Karmakar, M., Saha, S., Nag, A., & Nandi, S. (2025) · IEEE Access · doi:10.1109/access.2025.3608623 · Cited by 16 · see citing works
“This has necessitated a substantial increase in the key size from 1024 bit to 2048 bit and 4096 bit [145].”
Differential Fault Analysis of Twofish
Ali, S. S., & Mukhopadhyay, D. (2013) · Lecture notes in computer science · doi:10.1007/978-3-642-38519-3_2 · Cited by 9 · see citing works
“Afterward, DFA was mounted against many crypto-systems like AES [5–12], Triple-DES [13], CLEFIA [14, 15], IDEA [16], RSA [17–19].”
MethodPolynomial-based Lightweight Key Management in a Permissioned Blockchain
Albakri, A., Harn, L., & Maddumala, M. N. (2019) · IEEE Conference on Communications and Network Security · doi:10.1109/cns.2019.8802723 · Cited by 8 · see citing works
“We need to mention that a 2048-bit is the minimum key size for an RSA to be considered secure, since a 1024-bits RSA implementation was broken in 2010 [21].”
BackgroundChaser: An Enhanced Fault Injection Tool for Tracing Soft Errors in MPI Applications
Guan, Q., Hu, X., Grove, T., Fang, B., Jiang, H., Yin, H., & DeBadeleben, N. (2020) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn48063.2020.00051 · Cited by 8 · see citing works
“…[32], [41], [29], neutron (“cosmic”) radiation [12], [7], electromagnetic interference [30], electromigration [24], temperature [6], [23], voltage [11], 1 This manuscript is submitted for DSN2020 tool category 1 LA-19-27437 [37] extremes/fluctuations, and nefarious tampering/espionage [31].”
BackgroundCryptanalytic Attacks and Countermeasures on RSA
Dubey, M. K., Ratan, R., Verma, N., & Saxena, P. K. (2014) · Advances in intelligent systems and computing · doi:10.1007/978-81-322-1771-8_70 · Cited by 8 · see citing works
Analysis and Comparison of DES, AES, RSA Encryption Algorithms
Tiwari, P. K., Choudhary, V., & Aman, S. R. (2022) · International Conference on Advances in Computing, Communication Control and Networking (ICAC3N) · doi:10.1109/icac3n56670.2022.10073996 · Cited by 7 · see citing works
“In [1 , 2] the secret key algorithms were implemented and their performance time was compared by encrypting different sizes of text file.”
MethodHySecNJoining: A hybrid secure node joining algorithm for wireless sensor network
Kalita, H. K., & Kar, A. (2011) · doi:10.1109/comsnets.2011.5716524 · Cited by 6 · see citing works
“[14] identifies a fault-based attack on RSA authentication scheme.”
BackgroundCardio: Adaptive CMPs for reliability through dynamic introspective operation
Pellegrini, A., & Bertacco, V. (2011) · Proceedings · doi:10.1109/hldvt.2011.6113983 · Cited by 6 · see citing works
“Even worse, undetected faults can lead to silent data corruptions, potentially compromising system security and causing safety hazards [22].”
BackgroundSelf-citationVerification of Authenticated Firmware Loaders
Muduli, S. K., Subramanyan, P., & Ray, S. (2019) · Formal Methods in Computer-Aided Design · doi:10.23919/fmcad.2019.8894262 · Cited by 6 · see citing works
“Of course, the specific choice of operations to be included in the tamper relation depends on the SoC’s threat model.”
BackgroundInfluentialFault-Resilient Non-interference
Tedesco, F. D., Sands, D., & Russo, A. (2016) · IEEE Computer Security Foundations Workshop (CSFW) · doi:10.1109/csf.2016.35 · Cited by 5 · see citing works
“More recently, it has been shown that faults occurring in the computation of an RSA signature can permit an attacker to extract the private key from an authentication server [26].”
BackgroundShamshad, S., Riaz, F., Riaz, R., Rizvi, S. S., & Abdulla, S. (2021) · International Conference on Information and Communication Technology Convergence (ICTC) · doi:10.1109/ictc52510.2021.9621208 · Cited by 5 · see citing works
Quantum Computers—Security Threats and Solutions
Szatmáry, K. S. (2024) · Advanced sciences and technologies for security applications · doi:10.1007/978-3-031-47990-8_38 · Cited by 5 · see citing works
Syed, A. S. Q., Atheeq, C., Ali, L., & Quasim, M. T. (2024) · Engineering Technology & Applied Science Research · doi:10.48084/etasr.7073 · Cited by 4 · see citing works
Parametrized hardware architectures for the Lucas primality test
Masle, A. L., Luk, W. W., & Moritz, C. A. (2011) · International Conference on Embedded Computer Systems: Architectures, Modeling, and Simulation · doi:10.1109/samos.2011.6045453 · Cited by 4 · see citing works
“In a software environment, vulnerabilities of the operating system and both software-based [4] and hardware-based [13] attacks can be exploited to compromise the crypto-system.”
MethodFault analysis detection in public key cryptosystems (RSA)
Mamathashree, A. M., Remya, K., & Kumar, B. J. S. (2017) · doi:10.1109/iccsp.2017.8286409 · Cited by 4 · see citing works
Case study on multiple fault dependability and security evaluations
Grinschgl, J., Krieg, A., Steger, C., Weiß, R., Bock, H., Haid, J., Aichinger, T., & Ulbricht, C. (2012) · Microprocessors and Microsystems · doi:10.1016/j.micpro.2012.05.016 · Cited by 3 · see citing works
“In [25], it is concluded that fault attacks on the multiplication unit can be used to attack the RSA algorithm.”
BackgroundMethodInfluentialSecure remittance transaction to bankless consumers in a fragmented applications market
Mampaey, M. (2011) · Bell Labs Technical Journal · doi:10.1002/bltj.20512 · Cited by 3 · see citing works
“Also, because of recent vulnerabilities discovered on the RSA1024 algorithm [14], we propose the use of stronger asymmetric keying based on elliptic curve cryptography (ECC) [13].”
BackgroundApplication of elliptic curve cryptography in pretty good privacy (PGP)
Agrawal, A. K., & Sanchit, M. (2016) · International Conference on Computing, Communication and Automation · doi:10.1109/ccaa.2016.7813870 · Cited by 3 · see citing works
“Most of the specialized algorithms and heuristics, at present, can successfully break RSA in polynomial time until the key sizes are further increased [8][17][19].”
Cardio: CMP Adaptation for Reliability Through Dynamic Introspective Operation
Pellegrini, A., & Bertacco, V. (2014) · IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems · doi:10.1109/tcad.2013.2284008 · Cited by 2 · see citing works
Self-citationSecurity Issues in Tactical Software-Defined Radios
da Silva, F. A. B., Moura, D., & Galdino, J. F. (2014) · Advances in systems analysis, software engineering, and high performance computing book series · doi:10.4018/978-1-4666-6034-2.ch002 · Cited by 2 · see citing works
Lee, Y. S., Thiranant, N., Kim, H., Jo, J., & Lee, H. J. (2015) · Lecture notes in electrical engineering · doi:10.1007/978-3-662-46578-3_57 · Cited by 2 · see citing works
Classes of Attacks for Tactical Software Defined Radios
da Silva, F. A. B., Moura, D., & Galdino, J. F. (2012) · International Journal of Embedded and Real-Time Communication Systems · doi:10.4018/jertcs.2012100104 · Cited by 1 · see citing works
Lakshmi, C. V. (2013) · IOSR Journal of Electronics and Communication Engineering · doi:10.9790/2834-0460108 · Cited by 1 · see citing works
A method to assess the robustness of cryptographic circuits at the design stage
Arévalo-Garbayo, M., Portela-Garcia, M., García-Valderas, M., López-Ongil, C., & Entrena, L. (2014) · Microelectronics Journal · doi:10.1016/j.mejo.2013.12.012
On General Number Field Sieve and its Polynomial Selection
Zhou, G. (2014) · Applied Mechanics and Materials · doi:10.4028/www.scientific.net/amm.519-520.250
“[1][13] Up to now the RSA integer with bit length less than 1024 is partially solved, while [3] claimed to find a special attacking case for RSA-1024, many RSA integers are still open.”
BackgroundExploring the Interaction Between Device Lifetime Reliability and Security Vulnerabilities
Ho, C.-H., Staus, G., Ullmer, A., & Sakaralingam, K. (2011) · IEEE Computer Architecture Letters · doi:10.1109/l-ca.2011.16
“They are uncontrollable by a manufacturer and are today addressed by increasing guardband in various ways.”
BackgroundComputer Science & Technology Series
Pesado, P. M., Estayno, M. G., & Piccoli, M. F. (2017) · doi:10.35537/10915/61164
Правові аспекти щодо поняття «Компрометація особистого ключа електронного підпису»
Корнейко, О. В., & Костенко, О. В. (2020) · Ukrainian Information Security Research Journal · doi:10.18372/2410-7840.22.14658
LEGAL RISKS OF COMPROMISING A QUALIFIED ELECTRONIC SIGNATURE
Kostenko, O. V., Prokopovych-Tkachenko, D., & Florov, S. (2023) · Juridical scientific and electronic journal · doi:10.32782/2524-0374/2023-11/91
- Authors
- Pellegrini, A., Bertacco, V., & Austin, T.
- Affiliations
- University of Michigan (US)
- Venue
- 2010 Design, Automation & Test in Europe Conference & Exhibition (DATE 2010)
- Publisher
- IEEE
- Published
- 2010-03
- Pages
- 855-860
- OpenAlex
- W3149585926
- Cited by
- 56
- References
- 15
- Citations by year
- 2025: 1 · 2024: 2 · 2023: 1 · 2022: 2 · 2021: 3 · 2020: 3 · 2019: 4 · 2018: 1 · 2017: 5 · 2016: 4 · 2015: 4 · 2014: 6 · 2013: 6 · 2012: 4
- FWCI
- 5.17
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- Design, Automation, and Test in Europe (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
- Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- side-channel attacks, RSA signature, modular exponentiation, hardware vulnerabilities, transient faults, OpenSSL, FPGA implementation, microprocessor security, SPARC
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
