Projection of Dual-Rail DPA Countermeasures in Future FinFET and Emerging TFET Technologies

1 Projection of dual-rail DPA countermeasures in future FinFET and emerging TFET technologies I. M. DELGADO-LOZANO, E. TENA-SÁNCHEZ, J. NÚÑEZ, and A. J. ACOSTA, Instituto de Microelectrónica de Sevilla (IMSE-CNM), CSIC/Universidad de Sevilla The design of near future cryptocircuits will require greater performance characteristics in order to be implemented in devices with very limited resources for secure applications. Considering the security against differential power side-channel attacks (DPA), explorations of different implementations of dual-precharge logic gates with advanced and emerging technologies, using nanometric FinFET and Tunnel FET transistors, are proposed aiming to maintain or even improve the security levels obtained by current MOSFET technologies and reducing the resources needed for the implementations. As case study, dual-precharge logic primitives have been designed and included in the 4-bit substitution box of PRIDE algorithm, measuring the performance and evaluating the security through simulation-based DPA attacks for each implementation. Extensive electrical simulations with predictive PTM model on scaled 16nm and 22nm MOSFET, 16nm and 20nm FinFET and 20nm TFET, demonstrate a clear evolution of security and performances with respect to current 90nm MOSFET implementations, providing FinFET as fastest solutions with a delay 3.7 times better than conventional proposals, but being TFET the best candidate for future cryptocircuits in terms of average power consumption (x0.02 times compared with conventional technologies) and security in some orders of magnitude. CCS Concepts: •Security and privacy →Side-channel analysis and countermeasures ; •Hardware → Tunneling devices. Additional Key Words and Phrases: VLSI design of cryptographic circuits, side-channel attacks (SCAs), information security, low-power, dual precharge logic (DPL), substitution box (Sbox), sense amplifier based logic (SABL), emerging technologies, FinFET, TFET ACM Reference Format: I. M. Delgado-Lozano, E. Tena-Sánchez, J. Núñez, and A. J. Acosta. 2019. Projection of dual-rail DPA countermeasures in future FinFET and emerging TFET technologies. ACM J. Emerg. Technol. Comput. Syst. 15, 4, Article 1 (August 2019), 16 pages. https://doi.org/10.1145/1122445.1122456 1 INTRODUCTION Nowadays, the electronic devices that are daily present in our lives work with secret information that must not be revealed to third parties, thus there is an increasing need of secure devices to prevent malicious attacks [ 8 , 12 , 13 , 20 ]. In this context, secure devices make use of cryptographic algorithms that although are mathematically safe, can leak side-channel information when a Side- Channel Attack (SCA) is applied, being the main sources of leaked information: delay [ 12 ], power consumption [ 13 ] or electromagnetic radiation [ 8 ]. Among the wide variety of SCAs, Differential Power Analysis (DPA) are extended due to their simplicity, effectiveness, and the minimal equipment Authors’ address: I. M. Delgado-Lozano, [email protected]; E. Tena-Sánchez, [email protected]; J. Núñez, [email protected]; A. J. Acosta, [email protected], Instituto de Microelectrónica de Sevilla (IMSE-CNM), CSIC/Universidad de Sevilla, Américo Vespucio, 28, Seville, Spain, 41092. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from p[email protected]. ©2019 Association for Computing Machinery. 1550-4832/2019/8-ART1 $15.00 https://doi.org/10.1145/1122445.1122456 ACM J. Emerg. Technol. Comput. Syst., Vol. 15, No. 4, Article 1. Publication date: August 2019. 1:2 Delgado-Lozano, et al. required [ 20 ]. DPA attacks are based on the well known fact that dynamic power consumption in a logic circuit depends on the data being processed by the device. Thus, by correlating the encrypted data with the power consumption of a cryptographic device it is possible to retrieve the secret key through statistical analysis. To make cryptocircuits more resistant to DPA attacks, some alternatives and countermeasures have been widely proposed at circuit level, standing out those based on masking [ 6 , 7 , 10 , 20 ] and hiding [ 11 , 15 , 29 , 31 , 33 , 34 ]. Although both masking and hiding techniques can be applied to different abstractions levels, ranging from algorithm to gate level, we are going to focus on gate level hiding. Algorithm-level countermeasures are very specific and difficult to automate, due to their heavy dependence on specific cryptographic algorithm. Concerning gate-level countermeasures, masking has shown to be either vulnerable or very complicated to implement due to the large number of masks needed to provide a secure solution [ 26 ]. For this reason, gate-level hiding techniques present better trade-off between performance and security as compared to gate-level masking. To enhance gate-level hiding strategies, Dual-Rail with Precharge-Logic (DPL) families have been designed to carry out one computation in each clock cycle regardless the input conditions and getting the same power consumption in every cycle, ideally. In the case of DPL gates, those based on current-mode logic gates present static power consumption, being not suitable for lowpower applications. Among the different DPL logic styles, Sense-Amplifier Based Logic (SABL) [ 31 ] style has been extensively analyzed giving a good trade-off between performance and security [29], being widely accepted and thus, selected in this paper as our reference logic style. DPL logic styles have some associated penalties in terms of area, delay and power consumption due to the higher number of transistors used to maintain the two-phases operation mode and the symmetry inside their constitutive blocks. The scientific community is facing the diversion of strategies aiming to avoid the existing bottlenecks for current technologies as the limit of CMOS technology is approaching. The idea of using emerging devices “beyond CMOS" [ 9 ] drawn away from conventional technologies, and frequently from silicon, is a challenge. This is not only for generic processing purposes, but also for security applications. It is necessary to assess the role of these new devices, for instance the Tunnel FET (TFET) transistors, a promising alternative for SCA-resilient implementations [ 4 , 28 ], in the near future security applications.The design of DPA resistant DPL-based circuits is addressed, considering conventional MOSFET transistors, in both current and scaled nanometric technology nodes, nanometric FinFET technologies, and emerging technologies as TFETs, allowing a fair comparison on demonstrative cryptocircuit implementations. The main contributions of the paper are: i) Design of logic primitives in a DPL-based DPA-resistant SABL style, using MOSFET, FinFET and TFET technologies. ii) SABL structure redesign for TFET technologies. iii) Characterization of a PRIDE 4-bit substitution box (Sbox-4) as a case study through electrical simulations on predictive PTM models in seven selected current and emerging technologies. iv) Evaluation of security via DPA attacks. The organization of this paper is as follows: In Section 2, it is presented the previous work concerning emerging technologies for security applications. Section 3 presents the design of CMOS DPL-based secure logic gates against DPA attacks. Section 4 shows the modifications needed by the DPL logic gates to have a proper behavior in TFET technology. Section 5 includes the design of PRIDE Sbox-4 block as case study and the analyzed results in terms of performance and security for the carried out implementations. To end, in Section 6 we summarize the conclusion of this work and establish the future lines of research. ACM J. Emerg. Technol. Comput. Syst., Vol. 15, No. 4, Article 1. Publication date: August 2019. Projection of dual-rail DPA countermeasures in future FinFET and emerging TFET techs. 1:3 2 EMERGING TECHNOLOGIES FOR SECURITY APPLICATIONS The use of scaled MOSFET technologies shows some deficiencies in terms of power density and energy efficiency due to the impossibility of reducing threshold voltages, without exponentially increasing the leakage currents. In a context of resource constrained applications, as it is the case of portable and lightweight cryptography, which demand circuits with ultra-low power consumption and high efficiency in terms of energy, emerging alternatives to CMOS-based approaches are required to the full deployment of secure IoT systems [19, 36]. The development of new transistor technologies, circuits and architectures, represents an opportunity to face these challenges, facilitating the implementation of low-power and secure lightweight design styles. Some of these new devices can operate as Boolean switches in conventional computing systems whereas others have new features that make them more suitable for other computing paradigms such as non-Boolean logic or non-Von Neumann architectures. In particular, great efforts have been devoted to the implementation of DPA-resilient circuits using a wide variety of emerging devices [4, 14, 28, 37]. Several works have been carried out using FinFET transistors for security applications, as an emerging substitute for bulk CMOS at deep nanometric nodes (22 nm and beyond) with outstanding properties as a high ON/OFF current ratio and reduced short channel effects. In [ 37 ], a low-power DPA countermeasure is proposed consisting of a back-gate bias randomly adjusted which generates a large amount of noise allowing to mask the differential signal at key moments during the encryption, enhancing the resistance of the system against DPA attacks. In [ 14 ], an adiabatic FinFET-based circuit is presented providing a low-power and secure system which increase its resistance against SCAs by decreasing the frequency and thus, the instantaneous power consumption. TFETs [ 25 ], [ 18 ] are gated p-i-n diodes with symmetrical doping structure and operating under reverse bias condition. These devices can achieve steeper sub-threshold slopes ( < 60 mV/dec) and operate with reduced supply voltages compared to CMOS transistors without significantly increasing leakage currents. Although TFETs could offer superior performance against hardwarelevel attacks, as demonstrated in [ 4 , 28 ], for Current Mode Logic (CML) implementations, further analysis should be performed over other more advanced DPL structures with no static power consumption, as SABL. In this paper, we will study the design of DPL cryptocircuits against DPA attacks using FinFET, TFET and scaled MOSFET transistors [ 30 ]. Two different technological nodes (16 and 20 nm) will be used for predictive models of FinFET transistors [ 27 ], whereas 16 and 22 nm will be taken into consideration for MOSFET scaled technologies [ 38 ], and a 20 nm model [ 17 ] for TFET transistors. In addition, we will establish a comparison in terms of security with two 90 nm TSMC commercial technologies (standard and low-power), to have a global picture of next term DPL-based implementations. 3 DPL AS SECURE LOGIC APPROACH AGAINST DPA In 1999, Kocher et al. [ 13 ] showed that DPA attacks could retrieve the secret key of a cryptographic device with a high level of effectiveness. Standard CMOS logic style shows a great dependence between processed data and power consumption, thus, it was discarded for cryptographic applications soon, leading to the search of alternative logic styles in which the dependence between data being encrypted and power consumption were much lower, providing greater levels of reliability and security to cryptocircuits. DPL works with two alternating operation phases, precharge and evaluation, providing both the true and the complemented output with one transition per cycle and (almost) the same power consumption per processed data. DPL gates present a differential pull-down network (DPDN) which ACM J. Emerg. Technol. Comput. Syst., Vol. 15, No. 4, Article 1. Publication date: August 2019. 1:4 Delgado-Lozano, et al. Fig. 1. SABL-DPL structure. performs the logic function and a differential pull-up network (DPUN) which provides the gate outputs. The SABL proposal [ 31 ] is a DPL technique with superior effectiveness presented when compared with other DPL alternatives as it is stated from the results obtained in previous works [ 29 ]. The DPUN structure for SABL in Fig. 1 is implemented using clocked P-type transistors. The operation of this block is the following: T1 and T2 transistors are ON in the precharge phase, when clk = 0. So, nodes n1 and n2 will be set to 1, with values Q¯ Q = 00 due to the output inverters. In the evaluation phase (clk = 1), one of the T3 and T4 transistors connected to nodes n1 and n2, is grounded through a discharge path in the DPDN, giving the result depending only on the logic function implemented by the DPDN block and the input values. Transistor T5, always in conduction, equalizes n1 and n2 to 0. The key aspects to ensure the design of secure DPL gates are: i) to use the same amount of charge in each transition, as mentioned previously; ii) a fully symmetrical DPDN block independent from the input values meaning that all the paths from n1 and n2 to GND must have the same transistor count and equivalent RC values leading, thus, to constant delay; and finally iii) all the internal nodes of DPDN block have to be connected to n1 or n2. The full symmetry in DPUN block and the fact that the outputs of DPDN are not directly connected to the gate of output inverters in the DPUN block makes SABL logic style indicated against DPA attacks, and superior to other symmetric and differential DPL alternatives [29]. The implementation of DPDN blocks for different logic functions are shown in Fig.2. These structures are also valid for FinFET transistors because of their similar operation mode to MOSFET. However, the specificities of TFETs with an asymmetric doping structure, and an operation mode based on the band-to-band tunneling (BTBT) principle make necessary the specific design of secure SABL gates against DPA implemented with TFET transistors. 4 STRUCTURAL MODIFICATIONS FOR THE USE OF TFETS IN SABL The current flow in a conventional MOSFET device is based on the carriers thermionic emission through a potential barrier. This implies a difficulty in order to maintain acceptable levels of power consumption in nanometric technological nodes. However, TFETs show some interesting electric properties and can represent a feasible alternative to conventional MOS transistors, due to the differences in the carrier transport mechanism [ 21 ]. The TFET device consists of a p-i-n structure, with an added gate in inverse polarization conditions (Fig. 3). Its most distinctive characteristic is the doping structure, where the source doping is the opposite from the drain one, whereas for MOSFETs transistors the doping is completely symmetric. ACM J. Emerg. Technol. Comput. Syst., Vol. 15, No. 4, Article 1. Publication date: August 2019. Projection of dual-rail DPA countermeasures in future FinFET and emerging TFET techs. 1:5 (a) AND/NAND (b) XOR/XNOR (c) OR/NOR Fig. 2. DPDN structures for AND/NAND, XOR/XNOR and OR/NOR gates. (a) N-TFET (b) P-TFET Fig. 3. TFET structure scheme. The operation principle of TFETs is mainly based on the BTBT principle that allows carriers to leave the valence band, go through the bandgap by tunnel effect, and pass to the conduction band or vice-versa in such a way that the entry of carriers in the channel is controlled by this mechanism. For a N-TFET transistor, when the gate voltage is low, the device is OFF. In this circumstance, the channel conduction band is far above the source valence band preventing the tunnel effect from a band to the other and leading to a negligible drain intensity. When the gate voltage is increasingly augmented, the density of carriers under the gate starts to be modulated and the conduction band begins to descend. Once the gate voltage is sufficiently high, the channel conduction band is so low that itself and the source valence band are totally aligned (Fig.4). Once the electrons have passed to the channel, they moved to the drain due to the positive voltage applied in this terminal [ 25 ]. The operation principle is completely analogous for type P-TFET transistors, taking into consideration the exchange of doping structure between drain and source terminals. Since carrier transport from source to drain is made through BTBT, instead of thermionic emission, TFETs present a double advantage. The first one is the activation of carrier transport mechanism with a reduced supply voltage Vdd ( Vdd = 0 . 3 V instead of voltages around Vdd = 1 V for MOSFET transistors with the same dimensions). On the other hand, BTBT reduces enormously the probabilities of tunnel effect when the transistor is OFF, minimizing the leakage currents. Additionally, the drain current in TFETs is highly sensitive to the gate voltage variation, so a slight diminution of this parameter could quickly take the device into the cutoff region. Nevertheless, TFETs present a difficulty with respect to the conventional MOSFETs, since due to its asymmetric p-i-n structure, the current flows only in one direction. For a given gate voltage, a N-TFET has an appreciable current only if the p-i-n structure is reverse biased or, equivalently, if Vds is positive. In case of a negative Vds , the p-i-n structure is forward biased and the device behaves as a forward polarized diode. Further considerations about TFET transistor characteristic curves are given at [25]. The unidirectional conduction leads to some limitations when designing logic gates [ 21 ]. Concerning SABL gates, it is not possible to replace directly MOSFET transistors by TFET ones, being necessary some modifications in the DPUN block. Firstly, the n-type transistor introduced between ACM J. Emerg. Technol. Comput. Syst., Vol. 15, No. 4, Article 1. Publication date: August 2019. 1:6 Delgado-Lozano, et al. Fig. 4. Bands diagram for a n-TFET transistor. n1 and n2 nodes that was always in ON state, now will only drive in one direction, depending on the drain and source terminals position, which are not interchangeable in TFET technology. To sort this problem out, we introduce a second transistor connecting n1 and n2 nodes applying an exchange in the terminals with respect to the first of them, in such a way that conduction is re-established in both directions between both nodes. In addition, in the output and input nodes of DPDN output inverter, it is produced the bootstrapping phenomenon, described in [ 21 ] and solved in [ 3 ]. This phenomenon consists of a capacitive coupling produced between two different nodes due to the unidirectional conduction and the impossibility of discharge (charge) a node once its voltage value is higher (lower) than Vdd (GND). For instance, if the output node Q in the Fig.1 is capacitively coupled with the input of the inverter, we could have a higher voltage than Vdd in Q. In case of a MOSFET-based implementation of this circuit, the symmetric transistor structure would allow a fast discharge from this node to the source terminal, thus, we would find a slight peak turning back to Vdd quickly. However, the asymmetric structure of TFET generates a low conduction state when Vds is positive, so the p-type transistor cannot discharge Q, getting a superior voltage than Vdd . This explanation is analogous for voltages under GND value. To illustrate this effect (Fig. 5), we have simulated an AND/NAND gate in the original SABL style, where both the problem of unidirectionality and bootstraping lead to degraded waveforms. Although the bootstrapping effect would not produce a logic fault in DPL-SABL gates, strong delay problems appear, increasing this factor up to a 60%. Additionally, the signals degradation could be propagated through a series of logic gates leading to a tedious functionality check given that the circuit would not work between two well established voltage values (Vdd and GND) as it is typical in logic circuits. The solution to the bootstraping phenomenon explained in [ 3 ] will be applied to this case. It tries to find an alternative way to charge/discharge the node affected by bootstrapping. Placing a P-TFET with its source connected to the bootstrapped node, its drain connected to Vdd and gate connected to GND, it is possible to discharge a node with undesired positive voltage. In the same way, this effect could lead to a negative voltage value below GND. In this case, introducing a N-TFET with its source connected to the bootstrapped node, its drain to GND, and its gate to Vdd would allow to charge the negative node, bringing it back to GND. Therefore, adding both transistors to the bootstrapped node, we could protect it from this phenomenon in both directions. Nodes potentially affected by bootstrapping phenomenon were the output ones ( Q and ¯ Q ) and the input nodes to the DPUN output inverter. Adding the N-TFET that allowed the conduction between n1 and n2 nodes in both directions, the DPUN block used in order to build the logic gates for secure cryptographic applications is shown in Fig.6, while the waveforms once solved the bootstrapping and unidirectionality problems are shown in Fig.7. ACM J. Emerg. Technol. Comput. Syst., Vol. 15, No. 4, Article 1. Publication date: August 2019. Projection of dual-rail DPA countermeasures in future FinFET and emerging TFET techs. 1:7 Fig. 5. Bootstrapped waveforms for TFET-based AND/NAND logic gates in original SABL style. Fig. 6. DPUN block with modifications for TFET technology. 5 CASE STUDY AND RESULTS The main goal of this work is to compare TFET implementations of cryptographic DPL primitives with conventional and emerging technologies (concretely, FinFET transistors) used in cryptographic applications to determine their vulnerability to DPA attacks. TFET-based implementations are expected to have strong DPA resilience, due to the above mentioned carrier transport mechanism (BTBT) which reduces the probabilities of tunnel effect when the device is switched off, and hence it can operate at a very reduced supply voltage. This has two accumulative beneficial effects, reducing the power consumption figures, and making more ACM J. Emerg. Technol. Comput. Syst., Vol. 15, No. 4, Article 1. Publication date: August 2019. 1:8 Delgado-Lozano, et al. Fig. 7. Waveforms for TFET-based AND/NAND logic gates with solutions for bootstrapping. difficult the guessing of data through power current traces. These two characteristics make TFET a promising device to implement low-power oriented secure cryptocircuits. The current trend to reduce area and power consumption for portable security in the so-called lightweight cryptography is generating new families of low-resources algorithms [ 22 ]. In such context of lightweight cryptography, there exist several ciphers with excellent trade-off between hardware resources, security and power consumption. Since our study focuses on the applicability to security of new technologies and comparison with existing ones, the choice of a particular algorithm as case study is not critical. The selected cipher is PRIDE [ 1 ], a SPN (Substitution- Permutation Network) structure block cipher, with a 64-bit input plaintext and a 128-bit key during the encryption process executed in 20 operation rounds (being the first 19 rounds identical, and in the last round the linear layer is omitted). First, the 64-bit input is splitted into 16 4-bit nibbles which are XORed with the round key; then, the Sbox-4 is executed in parallel over the 16 nibbles and finally, permutated and processed by the linear layer. As stated in [ 1 ], PRIDE significantly outperforms all existing block ciphers of similar key-sizes, with the exception of SIMON and SPECK. Some preliminary work on Piccolo algorithm reveals that the results of the implementations presented in this paper are independent of the algorithm used as a case study. As case study to evaluate the security level obtained by each proposed implementation, we will design, characterize and attack the PRIDE Sbox-4, which is the most vulnerable component in block ciphers. Most of the DPA attacks on block ciphers target this non-linear operation block (Sboxes), thus it is widely used as a vehicle to evaluate the security level reached by different countermeasure proposals against DPA attacks [ 5 , 11 , 16 , 23 , 24 , 29 , 31 ]. Since our purpose is to compare different technologies, we are going to analyze them from an attacker friendly scenario that allows us to set the same attack conditions. Therefore, an ideal environment without the presence of any noise will be useful to establish a comparison among technologies, where different factors apart from the technology ones are not taken into consideration. This Sbox-4 has been implemented in both CMOS, FinFET and TFET technologies, being the results completely transferable to other block ciphers. The Sbox-4 used by PRIDE is a 4-bit input ( x0−x3 ), 4-bit output ( y0−y3 ) combinational ACM J. Emerg. Technol. Comput. Syst., Vol. 15, No. 4, Article 1. Publication date: August 2019. Projection of dual-rail DPA countermeasures in future FinFET and emerging TFET techs. 1:9 Fig. 8. Cryptographic device scheme. block described by the equation (1): y3=x1⊕x3x2 y2=x0⊕x2x1(1) y1=x3⊕y3y2 y0=x2⊕y2y1 To build this Sbox-4, we have used 4 2-input XOR/XNOR and 4 2-input AND/NAND SABL gates. Each one of these gates uses 18 transistors for MOSFETs and FinFETs, following the scheme in Fig.1 and Fig2, and 27 transistors for TFETs, following the schemes in Fig.6 and Fig.2. These numbers lead to a total of 144 transistors for MOSFET and FinFET implementations of PRIDE Sbox-4, and 216 transistors when the implementation is TFET-based. These Sboxes have been designed under Cadence using the following technologies: •TSMC: Standard 90-nm TSMC technology. •TSMC-LP: Low-power 90-nm TSMC technology. •MOSFET-PTM: Predictive technology models for 22 nm and 16 nm. •FinFET-PTM: Predictive technology models for 20 nm and 16 nm. •TFET: Technology model for 20 nm. For a fair comparison, the DPDNs have been designed using the minimum transistor width in every technology, whereas DPUNs have been designed maintaining the same aspect ratio for all the implementations. Performance measurements (average power, worst-case delay, power-delay product (PDP), duty cycle) and security evaluations (DPA attacks) have been obtained through SPECTRE electrical simulations, integrated into the Cadence environment. Specifically, transient simulations for 2000 randomly generated plaintext patterns and a suitable simulation step of 5 ps have been carried out to capture with sufficient accuracy the power supply current waveforms with reasonable execution times for all the 16 possible keys. Nominal Vdd for each technology and T = 27 ºC have been used. To measure the security level achieved by each implementation, simulation-based DPA attacks are carried out. The main objective of a DPA attacks is to recover the secret key K of a cryptographic device, in which the input or/and output patterns ( D or/and Y ) and the cryptographic algorithm are known. The implemented encryption process scheme is shown in Fig. 8 where D is the 4-bit input pattern randomly generated, K is the 4-bit key, X is the Sbox-4 input data get after the XOR operation between D and K , Y is a 4-bit output data and iVdd is the measured supply current in the Sbox-4 during encryption. The DPA attack has been carried out under MATLAB by following the procedure explained by Mangard et al. in [ 20 ] and it is completely analogous to the one done in [ 29 ] (Fig. 9). First, the power consumption ( iVddi ) of the implemented Sbox-4 is obtained, through electrical simulations under SPECTRE, during encryption for a huge number of input messages ( Di ) with a fixed private key ( Ksecret ). After that, the hypothetical power consumption values ( Hij ) are mathematically ACM J. Emerg. Technol. Comput. Syst., Vol. 15, No. 4, Article 1. Publication date: August 2019. 1:16 Delgado-Lozano, et al. [30] Erica Tena-Sánchez, Ignacio M. Delgado-Lozano, Juan Núñez, and Antonio J. Acosta. 2018. Benchmarking of nanometer technologies for DPA-resilient DPL-based cryptocircuits. In 2018 Conference on Design of Circuits and Integrated Systems (DCIS’18). [31] Kris Tiri, Moonmoon Akmal, and Ingrid Verbauwhede. 2002. A dynamic and differential CMOS logic with signal independent power consumption to withstand differential power analysis on smart cards. In European Solid-State Circuits Conference (ESSCIRC). IEEE, 403–406. [32] Kris Tiri, David Hwang, Alireza Hodjat, Bo-Cheng Lai, Shenglin Yang, Patrick Schaumont, and Ingrid Verbauwhede. 2005. Prototype IC with WDDL and Differential Routing – DPA Resistance Assessment. In International Workshop on Cryptographic Hardware and Embedded Systems (CHES’05). Springer, Berlin, Heidelberg, 354–365. https://doi.org/10. 1007/11545262_26 [33] Kris Tiri and Ingrid Verbauwhede. 2004. A logic level design methodlogy for a secure DPA resistant ASIC or FPGA implementation. In Design, Automation and Test in Europe (DATE’04). IEEE, 246–251. https://doi.org/10.1109/DATE. 2004.1268856 [34] Kris Tiri and Ingrid Verbauwhede. 2005. Design method for constant power consumption of differential logic circuits. In Design, Automation and Test in Europe (DATE’05). IEEE, 628–633. https://doi.org/10.1109/DATE.2005.113 [35] Kris Tiri and Ingrid Verbauwhede. 2005. A VLSI Design Flow for Secure Side-Channel Attack Resistant ICs. In Design, Automation and Test in Europe (DATE’05). IEEE, 58–63. https://doi.org/10.1109/DATE.2005.44 [36] Teng Xu, James B. Wendt, and Miodrag Potkonjak. 2014. Security of IoT systems: Design challenges and opportunities. In 2014 IEEE/ACM International Conference on Computer-Aided Design (ICCAD). IEEE, 417–423. https://doi.org/10. 1109/ICCAD.2014.7001385 [37] Meng Zhang and Niraj K. Jha. 2011. FinFET-based power management for improved DPA resistance with low overhead. ACM Journal on Emerging Technologies in Computing Systems 7, 3 (Aug. 2011), 1–16. https://doi.org/10.1145/2000502. 2000503 [38] Wei Zhao and Yu Cao. 2006. New generation of predictive technology model for sub-45nm design exploration. In 7th International Symposium on Quality Electronic Design (ISQED’06). IEEE. https://doi.org/10.1109/ISQED.2006.91 ACM J. Emerg. Technol. Comput. Syst., Vol. 15, No. 4, Article 1. Publication date: August 2019.