Securing implementations of feedback-shift-register-based ciphers using compiler optimizations and co-processors

Los algoritmos basados en registros de desplazamiento con realimentación (en inglés FSR) se han utilizado como generadores de flujos pseudoaleatorios en aplicaciones con recursos limitados como los sistemas de apertura sin llave. Se considera canal primario a aquel que se utiliza para realizar una transmisión de información. La aparición de los ataques de canal auxiliar (en inglés SCA), que explotan información filtrada inintencionadamente a través de canales laterales como el consumo, las emisiones electromagnéticas o el tiempo empleado, supone una grave amenaza para estas aplicaciones, dado que los dispositivos son accesibles por un atacante. El objetivo de esta tesis es proporcionar un conjunto de protecciones que se puedan aplicar de forma automática y que utilicen recursos ya disponibles, evitando un incremento sustancial en los costes y alargando la vida útil de aplicaciones que puedan estar desplegadas. Explotamos el paralelismo existente en algoritmos FSR, ya que sólo hay 1 bit de diferencia entre estados de rondas consecutivas. Realizamos aportaciones en tres niveles: a nivel de sistema, utilizando un coprocesador reconfigurable, a través del compilador y a nivel de bit, aprovechando los recursos disponibles en el procesador. Proponemos un marco de trabajo que nos permite evaluar implementaciones de un algoritmo incluyendo los efectos introducidos por el compilador considerando que el atacante es experto. En el campo de los ataques, hemos propuesto un nuevo ataque diferencial que se adapta mejor a las condiciones de las implementaciones software de FSR, en las que el consumo entre rondas es muy similar. SORU2 es un co-procesador vectorial reconfigurable propuesto para reducir el consumo energético en aplicaciones con paralelismo y basadas en el uso de bucles. Proponemos el uso de SORU2, además, para ejecutar algoritmos basados en FSR de forma segura. Al ser reconfigurable, no supone un sobrecoste en recursos, ya que no está dedicado en exclusiva al algoritmo de cifrado. Proponemos una configuración que ejecuta múltiples algoritmos de cifrado similares de forma simultánea, con distintas implementaciones y claves. A partir de una implementación sin protecciones, que demostramos que es completamente vulnerable ante SCA, obtenemos una implementación segura a los ataques que hemos realizado. A nivel de compilador, proponemos un mecanismo para evaluar los efectos de las secuencias de optimización del compilador sobre una implementación. El número de posibles secuencias de optimizaciones de compilador es extremadamente alto. El marco de trabajo propuesto incluye un algoritmo para la selección de las secuencias de optimización a considerar. Debido a que las optimizaciones del compilador transforman las implementaciones, se pueden generar automáticamente implementaciones diferentes combinamos para incrementar la seguridad ante SCA. Proponemos 2 mecanismos de aplicación de estas contramedidas, que aumentan la seguridad de la implementación original sin poder considerarse seguras. Finalmente hemos propuesto la ejecución paralela a nivel de bit del algoritmo en un procesador. Utilizamos la forma algebraica normal del algoritmo, que automáticamente se paraleliza. La implementación sobre el algoritmo evaluado mejora en rendimiento y evita que se filtre información por una ejecución dependiente de datos. Sin embargo, es más vulnerable ante ataques diferenciales que la implementación original. Proponemos una modificación del algoritmo para obtener una implementación segura, descartando parcialmente ejecuciones del algoritmo, de forma aleatoria. Esta implementación no introduce una sobrecarga en rendimiento comparada con las implementaciones originales. En definitiva, hemos propuesto varios mecanismos originales a distintos niveles para introducir aleatoridad en implementaciones de algoritmos FSR sin incrementar sustancialmente los recursos necesarios. ABSTRACT Feedback Shift Registers (FSR) have been traditionally used to implement pseudorandom sequence generators. These generators are used in Stream ciphers in systems with tight resource constraints, such as Remote Keyless Entry. When communicating electronic devices, the primary channel is the one used to transmit the information. Side-Channel Attack (SCA) use additional information leaking from the actual implementation, including power consumption, electromagnetic emissions or timing information. Side-Channel Attacks (SCA) are a serious threat to FSR-based applications, as an attacker usually has physical access to the devices. The main objective of this Ph.D. thesis is to provide a set of countermeasures that can be applied automatically using the available resources, avoiding a significant cost overhead and extending the useful life of deployed systems. If possible, we propose to take advantage of the inherent parallelism of FSR-based algorithms, as the state of a FSR differs from previous values only in 1-bit. We have contributed in three different levels: architecture (using a reconfigurable co-processor), using compiler optimizations, and at bit level, making the most of the resources available at the processor. We have developed a framework to evaluate implementations of an algorithm including the effects introduced by the compiler. We consider the presence of an expert attacker with great knowledge on the application and the device. Regarding SCA, we have presented a new differential SCA that performs better than traditional SCA on software FSR-based algorithms, where the leaked values are similar between rounds. SORU2 is a reconfigurable vector co-processor. It has been developed to reduce energy consumption in loop-based applications with parallelism. In addition, we propose its use for secure implementations of FSR-based algorithms. The cost overhead is discarded as the co-processor is not exclusively dedicated to the encryption algorithm. We present a co-processor configuration that executes multiple simultaneous encryptions, using different implementations and keys. From a basic implementation, which is proved to be vulnerable to SCA, we obtain an implementation where the SCA applied were unsuccessful. At compiler level, we use the framework to evaluate the effect of sequences of compiler optimization passes on a software implementation. There are many optimization passes available. The optimization sequences are combinations of the available passes. The amount of sequences is extremely high. The framework includes an algorithm for the selection of interesting sequences that require detailed evaluation. As existing compiler optimizations transform the software implementation, using different optimization sequences we can automatically generate different implementations. We propose to randomly switch between the generated implementations to increase the resistance against SCA.We propose two countermeasures. The results show that, although they increase the resistance against SCA, the resulting implementations are not secure. At bit level, we propose to exploit bit level parallelism of FSR-based implementations using pseudo bitslice implementation in a wireless node processor. The bitslice implementation is automatically obtained from the Algebraic Normal Form of the algorithm. The results show a performance improvement, avoiding timing information leakage, but increasing the vulnerability against differential SCA.We provide a secure version of the algorithm by randomly discarding part of the data obtained. The overhead in performance is negligible when compared to the original implementations. To summarize, we have proposed a set of original countermeasures at different levels that introduce randomness in FSR-based algorithms avoiding a heavy overhead on the resources required.

Quadrature generators based on ring oscillators and shift registers

Quadrature oscillators are key elements in modern radio frequency (RF) transceivers and very useful nowadays in wireless communications, since they can provide: low quadrature error, low phase-noise, and wide tuning range (useful to cover several bands). RC oscillators can be fully integrated without the need of external components (external high Q-inductors), optimizing area, cost, and power consumption. The conventional structure of ring oscillator offers poor frequency stability and phasenoise, low quality factor (Q), and besides being vulnerable to process, voltage and temperature (PVT) variations, its performance degrades as the frequency of operation increases. This thesis is devoted to quadrature oscillators and presents a detailed comparative study of ring oscillator and shift register (SR) approaches. It is shown that in SRs both phase-noise and phase error are reduced, while ring oscillators have the advantage of occupying less area and less consumption due to the reduced number of components in the circuit. Thus, although ring oscillators are more suitable for biomedical applications, SRs are more appropriate for wireless applications, especially when specification requirements are more stringent and demanding. The first architecture studied consists in a simple CMOS ring oscillator employing an odd number of static single-ended inverters as delay cells. Subsequently, the quadrature 4-stage ring oscillator concept is shown and post-layout simulations are presented. The 3 and 4-phase single-frequency local oscillator (LO) generators employing SRs are presented, the latter with 50% and 25% duty-cycles. The circuits operate at 600 MHz and 900 MHz, and were designed in a 130 nm standard CMOS technology with a voltage supply of 1.2 V.

New quasi-orthogonal BCH-derived sequences for CDMA applications

European Transactions on Telecommunications, vol. 18

A parallel convolutional coder including embedded puncturing with application to consumer devices

As consumers demand more functionality) from their electronic devices and manufacturers supply the demand then electrical power and clock requirements tend to increase, however reassessing system architecture can fortunately lead to suitable counter reductions. To maintain low clock rates and therefore reduce electrical power, this paper presents a parallel convolutional coder for the transmit side in many wireless consumer devices. The coder accepts a parallel data input and directly computes punctured convolutional codes without the need for a separate puncturing operation while the coded bits are available at the output of the coder in a parallel fashion. Also as the computation is in parallel then the coder can be clocked at 7 times slower than the conventional shift-register based convolutional coder (using DVB 7/8 rate). The presented coder is directly relevant to the design of modern low-power consumer devices

Campi finiti e segnale GPS

Lo scopo della tesi è quello di studiare una delle applicazioni della teoria dei campi finiti: il segnale GPS. A questo scopo si descrivono i registri a scorrimento a retroazione lineare (linear feedback shift register, LFSR), dispositivi utili in applicazioni che richiedono la generazione molto rapida di numeri pseudo-casuali. I ricevitori GPS sfruttano il determinismo di questi dispositivi per identificare il satellite da cui proviene il segnale e per sincronizzarsi con esso. Si inizia con una breve introduzione al funzionamento del GPS, poi si studiano i campi finiti: sottocampi, estensioni di campo, gruppo moltiplicativo e costruzione attraverso la riduzione modulo un polinomio irriducibile, fattorizzazione di polinomi, formula per il numero e metodi per la determinazione di polinomi irriducibili, radici di polinomi irriducibili, coniugati, teoria di Galois (automorfismo ed orbite di Frobenius, gruppo e corrispondenza di Galois), traccia, polinomio caratteristico, formula per il numero e metodi per la determinazione di polinomi primitivi. Successivamente si introducono e si esaminano sequenze ricorrenti lineari, loro periodicità, la sequenza risposta impulsiva, il polinomio caratteristico associato ad una sequenza e la sequenza di periodo massimo. Infine, si studiano i registri a scorrimento che generano uno dei segnali GPS. In particolare si esamina la correlazione tra due sequenze. Si mostra che ogni polinomio di grado n-1 a coefficienti nel campo di Galois di ordine 2 può essere rappresentato univocamente in n bit; la somma tra polinomi può essere eseguita come XOR bit-a-bit; la moltiplicazione per piccoli coefficienti richiede al massimo uno shift ed uno XOR. Si conclude con la dimostrazione di un importante risultato: è possibile inizializzare un registro in modo tale da fargli generare una sequenza di periodo massimo poco correlata con ogni traslazione di se stessa.

Application of SOA-NOLM in all-optical processing

This thesis presents experimental investigations of the use of semiconductor optical amplifiers in a nonlinear loop mirror (SOA-NOLM) and its application in all-optical processing. The techniques used are mainly experimental and are divided into three major applications. Initially the semiconductor optical amplifier, SOA, is experimentally characterised and the optimum operating condition is identified. An interferometric switch based on a Sagnac loop with the SOA as the nonlinear element is employed to realise all-optical switching. All-optical switching is a very attractive alternative to optoelectronic conversion because it avoids the conversion from the optical to the electronic domain and back again. The first major investigation involves a carrier suppressed return to zero, CSRZ, format conversion and transmission. This study is divided into single channel and four channel WDM respectively. The optical bandwidth which limits the conversion is investigated. The improvement of the nonlinear tolerance in the CSRZ transmission is shown which shows the suitability of this format for enhancing system performance. Second, a symmetrical switching window is studied in the SOA-NOLM where two similar control pulses are injected into the SOA from opposite directions. The switching window is symmetric when these two control pulses have the same power and arrive at the same time in the SOA. Finally, I study an all-optical circulating shift register with an inverter. The detailed behaviour of the blocks of zeros and ones has been analysed in terms of their transient measurement. Good agreement with a simple model of the shift register is obtained. The transient can be reduced but it will affect the extinction ratio of the pulses.

Testing of Interposer-Based 2.5D Integrated Circuits

The unprecedented and relentless growth in the electronics industry is feeding the demand for integrated circuits (ICs) with increasing functionality and performance at minimum cost and power consumption. As predicted by Moore's law, ICs are being aggressively scaled to meet this demand. While the continuous scaling of process technology is reducing gate delays, the performance of ICs is being increasingly dominated by interconnect delays. In an effort to improve submicrometer interconnect performance, to increase packing density, and to reduce chip area and power consumption, the semiconductor industry is focusing on three-dimensional (3D) integration. However, volume production and commercial exploitation of 3D integration are not feasible yet due to significant technical hurdles.

At the present time, interposer-based 2.5D integration is emerging as a precursor to stacked 3D integration. All the dies and the interposer in a 2.5D IC must be adequately tested for product qualification. However, since the structure of 2.5D ICs is different from the traditional 2D ICs, new challenges have emerged: (1) pre-bond interposer testing, (2) lack of test access, (3) limited ability for at-speed testing, (4) high density I/O ports and interconnects, (5) reduced number of test pins, and (6) high power consumption. This research targets the above challenges and effective solutions have been developed to test both dies and the interposer.

The dissertation first introduces the basic concepts of 3D ICs and 2.5D ICs. Prior work on testing of 2.5D ICs is studied. An efficient method is presented to locate defects in a passive interposer before stacking. The proposed test architecture uses e-fuses that can be programmed to connect or disconnect functional paths inside the interposer. The concept of a die footprint is utilized for interconnect testing, and the overall assembly and test flow is described. Moreover, the concept of weighted critical area is defined and utilized to reduce test time. In order to fully determine the location of each e-fuse and the order of functional interconnects in a test path, we also present a test-path design algorithm. The proposed algorithm can generate all test paths for interconnect testing.

In order to test for opens, shorts, and interconnect delay defects in the interposer, a test architecture is proposed that is fully compatible with the IEEE 1149.1 standard and relies on an enhancement of the standard test access port (TAP) controller. To reduce test cost, a test-path design and scheduling technique is also presented that minimizes a composite cost function based on test time and the design-for-test (DfT) overhead in terms of additional through silicon vias (TSVs) and micro-bumps needed for test access. The locations of the dies on the interposer are taken into consideration in order to determine the order of dies in a test path.

To address the scenario of high density of I/O ports and interconnects, an efficient built-in self-test (BIST) technique is presented that targets the dies and the interposer interconnects. The proposed BIST architecture can be enabled by the standard TAP controller in the IEEE 1149.1 standard. The area overhead introduced by this BIST architecture is negligible; it includes two simple BIST controllers, a linear-feedback-shift-register (LFSR), a multiple-input-signature-register (MISR), and some extensions to the boundary-scan cells in the dies on the interposer. With these extensions, all boundary-scan cells can be used for self-configuration and self-diagnosis during interconnect testing. To reduce the overall test cost, a test scheduling and optimization technique under power constraints is described.

In order to accomplish testing with a small number test pins, the dissertation presents two efficient ExTest scheduling strategies that implements interconnect testing between tiles inside an system on chip (SoC) die on the interposer while satisfying the practical constraint that the number of required test pins cannot exceed the number of available pins at the chip level. The tiles in the SoC are divided into groups based on the manner in which they are interconnected. In order to minimize the test time, two optimization solutions are introduced. The first solution minimizes the number of input test pins, and the second solution minimizes the number output test pins. In addition, two subgroup configuration methods are further proposed to generate subgroups inside each test group.

Finally, the dissertation presents a programmable method for shift-clock stagger assignment to reduce power supply noise during SoC die testing in 2.5D ICs. An SoC die in the 2.5D IC is typically composed of several blocks and two neighboring blocks that share the same power rails should not be toggled at the same time during shift. Therefore, the proposed programmable method does not assign the same stagger value to neighboring blocks. The positions of all blocks are first analyzed and the shared boundary length between blocks is then calculated. Based on the position relationships between the blocks, a mathematical model is presented to derive optimal result for small-to-medium sized problems. For larger designs, a heuristic algorithm is proposed and evaluated.

In summary, the dissertation targets important design and optimization problems related to testing of interposer-based 2.5D ICs. The proposed research has led to theoretical insights, experiment results, and a set of test and design-for-test methods to make testing effective and feasible from a cost perspective.

Effects of naps at work on the sleepiness of 12-hour night shift nursing personnel

Background and objective: The purpose of the present study was to evaluate the effects of a nap at work on the sleepiness of 12-hour, night-shift (registered and assistant) nursing personnel.Methods: Twelve nurses filled out daily logs, the Karolinska Sleepiness Scale (KS), and wore wrist actigraphs for two periods of four continuous days.Results: Mean nap duration during the night shifts was 138.3 (SD+39.8) minutes. The mean sleepiness level assessed by the KS score was lower, 3.3 (SD±1.6), when the nap was taken during the first span (00:01 - 03:00h) of the night shift, compared with 6.6 (SD±1.0) when there was no nap. The mean sleepiness level assessed by the KS score was also lower, 3.6 (SD±0.9), when the nap was taken during the second span (03:01 - 06:00h) of the night shift, compared with 7.0 (SD±1.1) when there was no nap. Thus, napping either during the first or second part of the night shift reduces sleepiness of 12-hour, night-shift nursing personnel. Moreover, the mean duration of the first sleep episode after night work was longer in those who did not nap than in those who did. Conclusions: The results of this study show that napping during the 12-hour, night-shift results in less sleepiness at work and less need for recovery sleep after work

Diffractive phase-shift lithography photomask operating in proximity printing mode

A phase shift proximity printing lithographic mask is designed, manufactured and tested. Its design is based on a Fresnel computer-generated hologram, employing the scalar diffraction theory. The obtained amplitude and phase distributions were mapped into discrete levels. In addition, a coding scheme using sub-cells structure was employed in order to increase the number of discrete levels, thus increasing the degree of freedom in the resulting mask. The mask is fabricated on a fused silica substrate and an amorphous hydrogenated carbon (a:C-H) thin film which act as amplitude modulation agent. The lithographic image is projected onto a resist coated silicon wafer, placed at a distance of 50 mu m behind the mask. The results show a improvement of the achieved resolution - linewidth as good as 1.5 mu m - what is impossible to obtain with traditional binary masks in proximity printing mode. Such achieved dimensions can be used in the fabrication of MEMS and MOEMS devices. These results are obtained with a UV laser but also with a small arc lamp light source exploring the partial coherence of this source. (C) 2010 Optical Society of America

A Paradigm Shift in Predoctoral Dental Curricula in Brazil: Evaluating the Process of Change

In 2002, the Brazilian Ministry of Education approved the official curricular guidelines for undergraduate courses in Brazil to be adopted by the nation's 188 dental schools. In 2005-06, the Brazilian Dental Education Association (BDEA) promoted workshops in forty-eight of the schools to verify the degree of transformation of the curriculum based on these guidelines. Among the areas analyzed were course philosophy (variables were v1: knowledge production based on the needs of the Brazilian Public Health System [BPHS]; v2: health determinants; and v3: postgraduate studies and permanent education); pedagogical skills (v4: curricular structure; v5: changes in pedagogic and didactic skills; and v6: course program orientation); and dental practice scenarios (v7: diversity of the scenarios for training/learning; v8: academic health care centers opened to the BPHS; and v9: participation of students in health care delivery for the population). The subjects consisted of faculty members (n=711), students (n=228), and employees (n=14). The results showed an incipient degree of curriculum transformation. The degree of innovation was statistically different depending on the type of university (public or private) for variables I, 2, 4, 5, 6, and 7. Private schools reported a higher level of innovation than public institutions. Resistance to transforming the dental curriculum according to the official guidelines may be linked to an ideological conception that supports the private practice model, continues to have faculty members direct all classroom activities, and prevents students from developing an understanding of professional practice as targeted towards the oral health needs of all segments of society.

Combined Monte Carlo and quantum mechanics study of the solvatochromism of phenol in water. The origin of the blue shift of the lowest pi-pi* transition

A combined and sequential use of Monte Carlo simulations and quantum mechanical calculations is made to analyze the spectral shift of the lowest pi-pi* transition of phenol in water. The solute polarization is included using electrostatic embedded calculations at the MP2/aug-cc-pVDZ level giving a dipole moment of 2.25 D, corresponding to an increase of 76% compared to the calculated gas-phase value. Using statistically uncorrelated configurations sampled from the MC simulation,first-principle size-extensive calculations are performed to obtain the solvatochromic shift. Analysis is then made of the origin of the blue shift. Results both at the optimized geometry and in room-temperature liquid water show that hydrogen bonds of water with phenol promote a red shift when phenol is the proton-donor and a blue shift when phenol is the proton-acceptor. In the case of the optimized clusters the calculated shifts are in very good agreement with results obtained from mass-selected free jet expansion experiments. In the liquid case the contribution of the solute-solvent hydrogen bonds partially cancels and the total shift obtained is dominated by the contribution of the outer solvent water molecules. Our best result, including both inner and outer water molecules, is 570 +/- 35 cm(-1), in very good agreement with the small experimental shift of 460 cm(-1) for the absorption maximum.

Dosage-dependent shift in the spore community of arbuscular mycorrhizal fungi following application of tannery sludge

The controlled disposal of tannery sludge in agricultural soils is a viable alternative for recycling such waste; however, the impact of this practice on the arbuscular mycorrhizal fungi (AMF) communities is not well understood. We studied the effects of low-chromium tannery sludge amendment in soils on AMF spore density, species richness and diversity, and root colonization levels. Sludge was applied at four doses to an agricultural field in Rolandia, Parana state, Brazil. The sludge was left undisturbed on the soil surface and then the area was harrowed and planted with corn. The soil was sampled at four intervals and corn roots once within a year (2007/2008). AMF spore density was low (1 to 49 spores per 50 cm(3) of soil) and decreased as doses of tannery sludge increased. AMF root colonization was high (64%) and unaffected by tannery sludge. Eighteen AMF species belonging to six genera (Acaulospora, Glomus, Gigaspora, Scutellospora, Paraglomus, and Ambispora) were recorded. At the sludge doses of 9.0 and 22.6 Mg ha(-1), we observed a decrease in AMF species richness and diversity, and changes in their relative frequencies. Hierarchical grouping analysis showed that adding tannery waste to the soil altered AMF spore community in relation to the control, modifying the mycorrhizal status of soil and selectively favoring the sporulation of certain species.

Distance Education in Another Register: Uses and Appropriation of Technologies in Teacher Education

The article explores the relationships between distance education, information and communication technologies and teacher education. Its focus is on the interactive media and its uses in an in-service teacher education program, in Brazil, and on the ways the teachers used the technologies doing their own appropriateness. It departs from the presuppositions of the society of knowledge, that is, the close relationships between new technologies, continuing professional development and social inclusion, arguing that this paradigm is an ideological discourse. The article shows how the teachers have used the technologies in creative ways, calling the attention to the importance of this teachers` abilities as a basic skill to facing the challenges of the society of knowledge itself.

A shift from passive teaching at medical conferences to more interactive methods improves physician learning

Conferences that deliver interactive sessions designed to enhance physician participation, such as role play, small discussion groups, workshops, hands-on training, problem- or case-based learning and individualised training sessions, are effective for physician education.

Matrix elements of U(2n) generators in a multishell spin-orbit basis. II. The two-shell nonzero shift ACCs and U(2n) generator MEs

This is the second in a series of articles whose ultimate goal is the evaluation of the matrix elements (MEs) of the U(2n) generators in a multishell spin-orbit basis. This extends the existing unitary group approach to spin-dependent configuration interaction (CI) and many-body perturbation theory calculations on molecules to systems where there is a natural partitioning of the electronic orbital space. As a necessary preliminary to obtaining the U(2n) generator MEs in a multishell spin-orbit basis, we must obtain a complete set of adjoint coupling coefficients for the two-shell composite Gelfand-Paldus basis. The zero-shift coefficients were obtained in the first article of the series. in this article, we evaluate the nonzero shift adjoint coupling coefficients for the two-shell composite Gelfand-Paldus basis. We then demonstrate that the one-shell versions of these coefficients may be obtained by taking the Gelfand-Tsetlin limit of the two-shell formulas. These coefficients,together with the zero-shift types, then enable us to write down formulas for the U(2n) generator matrix elements in a two-shell spin-orbit basis. Ultimately, the results of the series may be used to determine the many-electron density matrices for a partitioned system. (C) 1998 John Wiley & Sons, Inc.