# Low-Cost Full Correlated-Power-Noise Generator to Counteract Side-Channel Attacks
## 2 PA Attacks and Effective Countermeasures
### Countermeasures Against Power Analysis Attacks  
The selection of hardware countermeasures against SCA attacks is not straightforward. Each proposed countermeasure has pros and cons that must be carefully considered, since the increase in security levels entails a degradation in the operating conditions of the circuits, such as a degradation in the operating frequency, an increase in power consumption or occupied area. There is no best choice suitable for all cases, since the best solution will depend in each case on the particular application of the cryptographic module, where different requirements will have to be met and the best choice will be the one that offers the best trade-off in terms of performance and security levels.  
Since the emergence of power-analysis attacks in the late 1990s, the scientific community has proposed numerous countermeasures to mitigate the vulnerabilities of cryptographic circuits; some examples are [7; 10]. At the hardware level, the design strategies depend on the abstraction level and the mechanism employed to uncouple power consumption or electromagnetic emanations from the key and data being processed. These countermeasures span from the layout to the algorithm level, encompassing tasks from attack detection to adding redundant blocks to obscure potential information leakage. In this sense, the existing hardware countermeasures can be classified as follows. A first classification depends on the abstraction level, with countermeasures focused on the algorithm circuit or gate level. Regarding hardware countermeasures applied at the gate level [4], their main advantage is that, once the secure cell library has been designed with the selected secure logic style, and the automatic design flow has been adapted for use with this new library, the same design flow can be applied regardless of the implemented algorithm. Note that when combining gate-level countermeasures with those at a higher level or complementary ones at the same level of abstraction, additional analysis is required to ensure that the overall security enhancements do not interfere. Furthermore, countermeasures can also be classified based on the technique used to break the correlation between data and power consumption, which typically falls into two main categories: masking and hiding techniques.  
Masking is widely employed to mitigate PA attacks, where sensitive data are masked by combining it with a random data sequence in such a way that all encryption operations on the masked data become indistinguishable. The most straightforward method for implementing masking is through Boolean masking \(m\), which involves masking an input  
Figure 1: CPA attack scheme.  
word by performing an XOR operation with a random value. The masked signal \(a_{m}\) is propagated along the critical datapath [10], and as a consequence, the power consumption of the running implementation becomes unpredictable.  
Hiding countermeasures aim to achieve constant power consumption at the gate, circuit, or algorithm level, regardless of the processed data [4]. Since the introduction of CPA attacks, there have been numerous logic-style propositions aiming to achieve resistance against such attacks by ensuring power consumption remains independent of the data being processed. In an initial approach, this uniform power consumption can be attained by employing dual-rail signals and differential gates [11]. As the concept of concealment entails maintaining precise power consumption regardless of the processed data, it inherently necessitates complete symmetry. Nevertheless, the majority of these techniques encounter challenges in the precise calibration of the place and route operation to achieve equal capacitive loads on two wires.