Further Information

Electromagnetic (EM) side-channel analysis is a security testing technique that measures the unintended electromagnetic radiation emitted by a microchip while it performs operations like encryption. By capturing and statistically analyzing these subtle magnetic fluctuations, security researchers can deduce internal data such as secret cryptographic keys.

However, this involves access to the chip and sometimes even manual disassembly, which can be easily defeated with physical countermeasures. When such protected enclosures are present, the extraction of signals requires some specialized tricks such as proposed in [1].

[1] Active Electromagnetic Side-Channel Analysis: Crossing Physical Security Boundaries through Impedance Variations
https://tches.iacr.org/index.php/TCHES/article/view/12686/12368

Efficient hardware implementations of post-quantum cryptography have received substantial attention, but protecting these implementations against physical side-channel attacks remains an important challenge. Some masked hardware implementations of PQC schemes have been proposed (for example, [1]). The goal of this topic is to provide a comparative overview of proposed masking techniques, challenges, and pitfalls when implementing hardware accelerators for PQC schemes.

[1] Land, G., Marotzke, A., Richter-Brockmann, J., & Güneysu, T. (2023). Gadget-based Masking of Streamlined NTRU Prime Decapsulation in Hardware. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2024(1), 1-26. https://doi.org/10.46586/tches.v2024.i1.1-26

Recently, research studying attacks combining fault injection with side-channel analysis has gained traction. One proposed countermeasure is the usage of polynomial masking instead of the widely used Boolean masking. Recent work has made strides in increasing the efficiency of polynomial masking [1].

The goal of this work is to explore polynomial masking and its computational and randomness overheads.

[1] Andresen, J., Arnold, P., Berndt, S., Eisenbarth, T., Faust, S., Gourjon, M., Landthaler, E., Micheli, E., Orlt, M., Pauls, P., Wirschem, K., & Zhao, L. (2026). UP TO 50% OFF: Efficient Implementation of Polynomial Masking. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2026(1), 688-731. https://doi.org/10.46586/tches.v2026.i1.688-731

Physical Layer Security (PLS) exploits channel properties, where the attacker cannot decrypt the hidden message due to too many errors on his end compared to the legitimate receiver. This achieves Information-Theoretic Security. In contrast to regular cryptography, where the security is based on the secrecy of a key, which can be computed, Information Theoretic Security promises unconditional security. That means, the message is secure EVEN with the assumption that the attacker has unlimited computational capability.

A lot of PLS schemes are based on error correction codes, such as polar codes, convolutional codes or LDPC codes. [1]

Two main directions are possible for this seminar work:

• An in-depth explanation of some state of the art PLS scheme using error correction codes (such as the scheme in [2] using forward error correction) and evaluation in terms of use case scenarios and HW/SW codesign, advantages/disadvantages and identification of possible future work on this area.
• A historical overview of PLS schemes using error correction codes, their initial basis and their evolutions over time. Particular focus could be the explanation of the context and limitation of each scheme and the trajectory research took on the area over time. 

References:

[1] W. K. Harrison, J. Almeida, M. R. Bloch, S. W. McLaughlin and J. Barros, "Coding for Secrecy: An Overview of Error-Control Coding Techniques for Physical-Layer Security," in IEEE Signal Processing Magazine, vol. 30, no. 5, pp. 41-50, Sept. 2013, doi: 10.1109/MSP.2013.2265141

[2] Rongwo Xu et al 2024 J. Phys.: Conf. Ser. 2829 012010, DOI 10.1088/1742-6596/2829/1/012010

Physical Layer Security (PLS) exploits channel properties, where the attacker cannot decrypt the hidden message due to too many errors on his end compared to the legitimate receiver. This achieves Information-Theoretic Security. In contrast to regular cryptography, where the security is based on the secrecy of a key, which can be computed, Information Theoretic Security promises unconditional security. That means, the message is secure EVEN with the assumption that the attacker has unlimited computational capability.

PLS is usually limited in scope and not very performant. However, PLS methods give legitimate parties the possibility of exchanging secret keys for which potential eavesdroppers have zero information, thus achieving perfect security. This key can then be used in more performant symmetric encryption scenarios.

There are multiple attempts over the years since the discovery of the wiretap channel to create practical key exchange schemes using methods such as various channel properties, using Channel State Information (CSI) etc. [1]

Two main directions are possible for this seminar work:

• An in-depth explanation of some state of the art scheme for PLS key exchange (such as the scheme in [2] that includes AI) and comparison with regular computaional security in general (Diffie-Hellman, Post-Quantum Cryptography etc.) in terms of use case scenarios, advantages/disadvantages and identification of possible future work on this area.
• A historical overview of PLS key exchange schemes, their initial basis and their evolutions over time. Particular focus could be the explanation of the context and limitation of each scheme and the trajectory research took on the area over time. An initial starting point could be [3].

References:

[1] J. Zhang, G. Li, A. Marshall, A. Hu and L. Hanzo, "A New Frontier for IoT Security Emerging From Three Decades of Key Generation Relying on Wireless Channels," in IEEE Access, vol. 8, pp. 138406-138446, 2020, doi: 10.1109/ACCESS.2020.3012006.

[2] J. A. Sanchez Viloria, G. Sklivanitis, D. Pados and E. S. Bentley, "AI-Assisted Physical Layer Key Generation for Secure Wireless Communications," 2025 59th Asilomar Conference on Signals, Systems, and Computers, Pacific Grove, CA, USA, 2025, pp. 770-776, doi: 10.1109/IEEECONF67917.2025.11443725. 

[3] Wang, Y.; Du, Q.; Tang, X.; Song, H. Physical-Layer Key Generation Towards 6G: Overview, Challenges, and Evolving Designs. Electronics 2026, 15, 3772. https://doi.org/10.3390/electronics15173772

Side-channel and fault attacks on code-based schemes (Classic McEliece, BIKE, HQC) typically reveal only partial information about the secret error vector or message. Such leakage can be fed as "hints" into information-set decoding (ISD) to drastically reduce the attack cost.

Starting from the main paper, this seminar thesis reviews the state of the art in ISD with hints: which hint types exist (known message entries, error positions, error-free positions, block Hamming weights), how they are integrated into ISD, and what security reduction they yield. The student should survey follow-up work, e.g. practical side-channel ISD attacks and recent extensions to noisy/approximate hints, and discuss the strengths and limitations of the different techniques.

A.-L. Horlemann, S. Puchinger, J. Renner, T. Schamberger, A. Wachter-Zeh, „Information-Set Decoding with Hints", CBCrypto 2021. https://eprint.iacr.org/2021/279

Netlist reverse engineering describes the challenge of extracting design information from a flattened gate-level hardware circuit. Within a hardware design, Finite State Machines (FSMs) are of special interest for the reverse engineer, as they describe the control flow of the design. Extracting and reconstructing FSMs therefore remains an important discipline of the reverse engineering process. In recent years, machine learning based techniques have attracted high attention in hardware reverse engineering research. Especially Graph Neural Networks (GNNs) show high potential for circuit segmentation and classification tasks that are traditionally solved algorithmically.

The focus of this work is to analyze the use of GNNs for FSM reverse engineering. This includes a summary of potential applications and ongoing challenges.

References:

[1] L. Alrahis et al., "GNN-RE: Graph Neural Networks for Reverse Engineering of Gate-Level Netlists," in IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems, vol. 41, no. 8, pp. 2435-2448, Aug. 2022, doi: 10.1109/TCAD.2021.3110807. Available: https://doi.org/10.1109/TCAD.2021.3110807

During logic synthesis, the RTL description of a hardware design is converted into its gate-level netlist representation. During this process, various design information, such as hierarchy and signal names, is dropped, leaving behind an anonymous sea of gates. Netlist reverse engineering aims to reconstruct higher-level design information solely from the structure of the flattened netlist. While traditional reverse engineering relies heavily on algorithmic and ML-based techniques, recent research approaches explore the use and integration of rapidly evolving LLMs.

The focus of this work is on analyzing the potential of LLM integration into the hardware reverse engineering workflow. It includes listing upcoming opportunities and identifying key challenges.

References:

[1] M. O. Faruque, P. Jamieson, A. Patooghy and A. -H. A. Badawy, "Gate-Breaker: An LLM-Powered Netlist-to-RTL Reverse Engineering Tool," 2025 IEEE International Performance, Computing, and Communications Conference (IPCCC), Austin, TX, USA, 2025, pp. 1-8, doi: 10.1109/IPCCC66453.2025.11304682. Available: https://doi.org/10.1109/IPCCC66453.2025.11304682

Fault injection attacks disturb a running processor with a clock or voltage glitch, an electromagnetic pulse or a laser so that it skips or corrupts an instruction. Most attack papers, fault simulators and formally verified countermeasures rely on a simple abstraction: the "instruction skip" model, in which any single instruction can be skipped cleanly, independently of where it lies in memory or what it does.

Experimental studies on ARM Cortex-M and RISC-V microcontrollers paint a more complicated picture. Faults are often caused in the flash prefetch buffer, the instruction cache or the fetch pipeline, so whether an instruction is skipped depends on its alignment in a fetch line, its encoding length, its neighbours and the injection timing. Several instructions may be affected at once, and branch instructions behave differently from straight-line arithmetic.

The goal of this seminar thesis is to summarize the experimental literature and to contrast it with the assumptions made in fault simulators and countermeasure designs.