arXiv subjects

Niloufar Sayadi

Publications and source records attributed to Niloufar Sayadi.

3 recordsLinked to original sources

arXiv2026

s-MDM: Generative Virtualization of Multi-Device Hardware Variations for Portable DL-SCA

Deep Learning-based Side-Channel Analysis (DL-SCA) frequently suffers from catastrophic performance degradation across unseen hardware due to printed circuit board routing differences, silicon process variations, and measurement noise shifts. This poster presents the Synthetic Multiple Device Model (s-MDM), a zero-target-trace generative framework designed to improve cross-device portability. s-MDM combines a structured cVAE generator, a Walsh-Hadamard leakage anchor, continuous style modulation, and decoupled leakage-style--domain critics to synthesize virtual source-device profiles offline. Benchmarked on 32-bit side-channel traces (AES_PTv2), s-MDM maps a precise operational boundary: while physical MDM remains superior on identical electrical clones (D4), s-MDM achieves consistently low key rank on the layout/acquisition-shifted Pinata target, where physical baselines are unstable or misaligned.

cs.CR↗

arXiv2026

Physical Time-Lock Puzzles

Traditional time-lock puzzles enforce delayed access to encrypted secrets by relying on inherently sequential computational steps. However, since software-based constructions impose no fundamental bound on the physical execution speed of individual steps, they remain vulnerable to hardware acceleration and improved implementations. In practice, this renders existing schemes ``step-lock'' rather than true ``time-lock'' puzzles, making long-term delay guarantees highly speculative against decades of unpredictable hardware advancement. To address this fundamental limitation, we introduce the Physical Time-Lock Puzzle (P-TLP), a new paradigm that anchors solving delay directly to the intrinsic, hardware-bounded evaluation latency of silicon hardware. By leveraging noisy Physical Unclonable Functions (PUFs) as non-parallelizable delay oracles, P-TLPs establish resistance against both parallel computation and algorithmic acceleration under the random oracle model. To tolerate PUF evaluation noise while maintaining a tightly concentrated and predictable solving-delay window, we propose a composite puzzle architecture that combines multiple independent basic puzzles. We formally prove the optimality of a sequential greedy solving strategy and derive tightly concentrated solving-delay windows using Hoeffding and Berry-Esseen bounds. We additionally prove early-solve hardness, establishing that adversaries with substantial classical computation budgets cannot bypass the physically-enforced PUF evaluation bottleneck. We validate our theoretical analysis with an FPGA prototype built around a configurable Ring Oscillator PUF, confirming that our analytical delay predictions tightly match empirical measurements. Our results demonstrate that P-TLPs can deliver highly predictable, long-term delay guarantees, enabling practical deployment in high-value applications such as digital legacy management.

cs.CR↗

arXiv2025

Breaking XOR Arbiter PUFs with Chosen Challenge Attack

The XOR Arbiter PUF was introduced as a strong PUF in 2007 and was broken in 2015 by a Machine Learning (ML) attack, which allows the underlying Arbiter PUFs to be modeled individually by exploiting reliability information of the measured responses. To mitigate the reliability-based attacks, state-of-the-art understanding shows that the reliability of individual Arbiter PUFs and the overall XOR Arbiter PUF can be boosted to an arbitrarily high level, thus rendering all known reliability-based ML attacks infeasible; alternatively, an access control interface around the XOR Arbiter PUF can prevent the same challenge-response pairs from being accessed repeatedly, thus eliminating the leakage of reliability information. We show that, \textbf{for the first time, a perfectly reliable XOR Arbiter PUF can be successfully attacked in a divide-and-conquer manner}, meaning each underlying Arbiter PUF in an XOR Arbiter PUF can be attacked individually. This allows us to attack large XOR Arbiter PUFs efficiently, even without reliability information or any side-channel information. Our key insight is that, instead of reliability information, the responses of highly correlated challenges also reveal how close the responses are to the response decision boundary. This leads to a \textit{chosen challenge attack} on XOR Arbiter PUFs by carefully choosing correlated challenges to measure and aggregate the collected information. We validate our attack by using PUF simulation, as well as an XOR Arbiter PUF implemented on FPGA. We also demonstrate that our chosen challenge methodology is compatible with the state-of-the-art combined gradient-based multi-objective optimization attack. Finally, we discuss an effective countermeasure that can prevent our attack but with a relatively large area overhead compared to the PUF itself.

cs.CR↗