PACE: A Page-Adaptive, Cache-Anchored Memory Encryption Engine for RISC-V with Formally Verified nth-Order DPA Resistance

Abstract

Main memory carries data outside the processor’s trust boundary, so commodity systems-on-chip (SoCs) increasingly encrypt it; yet, in-line memory encryption engine itself becomes a differential power analysis (DPA) target whose key, if recovered, unlocks all of dynamic random-access memory (DRAM). We present PACE, a page-adaptive, cache-anchored memory encryption engine for RISC-V that makes nth-order DPA resistance practical and keeps cryptographic latency off the cache eviction critical path. PACE inserts a TileLink adapter between the last-level cache and the memory port and applies, per physical page, one of four policies (plaintext/confidentiality/confidentiality+integrity/+masking-order-d) selected from RISC-V page table bits through a memory-mapped control plane. Confidentiality uses counter mode whose per-line keystream is precomputed during cache residency; integrity is tree-free at the embedded operating point via on-chip counters and tags, with a live split counter block-MAC Bonsai Merkle tree for scale-out. DPA resistance is layered: ISAP-style fresh re-keying caps the data complexity per key at q≈1, and domain-oriented masking (DOM, d + 1 shares) protects the sole key processing block to order d. We implement PACE in Chisel on a Rocket SoC (Chipyard) and evaluate it with open-source tooling. A deterministic TileLink-level harness proves ciphertext-in-memory and detects tamper/replay/splice, and the live Tier-B engine (DRAM counters and per-line message authentication codes (MACs) plus an on-chip-rooted block-MAC tree) is validated from end to end on full Rocket and BOOM SoCs and on the FPGA; the masked Ascon-p S-box is proven order-d secure (d = 1, 2) under a glitch- and transition-aware model by three independent formal tools (COCO, PROLEAD, and SILVER, the last also deciding the full composability lattice and confirming exact glitch-robust order-2 probing security), with COCO extending the exact verdict to the highest synthesized order d = 3 (secure at probing orders 1–3); a simulated trace correlation power analysis (CPA) recovers the full key from an unprotected core and is defeated by masking, with a mutual information analysis confirming the N∝σ2(d+1) trace amplification law. We further realize PACE on field-programmable gate array (FPGA) silicon: the engine plus an on-chip ring oscillator power sensor is placed, routed, timing-closed at 100 MHz, and programmed on a Xilinx XC7Z020, and we drive a fixed-vs-random Test Vector Leakage Assessment (TVLA) campaign read back entirely over a JTAG (Joint Test Action Group). A multi-core configuration and a Linux control-plane driver are likewise validated. Across synthetic access patterns and named application kernels (AES, SHA-256, matrix multiplication, pointer chasing) on both in-order Rocket and out-of-order BOOM, application-level overhead is within measurement noise of plaintext for cache resident workloads (masking, in particular, is cycle-identical to plain confidentiality), and we characterize the cost of each policy, masking order, and re-keying interval, demonstrating side-channel-hardened memory encryption on open RISC-V hardware.