% =========================================================================
% Bibliography for the krypteia / arcana side-channel documentation.
%
% Entries are keyed using the file-stem convention of `doc/papers/` so
% that a citation like :cite:`adomnicai2021_fixslicing_aes` makes it
% trivial to locate the referenced PDF on disk under
% `arcana/doc/papers/<key>.pdf`.
%
% Order: normative specifications, then seminal cross-cutting SCA
% literature, then per-primitive references.
% =========================================================================

% -------------------------------------------------------------------------
% Normative specifications
% -------------------------------------------------------------------------

@techreport{fips197,
  author       = {{National Institute of Standards and Technology}},
  title        = {{FIPS 197 — Advanced Encryption Standard (AES)}},
  institution  = {NIST},
  year         = {2001},
  number       = {FIPS 197},
  url          = {https://csrc.nist.gov/publications/detail/fips/197/final},
}

@techreport{fips180_4,
  author       = {{National Institute of Standards and Technology}},
  title        = {{FIPS 180-4 — Secure Hash Standard (SHS)}},
  institution  = {NIST},
  year         = {2015},
  number       = {FIPS 180-4},
  url          = {https://csrc.nist.gov/publications/detail/fips/180/4/final},
}

@techreport{fips202,
  author       = {{National Institute of Standards and Technology}},
  title        = {{FIPS 202 — SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions}},
  institution  = {NIST},
  year         = {2015},
  number       = {FIPS 202},
  url          = {https://csrc.nist.gov/publications/detail/fips/202/final},
}

@techreport{fips186_5,
  author       = {{National Institute of Standards and Technology}},
  title        = {{FIPS 186-5 — Digital Signature Standard (DSS)}},
  institution  = {NIST},
  year         = {2023},
  number       = {FIPS 186-5},
  url          = {https://csrc.nist.gov/publications/detail/fips/186/5/final},
}

@techreport{nist_sp_800_38b,
  author       = {{National Institute of Standards and Technology}},
  title        = {{NIST SP 800-38B — Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication}},
  institution  = {NIST},
  year         = {2005},
  number       = {SP 800-38B},
}

@techreport{nist_sp_800_56a,
  author       = {{National Institute of Standards and Technology}},
  title        = {{NIST SP 800-56A Rev. 3 — Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography}},
  institution  = {NIST},
  year         = {2018},
  number       = {SP 800-56A Rev. 3},
}

@misc{rfc8017,
  author       = {Moriarty, K. and Kaliski, B. and Jonsson, J. and Rusch, A.},
  title        = {{PKCS \#1: RSA Cryptography Specifications Version 2.2}},
  howpublished = {RFC 8017, IETF},
  year         = {2016},
  url          = {https://www.rfc-editor.org/rfc/rfc8017},
}

@misc{rfc8032,
  author       = {Josefsson, S. and Liusvaara, I.},
  title        = {{Edwards-Curve Digital Signature Algorithm (EdDSA)}},
  howpublished = {RFC 8032, IETF},
  year         = {2017},
  url          = {https://www.rfc-editor.org/rfc/rfc8032},
}

@misc{rfc7748,
  author       = {Langley, A. and Hamburg, M. and Turner, S.},
  title        = {{Elliptic Curves for Security}},
  howpublished = {RFC 7748, IETF},
  year         = {2016},
  url          = {https://www.rfc-editor.org/rfc/rfc7748},
}

@misc{rfc6979,
  author       = {Pornin, T.},
  title        = {{Deterministic Usage of the Digital Signature Algorithm (DSA) and Elliptic Curve Digital Signature Algorithm (ECDSA)}},
  howpublished = {RFC 6979, IETF},
  year         = {2013},
  url          = {https://www.rfc-editor.org/rfc/rfc6979},
}

@misc{rfc2104,
  author       = {Krawczyk, H. and Bellare, M. and Canetti, R.},
  title        = {{HMAC: Keyed-Hashing for Message Authentication}},
  howpublished = {RFC 2104, IETF},
  year         = {1997},
  url          = {https://www.rfc-editor.org/rfc/rfc2104},
}

@misc{cfrg_hedged_sigs,
  author       = {Mattsson, J. P. and Thormarker, E. and Ruohomaa, S.},
  title        = {{Hedged ECDSA and EdDSA Signatures}},
  howpublished = {Internet-Draft draft-irtf-cfrg-det-sigs-with-noise, IETF CFRG},
  year         = {2024},
  url          = {https://datatracker.ietf.org/doc/draft-irtf-cfrg-det-sigs-with-noise/},
}

% -------------------------------------------------------------------------
% Seminal / cross-cutting side-channel literature
%
% Cross-cutting entries shared with quantica/doc/sca/biblio.bib
% (kocher1996timing, kocher1999dpa, brier2004cpa, chari2002template,
% boneh1997dfa, dobraunig2018sifa, reparaz2017dudect, langley2010ctgrind)
% intentionally are NOT duplicated here — sphinxcontrib-bibtex requires
% globally unique keys across all bibtex_bibfiles. In the unified
% workspace doc build (`./gendoc.sh all`), they come from the quantica
% bib. In standalone arcana builds (`./gendoc.sh arcana`), gendoc.sh
% stages the quantica biblio file alongside arcana's so the workspace
% bibliography stays single-sourced.
% -------------------------------------------------------------------------

@article{boneh2001jcrypt_dfa,
  author       = {Boneh, Dan and DeMillo, Richard A. and Lipton, Richard J.},
  title        = {{On the Importance of Eliminating Errors in Cryptographic Computations}},
  journal      = {Journal of Cryptology},
  volume       = {14},
  number       = {2},
  pages        = {101--119},
  year         = {2001},
}

@misc{geimer2024_ct_tools_usability,
  author       = {Geimer, Antoine and Vergnolle, Mathieu and Recoules, Frédéric and Daniel, Lesly-Ann and Bardin, Sébastien and Maurice, Clémentine},
  title        = {{A Usability Evaluation of Constant-Time Analysis Tools}},
  howpublished = {ePrint 2024/2060},
  year         = {2024},
  url          = {https://eprint.iacr.org/2024/2060},
}

@misc{zhang2025_ct_llvm,
  author       = {Zhang, Zhiyuan and Daniel, Lesly-Ann and Bardin, Sébastien and Maurice, Clémentine},
  title        = {{CT-LLVM: Automatic Large-Scale Constant-Time Analysis}},
  howpublished = {ePrint 2025/338},
  year         = {2025},
  url          = {https://eprint.iacr.org/2025/338},
}

% -------------------------------------------------------------------------
% AES — SCA, masking, fixslicing
% -------------------------------------------------------------------------

@inproceedings{bernstein2005_aes_cache_timing,
  author       = {Bernstein, Daniel J.},
  title        = {{Cache-Timing Attacks on AES}},
  booktitle    = {Technical report (cr.yp.to)},
  year         = {2005},
  url          = {https://cr.yp.to/antiforgery/cachetiming-20050414.pdf},
}

@inproceedings{osvik2006cache_aes,
  author       = {Osvik, Dag Arne and Shamir, Adi and Tromer, Eran},
  title        = {{Cache Attacks and Countermeasures: The Case of AES}},
  booktitle    = {CT-RSA 2006},
  year         = {2006},
  pages        = {1--20},
  publisher    = {Springer},
}

@article{adomnicai2021_fixslicing_aes,
  author       = {Adomnicai, Alexandre and Peyrin, Thomas},
  title        = {{Fixslicing AES-like Ciphers — New bitsliced AES speed records on ARM-Cortex M and RISC-V}},
  journal      = {IACR Transactions on Cryptographic Hardware and Embedded Systems},
  volume       = {2021},
  number       = {1},
  pages        = {402--425},
  year         = {2021},
  url          = {https://eprint.iacr.org/2020/1123},
}

@inproceedings{kasper2009aes_gcm_bitsliced,
  author       = {Käsper, Emilia and Schwabe, Peter},
  title        = {{Faster and Timing-Attack Resistant AES-GCM}},
  booktitle    = {CHES 2009},
  year         = {2009},
  pages        = {1--17},
  publisher    = {Springer},
}

@inproceedings{trichina2003masked,
  author       = {Trichina, Elena},
  title        = {{Combinational Logic Design for AES SubByte Transformation on Masked Data}},
  booktitle    = {ePrint 2003/236},
  year         = {2003},
}

@inproceedings{bilgin2014threshold_aes,
  author       = {Bilgin, Begül and Gierlichs, Benedikt and Nikova, Svetla and Nikov, Ventzislav and Rijmen, Vincent},
  title        = {{A More Efficient AES Threshold Implementation}},
  booktitle    = {AFRICACRYPT 2014},
  year         = {2014},
  pages        = {267--284},
  publisher    = {Springer},
}

@inproceedings{battistello2015fault_aes,
  author       = {Battistello, Alberto and Giraud, Christophe},
  title        = {{Fault Analysis of Infective AES Computations}},
  booktitle    = {FDTC 2015},
  year         = {2015},
}

@article{anssi2023_aes_ml_dpa,
  author       = {Masure, Lo\"{i}c and Strullu, R\'{e}mi},
  title        = {{Side-channel analysis against ANSSI's protected AES implementation on ARM: end-to-end attacks with multi-task learning}},
  journal      = {Journal of Cryptographic Engineering},
  volume       = {13},
  number       = {2},
  pages        = {129--147},
  year         = {2023},
  url          = {https://eprint.iacr.org/2021/592},
  note         = {ePrint 2021/592 — preprint of the Springer JCEN 2023 paper. Earlier bib had a confused author list (likely mixed with the related ePrint 2023/006 by Cristiani et al.).},
}

% -------------------------------------------------------------------------
% RSA — SCA, fault, CRT countermeasures
% -------------------------------------------------------------------------

@inproceedings{aumuller2002rsa_crt,
  author       = {Aumüller, Christian and Bier, Peter and Fischer, Wieland and Hofreiter, Peter and Seifert, Jean-Pierre},
  title        = {{Fault Attacks on RSA with CRT: Concrete Results and Practical Countermeasures}},
  booktitle    = {CHES 2002},
  year         = {2002},
  pages        = {260--275},
  publisher    = {Springer},
}

@inproceedings{joye2007rsa_infective,
  author       = {Joye, Marc and Tunstall, Michael},
  title        = {{Securing CRT-RSA against Bellcore Attacks}},
  booktitle    = {CHES 2007 / book chapter},
  year         = {2007},
  note         = {Infective computation against fault attacks on RSA-CRT.},
}

@misc{rauzy2013_formal_crt_rsa,
  author       = {Rauzy, Pablo and Guilley, Sylvain},
  title        = {{A Formal Proof of Countermeasures Against Fault Injection Attacks on CRT-RSA}},
  howpublished = {ePrint 2013/506},
  year         = {2013},
  url          = {https://eprint.iacr.org/2013/506},
}

@misc{rauzy2016_algorithmic_crt_rsa,
  author       = {Rauzy, Pablo and Guilley, Sylvain and Najm, Zakaria},
  title        = {{Algorithmic Countermeasures Against Fault Attacks and Power Analysis for RSA-CRT}},
  howpublished = {ePrint 2016/238},
  year         = {2016},
  url          = {https://eprint.iacr.org/2016/238},
}

@inproceedings{coron1999rsa_blinding,
  author       = {Coron, Jean-Sébastien},
  title        = {{Resistance Against Differential Power Analysis For Elliptic Curve Cryptosystems}},
  booktitle    = {CHES 1999},
  year         = {1999},
  pages        = {292--302},
  publisher    = {Springer},
  note         = {Includes message-blinding for RSA.},
}

@inproceedings{walter2002montgomery_leak,
  author       = {Walter, Colin D.},
  title        = {{MIST: An Efficient, Randomized Exponentiation Algorithm for Resisting Power Analysis}},
  booktitle    = {CT-RSA 2002},
  year         = {2002},
}

@inproceedings{brumley2003remote_timing,
  author       = {Brumley, David and Boneh, Dan},
  title        = {{Remote Timing Attacks Are Practical}},
  booktitle    = {USENIX Security 2003},
  year         = {2003},
}

@inproceedings{bleichenbacher1998rsa,
  author       = {Bleichenbacher, Daniel},
  title        = {{Chosen Ciphertext Attacks Against Protocols Based on the RSA Encryption Standard PKCS \#1}},
  booktitle    = {CRYPTO 1998},
  year         = {1998},
}

@inproceedings{giraud2006rsa_safe_error,
  author       = {Giraud, Christophe},
  title        = {{An RSA Implementation Resistant to Fault Attacks and to Simple Power Analysis}},
  booktitle    = {IEEE Transactions on Computers, Vol. 55 No. 9},
  year         = {2006},
}

% -------------------------------------------------------------------------
% ECDSA / ECDH on Weierstrass curves
% -------------------------------------------------------------------------

@inproceedings{coron1999dpa_ecc,
  author       = {Coron, Jean-Sébastien},
  title        = {{Resistance Against Differential Power Analysis For Elliptic Curve Cryptosystems}},
  booktitle    = {CHES 1999},
  year         = {1999},
  pages        = {292--302},
  publisher    = {Springer},
  note         = {Scalar blinding, randomized projective coordinates, point blinding for ECC.},
}

@inproceedings{brier2002weierstrass_sca,
  author       = {Brier, Eric and Joye, Marc},
  title        = {{Weierstraß Elliptic Curves and Side-Channel Attacks}},
  booktitle    = {PKC 2002},
  year         = {2002},
}

@inproceedings{joye2007regular,
  author       = {Joye, Marc},
  title        = {{Highly Regular Right-to-Left Algorithms for Scalar Multiplication}},
  booktitle    = {CHES 2007},
  year         = {2007},
  pages        = {135--147},
  publisher    = {Springer},
  note         = {The Joye double-add ladder.},
}

@misc{goudarzi2020_double_add_ladders,
  author       = {Goudarzi, Dahmun and Joye, Marc},
  title        = {{Faster Montgomery and double-add ladders for short Weierstrass curves}},
  howpublished = {ePrint 2020/437},
  year         = {2020},
  url          = {https://eprint.iacr.org/2020/437},
}

@inproceedings{aranha2020_ladderleak,
  author       = {Aranha, Diego F. and Novaes, Felipe Rodrigues and Takahashi, Akira and Yasuda, Mehdi and Tibouchi, Mehdi},
  title        = {{LadderLeak: Breaking ECDSA With Less Than One Bit Of Nonce Leakage}},
  booktitle    = {ACM CCS 2020},
  year         = {2020},
  url          = {https://eprint.iacr.org/2020/615},
}

@misc{jancar2020_minerva,
  author       = {Jančár, Ján and Sedlacek, Vladimir and Svenda, Petr and Sys, Marek},
  title        = {{Minerva: The curse of ECDSA nonces}},
  howpublished = {ePrint 2020/728 / TCHES 2020 Issue 4},
  year         = {2020},
  url          = {https://eprint.iacr.org/2020/728},
}

@inproceedings{albrecht2021bdd,
  author       = {Albrecht, Martin R. and Heninger, Nadia},
  title        = {{On Bounded Distance Decoding with Predicate: Breaking the ``Lattice Barrier'' for the Hidden Number Problem}},
  booktitle    = {EUROCRYPT 2021},
  year         = {2021},
}

@inproceedings{bauer2014ecdsa,
  author       = {Bauer, Aurélie and Jaulmes, Eliane and Prouff, Emmanuel and Wild, Justine},
  title        = {{A Synthesis of Side-Channel Attacks on Elliptic Curve Cryptography in Smart-Cards}},
  booktitle    = {Journal of Cryptographic Engineering},
  year         = {2014},
}

@inproceedings{moghimi2020tpm_fail,
  author       = {Moghimi, Daniel and Sunar, Berk and Eisenbarth, Thomas and Heninger, Nadia},
  title        = {{TPM-FAIL: TPM meets Timing and Lattice Attacks}},
  booktitle    = {USENIX Security 2020},
  year         = {2020},
  url          = {https://www.usenix.org/conference/usenixsecurity20/presentation/moghimi-tpm},
}

@inproceedings{pessl2017drama,
  author       = {Pessl, Peter and Gruss, Daniel and Maurice, Clémentine and Schwarz, Michael and Mangard, Stefan},
  title        = {{DRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks}},
  booktitle    = {USENIX Security 2017},
  year         = {2017},
}

% -------------------------------------------------------------------------
% EdDSA / Ed25519 — fault, SCA
% -------------------------------------------------------------------------

@inproceedings{romailler2017eddsa_fault,
  author       = {Romailler, Yolan and Pelissier, Sylvain},
  title        = {{Practical Fault Attack against the Ed25519 and EdDSA Signature Schemes}},
  booktitle    = {FDTC 2017},
  year         = {2017},
  publisher    = {IEEE},
}

@misc{cao2020_lattice_fault_det_sig,
  author       = {Cao, Weiqiong and Lai, Xuejia and Liu, Jie and Wang, An},
  title        = {{Lattice-Based Fault Attacks on Deterministic Signature Schemes of ECDSA and EdDSA}},
  howpublished = {ePrint 2020/803 / SAC 2020},
  year         = {2020},
  url          = {https://eprint.iacr.org/2020/803},
}

@inproceedings{samwel2018ed25519_wolfssl,
  author       = {Samwel, Niels and Batina, Lejla and Bertoni, Guido and Daemen, Joan and Susella, Ruggero},
  title        = {{Breaking Ed25519 in WolfSSL}},
  booktitle    = {CT-RSA 2018},
  year         = {2018},
}

% -------------------------------------------------------------------------
% X25519 / Curve25519 / Curve448
% -------------------------------------------------------------------------

@inproceedings{bernstein2006_curve25519,
  author       = {Bernstein, Daniel J.},
  title        = {{Curve25519: New Diffie-Hellman Speed Records}},
  booktitle    = {PKC 2006},
  year         = {2006},
  publisher    = {Springer},
}

@misc{weissbart2021_curve25519_ml_sca,
  author       = {Weissbart, Léo and Picek, Stjepan and Batina, Lejla},
  title        = {{Systematic Side-channel Analysis of Curve25519 with Machine Learning}},
  howpublished = {ePrint 2021/944},
  year         = {2021},
  url          = {https://eprint.iacr.org/2021/944},
}

@article{hutter2015_curve25519_arm,
  author       = {Düll, Michael and Haase, Björn and Hinterwälder, Gesine and Hutter, Michael and Paar, Christof and Sánchez, Ana Helena and Schwabe, Peter},
  title        = {{High-speed Curve25519 on 8-bit, 16-bit, and 32-bit microcontrollers}},
  journal      = {Designs, Codes and Cryptography},
  volume       = {77},
  pages        = {493--514},
  year         = {2015},
}

@misc{adomnicai2024_curve25519_curve448,
  author       = {Adomnicai, Alexandre and others},
  title        = {{A High-Performance Curve25519 and Curve448 Unified Implementation}},
  howpublished = {arXiv 2504.04731},
  year         = {2024},
  url          = {https://arxiv.org/pdf/2504.04731},
}

% -------------------------------------------------------------------------
% HMAC / SHA-2 SCA
% -------------------------------------------------------------------------

@article{belenky2023_cdpa_hmac_sha2,
  author       = {Belenky, Yaacov and Dushar, Ira and Teper, Valery and Bugaenko, Valeriya and Karavaev, Oleg and Azriel, Leonid and Kreimer, Yury},
  title        = {{Carry-based Differential Power Analysis (CDPA) and its Application to Attacking HMAC-SHA-2}},
  journal      = {IACR Transactions on Cryptographic Hardware and Embedded Systems},
  volume       = {2023},
  number       = {3},
  pages        = {1--29},
  year         = {2023},
  url          = {https://tches.iacr.org/index.php/TCHES/article/view/10955},
}

@inproceedings{belaid2014hmac_sha2_dpa,
  author       = {Belaïd, Sonia and Bettale, Luk and Dottax, Emmanuelle and Genelle, Laurent and Rondepierre, Franck},
  title        = {{Differential Power Analysis of HMAC SHA-2 in the Hamming Weight Model}},
  booktitle    = {SECRYPT 2013},
  year         = {2013},
}

@misc{goubin2001boolean_arithmetic,
  author       = {Goubin, Louis},
  title        = {{A Sound Method for Switching between Boolean and Arithmetic Masking}},
  howpublished = {CHES 2001},
  year         = {2001},
}

@inproceedings{bertoni2017keccak_masking,
  author       = {Bertoni, Guido and Daemen, Joan and Hoffert, Sebastian and Peeters, Micha\"{e}l and Van Assche, Gilles and Van Keer, Ronny},
  title        = {{Farfalle: parallel permutation-based cryptography}},
  booktitle    = {IACR Transactions on Symmetric Cryptology (ToSC)},
  volume       = {2017},
  number       = {4},
  pages        = {1--38},
  year         = {2017},
  url          = {https://eprint.iacr.org/2016/1188},
  note         = {[TO CONFIRM] bibkey says "keccak\_masking" but title and content are about Farfalle (a different Bertoni/Keccak-team construction). If the SCA documentation intended a Keccak-masking reference, this entry should be replaced (candidate: keccak.team "Note on side-channel attacks").},
}

% Cross-cutting references inherited from quantica's bib
% (coron2024_masked_rejection_dilithium and similar) are intentionally
% NOT duplicated here. Arcana citations of those keys resolve through
% the merged bib loaded by sphinxcontrib-bibtex.
