Modou Sarry

Hélène Le Bouder

Eïd Maaloouf

Gaël Thomas

Blind Side Channel Analysis against AEAD with a Belief Propagation Approach

Keywords: authenticated encryption with associated data (AEAD), side channel analysis (SCA), blind side channel analysis (BSCA), belief propagation (BP), Sparkle, Alzette, LFSR, Elephant

This paper present two new attacks on two lightweight authenticated encryption with associated data (AEAD): Sparkle and Elephant. These attacks are blind side channel analysis (BSCA). The leakage is considered as an Hamming weight (HW) with a Gaussian noise. In both attacks, a belief propagation (BP) algorithm is used to link the different leaks. Another objective is to present BSCA as a new tool for evaluating the robustness of a symmetric cryptographic primitive subfunctions.

Introduction

Today, the Internet of things (IoT) interconnects every aspect of our lives, leading to a proliferation of embedded systems. These devices play an essential role in many sectors such as industry, intelligent transport, smart cities and healthcare, to name but a few. However, due to the sensitive nature of the data they process, it is imperative to ensure the security of these systems. Protecting confidential information and preventing cyber-attacks are major concerns when deploying these circuits. Securing these systems is therefore of crucial importance.

In this context, the National Institute of Standards and Technology (NIST) started a competition [START_REF]Lightweight Cryptography Standardization Process[END_REF] for the standardization of a lightweight authenticated encryption with associated data (AEAD).

Physical attacks rely on the interaction of the computing unit with the physical environment. They are mainly divided in two families: side channel analysis (SCA) and fault injection attacks. SCA [START_REF] Ouladj | Side-Channel Analysis of Embedded Systems[END_REF] are based on observations of the circuit behaviour during the computation. They exploit the fact that some physical values of a circuit depend on intermediary values of the computation. This is the so-called leakage of information of the circuit. Blind side channel analysis (BSCA) is a new family of SCA, where no inputs nor outputs are used to recover a cryptographic key, only the traces and the knowledge of the algorithm is used.

Motivation Many attacks already exist on older symmetric cryptography algorithms like the advanced encryption standard (AES) [START_REF]Specification for the Advanced Encryption Standard[END_REF]. Since many AEAD algorithms are relatively new, there are far fewer attacks against them [START_REF] Berti | A Finer-Grain Analysis of the Leakage (Non) Resilience of OCB[END_REF][START_REF] Siang | Differential analysis aided power attack on (non-) linear feedback shift registers[END_REF][START_REF] Adomnicai | Practical algebraic side-channel attacks against acorn[END_REF][START_REF] Banciu | Exploring the resilience of some lightweight ciphers against profiled single trace attacks[END_REF]. Moreover, these new algorithms are often designed to be more resistant to physical attacks than AES. Therefore, one motivation is to test the resistance of these new algorithms against SCA.

Another main motivation is to build an attack which uses only traces, no text and no profiling. We are in the case of an attacker who can just observe a leakage but has no access to the device's input/output, hence the name of blind side channel analysis (BSCA). Once has to remark that retrieving the key without the ciphertext in BSCA may seem absurd in the context of confidentiality. However, in the context of integrity, an attacker could forge a tag for their message after obtaining the secret key.

The last motivation is to show that the BSCA context can be seen as a new tool to evaluate cryptosystems. This method is a good way to select the subfunction of an algorithm at a mathematical level. Thinking about the security of the cryptographic algorithm is an important approach.

Contribution

In this paper, we evaluate the security of two AEADs: Elephant [START_REF] Beyne | Elephant v2. NIST lightweight competition[END_REF] and Sparkle [START_REF] Beierle | Schwaemm and esch: lightweight authenticated encryption and hashing using the sparkle permutation family[END_REF] against BSCA. The attack on Elephant is a major improvement of a first BSCA [START_REF] Awaleh Houssein Meraneh | Blind Side Channel On The Elephant LFSR[END_REF][START_REF] Maillard | Blind side channel analysis on the Elephant LFSR Extended version[END_REF]. The attack on Sparkle is a new attack. The results are based on a belief propagation (BP) algorithm [START_REF] Barber | Bayesian Reasoning and Machine Learning[END_REF].

Organization Targeted algorithms Sparkle and Elephant are described in section 2. State of the art of BSCA attacks are summarised in section 3. Our attack methodology is described in section 4. The application of this attack against the Elephant algorithm and the corresponding results are presented in section 5. Similarly, the application of this attack against the Sparkle algorithm is discussed in section 6. Finally, the conclusion is drawn in section 7.

Authenticated encryption with associated data (AEAD)

NIST Competition

Authenticated encryption with associated data (AEAD), illustrated in Figure 1, should ensure confidentiality and integrity. It takes as input different parameters: a plaintext denoted M , the associated data denoted A, a secret key K, and an initialisation vector N also called a nonce. The nonce is public but must be different for each new plaintext. The algorithms ensure confidentiality of the plaintext M and integrity of both the plaintext M and the associated data A. It returns a ciphertext C and a tag T .

In this context, the NIST started the competition [START_REF]Lightweight Cryptography Standardization Process[END_REF] for lightweight cryptography candidates for AEAD. In August 2019, NIST received 57 submissions to be considered for standardization. In March 2021, only 10 finalists remained

AEAD M A K N C T Fig. 1. Overview of AEAD.
of which Elephant [START_REF] Beyne | Elephant v2. NIST lightweight competition[END_REF] and Sparkle [START_REF] Beierle | Schwaemm and esch: lightweight authenticated encryption and hashing using the sparkle permutation family[END_REF] which are targeted in this paper. Finally, in February 2023, NIST decided to standardize ASCON [START_REF] Dobraunig | Ascon. Submission to the CAESAR competition[END_REF].

Elephant

Elephant [START_REF] Beyne | Elephant v2. NIST lightweight competition[END_REF][START_REF] Beyne | Dumbo, Jumbo, and Delirium: Parallel Authenticated Encryption for the Lightweight Circus[END_REF] was a finalist to the NIST lightweight cryptography competition.

It is a nonce-based AEAD. Its construction is based on an Encrypt-then-MAC that combines counter (CTR) mode encryption with a variant of the protected counter sum [START_REF] Daniel | How to Stretch Random Functions: The Security of Protected Counter Sums[END_REF][START_REF] Luykx | A MAC Mode for Lightweight Block Ciphers[END_REF]. Elephant uses a cryptographic permutation masked with linear feedback shift registers (LFSRs) in an Even-Mansour-like fashion [START_REF] Granger | Improved Masking for Tweakable Blockciphers with Applications to Authenticated Encryption[END_REF] in place of a block cipher.

Let P be an n-bit cryptographic permutation, and φ an n-bit LFSR. The function mask : {0, 1} 128 × N × {0, 1, 2} → {0, 1} n used to mask the permutation P is defined as follows:

mask j,i K = (φ ⊕ id) i • φ j • P(K||0 n-128 ); (1)
where id is the identity function. One important thing to note is that the values of mask j,i K depend only on the secret key K and not on any other input of Elephant. Encryption enc under Elephant gets as input a 128-bit key K, a 96-bit nonce N , associated data A ∈ {0, 1} * , and a plaintext M ∈ {0, 1} * . It outputs a ciphertext C as large as M , and a τ -bit tag T . The algorithm is depicted on Figure 2.

Elephant comes in three flavours which differ on the n-bit cryptographic permutation P and the n-bit LFSR φ used, as well as the tag size τ .

In this paper, we focus on the smallest and main instance Dumbo. It uses the 160-bit permutation Spongent-π[160] [START_REF] Bogdanov | Spongent: a Lightweight Hash Function[END_REF], the 160-bit LFSR φ Dumbo , and has tag size τ = 64 bits.

Let ≪, , and denote the left rotation, left shift, and right shift operators respectively. The update equation of LFSR φ Dumbo is given at the byte level by equation ( 2) and illustrated on Figure 3.

φ Dumbo : (x 0 , • • • , x 19 ) → (x 1 , • • • , x 19 , x 0 ≪ 3 ⊕ x 3 7 ⊕ x 13 7) (2) K || 0 * P mask 0,0 K ϕ N || A1 mask 1,0 K ϕ A2 P • • • • • mask -1,0 K • • • • • • A || 10 * P • • ϕ ⊕ id mask 0,1 K N || 0 * P • • • ϕ ⊕ id mask 1,1 K N || 0 * P • • ϕ ⊕ id mask -1,1 K N || 0 * P • • Trunc|M | M C M1 C1 M2 C2 • • • • • • C || 10 * P mask -1,2 K ϕ ⊕ id • P mask 1,2 K ϕ ⊕ id • P mask 0,2 K ϕ ⊕ id • • • • • • • P Trunct T • Fig. 2.
Elephant associated data authentication (left), plaintext encryption (middle), and ciphertext authentication (right). This figure comes from [START_REF] Awaleh Houssein Meraneh | Blind Side Channel On The Elephant LFSR[END_REF][START_REF] Maillard | Blind side channel analysis on the Elephant LFSR Extended version[END_REF] Fig. 3. The 160-bit LFSR φ Dumbo . This figure comes from [START_REF] Awaleh Houssein Meraneh | Blind Side Channel On The Elephant LFSR[END_REF][START_REF] Maillard | Blind side channel analysis on the Elephant LFSR Extended version[END_REF] according to the description of Elephant [START_REF] Beyne | Elephant v2. NIST lightweight competition[END_REF]. Schwaemm is the AEAD of the Sparkle [START_REF] Beierle | Schwaemm and esch: lightweight authenticated encryption and hashing using the sparkle permutation family[END_REF] submission to the NIST lightweight cryptography competition. It is a permutation-based AEAD that builds upon the Beetle [START_REF] Chakraborti | Beetle Family of Lightweight and Secure Authenticated Encryption Ciphers[END_REF] variant of the Duplex [START_REF] Bertoni | Duplexing the Sponge: Single-Pass Authenticated Encryption and Other Applications[END_REF] construction by adding an extra linear whitening layer W, from the inner state into the outer state. The underlying cryptographic permutation is named Sparkle which gives the whole submission its name.

Sparkle

Several instances of both algorithms with various performance and security trade-offs are proposed.

The main instance is Schwaemm256-128. The rest of this paper then focuses on this particular instance. It is illustrated in Figure 4.

Schwaemm256-128 takes a 256-bit nonce N , a 128-bit key K, and produces a 128-bit authentication tag T . The corresponding Sparkle permutation is the 384-bit-wide variant, denoted Sparkle384.

Zoom on Sparkle

The Sparkle permuations are based on a substitution permuation network (SPN) structure. The linear layer is a Feistel-type transformation operating on 64-bit branches. It is based on a linear function M whose description is not necessary for the understanding of this paper. The non-linear layer is a 64-bit S-box named Alzette A i , applied in parallel to every branch of the Feistel, where i denotes the index of the branch. More details on Alzette are given in the paragraph 2.3.

The number of rounds depends on the particular instance, and whether it is used in the initialisation, encryption or tag generation phase of Schwaemm.

In the case of Schwaemm256-128, the number of rounds is R = 11 for the initialisation and tag generation, and only R = 7 for encryption. The first round of Sparkle384 of the initialisation phase of Schwaemm256-128 is depicted on Figure 5. One important thing to note is that the state is initialised with the concatenation of the nonce N and the secret key K.

s0 s1 s2 s3 s4 s5 A0 A1 A2 A3 A4 A5 / 64 / 64 / 64 / 64 / 64 / 64 N K M • • • s 0 s 1 s 2 s 3 s 4 s 5

Alzette

The Alzette S-box A i is a 64-bit permutation parametrised by a 32-bit known value α i that depends only on the index i of branch inside the Sparkle permutation. It is built as a 4-round addition-rotation-xor (ARX) Feistel cipher with all round keys equal to α i . As the name ARX suggests, it uses a combination of 32-bit modular additions, rotations, and xors. The whole process is depicted on Figure 6.

BSCA Context

While it has been proven that an algorithm is mathematically secure, its implementation can still expose vulnerabilities known as physical attacks. Physical attacks, such as SCA, constitute a specific subcategory of these vulnerabilities. They exploit the fact that certain physical characteristics of a device depend on intermediate values of the calculations performed, resulting in an information

0 / 32 ≪ 1 1 • ≪ 8 r0 / 32 • αi 1 r1 ≪ 15 • 2 • ≪ 15 αi 2 r2 • 3 • ≪ 1 αi 3 r3 ≪ 8 • 4 • ≪ 16 αi 4 r4
Fig. 6. The Alzette S-box Ai used in Sparkle.

leakage within the circuit. This information leakage could be utilized to retrieve secrets, such as a secret key.

Many SCA belong to the family of correlation power analysis (CPA) [START_REF] Paul | Differential power analysis[END_REF][START_REF] Brier | Correlation power analysis with a leakage model[END_REF][START_REF] Gierlichs | Mutual information analysis[END_REF]. To succeed these attacks need data like plaintext or ciphertext. Then these attacks use a mathematical model for the leakage. A confrontation is performed between measurements and predictions built with the model and known data. More precisely, a statistic tool called distinguisher gives score to the different targets.

In the case of sponge and duplex building, to the best of our knowledge, there are very few CPA attacks [START_REF] Samwel | DPA on hardware implementations of ascon and keyak[END_REF]. In a classical block cipher, the secret key is directly used in each round. In a duplex or sponge case, the secret key is used only once or twice, at the start and at the end of the whole algorithm. The first difficulty is caused by this fact. Moreover, in the specific use case Sparkle, there is no small S-box. On the contrary, Alzette is a very big S-box. That is one other reason, we have not chosen to study CPA attacks on Sparkle, but blind SCA.

BSCA is a type of SCA where some information that is usually known is unknown. The main concept is to perform the attack solely based on leakage measurements. The attacker model is different from that in a classic CPA. They have access to less information. Often BSCA is based on a strong assumption: the attacker is supposed to retrieve a noisy HW from the leakage.

Linge et. al [START_REF] Linge | Using the joint distributions of a cryptographic function in side channel analysis[END_REF] have presented the first BSCA. The goal is to attack the block cipher AES without using data such as plaintext or ciphertext. At the same time, Le Bouder et. al [START_REF] Hélène | A Multi-round Side Channel Attack on AES Using Belief Propagation[END_REF] published a first attack. Then, these works have been improved by Clavier et al. [START_REF] Clavier | Improved blind side-channel analysis by exploitation of joint distributions of leakages[END_REF]. Moreover, their contribution introduces for the first time, the name of blind side channel analysis (BSCA). Now it is a new family of SCA, and different symmetric cryptography algorithms are targeted by these attacks such as AES [START_REF] Linge | Using the joint distributions of a cryptographic function in side channel analysis[END_REF][START_REF] Hélène | A Multi-round Side Channel Attack on AES Using Belief Propagation[END_REF][START_REF] Clavier | Improved blind side-channel analysis by exploitation of joint distributions of leakages[END_REF][START_REF] Clavier | Quadrivariate improved blind side-channel analysis on boolean masked aes[END_REF], Elephant [START_REF] Awaleh Houssein Meraneh | Blind Side Channel On The Elephant LFSR[END_REF], and PRINCE [START_REF] Yli-Mäyry | Diffusional Side-Channel Leakage From Unrolled Lightweight Block Ciphers: A Case Study of Power Analysis on PRINCE[END_REF].

Description of the attacks

Simulated leakage Model

The power consumption or electromagnetic leakages are very correlated to the Hamming weight (HW) of the data. It is a classical model used in the domain of SCA.

One important advantage of HW is that it rapidly reduces guesses. For example, let x be a byte, so x can take 256 values in [[0, 255]]. With the HW of x, the attacker reduces the list of possible values, as shown in Table 1. Another model for the leakage is a HW with an additive Gaussian noise. For a given discrete random variable byte x, and its HW(x) ∈ [[0, 8]]; HW(x) denotes the continuous random variable representing the simulated Hamming weight so called noisy; defined in R as:

HW(x) = HW(x) + σ x,t ; (3)
with σ x,t an event of the Gaussian random variable N ( 0, σ 2 ) at a time t. The probability density function F associated to N ( 0, σ 2 ) is given by:

F σ (x) = 1 σ • √ 2π • exp ( - 1 2 • ( x σ ) 2 ) . ( 4
)
In this paper, BSCA are studied, so the attacker uses only simulated leakage. The simulation of the power consumption or electromagnetic leakage is generated with Gaussian noise added to the HW obtained from the intermediate computations at the byte level. To simplify the simulation, it is assumed that the noise level remains the same throughout the system. The simulations, which were performed using the Python programming language (v3.9), represent a typical unprotected implementation on an 8-bit processor.

Belief propagation (BP)

In our attack approach, relations between the different values for which a nosy HW is simulated, and exploited. For that belief propagation (BP) is used. BP was first used by Gallager [START_REF] Robert | Low-density parity-check codes[END_REF][START_REF] Robert | Low Density Parity check codes[END_REF] for decoding low-density parity-check (LDPC) codes [START_REF] Chung | On the design of low-density parity-check codes within 0.0045 dB of the Shannon limit[END_REF]. It was then rediscovered by Tanner [START_REF] Tanner | A recursive approach to low complexity codes[END_REF] and formalized by Pearl [START_REF] Pearl | Reverend Bayes on Inference Engines: A Distributed Hierarchical Approach[END_REF]. The first time that BP was used in SCA on symmetric encryption, in the attack of Veyrat-Charvillon et al. [START_REF] Veyrat-Charvillon | Soft Analytical Side-Channel Attacks[END_REF], then it is studied in [START_REF] Grosso | ASCA, SASCA and DPA with Enumeration: Which One Beats the Other and When?[END_REF][START_REF] Hélène | A Multi-round Side Channel Attack on AES Using Belief Propagation[END_REF].

Tanner graph A BP algorithm relies on a bipartite graph called a factor graph (or Tanner graph). To each node in the factor graph is associated some information. The nodes of a factor graph as are of two kinds:

-variable nodes V representing the variables handled by the algorithm under attack; -factor nodes, representing the equations E between these variables.

An edge links a variable node V with a factor node E, when the equation represented by the factor node E involves the variable node V . An example of a factor graph is illustrated in Figure 7.

N denotes the set of neighbours for a node. Thus the set N(E) is made of the variable nodes V involved in equation E, and the set N(V ) is made of factor nodes E that depend on V .

BP algorithm The belief propagation (BP) algorithm inputs are

-the Tanner graph, -prior probabilities P A (V = v) on the different variable nodes V .

The BP algorithm returns a better belief, from the initial values P A (V = v). More precisely, BP computes probabilities a posteriori P P (V = v) on the different variable nodes according prior probabilities. The values P P (V = v) are computed according to the input prior probability P A (V = v) and to the probabilities P(V = v|E) conditional on factor nodes E ∈ N(V ) to be satisfied using the following equation:

V 0 V 1 V 2 V 3 V 4 V 5 E 0 E 1 E 2 E 3
P P (V = v) ∝ P A (V = v) × ∏ E∈N(V ) P(V = v|E) (5)
In practice, nodes in the factor graph exchange information messages with their neighbours. More precisely, since the graph is bipartite, two types of messages are exchanged:

-factor to variable messages between a factor node E and a variable node V , denoted µ E→V :

µ E→V (v) = ∑ v1,v2,••• ,v #N(E)-1 E(v, v 1 , • • • , v #N(E)-1 ) × ∏ Vi∈N(E)\{V } µ Vi→E (v i ) (6
) This equation comes from the law of total probability. Roughly speaking, the quantity µ E→V (v) represents the belief from the perspective of factor node E that variable node V take the value v. The information is gathered from the other variables nodes in N(E).

-variable to factor messages between a variable node V and a factor node E, denoted µ E→V .

µ V →E (v) ∝ P A (V = v) × ∏ E ′ ∈N(V )\{E} µ E ′ →V (v) (7)
This equation is essentially Bayes' rule. Here variable node V updates its belief using informations from the factor nodes in N(V ). This equation is meant to be used in alternance with Equation [START_REF] Adomnicai | Practical algebraic side-channel attacks against acorn[END_REF]. So the contribution from node E is deliberately excluded to avoid self-persuasion.

Both equations make independence assumptions to make computations feasible in practice at the expanse of the risk to converge to an incorrect value.

To complete the description of the BP algorithm, an initialization step is done before applying the above equations. The variable to factor messages µ V →E (v) are initialized with the prior probabilities P A (V = v). In summary, after an initialization phase, BP works by alternatively applying equations ( 6) then [START_REF] Banciu | Exploring the resilience of some lightweight ciphers against profiled single trace attacks[END_REF] for every edge (V, E) in the Tanner graph. At the end of the execution, the returned value P P (V = v) is computed using equation ( 5) where the probabilities P(V = v|E) are replaced by their approximations µ E→V (v). The number of iterations depends of the rapidity of convergence, which in turn depends on the Tanner graph.

Attack on Elephant

Attack path

The attack path is based on a similar approach as presented in the theoretical work by Meraneh et al. [START_REF] Awaleh Houssein Meraneh | Blind Side Channel On The Elephant LFSR[END_REF][START_REF] Maillard | Blind side channel analysis on the Elephant LFSR Extended version[END_REF]. However, their attack focuses on obtaining HW information and is limited to scenarios without noise. It is a theoretical and mathematical assumption that is very useful for testing ideas, but it never happens in the real world. In this paper, we improve this attack to consider noisy HW more close than real measurements and propose the use of BP as a solution to address this challenge.

Linear feedback shift registers (LFSRs) find applications in various lightweight cryptography candidates, where their initial state is typically determined by both a key and a nonce. Since the nonce must be altered for each encryption request, attacks against such schemes are confined to the decryption algorithm. However, in the case of Elephant, the LFSR solely relies on the secret key. As a result, our attack can be employed in an encryption scenario as well.

The objective of the described attack is to recover the secret initial state of the LFSR. Three crucial points should be noted as following.

-Retrieving the initial state of the LFSR, which is equal to mask 0,0 K , is equivalent to retrieving the secret key. Indeed, the initial state is the result of the known permutation P applied to the key. -As the retroaction polynomial is publicly known, it is possible to shift the LFSR backwards: an attacker who recovers enough consecutive bytes of the secret stream is able to reconstruct the initial state. -The smaller the LFSR is, the more the attack is able to succeed. As a consequence, the Dumbo instance (see Figure 3) is the most vulnerable one: the following of this section is focused on Dumbo.

Since the LFSR generates a single new byte at each iteration, let the content of the Dumbo LFSR be denoted as follows:

(x j , • • • , x j+19 ) = mask j,0 K (8)
and let x j+20 be the byte generated at iteration j. Similarly, let (y j ,

• • • , y j+19 ) = mask j,1 K and (z j , • • • , z j+19 ) = mask j,2 K
. By definition of mask, the following hold for all j ≥ 0:

y j = x j ⊕ x j+1 ( 9
)
z j = x j ⊕ x j+2 . ( 10
)
The attacker can thus exploit two attack vectors: on the one hand, equations ( 2) coming from iterating the LFSR, and on the other hand, equations ( 9) and ( 10) coming from the different masks used for domain separation. In this use case, the attacker obtain a leakage, simulated by noisy HW on the different bytes of the Dumbo LFSRs.

Once has to remark that a classic CPA is impossible on the mask 0,0 K , because the attacker knows zero data in this function.

Tanner graph

In the case of Elephant, the Tanner graph is defined as follows. Variable nodes are the bytes x j , y j and z j of the LFSRs. There are four types of factor nodes:

-E y0 , E y1 , . . . , E y20 represent the equation [START_REF] Beierle | Schwaemm and esch: lightweight authenticated encryption and hashing using the sparkle permutation family[END_REF]. -E z0 , E z1 , . . . , E z19 represent the equation [START_REF] Awaleh Houssein Meraneh | Blind Side Channel On The Elephant LFSR[END_REF].

-We have divided the feedback equation ( 2) into two sub-equations. This helps reduce the amount of computation in BP. Indeed, the number of terms in equation ( 6) is exponential in the number of neighbours in N(E). The factor nodes corresponding to equation ( 2) are given in Table 2.

The Elephant Tanner graph is illustrated in Figure 8.

: tx20 = (x0 ≪ 3) ⊕ (x3 ≪ 7) Eux 20 : x20 = tx20 ⊕ (x13 ≫ 7) Etx 21 : tx21 = (x1 ≪ 3) ⊕ (x4 ≪ 7) Eux 21 : x21 = tx21 ⊕ (x14 ≫ 7) Ety 20 : ty20 = (y0 ≪ 3) ⊕ (y3 ≪ 7) Euy 20 : y20 = ty20 ⊕ (y13 ≫ 7)

Results

Table 3 presents the average and median rank of the correct key byte for various noise levels σ. The statistics are done for all 20 bytes and repeated with 1000 different randomly generated keys.

Results indicate that when the noise level is low, BP helps pushing up the ranks of the correct key bytes. An attacker can then leverage the posterior probabilities returned by BP using smart key enumeration techniques to try and find the whole key. Note that since the LFSR computation only depend on the key, it is possible to reduce the noise level by averaging several traces. Another important thing to note is that, finding the correct value of any mask j,i K , not just the first one, counts as a successful attack. Depending on the actual value of mask j,i K , some may be easier to attack than others, as was already noticed by Meraneh et al. [START_REF] Awaleh Houssein Meraneh | Blind Side Channel On The Elephant LFSR[END_REF] in the noise-free case.

Attack on Sparkle

Attack path

During the initialisation phase of Schwaemm256-128, the key K is loaded into the last 128 bits of the Sparkle384 state, see into two 64-bits halves. Then, in the first round, K 1 is the input of Alzette A 4 , and K 2 of Alzette A 5 .

The rest of this section only describes the attack for a single Alzette since they work exactly the same but for the constant α.

As stated in subsection 2.3, Alzette is a 4-round ARX Feistel cipher, illustrated in see Figure 6. In this use case, the attacker can obtain simulated leakage on the different internal values ℓ i , ℓ ′ i , and r i of Alzette. Here again, we assume a leakage model as a noisy HW of the bytes, as described in equations ( 3) and (4). The leakage observed in the first round of Alzette is depicted in Figure 9.

0 / 32 ≪ 1 1 • ≪ 8 r0 / 32 • α 1 r1 HW( 1 )
HW( 1) HW(r1) Fig. 9. Measurement leakage in the first round Alzette described in section 2.3 and Figure 6.

The different internal values related to each other thanks to the following Alzette equations:

ℓ ′ 1 = ℓ 0 ⊞ (r 0 ≪ 1) , ℓ 1 = ℓ ′ 1 ⊕ α , r 1 = (ℓ ′ 1 ≪ 8) ⊕ r 0 ℓ ′ 2 = ℓ 1 ⊞ (r 1 ≪ 15) , ℓ 2 = ℓ ′ 2 ⊕ α , r 2 = (ℓ ′ 2 ≪ 15) ⊕ r 1 ℓ ′ 3 = ℓ 2 ⊞ r 2 , ℓ 3 = ℓ ′ 3 ⊕ α , r 3 = (ℓ ′ 3 ≪ 1) ⊕ r 2 ℓ ′ 4 = ℓ 3 ⊞ (r 3 ≪ 8) , ℓ 4 = ℓ ′ 4 ⊕ α , r 4 = (ℓ ′ 4 ≪ 16) ⊕ r 3 (11)
To the best of our knowledge, this attack is the first BSCA against Sparkle.

Tanner graph

In the case of Sparkle, the variable node in the Tanner graph are defined at the bit level. They are the bits of the different ℓ i , ℓ ′ i , and r i . for 0 ≤ i ≤ 4. Since modular additions are involved, a 31-bit carry variable c i is also added at each round.

As for the equations, they are of two kinds:

-the bitwise translation of equations ( 11) which describe Alzette, -the HW equations (sum of bits gives the HW).

In this case, the HW are represented in the graph because they induce new relations between the different bits. The Figure 10 shows a part of the Tanner graph of the first round of Alzette.

1 (b) c1(b) c1(b -1) E 1 = 0 (r0≪1)(b) 0(b) r0(b -1) r0(b -8) E 1 = 0 ⊕α(b) 1(b) Er 1=( 0 ≪8)⊕r0 (b) r1(b -8) EHW( 1)= 1(b)
HW( 1) First, note that as in the case of the attack on Elephant, it is possible to reduce the noise level by averaging several traces, since the variables handled only depend on the key.

EHW( 1)= 1(b) HW( 1) EHW(r 1)= r1(b) HW(r1)
Second, it is important to consider that the correct key is often not the first attempt, as there may be a few unknown bits for the attacker. Therefore, allowing the attacker to perform an exhaustive search can be relevant to uncover the remaining bits. That is why we grant the attacker a certain computational power.

Let n be the number of bits the attacker can flip on 64 bits. This means that they can try up to P keys where P is given by:

P = ( 64 0 ) + ( 64 1
)

+ ( 64 2
)

+ • • • + ( 64 n
) .

Since they must do this for both half-keys, the total number of keys they can guess is P 2 . Table 7 indicates the number of keys found out of 1000 with an attacker possessing a computing power of P 2 as a function of the number of bits n they can flip in a reasonnable amount of time.

It is essential to point out that this exhaustive search does not exploit the a posteriori probabilities returned by BP. Therefore, the use of smarter key enumeration techniques, exploiting these probabilities, will certainly lead to improved results without the need for a specific computing power to perform an exhaustive search. Future projects include the use of key enumeration.

Conclusion

In this paper, two attacks on two lightweight AEAD algorithms have been successfully conducted and for each attack we used a single simulated measurement.

Firstly, an improvement on the attack against Elephant [START_REF] Awaleh Houssein Meraneh | Blind Side Channel On The Elephant LFSR[END_REF] incorporating a noisy Hamming weight model is presented. This enhanced approach allows for intelligent backtracking of the key, increasing the chances of finding the correct value.

Next, the first BSCA on Sparkle has been described. By exploiting the attacker computational power, we have shown that the attack can indeed recover a significant portion of the secret keys when the noise level is moderate. Using backtracking on the key in an intelligent way that could improve results without doing an exhaustive search for the few remaining bits not predicted by our attack.

The power of the BP algorithm was also highlighted in our research, prompting us to develop a generic tool for it in the future. In future work, we can speed up the computation time of BP by using Walsh-Hadamard transform [START_REF] Ouyang | Fast algorithm for walsh hadamard transform on sliding windows[END_REF].

Our future research has to focus on transitioning these attacks into practical implementations and to develop a key backtracking algorithm that is intelligent with posterior probabilities. Additionally, we plan to explore the security of Ascon, the NIST competition winner, as a potential target for our future investigations.

Fig. 4 .

 4 Fig.4. Encryption using Schwaemm256-128, where Sparkle384 R is the Sparkle384 permutation with R rounds, ρ is a linear application, W the linear whitening layer, and the constant ConstM indicating whether the plaintext M was padded or not.

Fig. 5 .

 5 Fig. 5. The first round of the Sparkle384 permutation during the initialisation of Schwaemm256-128.

Fig. 7 .

 7 Fig. 7. Example of a Tanner factor graph part. Circles are variable nodes and squares are factor nodes.

21 Fig. 8 .

 218 Fig. 8. Tanner factor graph on LFSR Dumbo of Elephant.

Figure 4 .

 4 Let split K = K 1 ||K 2

Fig. 10 .

 10 Fig. 10. Tanner graph of the first round of Alzette. Only a bit with index b ∈ [[0, 31]] of each 32-bit register is shown. Relative indices are given mod 32. The carries in the modular operation are denoted c1(b) and c1(b -1). Bits belonging to the same 32-bit register are enclosed in dashed lines.

Table 1 .

 1 Number of possible values for a byte x according its HW. This table comes from[START_REF] Hélène | A Multi-round Side Channel Attack on AES Using Belief Propagation[END_REF]

	HW(x) 0 1 2 3 4 5 6 7 8
	#x	1 8 28 56 70 56 28 8 1

Table 2 .

 2 Intermediate and final feedback equation

	intermediate feedback equation	final feedback equation
	Etx 20

Table 3 .

 3 Rank of all key bytes on 1000 different keys of 20 bytes for different noise levels σ. More precisely, BP algorithm returns probabilities a posteriorifor each possible value of each byte. These probabilities can be sorted from most likely to least likely. This table calculates the rank of the correct value for each byte.

	σ Mean Standard Deviation Min Quartile Q1 Median Quartile Q3 Max
	0.1 3.54	5.97	0	0	3	3	27
	0.15 3.54	5.97	0	0	3	3	27
	0.2 3.67	6.11	0	0	3	3	31
	0.25 4.95	9.31	0	0	3	3	97
	0.3 6.00	10.76	0	0	3	3	97
	0.35 7.46	13.10	0	0	3	8	97
	0.4 9.59	15.72	0	0	3	8	97
	0.5 15.97	23.03	0	3	8	31	153
	0.6 23.65	31.41	0	3	8	31	157
	0.7 33.73	40.11	0	3	27	36	213
	1 70.68	61.42	0	31	36	92	246

Table 6 .

 6 Number of bits recovered for the 128-bit master key K.

	σ Mean Standard Deviation Min Quartile Q1 Median Quartile Q3 Max
	0.1 114.06	4.07	89	112	114	117	123
	0.15 114.22	3.59	92	112	114	116	123
	0.2 114.26	3.51	97	112	114	117	124
	0.25 114.11	3.76	92	112	114	116	124
	0.3 113.89	3.67	97	112	114	116	125
	0.35 113.36	3.94	90	111	113	116	124
	0.4 112.92	3.82	95	111	113	115	124
	0.45 112.05	4.09	89	110	112	115	123
	0.5 111.35	3.85	92	109	111	114	123
	0.6 109.48	3.97	89	108	110	112	121
	0.7 108.06	3.77	87	106	108	110	120
	1 105.65	4.65	85	105	107	108	115

Table 7 .

 7 Number of keys, out of 1000, found for both Alzettes by an attacker with computational power P 2 , that can exhaustively flip up to n bits in each 64-bit subkey. n = 4, P 2 = 2 39 n = 5, P 2 = 2 46 n = 6, P 2 = 2 53 n = 7, P 2 = 2 59 n = 8, P 2 = 265

	σ	A4	A5	A4	A5	A4	A5	A4	A5	A4	A5
	0.1 175	169	274	283	494	422	610	586	831	787
	0.15 174	168	273	281	492	420	611	585	831	786
	0.2 175	172	284	285	485	421	611	586	818	776
	0.25 171	170	284	280	470	417	612	566	801	740
	0.3 177	133	284	246	447	389	582	554	751	716
	0.35 155	136	248	229	368	365	540	512	703	664
	0.4 137	105	243	187	368	306	523	468	652	618
	0.45 110	84	180	167	285	265	431	407	584	559
	0.5	88	53	154	112	246	216	380	342	527	495
	0.6	34	23	86	51	132	116	225	213	360	326
	0.7	9	7	25	18	65	43	150	100	266	211
	1	0	0	2	1	15	6	47	35	119	88

Acknowledgments This research is part of the APCIL project found by the Brittany region. The authors would like to thank Laurent Toutain.

Results

We ran our attack on both Alzettes in a parallel manner, the only difference being the α 4 constant used by A 4 and α 5 used by A 5 .

For the different values of the noise σ and with a single simulated measurement, the number of correct decisions on the input bits, or the number of recovered bits was calculated. The experiment was repeated on 1000 uniformly drawn random keys.

Table 4 presents the number of recovered bits of the 64-bit K 1 input of Alzette A 4 . Table 5 does the same for K 2 and A 5 . Finally, Table 6 presents the number of bits recovered for the whole 128-bit master key K of Sparkle.


Marco Benfante

Jean-Luc Reverchon

Olivier Gilard

Stéphane Demiguel

Cédric Virmontois

Clémentine Durnez

Thierry Dartois

Vincent Goiffon

Electric Field-Enhanced Generation Current in Proton Irradiated InGaAs Photodiodes

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Electric Field Enhanced Generation Current in

Proton Irradiated InGaAs Photodiodes M. Benfante, J-L. Reverchon, O. Gilard, S. Demiguel, C. Virmontois, C. Durnez, T. Dartois, and V. Goiffon

Abstract-Dark current degradation due to 49. [START_REF] Leroy | Principles of Radiation Interaction in Matter and Detection[END_REF] MeV proton irradiation is studied on lattice-matched InGaAs PIN photodiodes. This degradation is described in terms of electric field enhanced Shockley-Read-Hall generation current in the depletion region. In this paper we present a model of the radiation-induced generation current which includes the role of the electric field through the generation rate field enhancement factor (GRFEF). Using a combination of dark current-voltage and capacitancevoltage measurements, an experimental GRFEF is extracted for the thermal generation rate. This GRFEF has been used to define a new damage factor for InGaAs at low electric field that has been compared to previous literature studies. As a final result, the low-field generation lifetime degradation as a function of the fluence has been extracted. Index Terms-Damage factor, dark current, electric field enhancement, indium gallium arsenide (InGaAs), photodiodes, proton irradiation, Shockley-Read-Hall, generation lifetime.

I. INTRODUCTION

T HE effects of space radiation on indium gallium arsenide (InGaAs) photodiodes have been an object of attention of physicists and engineers for the last 25 years [START_REF] Hugon | Near-room operating temperature SWIR InGaAs detectors in progress[END_REF]. InGaAs, with a gap at 300 K of 0.74 eV (corresponding to a cutoff wavelength of λ c ≈ 1.67 µm) is a suitable semiconductor in the Short Wavelength InfraRed (SWIR) domain. Examples of space applications for such devices are earth observation (vegetation, ice) and satellite-to-satellite or satellite-to-ground telecommunications. Such missions require a low dark current at high operating temperature (≈ 250 K). InGaAs has shown promise as a good candidate to replace MCT (Mercury Cadmium Telluride or HgCdTe) for high temperature operation. Several studies have been done on the effects of proton irradiation on the dark current of InGaAs photodiodes [START_REF] Tauziede | Evaluation of InGaAs array detector suitability to space environment[END_REF]- [START_REF] Kleipool | In-flight proton-induced radiation damage to SCIAMACHY's extended-wavelength InGaAs nearinfrared detectors[END_REF]. Barde et al. [START_REF] Barde | Displacement damage effects in InGaAs detectors: experimental results and semi-empirical model prediction[END_REF] showed that dark current spikes and Random Telegraph Signals (RTS) observed in the frame of SPOT4 (Satellite pour l'Observation de la Terre 4) mission on lattice-matched InGaAs (In 0.53 Ga 0.47 As) detector modules can be explained by the effects of proton irradiation. Moreover, they affirmed that this degradation was due to the degradation of InGaAs itself, and not to the degradation of the Charge M. Benfante is with III-V Lab, ISAE-SUPAERO, CNES, Thales Alenia Space (e-mail: marco.benfante@3-5lab.fr, telephone: 0169415522).

J-L Reverchon is with III-V Lab, 1 Avenue Augustin Fresnel, 91767 Palaiseau, France (e-mail:jean-luc.reverchon@3-5lab.fr) O. Gilard, C. Durnez and C. Virmontois are with the French Space Agency CNES, 31401 Toulouse Cedex 4, France (e-mail: olivier.gilard@cnes.fr; clementine.durnez@cnes.fr; cedric.virmontois@cnes.fr).

V. Goiffon is with ISAE SUPAERO, Université de Toulouse, 10 avenue E. Belin, F-31055, Toulouse, France (e-mail: vincent.goiffon@isae-supaero.fr).

S. Demiguel and T. Dartois are with Thales Alenia Space, 06156 Cannes La Bocca, France.

Coupled Device (CCD) readout circuit. Tauziede et al. [START_REF] Tauziede | Evaluation of InGaAs array detector suitability to space environment[END_REF] studied the effects of proton irradiation on InGaAs pixel arrays called "Cactus" produced at III-V Lab, France. The Read Out Integrated Circuit (ROIC) consisted of a Capacitance TransImpedance Amplifier (CTIA) circuit. They noticed an increase of the peak dark current and average dark current after irradiation, with a higher increase for low proton energies. Moreover, they found an increase of RTS amplitude with integration time and temperature. Kleipool et al. [START_REF] Kleipool | In-flight proton-induced radiation damage to SCIAMACHY's extended-wavelength InGaAs nearinfrared detectors[END_REF] analyzed the degradation of InGaAs pixel arrays that had been aboard the SCIAMACHY (SCanning Imaging Absorption spectroMeter for Atmospheric CHartographY) instrument of ENVISAT (Environmental SAtellite). The module's channel consisting of In 0.53 Ga 0.47 As did not show any degradation, contrary to what has been seen in [START_REF] Barde | Displacement damage effects in InGaAs detectors: experimental results and semi-empirical model prediction[END_REF]. The authors tried to justify these results by stating differences in the device properties and operation conditions. All the cited studies attribute degradation to displacement damage. Displacement damage is due to the displacement of the atoms from their lattice site caused by the interaction between the protons and the nuclei of the semiconductor atoms. This damage is responsible for the formation of extra electronic levels in the band gap which enhance the Shockley-Read-Hall (SRH) generation current in the depletion regions [START_REF] Leroy | Principles of Radiation Interaction in Matter and Detection[END_REF], [START_REF] Srour | Universal damage factor for radiation-induced dark current in silicon devices[END_REF].

In this paper, planar disk-shaped lattice-matched InGaAs photodiodes of different diameters are analyzed when irradiated with 49.7 MeV protons. The effects of proton irradiation are evaluated by means of the dark current degradation ∆J combining dark current-voltage (I d -V) and capacitance-voltage (C-V) measurements. We show that the dark current is strongly affected by the electric field in the depletion region of the diode. This is confirmed by an estimation of the activation energy extracted from the dark current characteristics. The effects of electric field enhancement on dark current [START_REF] Vincent | Electric field effect on the thermal emission of traps in semiconductor junctions[END_REF] have been studied for pn junctions in other materials like Silicon [START_REF] Murakami | Separation and analysis of diffusion and generation components of pn junction leakage current in various silicon wafers[END_REF], [START_REF] Poyai | Impact of a high electric field on the extraction of the generation lifetime from the reverse generation current component of shallow n + p-well diodes[END_REF] or Germanium [START_REF] Simoen | On the temperature and field dependence of trap-assisted tunneling current in Ge p + n junctions[END_REF]. To the best of our knowledge, there are no previous studies of electric field enhancement effects on irradiated InGaAs photodiodes.

II. EXPERIMENTAL DETAILS

A cross section of an irradiated photodiodes is shown in Fig. 1. The pn junction is created by Zn diffusion. The high Zn concentration (> 10 18 cm -3 ) makes the p-side degenerate. Therefore, the device can be considered as a one-sided pn junction. The epitaxial growth and process are typical of that used to fabricate InGaAs-based photodiodes [START_REF] Tauziede | Evaluation of InGaAs array detector suitability to space environment[END_REF], [START_REF] Nuns | Displacement damage effects in InGaAs photodiodes due to electron, proton, and neutron irradiations[END_REF].

The proton irradiation has been carried out at Université Catholique de Louvain (UCL) in Louvain-La-Neuve, Belgium. Step Cumulated fluence (cm -2 ) Mean flux (cm -2 s -1 ) This consisted of four steps described in Table I. The exposure was carried out at ambient temperature and the diode pins were short-circuited. The energy and fluences chosen corresponded to the typical doses received for the envisaged space missions. In the example of the SPOT4 mission, the expected Displacement Damage Dose received in a 7 years mission is approximately 4.5 × 10 7 MeV/g which corresponds to an equivalent 49.7 MeV proton fluence of about 1.5×10 10 cm -2 . I d -V measurements have been conducted at ambient temperature on the irradiation site before and after each fluence to study the dependence of the dark current on the fluence. I d -V and C -V measurements were performed at the III-V Lab about one month after irradiation. In particular, temperature dependence of the I d -V has been studied between 270 K and 315 K in order to observe changes in the dark current activation energy of irradiated devices. The C -V measurements have been performed at room temperature. Table II shows the different diameters of the disk-shaped diodes which have been analyzed to evaluate the impact of the dimensions on the dark current and to extract the diode capacitance.

1 1 ×

III. MEASUREMENTS AND RESULTS

I d -V curves have been taken from -8 V to 0.4 V. Since InGaAs photodiodes are reverse biased during normal operation in real applications, only the reverse bias is considered. Reverse bias (V) We limited the range to a maximum reverse bias of 8 V to avoid any band to band tunnel contribution. Figure 2 shows the dark current for Diode5 for all fluences. All the five diodes showed similar behavior. Before irradiation, the contributions to the current from the perimeter and the area of the diode are comparable for the diameters considered. In particular, we found that the surface contribution is mainly a diffusion current whereas the perimeter contribution is a mix of diffusion current and SRH generation current. The same results were found by [START_REF] Rouvié | InGaAs focal plane array developments at III-V Lab[END_REF] who analyzed the dark current dependence on the size and temperature for the same photodiode structure as the one in the present paper. The temperature dependence of the dark current before irradiation shown in Fig. 3 proves the co-existence of these two contributions. At low bias, the generation current is negligible and the activation energy is the one of the InGaAs band gap energy whereas at larger bias the SRH current contribution makes the activation energy decrease. This is consistent with previous measurements on similar InGaAs photodiodes [START_REF] Djedidi | Investigation of the influence of Zn-diffusion profile on the electrical properties of InGaAs/InP photodiodes[END_REF].

The effect of the proton irradiation on the photodiodes is to increase the dark current and to change its voltage dependence compared to pre-irradiation. In order to give an idea of the degradation rate, at 5 V, the dark current value on the pre-irradiated Diode5 is 1.19×10 -11 A and it increases to 1.65×10 -8 A at a fluence of 1×10 10 cm -2 . Another effect of the proton irradiation is to make the dark current proportional to the surface. Figure 4 shows the dark current as a function of the diode area before irradiation as well as at the second and the fourth fluences.

A. Dark Current Dependence on Fluence

The dark current density degradation is defined as ∆J(Φ) = J post (Φ) -J pre , where J post (Φ) is the dark current density after irradiation at fluence Φ and J pre is the dark current density before irradiation. It has been calculated by normalizing the dark current to the area given by the Zn diffusion. Figure 5 shows that the degradation is linear with fluence. All diodes showed this same dependence.

In order to contextualize these results, we comment on the role of the dark current in real space applications. The impact of dark current on detector performances is to decrease the Signal to Noise Ratio (SNR). Considering just the photoactive material we have:

SNR = Signal Noise = γ I p P shot + P thermal (1)
where

P shot = 2q(I d + I p + I b )B is the shot noise, P thermal = 4kT B R
is the thermal noise [START_REF] Sze | Physics of semiconductor devices[END_REF] and γ is a proportionality coefficient. In these equations, q is the elementary charge, I d is the dark current, I p is the photocurrent due to the signal, I b is the photocurrent due to the background, k is the Boltzmann constant, T is the temperature, B is the noise bandwidth and R = dI d dV is the diode resistance. In imaging applications, the dark current reduces the dynamic range since the maximum signal is limited by the pixel charge integration capacitance, the last being partially filled with dark signal. The practical maximum acceptable requirements for dark current depend on the targeted SNR for the particular mission. Examples of mission-related parameters which influence the SNR are the spectral resolution, the spatial resolution, the operating temperature, the frame rate. The SNR depends also on the environmental properties like the spectral radiance at the detected wavelength and the total dose received during the mission for the related satellite orbit. Practical examples of how technical requirements are chosen for SWIR applications can be found in [START_REF] Dariel | Development of an SWIR multispectral detector for GMES/Sentinel-2[END_REF], [START_REF] Sierk | The European CO2 Monitoring Mission: observing anthropogenic greenhouse gas emissions from space[END_REF].

The linearity relation between the dark current degradation and the fluence is valid at all the investigated bias. Therefore we can write:

∆J(V, Φ) = α(V ) × Φ ( 2
)
where α is the Dark Current-related Damage Rate [START_REF] Moll | Radiation damage in silicon particle detectors: Microscopic defects and macroscopic properties[END_REF] and Φ the fluence. Figure 6 shows the coefficient α as a function of the reverse bias. The dependence of α on material properties and measurement and irradiation conditions will be discussed in the case where the proton-induced current degradation is a generation current in the depletion region. These dependencies make a direct comparison with irradiation-induced degradation on SWIR HgCdTe detectors not directly applicable. Moreover, until now there have not been any public studies investigating the irradiation effects on SWIR HgCdTe as absorbing material.

An example of dark current degradation induced by proton irradiation on a complete NIR (Near-InfraRed) HgCdTe detector (detecting layer + ROIC) can be found in [START_REF] Crouzet | First proton and gamma radiation of the MCT NIR European astronomy large format array detector[END_REF].

B. Activation energy

In order to understand the physical origin of the dark current after irradiation, it was important to understand its behavior in regard to temperature. In Fig. 7 the activation energy as a function of the reverse bias has been plotted for Diode5. All the five diodes showed the same behavior. The activation energy E a has been computed from an Arrhenius law:

I = Ae -Ea kT (3)
where the factor A is temperature independent. It is observed that the activation energy is much lower with respect to its value before irradiation (Fig. 3). Moreover, we note that the activation energy decreases when the reverse bias increases. At low reverse bias, the activation energy is about half the band gap energy of InGaAs (0.37 eV). This activation energy is typical for SRH generation current, whose temperature dependence follows the intrinsic carrier concentration n i [START_REF] Forrest | In0.53Ga0.47As photodiodes with dark current limited by generationrecombination and tunneling[END_REF]. The decrease in activation energy with reverse bias is associated with field-enhancement mechanisms on the generation of carriers [START_REF] Simoen | On the temperature and field dependence of trap-assisted tunneling current in Ge p + n junctions[END_REF].

In order to investigate field enhancement effects, a proper model for the dark current is needed. This is the scope of the next section.

C. Field Enhancement Factor Extraction

Considering the employed fluences, ∆J(Φ) = J post (Φ) -J pre ≈ J post is a SRH generation current. The irradiation-induced SRH generation current density can be described by the integral of the electric field-dependent radiation-induced generation rate ∆U (F, Φ) at fluence Φ over the depletion region width W :

∆J(V, Φ) = q W (V ) 0 ∆U (F (x, W ), Φ)dx = q∆U 0 (Φ) W (V ) 0 Γ GR (F (x, W ))dx (4)
where q is the elementary charge. The radiation-induced generation rate ∆U (F, Φ) has been expressed in terms of the Generation Rate Field Enhancement Factor (GRFEF) Γ GR as ∆U (F, Φ) = ∆U 0 (Φ) × Γ GR (F (x, W )) where ∆U 0 is the radiation-induced generation rate per unit volume in absence of field effects. To justify this approach, we rewrite the typical generation rate through states within the bandgap [START_REF] Sah | Carrier generation and recombination in p-n junctions and p-n junction characteristics[END_REF] by introducing a field enhancement factor Γ n(p) [START_REF] Hurkx | A new recombination model for device simulation including tunneling[END_REF] to the electron (hole) lifetime. The net radiation-induced generation rate can be written as:

∆U (F, Φ) = n i τ g (F, Φ) = n i τ n (Φ) Γ n (F ) + τ p (Φ) Γ p (F ) -1 (5)
where n i is the intrinsic carrier concentration, τ g the generation lifetime and τ n(p) (Φ) is the low field generation lifetime for electrons (holes) [START_REF] Schroder | The concept of generation and recombination lifetimes in semiconductors[END_REF]:

τ n (Φ) = τ n0 e -E t -E i kT τ p (Φ) = τ p0 e E t -E i kT (6)
We remark that the GRFEF Γ GR expresses the enhancement of the electron-hole pair generation rate through states in the band gap and it should not be confused with Γ n(p) , which expresses the field enhancement of the single transition rate between conduction (valence) band and the trap. Note also that we have dropped the symbol "∆" in (5) because ∆J(Φ) ≈ J post . We can relate the two lifetimes as τ p0 = a × τ n0 . The factor a depends on thermal velocity of carriers and the relative capture cross sections of electrons and holes [START_REF] Sze | Physics of semiconductor devices[END_REF]. Consequently:

∆U (F, Φ) = ∆U 0 (Φ)Γ GR (F ) (7)
where

     ∆U 0 (Φ) = ni kτn0(Φ) = ni τ0(Φ) Γ GR (F ) = k e -E t -E i kT Γn(F ) + ae E t -E i kT Γp(F ) -1 (8)
k = Γ GR -1 (0) is a normalization constant such that Γ GR (0) = 1. Its expression can be found by setting Γ n(p) = 1.

For example, for E t = E i and τ n0 = τ p0 , then k = 2 and the formula reduces to the one found by [START_REF] Sah | Carrier generation and recombination in p-n junctions and p-n junction characteristics[END_REF]. The linear dependence of ∆J with fluence (see ( 2)) suggests that the generation lifetime degradation is inversely proportional to the fluence, i.e. τ 0 × Φ = K g where K g is the generation lifetime damage factor. Therefore, we can rewrite (4) as:

∆J(V ) = q n i K g W (V ) 0 Γ GR (F (x, W ))dx × Φ (9)
∆U 0 = ni Kg Φ can be assumed to be independent on position, assuming that SRH centers created by the proton irradiation are uniformly distributed in the InGaAs layer due to the large proton energy employed.

For a constant doping, it can be shown that:

d(∆J) dW = q∆U 0 Γ GR (F max ) (10)
In the following, even if in our case the doping is not constant for the first 1 µm from the junction, we will consider that [START_REF] Murakami | Separation and analysis of diffusion and generation components of pn junction leakage current in various silicon wafers[END_REF] applies. This can be justified by two arguments. The first is that the doping varies smoothly and the second is that the GRFEF is usually strongly dependent on the field.

In order to perform this analysis on experimental data, the depletion region width W has been extracted from C -V measurements as

W (V ) = ε 1 C A (V )
, where C A is the capacitance density and ε is the dielectric constant of InGaAs. The capacitance density has been obtained from

C(V ) = C A (V ) × A + C P (V )
where C is the measured capacitance, A is the area of the diode, and C P is the parasitic capacitance. To extract C A , the three biggest diodes (Diode3,4,5) have been considered (Fig. 8). For all the doses, the capacitance at last dose has been used to extract W and perform the analysis. In fact, we have not observed important irradiation-induced changes in the capacitance with respect to the pre-iradiation values. The doping profile, which allows computing the maximum electric field at the junction, has been extracted for x > W (0 V) as

N (W ) = 1 2 qε d(C -2 A ) dV -1
as shown in Fig. 9. The doping profile at x < W (0 V) has been extrapolated from the C(V ) trend and modeled by a parabolic behavior. This may be due to donor compensation close to the junction. The maximum electric field range is 1.1-8.2×10 6 V/m in the reverse bias range 0-8 V.

D. Damage Factor

The model shown in the previous section can be used to extract the Damage Factor K dark in the case of presence of electric field effects. K dark has been introduced by [START_REF] Srour | Universal damage factor for radiation-induced dark current in silicon devices[END_REF] to account for radiation-induced dark current in silicon devices. In particular, it properly describes the degradation when the

Extracted doping Parabolic Model

Fig. 9. Doping profile as a function of the depletion region width W . The red curve shows the profile used for the calculation, which is extrapolated from the C(V )-derived doping profile trend (in blue). The vertical dashed line is

at x = W (0 V).
dark current is dominated by thermal generation through bulk centers in the depletion region. K dark is defined in [START_REF] Srour | Universal damage factor for radiation-induced dark current in silicon devices[END_REF] as the increase of thermal generation rate ∆U per unit of displacement damage dose D d deposited:

K dark = ∆U D d (11)
The displacement damage dose is defined as D d (E) = N IEL(E) × Φ where NIEL is the Non-Ionizing Energy Loss and E is the proton kinetic energy.

In the case of a uniform radiation-induced thermal generation rate ∆U over the depletion region W , the dark current increase has been expressed in [START_REF] Srour | Universal damage factor for radiation-induced dark current in silicon devices[END_REF] as:

∆J(V ) = (q × K dark × W (V ) × N IEL) × Φ (12)
The only dependence of ∆J in ( 12) on V is through W . However, this is the case where field enhancement mechanisms ). In violet the value found by [START_REF] Gilard | Damage factor for radiation-induced dark current in InGaAs photodiodes[END_REF], independent on voltage.

are negligible (Γ GR = 1). In our case, ∆J being an electric field-enhanced generation current, it should be described by ( 9) rather than [START_REF] Simoen | On the temperature and field dependence of trap-assisted tunneling current in Ge p + n junctions[END_REF].

Relying on meta studies conducted on InGaAs photodiodes with similar structure [START_REF] Nuns | Displacement damage effects in InGaAs photodiodes due to electron, proton, and neutron irradiations[END_REF], [START_REF] Gilard | Damage factor for radiation-induced dark current in InGaAs photodiodes[END_REF], which employed different proton energies and particles, we assume that the "NIEL scaling hypothesis" is valid in our case. This allow us to say that not only ∆J is proportional to the fluence, but also to the NIEL as assumed by the model [START_REF] Simoen | On the temperature and field dependence of trap-assisted tunneling current in Ge p + n junctions[END_REF]. In order to compare our damage factor with the one found by [START_REF] Gilard | Damage factor for radiation-induced dark current in InGaAs photodiodes[END_REF], [START_REF] Nelson | In situ deeplevel transient spectroscopy and dark current measurements of protonirradiated InGaAs photodiodes[END_REF] (where the authors used the model ( 12)), we rewrite [START_REF] Murakami | Separation and analysis of diffusion and generation components of pn junction leakage current in various silicon wafers[END_REF] in terms of D d as:

1 qD d d(∆J) dW = K dark,0 Γ GR (F max ) (13)
K dark,0 = ∆U0 D d = ni
Kg×N IEL is the dark current damage factor at low field and quantifies the generation rate degradation per unit of D d deposited with no field enhancement effects. If Γ GR ≈ 1, then K dark,0 corresponds to K dark defined in [START_REF] Srour | Universal damage factor for radiation-induced dark current in silicon devices[END_REF] and used by [START_REF] Gilard | Damage factor for radiation-induced dark current in InGaAs photodiodes[END_REF], [START_REF] Nelson | In situ deeplevel transient spectroscopy and dark current measurements of protonirradiated InGaAs photodiodes[END_REF].

The experimental result of such analysis is shown in Fig. 10 for the Diode5 at the fourth dose. The GRFEF at room temperature turns out to follow the empirical law:

Γ GR (F ) = exp F F 0 (14)
where F 0 = 1.9 × 10 5 V/m. We note that the field enhancement ratio between 0 V and 8 V is about 40. All the diodes showed a similar trend at all the four fluences. It is possible to extract K dark,0 by looking at the intercept of log 1 qD d d∆J dW vs √ F max with the y-axis. The average value of the extracted damage factor (computed from all the fluences except the lowest, since at the lowest fluence the current proportionality with diode surface is less precise), considering Diode4 and Diode5, gives a value at

∼ 293 K of K dark,0 = 3.8 × 10 8 g • s -1 • MeV -1 • cm -3 using N IEL = 3.6461 × 10 -7 MeV • m 2 • g -1 [25]. We re- mind that the extracted low field damage factor K dark,0 is TABLE III LITERATURE COMPARISON OF DAMAGE FACTORS K dark FOR INGAAS PHOTODIODES AT ROOM TEMPERATURE K dark (g • s -1 • MeV -1 • cm -3 ) Comments This work 3.8 × 10 8 Low-field [4]
1.2 × 10 9 Between 0 and 5 V [START_REF] Nelson | In situ deeplevel transient spectroscopy and dark current measurements of protonirradiated InGaAs photodiodes[END_REF] 2.7 × 10 9 At 0.2 V calculated from the I d -V measured on site right after each fluence. Since, we observed a room temperature annealing of about 20% of the dark current during the following month, K dark follows the same trend. This annealing occurred in the first days after the irradiation; no further important annealing has been observed. This means that, when comparing K dark with other references, attention should be paid at the time elapsed between the irradiation and the measurement. A comparison with the literature is shown in Table III. The main difference from the literature is expected to stem from the effect of the electric field that was not removed in [START_REF] Gilard | Damage factor for radiation-induced dark current in InGaAs photodiodes[END_REF], [START_REF] Nelson | In situ deeplevel transient spectroscopy and dark current measurements of protonirradiated InGaAs photodiodes[END_REF]. For example, [START_REF] Nelson | In situ deeplevel transient spectroscopy and dark current measurements of protonirradiated InGaAs photodiodes[END_REF] used the value of K dark calculated at 0.2 V because they found a higher K dark at higher reverse bias. They attributed this result to the onset of tunneling as field enhancement effect in the thermal generation. We highlight that the InGaAs doping concentration, in that study, was about one order of magnitude higher with respect to the present work.

We come back now to [START_REF] Djedidi | Investigation of the influence of Zn-diffusion profile on the electrical properties of InGaAs/InP photodiodes[END_REF] in order to find a theoretical justification for such a result. We remind that the GRFEF depends on Γ n(p) as described in [START_REF] Srour | Universal damage factor for radiation-induced dark current in silicon devices[END_REF]. There are mainly two electric field enhancement mechanisms for the generation of carriers through traps in the band gap: the Poole-Frenkel (PF) and the Phonon-Assisted Tunneling (PAT) [START_REF] Vincent | Electric field effect on the thermal emission of traps in semiconductor junctions[END_REF]. In Fig. 11 the two mechanisms are represented in the case of an electron emission from a Coulombic well in the presence of a constant electric field F . The electric field is considered constant, giving a contribution to the potential -qF r (local field approximation). The same picture applies for hole emission, where the barrier seen by holes where no electric field is present is E g -E t , E g being the band gap energy. Vincent et al. [START_REF] Vincent | Electric field effect on the thermal emission of traps in semiconductor junctions[END_REF] gave an analytical expression for the one-dimensional (1-D) field enhancement factors associated to these mechanisms in the case of a trap with a Coulombic potential. After defining z = E kT , we have:

Γ(F ) P F = exp ∆E(F ) kT (15a) Γ(F ) P AT = = E t kT ∆E kT exp z -z 3/2 f (F )g(F ) dz (15b)
where

       f (F ) = 4 3 (2m * ) 1/2 (kT ) 3/2 q F g(F ) = 1 -∆E(F ) zkT 5/3
and the barrier lowering is

∆E(F ) = q 3 F πε 1/2
. At first glance, our experimental GRFEF Γ GR has a field dependence similar to the PF. A similar law for the GRFEF was found by [START_REF] Poyai | Impact of a high electric field on the extraction of the generation lifetime from the reverse generation current component of shallow n + p-well diodes[END_REF] who studied the generation current in silicon n + -p junctions. In [START_REF] Poyai | Impact of a high electric field on the extraction of the generation lifetime from the reverse generation current component of shallow n + p-well diodes[END_REF], they found however a value for F 0 lower than expected. Similarly, our extracted F 0 is about 10 times lower than the expected one for InGaAs

F 0 = q 3 πεk 2 T 2 -1
= 1.56 × 10 6 V/m at 293 K. We have tried to explain this inconsistency by simulating the GRFEF. Coming back to [START_REF] Srour | Universal damage factor for radiation-induced dark current in silicon devices[END_REF], the GRFEF is defined as:

Γ GR (F ) = k e -E t -E i kT Γ n (F ) + ae E t -E i kT Γ p (F ) -1 (16)
where Γ n(p) (F ) = Γ P AT,n(p) (F ) + Γ P F (F ) is the electron (hole) emission enhancement factor. In order to explain our empirical GRFEF by means of PF and PAT mechanisms, we have plotted in Fig. 12 the simulated GRFEF of [START_REF] Dariel | Development of an SWIR multispectral detector for GMES/Sentinel-2[END_REF] in the case of a trap with energy E t = 0.29 eV from the conduction band edge for different values of a = τp0 τn0 . This trap energy has been found by Shaw et al. [START_REF] Shaw | Radiation-induced reverse dark currents in In0.53Ga0.47As photodiodes[END_REF] to be responsible for the generation of current in electron-irradiated InGaAs photodiodes. However, other literature studies are not in accordance on this value. Nelson et al. [START_REF] Nelson | In situ deeplevel transient spectroscopy and dark current measurements of protonirradiated InGaAs photodiodes[END_REF] found E t = 0.44 eV for proton-irradiated InGaAs photodiodes.

Although we tried to tune the model parameters, we have not been able to explain a Γ GR ratio of about 40 between electric field values of 10 6 and 10 7 V/m. We are inclined to believe that a PAT-limited GRFEF is the only possibility because the PF effect has a much weaker field dependence than the one we have found in our experimental GRFEF [START_REF] Vincent | Electric field effect on the thermal emission of traps in semiconductor junctions[END_REF]. One possibility could be that in our case PAT is induced in defect clusters where very high local fields [START_REF] Barde | Displacement damage effects in InGaAs detectors: experimental results and semi-empirical model prediction[END_REF] can be present. This charged clusters are of the order of the Debye length L D = kT q 2 N D ≈ 60 nm as can be shown by Monte Carlo simulations [START_REF] Moll | Radiation damage in silicon particle detectors: Microscopic defects and macroscopic properties[END_REF] and therefore they are not detected by C -V Generation Rate Field Enhancement Factor Trap Energy=0.29 eV @ T=300 K p0 / n0 p0 / n0

Acceptor Donor Fig. 12. Simulated Generation Rate Field Enhancement Factor at 300 K as a function of the square root of the electric field with a as parameter for an acceptor trap (dashed line) and a donor trap (solid line). The solid arrow points towards the higher a for the donor trap whereas the dashed arrow points towards the higher a for the acceptor trap. The used tunneling effective masses are mn = 0.034m 0 and mp = 0.46m 0 [START_REF] Walker | Heavy and light hole minority carrier transport properties in low-doped n-InGaAs lattice matched to InP[END_REF]. 4) where the experimental GRFEF obtained from the model described by [START_REF] Murakami | Separation and analysis of diffusion and generation components of pn junction leakage current in various silicon wafers[END_REF] has been used for all the fluences. The lowfield generation lifetime τ 0 , defined in (8), is the fitting parameter.

measurements. Given the difficulties to find a match between models and experience, we keep this analysis quite empirical.

To double check that (14) really does describe the voltage dependence (and consequently the field dependence) of the dark current after irradiation at room temperature, this model has been used to compute the dark current as in (4). There is a good match between the model and the measurement, as shown in Fig. 13. The fitted generation lifetimes τ 0 are indicated in Table IV. Figure 14 shows the generation lifetime degradation with fluence. A generation lifetime damage factor K g = 1.12 × 10 10 p + • s • m -2 has been found. We remind that this lifetime is defined by [START_REF] Srour | Universal damage factor for radiation-induced dark current in silicon devices[END_REF] and it should not be confused with the recombination lifetime extracted from time- resolved photoluminescence (TR-PL) measurements. In fact, the recombination lifetime in TR-PL experiments is extracted in the low-injection conditions and it is given by:

τ -1 r = τ -1 rad + τ -1 SRH + τ -1 Aug (17)
In the case of n-doped semiconductor, τ rad is the radiative recombination lifetime, τ SRH = τ p0 and τ Aug is the Auger recombination lifetime. Expressions for τ rad and τ Aug can be found in [START_REF] Rosencher | Optoelectronics[END_REF].

IV. CONCLUSION

The degradation of InGaAs PIN photodiodes due to 49.7 MeV proton irradiation at 293 K has been studied. The sample availability at the III-V Lab allowed us to study the InGaAs photodiode degradation, without the influence of any Read Out Integrated Circuit, the last being the case in [START_REF] Hugon | Near-room operating temperature SWIR InGaAs detectors in progress[END_REF], [START_REF] Tauziede | Evaluation of InGaAs array detector suitability to space environment[END_REF], [START_REF] Barde | Displacement damage effects in InGaAs detectors: experimental results and semi-empirical model prediction[END_REF], [START_REF] Kleipool | In-flight proton-induced radiation damage to SCIAMACHY's extended-wavelength InGaAs nearinfrared detectors[END_REF]. The dark current degradation turns out to be proportional to the fluence and it is due to the creation of SRH generation centers in the depletion region of InGaAs. A model based on the SRH generation current has been developed to consider the role of the electric field on the enhancement of the thermal carrier generation. An experimental Generation Rate Field Enhancement Factor has been extracted. Its dependence on the electric field has been addressed starting from the fundamental physics of field-assisted emission of a carrier from a potential trap. The match between the theoretical calculations that we conducted and the experiments was not straightforward because the theoretical models include several parameters to which we did not have access. Because of the strong dependence of the GRFEF on the field, we suspect that tunneling is the main mechanism. The GRFEF has been included in the definition of the Damage Factor. A lowfield damage factor has been extracted and compared to other studies of proton irradiation on InGaAs photodiodes. As expected, removing the effects of the electric field lowers its value. This suggests the use, in space applications, of a reverse bias as low as reasonably possible in order to reduce electric field enhancement effects. Moreover, the doping concentration should be also reduced. As the final result of our analysis, the low-field generation lifetime degradation has been extracted. Its value is dependent on the position of the trap level in the band gap. Further DLTS data could help in having a more complete understanding of the trap energy level responsible for the degradation.

Fig. 1 .

 1 Fig. 1. Cross section of an InGaAs PIN photodiode. The black rectangles represent the two contacts. D is the diameter of the disk-shaped diode. The total thickness of the structure is 4 µm and the thickness of the InGaAs active layer is 3 µm.

2 Fig. 2 .

 22 Fig.2. Dark current evolution with fluence for Diode5. The dark current before irradiation is also drawn.

Fig. 3 .

 3 Fig. 3. Activation energy before irradiation. Inset: I d -V curve for temperatures: 270 K, 285 K, 300 K, 315 K.

Fig. 4 .Fig. 5 .

 45 Fig. 4. Dark current at 5 V vs diode area a) before irradiation and at b) 2 nd fluence (3 × 10 10 cm -2 ), c) 4 th fluence (3 × 10 11 cm -2 ) for the five diodes of TableII.

Fig. 6 .Fig. 7 .

 67 Fig. 6. Dark current-related damage rate for Diode5 as a function of the bias.

Fig. 8 .

 8 Fig. 8. Capacitance density measured one month after the 4 th fluence. Inset: Capacitance of the three biggest diodes from which the capacitance density is extracted.

Fig. 10 .

 10 Fig.10. Extraction of the low-field Damage Factor K dark,0 at room temperature for Diode5 at the 4 th fluence (3 × 10 11 cm -2 ). In violet the value found by[START_REF] Gilard | Damage factor for radiation-induced dark current in InGaAs photodiodes[END_REF], independent on voltage.

Fig. 11 .

 11 Fig.11. Poole-Frenkel and Phonon-Assisted Tunneling electron emission enhancement for a Coulombic well. In the figure, the trap is located at r = 0 and E = 0 represents the energy at which the electron would be free in the absence of the electric field F . Et is the energy of the trap measured from the conduction band edge and ∆En is the barrier lowering see by an emitted electron due to the local field F .

2 Fig. 13 .

 213 Fig.[START_REF] Rouvié | InGaAs focal plane array developments at III-V Lab[END_REF]. Dark current density as a function of the reverse bias at each dose for Diode 5. The circled curves represent the measurement whereas the solid curves show the simulation using (4) where the experimental GRFEF obtained from the model described by[START_REF] Murakami | Separation and analysis of diffusion and generation components of pn junction leakage current in various silicon wafers[END_REF] has been used for all the fluences. The lowfield generation lifetime τ 0 , defined in[START_REF] Srour | Universal damage factor for radiation-induced dark current in silicon devices[END_REF], is the fitting parameter.

11 3Fig. 14 .

 1114 Fig. 14. Inverse of the low-field generation lifetime τ 0 as a function of the fluence.

TABLE I

 I

	PROTON IRRADIATION STEPS (E=49.7 MEV, T=293 K)

TABLE IV EXTRACTED

 IV LOW-FIELD GENERATION LIFETIME AS A FUNCTION OF FLUENCEFluence (cm -2 ) Generation Lifetime (µs)

	1 × 10 10	91
	3 × 10 10	36
	1 × 10 11

ACKNOWLEDGMENT

The authors gratefully acknowledge CNES and Thales Alenia Space for co-funding this research. They have also appreciated valuable discussions with B. Vinter.