Herman Van Rompuy

Exchanges of insults are rare in the European Parliament. The process of self-rationalization that presided over the rise of the institution affects all interactions between parliamentariansincluding the civility of their exchanges. Yet, as in all parliamentary institutions, insult remains possible because of pluralism and publicity. Through the analysis of certain mediatized episodes, the contribution highlights factors more specific to the European Parliament likely to generate verbal tension, namely: the presence of Eurosceptic representatives, the lack of cultural agreement on what can be said, the multiplicity of traditions of political rhetoric and the defence of certain European taboos such as peace and the usefulness of Parliament.

in 2010 by the British Eurodeputy and leader of the Eurosceptic party UKIP 1 Nigel Farage did not go unnoticed. The statement, exclaimed during a plenary session, contrasted with the polite, even dull, style of most European Parliament (EP) sessions. Indeed, the institution is usually characterised by the considerable mastery of its internal interactions, which bears the hallmark of a parliamentary style favouring detailed exchanges on substance rather than verbal jousting -in other words, it represents the domination of the working parliament over the talking parliament [START_REF] Rozenberg | Comparer les parlements[END_REF]. Furthermore, the EP's historical rise in power may be understood as a process of self-rationalisation, the effects of which influence both its inter-institutional strategies and the votes of its members or, in this case, their verbal interactions [START_REF] Costa | Le Parlement européen, assemblée délibérante[END_REF].

A sense of responsibility, a willingness to comprise and a desire to control the institution's image are the driving forces behind the main EP and group leaders, and the assembly's administration. It has resulted in a strict codification of behaviour, notably via frequent revisions of the Rules of Procedure.

However well-policed it may be, the institution is still a parliamentary one. Verbal tensions are not only fostered by the expression of pluralism within a common space, but also by the growing number of member states , the rotation of parliamentarians and their accompanying diverse parliamentary traditions. As a result, the history of insults in the EP represents a unique axis of observation of the institution's continuously thwarted efforts to impose its order. More precisely, we support the view that: a. phenomena of verbal tensions can structurally emerge within any parliamentary settings; b. the EP offers a relevant way to prove it given its propensity to consensus and order; c. more precisely in the case of the EP, verbal tensions may occur because both of its intercultural dimension and of the possible breaking of two common goods:

peace and the parliamentary nature of the institution.

The verbal (in)discipline of the EP, less understood and studied than the discipline of voting (for instance, [START_REF] Hix | Democratic Politics in the European Parliament[END_REF], is analysed here by considering first the occurrence of the insult, then the regulatory and political rationales of its canalisation. In the third section, we defend the idea that, despite the EP's capacity to regulate interactions in situ, verbal tensions are inevitable.

The impossibility of parliamentary civility

In parliaments, verbal violence is no different from what has been observed regarding physical violence: though prohibited in theory, it can strike at any moment (Baudot &Rozenberg 2010 and[START_REF] Douglas | How Institutions Think[END_REF]. Parliament presumes a certain pacification of human relations; this is where people can oppose each other with their words and where, like at Westminster since 1313, weapons are left in the cloakroom. However, this parliamentary civility seems to be structurally and continuously threatened. There are several reasons for this. First, pluralism: parliament, as an institution, implies people who disagree to act collectively. Second, orality: above all, a parliament is an institution where people speak ("parler", in French), where elected representatives must orally justify their stance. The legislative process often allows opposing views to emerge in the discussion, regardless of their representation in the hemicycle. This pro and contra discourse can increase tensions notwithstanding other measures intended to foster compromise [START_REF] Palonen | From Oratory to Debate[END_REF]. A final element contributing to tensions is procedural transparency against a background of electoral competition. Parliamentarians are not only competing to impose their vision of a proposed law; they are members of partisan teams that periodically clash at the ballot box. A significant proportion of their interactions occur under public scrutiny -the public in galleries, and even more so, the public as a whole, who are likely to follow them via the media or comments made by opinion leaders. The famous comparison between French and American constituent assemblies has certainly highlighted the "civilising force of parliamentary hypocrisy": the imperative of publicity helps to disqualify certain arguments that are not essentially universal [START_REF] Elster | Arguing and Bargaining in Two Constituent Assemblies[END_REF]. However, it also generates tensions and detracts from the quality of debate. Comparisons between the work of the committees, which is not as closely observed and is more confidential, and that of the plenary session, or between the upper and lower chambers, have provided various illustrations of this phenomenon 2 .

Insults, threats and verbal jousting can at any moment disturb the serenity of parliamentary order. This is particularly true since parliaments are in some respects "emotional arenas" (Fineman 1993), capable of arousing passionate exchanges and where the reputations of elected representatives are at stake. In political cultures that favour a high degree of civility in their interactions, some parliamentarians will thus try to get their colleagues -or better yet, a minister -off their backs by resorting to insults in the same manner as one may push for a foul in team sports.

In most cases, the potential for exchanging insults in parliament has led to various forms of regulation. In the first instance, this is done through polite conventions, such as refraining from making direct references to each other in British parliaments. However, regulating verbal interactions is a delicate exercise, given the difficulty of objectively assessing the degree to which an expression may be insulting, on the one hand, and of imposing sanctions upon elected representatives legitimised by the ballot and protected in their right to speak freely, on the other hand. The British House of Commons, for example, has abandoned the idea of upholding a record of unparliamentary language precisely because, as pointed out by its Secretary General with typical English irony "On the one hand this would ignore the all-important issue of context; and on the other it would provide perhaps irresistible temptation to some" 3 . Nonetheless, most of the internal rules of the Chambers stipulate sanctions, in some cases severe, when an arbitral authority within the Chamber, either individually or collectively, considers that the threshold of civility has been surpassed (Ile 2004).

The EP is not immune to these moments of verbal tension, inseparable from the parliamentary process. Occasionally, insults explode. In 2003, Silvio Berlusconi compared the chairman of the Socialist Group, Martin Schultz, to a World War II kapo. On a less egregious note, in 2017 Jean-Claude Juncker, President of the Commission, complained about the low attendance of elected representatives in the plenary and declared that the parliament was "ridiculous".

Compared to other European assemblies, these outbursts, to which we will return in the last section, are still quite rare, and for the reasons we will now elaborate.

The containment of insults in the European Parliament

In principle, the EP is an institution where the behaviour of elected representatives is particularly civil and courteous. Indeed, a high level of respect between speakers was underlined by an empirical study on debates conducted using the Discourse Quality Index [START_REF] Lord | The politics of justification? Applying the 'Discourse Quality Index' to the study of the European Parliament[END_REF]. This is due to the conditions under which the institution was created, to the low level of political conflict it has experienced for a long time and, when it increased, to the very manner in which outrageous behaviour and statements by members were tackled.

An assembly designed to be peaceful

The relatively pacific nature of deliberations in the EP is the result of a combination of four factors (Ripoll Servent 2008). First, until the mid-1990s, it was an institution whose raison d'être was primarily symbolic. In the treaties establishing the European Communities (Treaty of Paris, 1950 andTreaties of Rome, 1957), the Assembly was endowed with very limited powers and was above all a concrete manifestation of European reconciliation. By sitting together on the same benches, the representatives of the six founding states were to demonstrate the possibility of a peaceful and constructive deliberation at the supranational level.

Second, because the EP had limited powers, it was not a place where tempers ran high. Since its deliberations had no practical consequences, opposition and controversy were kept to a minimum. Moreover, the commitment of the deputies was modest since, before 1979, they were national parliamentarians holding two mandates at the same time.

Third, the moderation that has long characterised the deliberation of the EP was linked to the specific constraints deriving from its supranational nature. The fact that its members had to rely on translation for their exchanges led to a particular form of deliberation, which was more a succession of monologues than a politicised verbal exchange [START_REF] Abélès | La vie quotidienne au Parlement européen[END_REF][START_REF] Costa | Le Parlement européen, assemblée délibérante[END_REF].

Moreover, there is little room for lyrical, humorous or caustic statements through the medium of interpreters. This arrangement also makes it easy for the chair to manage the speakers. He or she can simply cut off the microphone of the member who is speaking to interrupt the interpretation if he or she exceeds the time, makes remarks that are irrelevant to the subject of the debate or indulges in verbal misconduct. The supranational nature of the assembly also implies the absence of a European political class. Members of the EP (MEPs), whose turnover is higher than in national parliaments (60% in 2019), do not have the degree of familiarity that exists at national level and are therefore less likely to be informal, to settle scores and to harbour antagonisms [START_REF] Michon | A database about the Members of European Parliament: Contributions and limitations of automated data collection in the study of European political elites[END_REF]. The supranational nature of the assembly is prone to lead to sluggish deliberation, since it is largely focused on highly technical texts [START_REF] Roger | Voice (s) in the European Parliament[END_REF].

Legislative proposals deal with issues that do not usually give rise to major political differences (internal market, agricultural policy, international trade, etc.) and are the result of a drafting process designed to eliminate national and partisan conflicts. The deliberate depoliticization of the dossiers, through the use of expertise and the division of texts [START_REF] Jobert | Le mythe de la gouvernance dépolitisée[END_REF] is not conducive to verbal jousting, and hence to the insults to which it can lead.

Finally, the supranational nature of the EP means that its deliberations receive little media coverage, which encourages deputies to focus on the substance of the issues and not to engage in political debates and personal opposition [START_REF] Morgan | The European Parliament, mass media and the search for power and influence[END_REF]).

An increasing political polarisation

Over time, however, the EP has become a more polarised and politically divisive assembly, with MEPs more prone to outbursts and violent language [START_REF] Kreppel | The European Parliament and the Supranational Party System: A Study of Institutional Development[END_REF]. Initially, they were predominantly recruited from the pro-European integration parties -Christian-Democrats, Socialists and Liberals. Until 1979, some Member States even refused to send representatives of the more critical parties, as was the case with the Communists in Italy. After the 'empty chair crisis' orchestrated by Charles de Gaulle in the Council in 1965, to protest against the excessively federal approach to Community integration, the Gaullist MEPs chose to sit separately from the Christian-Democrats in the European Democratic Group. At the other end of the hemicycle, the Communist MEPs created the Unified European Left Group in 1974. Both groups developed a more critical discourse on European integration, but the deliberations remained generally polite.

This changed dramatically following the first direct elections to the EP in 1979. As all Member States with the exception of the UK opted for proportional representation, the partisan spectrum was considerably broadened. The EP has not only welcomed members from all parties represented in national parliaments (more than 200 today), it has become the preferred destination for the leaders of fringe and anti-system parties that were previously not in a position to be elected in their own national parliament [START_REF] Brack | Opposing Europe in the European Parliament: Rebels and radicals in the chamber[END_REF]. Since 1979, green, far-right and far-left parties, as well as some regionalist parties, have always been represented in Brussels and Strasbourg. In short, the EP has long been the outlet for minority parties that were unable to gain access to national representation, especially when the first-past-the-post system was in place. In France, this was the case for the National Front (10 seats in the EP in 1984; 22 in 2019) and the Greens (8 seats in 1989; 12 in 2019), but also for more modest parties such as the Lutte Ouvrière, the Ligue Communiste Révolutionnaire and Chasse Pêche Nature et Traditions 4 (3, 2 and 6 seats respectively in 1999).

These elected representatives -and their counterparts from other Member States -were mobilised in the EP in more than one way. Since they often had no voice at the national level, they saw the European assembly as a platform for expression. They therefore multiplied their passionate speeches, which were designed to be commented on and taken up by the media, and which were only reported on by virtue of their sheer outrageousness. Jean-Marie Le Pen, the founder and historical leader of the French Front National, had particularly made a name for himself in this respect, giving numerous bombastic speeches to an audience beyond the assembly during his very long career as a MEP (1983-2003 and 2004-2019). In addition, the deputies of minority and anti-system parties have always been -with the exception of the Greens and some regionalists -more or less hostile to European integration, at least as it is enshrined in the treaties. Finally, elected representatives of fringe and anti-system parties often did not want to integrate themselves into the functioning of the EP, whose legitimacy they challenged. Those from the extreme right were even excluded by a "cordon sanitaire" policy, imposed by their peers to protest against their extremist views. As a result, many members of the extreme-left and extreme-right groups were constrained to adopt a purely tribune-like posture, conducive to excesses of language and, occasionally, to insults.

The regulation of excessive behaviour

The EP authorities and the leaders of the main political groups tried to limit the influence of anti-European parliamentarians, to deprive them of the means to engage in dilatory strategies and to prevent them from making speaking out. A first reform took place following an incident in October 1988 by the Reverend Ian Paisley, leader of the Democratic Unionist Party of Northern Ireland 5 . The MEP interrupted Pope John Paul II's speech to the EP by shouting "Death to the antichrist!" and holding up a sign reading: "Pope John Paul II Antichrist". One year later, a serious incident was triggered by MEPs from the Group of the European Right (nationalist right), who wanted to protest against being excluded from the appointment of key positions in the EP. Their protest degenerated into a brawl which forced the President to suspend the sitting and clear the room. In order to avoid a recurrence of such situations, the Rules of Procedure were revised so as to deal more severely with troublemakers, a process that has continued ever since, following various incidents.

Today, the Rules of Procedure strictly regulate the speeches of MEPs and strongly sanction insults and disorderly behaviour. This evolution reflects the more general quest, since the entry into force of the Single European Act (1987) and the Maastricht Treaty (1993), for a certain form of parliamentary efficiency. In summary, EP authorities have sought to maximise the powers granted to them by improving their deliberative effectiveness. This meant, on the one hand, prioritising the adoption of texts and consensus building, and on the other hand, limiting the rights of individual MEPs and the degree of spontaneity of exchanges in plenary sessions (Brack & costa 2012).

Although the various reforms governing MEPs' behaviour and their sanctions have not succeeded in dissuading or preventing such behaviour -a point we shall return to later -they have led to severely restricting speaking in plenary sessions in particular. Apart from rare exceptions, Members are only allowed to speak if they have been included on the list of speakers by their political group or by virtue of their duties (rapporteur, committee chairman, etc.). Moreover, their speaking time is strictly limited -often just one or two minutes -and carefully counted by the session chair.

Finally, EP authorities have always made a point of strongly reacting to outrageous comments and conduct due to their attachment to some form of "dignity" of the assembly. They consider that the EP must embody the values that are at the heart of European integration (democracy, human rights, tolerance, temperance, etc.), and therefore seek to repress any inappropriate behaviour or remarks within it. This is the reasoning that led to the creation in 1984 of the Committee of Inquiry into the Rise of Fascism and Racism in Europe, after the election of the first extreme right-wing MEPs 6 , and to the implementation of the "cordon sanitaire" policy against them, which is still in force today.

This attitude has led to a very restrictive regulatory arsenal. In the current version of the Rules of Procedure (updated in February 2023 7 ), Rule 10.4 states that "during parliamentary debates in the Chamber, Members shall refrain from offensive language"; it applies de facto to all EP bodies. An interpretation of the Rules by the Committee on Constitutional Affairs provides that it is for the President to determine whether such language is offensive, taking into account the intentions of the speaker, the perception of the statement, the extent to which it "harms the dignity and reputation of Parliament, and the freedom of speech of the Member concerned."

Rule 176 details a wide range of possible sanctions: reprimand, forfeiture of entitlement to the daily subsistence allowance, temporary suspension of the Member's rights to take part in the EP's activities, suspension from representing the assembly, limitation of rights of access to confidential or classified information. Finally, Annex II of the Rules of Procedure contains the "Code of appropriate behaviour for Members of the European Parliament in exercising their duties", which stipulates, among other things, that they must refrain from using "degrading, insulting, offensive or discriminatory" language.

Beyond the regulatory framework for MEPs' expression, more political considerations have led some of the Eurosceptic MEPs to moderate their statements. The detailed study of that population has brought to light different profiles: alongside the radicals and the absentees, some have chosen to play the Brussels game and ended up adopting a more moderate attitude [START_REF] Brack | Opposing Europe in the European Parliament: Rebels and radicals in the chamber[END_REF]. Even beyond the parliament, the functionalist tropism of European institutions, which has withstood many crises, is a powerful vector of moderation ( [START_REF] Novak | Enduring consensus: why the EU legislative process stays the same[END_REF]. In their systematic study of EP debates between 2004 and 2009, C. Lord and D. Tamvaki (2013) found that MEPs were more civil when debating issues that fall within the Union's core competences, such as climate and the budget. All the evidence suggests that the desire to be a good student of legislatives process leads to the exclusion of iconoclastic words -or speakers.

The impossibility of neutralising verbal violence in the European Parliament

Despite political and procedural constraints, verbal misconduct is still possible. We defend the idea that in matters of civility of speech, as in other aspects of parliamentary behaviour, hyper (self) rationalisation cannot be completely achieved. As argued in the first part, the parliaments mode of selection and the inevitability of the oral phase preceding the decision structurally allow for disorder to arise. Outrageous or unruly elected representatives can resist the strong pressures exerted on them. Compared to other institutional actors (judges, ministers, civil servants, etc.) the sanctions that can be taken against parliamentarians are limited in scopesince they have been elected. Freedom of speech is thus one of the privileges, in the British sense, granted to parliamentarians, even before the democratic era. The authenticity of government scrutiny and public action presupposes that everything can be said from the rostrum.

The EP is no more immune than other parliaments to this potentiality of disorder, not only because it has always attempted to mimic the parliamentary matric developed in European democracies, but also because it has had openly anti-system members in its ranks since 1965.

The driving force behind their political engagement is to fight against European integration or against the political leaders of their country, which requires them to abandon, if necessary, the smooth and courteous tone that typically dominates EP deliberations. As these political powers have tended to find refuge in the European assembly, it has served as a platform for them to address their constituents and their media outlets, irrespective of the substance of their deliberations. The Rules of Procedure and the session chairman can limit excesses, but they cannot totally and constantly silence these members, unless they openly deny the parliamentary deliberative ideal and the representative nature of the institution.

The intercultural insult and its misinterpretations

More specifically in the EP, the intercultural character of the assembly tends to favour verbal tensions. As a fluid social phenomenon, an insult implies an interaction between three actors: an insulter, an insulted, and third parties able to attest to the insulting nature of an intervention or interaction 8 . As such, the similarity of the cultural codes of both speakers and third parties (in this case, other parliamentarians, journalists and even voters) is a crucial issue for the mutual recognition of an insult. In the EP, the implicit agreement of what constitutes an insult is not self-evident given the differences in language, rhetorical culture but also in parliamentary style (Plaonen 2018). This cultural pluralism is the source of an unavoidable misinterpretation regarding the type or degree of insult.

The most obvious illustration of these intercultural differences is the definition of what can be said. Certain radical statements are perceived as radical in some European countries, but they are still tolerated, whereas they are not -or no longer -permissible elsewhere. This is the case, for example, with the misogynistic statements of the Polish MEP Janusz Korwin-Mikke, who declared in a sitting on 2 March 2017: "Of course women must earn less than men because they are weaker, they are smaller, they are less intelligent." These words were perceived as an insult by many of the elected representatives in the session, particularly the women who viciously responded to him. Without minimising the far-right MEP's desire to provoke, it appears that the parliamentary system can give rise to such outrages, not only because the elected representative is called upon to defend a certain world view from the rostrum, but also because an a priori agreement on what is permissible is more absent in the EP than in other more culturally homogenous assemblies. It is worth noting that the sanction imposed by the EP on Mr. Korwin-Mikke was invalidated by the Court of Justice of the European Union in 2018. The Court's established jurisprudence emphasises the "particular importance of the freedom of expression of Members of Parliament" and stresses that an elected representative may be penalised by his institution based on his conduct, namely the disruption of the orderly conduct of debates, and not for his words alone, even if they jeopardise the dignity of the Parliament 9 . This pluralism inherent to the EP does not only condition the definition of the general values of the political community but also the conception of parliamentarianism and the place of rhetoric within it. Beyond disagreements on substance, verbal tensions are also a question of parliamentary style. In British culture, in particular, the sophisticated use of words as part of an incrimination strategy is central (Atkins & al. 2014). This can be seen as offensive, not only because it is aggressive, but also because other elected representatives, socialised in other assemblies, are less used to this style and less able to deal with it. After 1973, the first British MEPs tried, rather unsuccessfully, to change the procedures in a more confrontational direction [START_REF] Caroline | The First British MEPs: Styles and Strategies[END_REF]. They and some of their colleagues, who were drawn to the parliamentary role of the debater [START_REF] Navarro | Les députés européens et leur role[END_REF], then took advantage of debates on the state of the Union, presidencies, or general current affairs to honour parliamentary deliberation. It is interesting in this respect to read the full speech by MEP Nigel Farage mentioned in the introduction, which followed the election of H. Van Rompuy as President of the Council.

Box 1. Full text of Nigel Farage's speech in plenary on 24 February 2010 (Brussels) 10 President of Europe -this long-awaited day. We were told that, when we had a President, we would see a giant global political figure: the man that would be the political leader for five hundred million people; the man that would represent all of us on the world stage; the man whose job was so important that of course, you are paid more than President Obama. Well, I am afraid what we got was you. And I am sorry, but after that performance that you gave earlier… I do not want to be rude, but you know, really, you have the charisma of a damp rag and the appearance of a low-grade bank clerk. (Protests)

The question that I want to ask and that we are all going to ask is: who are you? I had never heard of you; nobody in Europe had ever heard of you. I would like to ask you, Mr President: who voted for you? (Loud protests) And what mechanism -I know democracy is not popular with you lot -what mechanism do the peoples of Europe have to remove you? Is this European democracy? I sense, though, that you are competent and capable and dangerous, and I have no doubt that it is your intention to be the quiet assassin of European democracy and of the European nation states. You appear to have a loathing for the very concept of the existence of nation states; perhaps that is because you come from Belgium, which, of course, is pretty much a non-country. (Reactions) But since you took over, we have seen Greece reduced to nothing more than a protectorate. Sir, you have no legitimacy in this job at all, and I can say with confidence that I speak on behalf of the majority of the British people in saying: we do not know you, we do not want you, and the sooner you are put out to grass, the better.

It is evident that the British MEP is careful not to use foul language to describe the President of the Council. He uses graphic metaphors -the damp rag, the low-grade bank clerk -which are particularly telling 11 . He also multiplies the rhetorical devices aimed at attenuating the defamatory scope of his remarks ("I am sorry," "I don't want to be rude,"), by mixing compliments and criticisms ("you are competent and capable and dangerous"), by using irony (with the allusion to Van Rompuy's oral "performance", who is notoriously a poor orator), and even by deploying a certain aesthetic of language ("the quiet assassin": quite a clever touch).

Everything suggests that the former Dulwich College resident is part of a rhetorical tradition, which permeates British political culture, of using a variety of figures of speech to gain the upper hand in an exchange while avoiding crude insults.

The existential insult

Another reason for the unassailable nature of EP insults is almost contradictory to the previous one: despite its intercultural diversity and the misunderstandings that can result from it, the assembly is also based on a system of common goods and places [START_REF] Goyet | Le sublime du lieu commun[END_REF]. By this, we mean the ways of seeing the world that have underpinned the institutionalisation of the Parliament and have been reinforced in the process. The belief on which all institutions are based, as anthropologists speak of [START_REF] Legendre | Les Collages qui font un État[END_REF], automatically generates the possibility of scandal -and therefore of insult -through its denunciation. In other words: insult presupposes the existence of a community.

Mapping the common values that underpin the EP is beyond the scope of this contribution. However, it is worth noting that what has been identified as insults to the EP, for example by the online media by offering rankings, touches on important axiological issues 12 . Firstly, peace, understood as the possibility of harmonious coexistence between peoples, but also the redemption of those responsible for the atrocities of the 20th century. This is where Silvio Berlusconi's comparison between Martin Schulz and a kapo does not sit well. The debate was held at the opening of the Italian Council Presidency, with the Italian head of government intervening at the end of the debate to respond to the various speakers, including Mr. Schulz, a German elected representative who had spoken on behalf of the Socialist Group.

Box 2. Excerpts from the plenary debate, 2 July 2003 (Strasbourg) 13 S. Berlusconi. Mr Schulz, I know there is a producer in Italy who is making a film about Nazi concentration camps. I will suggest you for the role of guard. You would be perfect! [Laughter, protests from the left] […] E. Barón Crespo. I would ask you 14 , as well as giving the floor to Mr Schulz, to call on Mr Berlusconi, the President-in-Office of the Council, to withdraw those comments, out of respect for the values we all share as Europeans. [Applause] President. It is perhaps better that we should deal with this matter directly. I do not want to open up a whole debate. There is considerable emotion in the House regarding this. It is very clear that a Member is entitled to make a contribution in a debate and to have it responded to with some serenity. In this case, in the vigour and flow of his response, Mr Berlusconi perhaps allowed himself to go beyond the ordinary rules of engagement. [Mixed reactions] […] M. Schulz. Mr President, thank you for giving me the floor. I do not need three minutes. I will be very brief. During his statement, if the translation was correct, Mr Berlusconi said that a director is currently shooting a film in Italy about the concentration camps, and was inviting me to take the role of the Kapo… [Heckling]... that is to say, the role of the SS henchman. I have only one thing to say to you in response: my respect for the victims of fascism prevents me from saying a single word about this. However, I am quite clear in my mind that it is very difficult to accept a situation in which a President-in-Office of the Council, when he comes up against the slightest contradiction during a debate, loses his composure in this way. [Loud and sustained applause from the left and centre left, standing ovation] S. Berlusconi. Mr President, who was not in the Chamber to hear Schulz's speech? That he should insult me seriously on a personal level, gesticulating and in a tone of voice that really is unacceptable in a Parliament like this. I said what I said ironically. If you are all unable to understand irony, I am sorry. But I will not withdraw what I said ironically unless Mr Schulz withdraws the personal insults he made. I said it ironically; he did that maliciously! [Applause from the right, uproar on the left] President. Colleagues! Please, could we have some calm! There are many colleagues who wish to make points of order and to speak. We are running very late. I will not take those points. I wish to say, as President of the House, that I personally regret the tone that the latter part of this morning's debate has taken. It is unfortunate. It is a distraction from the European business we have at hand. It is regrettable. I should now like to invite the President of the European Commission to close this debate in some serenity and then to proceed to the vote.

[Sustained applause]

A long excerpt was presented because it captures the sudden intensity of the debates produced by the unusual association between a German elected representative and a concentration camp guard. The reference by a former EP President, E. Barón Crespo, to European values is significant for the normative scope of the debates. S. Berlusconi seems to be aware that he has broken a taboo by moderating his words a trifle (without withdrawing them) and by placing himself in the position of the insulted. Finally, the attitude of the President of the EP, the Irishman P. Cox, is revealing, to the point of caricature, of the desire to calm down the debate by minimising the scope of the remarks made by the head of the Italian government, by refusing to allow the incident to continue, and by recalling the time constraints and the mission of the assembly in terms of substance. His conclusion -"a distraction from the European business we have in hand" -perfectly sums up the functionalist mindset of the institution. It is also worth noting that the EP services preferred the less controversial word "guard" in the official report of S. Berlusconi's remarks who, although speaking in Italian, had used the word "kapo".

Another major source of damage to European values concerns the EP itself. The culture of the institution has been characterised since its inception by the desire to convince people that it is a "real Parliament", a title that the assembly gave itself by authority (1965) well before the treaties conferred it (1987). Questioning the authenticity of the EP's parliamentary character is taboo and is perceived as an insult to the entire institution. Ironically, the speeches of two Mr Farage, one moment. Colleagues! With all due respect for your enthusiasm, you are doing what UKIP normally does here in this house. So: do not copy them. But I would like to say one thing to you, Mr Farage: [about] what you said -that my colleagues in this House have never done a decent job -do not take your own case as a generalisation.

CONCLUSION

The focus on some colourful episodes of insults in the EP illuminates their inextricable links with parliamentary deliberation. Deliberation certainly presupposes respect for the rules of order and courtesy, but also the recognition of a variety of viewpoints, and therefore of sometimes profound disagreements, and a certain degree of freedom of speech, which may even reach extremes. This double presupposition of pluralism and free expression is at the core of an institution whose function is to bring about consensus or majorities from the confrontation of various positions, through the exchange of arguments and the negotiation of agreements. In a democratic assembly, debates are supposed to be based on reason, but a balance must be found between the use of expertise as a vehicle for dispassionate exchange and rational argumentation, and the more political debates, based on opinions, values and convictions. In other words, MEPs, especially those from anti-system or radical parties, cannot be expected to stick to reason and moderation: they occasionally express radical views, the very views for which they were elected. Given their representative legitimacy and their freedom of speech and tone, verbal slips and insults cannot be excluded.

The existence of episodes of verbal tensions within an institution as seemingly rationalised, quiet, and polite as the EP was taken as a worst case scenario: if insults emerge within it, there are reasons to think that they are intrinsic to parliaments as modern representative institutions. Indeed, we have highlighted that as any political organization, the EP is rooted on share beliefs and norms, and that, as any pluralist debating body, outliers sometimes question them. In the EP, the scandal typically emerges when orators question the contribution of the EU to peace and the relevance of the institution itself. In that sense, it can be said that the EP is a real parliament, not only because it holds significant prerogatives and follows relevant procedures but also because the Parliament is able to think as an institution, to quote Mary [START_REF] Douglas | How Institutions Think[END_REF], beyond its multi-cultural nature.

More specifically to the EP, the issue of verbal tensions leads to another one: that of the media coverage of its activities. We know indeed that the way norms are respected or not within a given organisation partly derives from actual regulations within interacting settings (Walter 2021). The EP is not poorly elected, but it is little known and rather absent from the media.

How can journalists and citizens be interested in the lacklustre debates between mostly anonymous MEPs, which most often boil down to a litany of perfectly courteous, expert, and calibrated speeches? In fact, the EP's plenary deliberations are, most of the time, nothing more than a stage production, a formalisation of agreements reached beforehand. The real exchanges take place upstream, within the parliamentary committees and groups, between their representatives, and within the framework of 'trilogues' which bring together, behind closed doors, representatives of the EP, the Commission, and the Council. Since the beginning of the 2000s, the public deliberation of the EP has essentially been a form of validation of these agreements, devoid of surprise and drama. In this respect, the EP is perhaps more capable of being recognised as a representative body by European citizens when it is the place for slurs, murderous phrases and armed conflicts. On these occasions, the EP is actually given more media coverage than usually. Insults, in other words, are a risk to be taken in order to assert the representativeness of an institution. Such conclusion resonates with other parliaments in the world in an age when their representative nature is largely questioned.

  political opponents illustrate this and each called for a clarification from the President of the session. The first excerpt takes place during a debate introducing the Maltese Presidency of the EU Council. Jean-Claude Juncker, known for his frankness, is indignant about the low number of elected representatives who have come to listen to the Maltese Prime Minister J. Muscat. The transcript respects the languages used to indicate that while multilingualism eases verbal tensions, it does not prevent them. In this case, the two speakers alternated between languages during their speeches. Box 3. Excerpts from the plenary debate of 4 July 2017 (Strasbourg) J.-C. Juncker. Monsieur le Président, Monsieur le Premier ministre, le Parlement européen est ridicule, très ridicule. Je salue ceux qui se sont donné la peine de se déplacer ici, mais le fait qu'une trentaine de députés seulement assiste à ce débat démontre à suffisance que le Parlement n'est pas sérieux, et je voulais le dire aujourd'hui. Si M. Muscat était Mme Merkel -difficilement imaginable -ou M. Macron -plus imaginable... 15 We would have a full House. The Parliament is totally ridiculous. President. La prego, signor Presidente, di avere un atteggiamento più rispettoso nei confronti di questo Parlamento. 16 Monsieur le Président, je vous en prie, vous pouvez critiquer le Parlement, mais ce n'est pas la Commission qui doit contrôler le Parlement. C'est le Parlement qui doit contrôler la Commission. 17 J.-C. Juncker. There are only a few Members in the plenary to control the Commission. You are ridiculous! I wanted to pay tribute to the Maltese Presidency [The President interrupted the speaker.] President. Monsieur le Président, je vous en prie, veuillez utiliser un langage différent. Nous ne sommes pas ridicules. Je vous en prie! 18 J.-C. Juncker. I will never again attend a meeting of this kind. The Commission is under the control of the Parliament, but the Parliament has to respect even the presidencies of smaller countries, which Parliament is not doing. In a revealing manner, President A. Tajani dismisses the debate on absenteeism in favour of a reminder of the great constitutional balances of the EU under which the EP can effectively censure the Commission. The last example is the plenary debate in the wake of the Brexit referendum. Here, UKIP MEP N. Farage made triumphant remarks against his colleagues. He was interrupted by protests when he said that MEPs had never really worked in their lives. 19 EP President Martin Schulz then intervened and called for calm, but also, less conventionally, to challenge the claim. Box 4. Plenary speech by Martin Schulz, EP President, 28 June 2016 (Brussels) 20


Sylvain Guilley
email: sylvain.guilley@telecom-paristech.fr

Laurent Sauvage

Jean-Luc Danger

Tarik Graba

Yves Mathieu

Evaluation of Power-Constant Dual-Rail Logic as a Protection of Cryptographic Applications in FPGAs

Keywords: FPGA, security, side-channel attacks, attacks mitigation, power-constant logic, positive dual-rail logic

FPGAs are often considered for high-end applications that require embedded cryptography. These devices must thus be protected against physical attacks. However, unlike ASICs, in which custom and backend-level counter-measures can be devised, FPGAs offer less possibilities for a designer to implement counter-measures. We investigate "wave dynamic differential logic" (WDDL), a logic-level counter-measure based on leakage hiding thanks to balanced dual-rail logic.

First of all, we report a CAD methodology for achieving WDDL in FPGA. An experimental security evaluation of the DES encryption algorithm in WDDL shows that the usage of positive logic is mandatory to resist to straightforward attacks.

Second, we discuss how to reduce the size overhead associated with WDDL. The efficiency of some synthesizers is assessed. In the case of DES, we provide with an original heuristic to obtain substitution boxes smaller than those generated automatically with legacy ASIC synthesizers.

I. INTRODUCTION

Modern cryptographic algorithms have been devised to be implemented efficiently in software. This has been a requirement for the AES [START_REF]Advanced Encryption Standard (AES)[END_REF] candidates, and is still a premium for the SHA-3 [START_REF]Cryptographic hash project[END_REF] contest. However, some applications require a fast execution that software can't always provide. Typically, nomadic mobile devices demand a hardware accelerator to meet the required execution speed with a low power budget. This problematic is now well identified, and has led to a wide field of researches on "lightweight embedded cryptography".

The market for embedded cryptography can be divided into two categories. On the one hand, large volume products, such as commercial identification devices (product/merchandise tracing, credit cards, e-purses or e-money, TPMs, telco SIM cards, pay-TV, transport tickets, customer loyalty programmes) or national infrastructures (passport, identity cards, driving license or healthcare registration), are implemented in smartcards or RFID tags. These devices take advantage of the ASIC technology, which is relevant from an economical point of view. The deployment of such services indeed implies the issuing of millions of electronic devices. Consequently this increases the risk of fraud as product counterfeiting or illegal activities.

On the other hand, low volume secure devices are also needed for specific markets (satellites, critical premises access control, secure login on information systems, watermarking camcorders, IDS, VPN laptop cards, crypto tokens, encrypted hard drives or dongles, IPsec routers), governmental or military (secure terminals, PDAs, network facilities). For these high-end applications, FPGAs are often considered the most suitable choice. Despite a higher unitary cost, FPGAs do not suffer from a high investment (masks preparation and complex manufacturing processes). The FPGAs are readily available COTS and provide a short time-to-market development cycle. In addition, the reconfigurability of FPGAs is an advantage over ASICs: any bug or security vulnerability can, if necessary, be fixed after the products are operationally deployed. This agility is a predominant feature, because these applications are extremely sensitive. They must resist assaults from strong attackers, such as organized mafias or state intelligence services, motivated by large scale fraud or economic/warfare supremacy.

Both cryptographic ASICs and FPGAs must be certified with a high evaluation assurance level, as specified for example by FIPS 140 or the ISO common criteria. These certifications imply that the "target of evaluation" be tamper resistant. An overview of security issues in FPGAs can be found on Saar Drimer's homepage [START_REF] Drimer | Personal web page[END_REF]. Concerning bitstream protections FPGA manufacturers already propose solutions based on embedded bitstream deciphering with a local key storage. An overview is given in [START_REF] Trimberger | Trusted design in FPGAs[END_REF]. For sound trusted computing devices, that are properly architectured with a robust combination of algorithms using a suitable key length, entropic initialization vector (IVs), etc., the most evident threat arises from attacks on the implementation itself. Implementationlevel attacks fall into two categories, depending whether they are active or passive. Active attacks consist in either injecting faults so as to gain information from the device corrupted execution results [START_REF] Giraud | A Survey on Fault Attacks[END_REF]. Usual counter-measures consists in detecting errors, using codes or redundancy. Passive attacks, also called side-channel attacks (SCAs), consist in simply observing the devices' emanations while it is performing a cryptographic operation. Consequently, the device can't know that it's under analysis. The attack consists either in computing a correlation coefficient between the acquired traces and the expected dissipation according to a key hypothesis (e.g. SPA, DPA, CPA, EMA) or in the consultation of a precharacterized database (e.g. template attacks (TA) [START_REF] Agrawal | Templates as Master Keys[END_REF], [START_REF] Archambeau | Template Attacks in Principal Subspaces[END_REF], [START_REF] Chari | Template Attacks[END_REF]). Common counter-measures against observation attacks consist in randomizing the execution, using clock jitter, dummy or decoy clock cycles, or in blinding intermediate data words. The goal is to make an statistical treatment irrelevant. Another customary technique consists in balancing the circuit's activity, so as to make any dissipation data-independent. This approach alleviates the need for an high quality randomness source, but in return demands a strong effort in the balancing process.

Many protections against active and passive attacks have been proposed for ASICs. The logical-level countermeasures can be ported as such on FPGAs, since FPGAs are just a reconfigurable ASICs. On the other hand, backend-level countermeasures are more difficult to adapt to FPGAs, because the cells layout and the routing resources are hardwired. Indeed, some FPGA families have been strengthened for remaining functional in harsh environments, such as space, nuclear plants, or radiative medical apparati. They are particularly robust against Single Even Upset (SEU) and/or signal integrity at the I/O interfaces. Protections against active attacks can take advantages of robust FPGAs strategies at RTL level like register triplication or by using sensors to detect an abnormal event. But concerning passive attacks FPGAs aren't intrinsically immune. It seems on the contrary that FPGAs have a propension of leaking much information [START_REF] Franc ¸ois-Xavier | Power Analysis of an FPGA Implementation of Rijndael: Is Pipelining a DPA Countermeasure? In CHES[END_REF]. As compared to regular ASICs, the interconnection network is extremely dissipative, because it consists of active switches and long distances between logic cells.

We study in this paper a power consumption balancing strategy called "wave dynamic differential logic" (WDDL [START_REF] Tiri | A Logic Level Design Methodology for a Secure DPA Resistant ASIC or FPGA Implementation[END_REF]) that is well suited for FPGAs. Its principle is to duplicate the netlist into a true and a false part, that share the same topology (interconnection graph). The graph is devised such that if any gate of one network switches, then the sibling gate of the dual network does not, and vice-versa. This way, from a macroscopic standpoint, the activity of the circuit is constant. This is at least true at the logical level, i.e. at the first order.

The rest of the paper is organized as follows: Section II details the methodology used to achieve a WDDL netlist, and gives some indications on the overhead caused by switching from insecure to secure netlists. Then we report in section III experimental security improvements reached by two types of WDDL netlists (non-positive and positive) over an unprotected reference. The section IV analyzes the performance of some synthesizers in mapping into logical gates the most complicated parts of a cryptographic algorithm, namely the substitution boxes. Finally, the section V concludes on the efficiency and the cost of protecting FPGAs against SCAs using a power-constant strategy and provides some suggestions for improvements.

II. FITTING WDDL INTO FPGAS

A. State-of-the-Art about Dual-Rail Logic in FPGAs

Kris Tiri reports in [START_REF] Tiri | A Logic Level Design Methodology for a Secure DPA Resistant ASIC or FPGA Implementation[END_REF]- [START_REF] Tiri | Synthesis of Secure FPGA Implementations[END_REF] implementation methods for WDDL in FPGAs. Other types of logic use also differential logic like MDPL which is a masked logic introduced in [START_REF] Popp | Masked Dual Rail Pre-Charge Logic: DPA Resistance without Routing Constraints[END_REF]. Despite the great advantages provided by differential logic like WDDL or MDPL, it has been proved in [START_REF] Popp | Evaluation of the Masked Logic Style MDPL on a Prototype Chip[END_REF], [START_REF] Suzuki | Security Evaluation of DPA Countermeasures Using Dual-Rail Precharge Logic Style[END_REF] that this logic type has still little imbalance due to early evaluation or technological bias. However no successful attacks based on differential logic on FPGAs has been reported so far. Secured designs in FPGAs based on masked logic are also described by Franc ¸ois-Xavier Standaert in [START_REF] Franc ¸ois-Xavier | FPGA Implementations of the DES and Triple-DES Masked Against Power Analysis Attacks[END_REF].

The seminal publication [START_REF] Tiri | A Logic Level Design Methodology for a Secure DPA Resistant ASIC or FPGA Implementation[END_REF] suffers a large area overhead due to the restriction to the minimal library consisting of only {INV, AND, OR} (3 gates). In [START_REF] Tiri | Synthesis of Secure FPGA Implementations[END_REF], a clustering method allows to use all AND-OR combinations (166 gates in LuT4 FPGAs). The method is shown to be automatable thanks to an ASIC synthesizer in [START_REF] Tiri | Secure Logic Synthesis[END_REF].

WDDL in FPGAs has already been studied by Pengyuan Yu. Separated Dynamic Dual-Rail Logic (SDDL), described in [START_REF] Yu | Implementation of DPA-Resistant Circuit for FPGA[END_REF], is shown experimentally to fail because of glitches caused by a race between a global signal (precharge) and local signals (differential data pairs). Double WDDL (DWDDL) introduced in [START_REF] Yu | Implementation of DPA-Resistant Circuit for FPGA[END_REF] is definitely secure. It is the first designagnostic method to obtain secure implementations in FPGA from both a logical and physical point of views. The only "industrial acceptance" issue about DWDDL is that it quadruples at least the implementation area.

The DWDDL remains nevertheless weak because the functional design and the complementary one are far one from each other. One previous paper [START_REF] Quisquater | ElectroMagnetic Analysis (EMA): Measures and Counter-Measures for Smard Cards[END_REF] shows that an integrated antenna of about 40 µm extension can measure EM emanations selectively. Such an accuracy probably allows to separate the radiations of the functional from the fake complementary alter ego WDDL module.

In the rest of this section, we present a case-study on the DES [START_REF]Data Encryption Standard[END_REF] cryptographic algorithm. As such, DES is no longer suitable for block encryption, because its keylength of 56 bit is too short [START_REF] Rouvroy | Efficient Use of FPGAs for Implementations of DES and Its Experimental Linear Cryptanalysis[END_REF]. Massively parallel or networked machines can indeed exhaust the 2 56 keys in a few days. This certainly compromises DES ciphertexts, and definitely ruins any hope of forward secrecy. AES [START_REF]Advanced Encryption Standard (AES)[END_REF] is the successor of DES with a key length at least equal to 128 bit. However, when DES is used as DESX (the standard DES is sandwitched between an input and an output Vernam masking of the plain-and ciphertext), or as triple DES (as described in appendix 2 of [START_REF]Data Encryption Standard[END_REF]), it is perfectly secure. It has been selected, amongst others, for the international passport and is still used in banking applications for instance. The main appeal of DES lays in its compactness when implemented in hardware. We have therefore used a fully-fledged DES (achieving simple and triple DES, with all specified modes of operations), whose architecture is described in [START_REF] Guilley | A Fast Pipelined Multi-Mode DES Architecture Operating in IP Representation[END_REF]. As detailed later on in Sec. III, we managed to fit several DES instances in a single FPGA.

Our goal is to evaluate WDDL (positive or not) on a real embedded cryptographic application. We emphasize that the results presented in this paper are the first experimental implementations and attacks on a full-featured cryptographic system-on-chip equipped with a DES processor protected by WDDL. To be exact, we present WDDL and WDDL+ experimental results at the logical level only. The backend has been delegated without constraints automatic "partition, placeand-route" tools. However, given the symmetry of WDDL and WDDL+ netlist, we assume that backend implementation does not drastically deteriorates the logical symmetry between the dual networks. Albeit intuitive, this hypothesis is nonetheless to be verified on more accurate setups. Our experience, detailed in the sequel, is that the most secure power-constant logic (WDDL+) is already fairly strong against straightforward attacks, without any supplementary backend-level intervention.

B. Design Secure Partitioning

In DES, the control is independent of the data. Whatever the key or the plaintext, the algorithm consists in sixteen consecutive rounds. It is thus only required to secure the datapath (made up of the message and the key paths). The control part is never attacked because it conveys no useful information.

Therefore, the datapath is implemented in WDDL, whereas the control remain regular. The source code of the cryptographic engine can be written in an HDL language in behavioral (aka RTL) style. Only the ad hoc converters, that ensure the transcoding between single and dual-rail logic blocks, are described in a structural style.

C. Synthesis in WDDL

On the one hand, the non-secure blocks, typically the control of DES, can be synthesized with the toolchain that comes with FPGAs (Altera quartus or Xilinx ise). Alternatively, generic synthesizers, such as precision by Mentor Graphics or Synplify Pro by Synplicity, can be fair FPGA vendor independent substitutes.

On the other hand, secure blocks must pass through a more specific synthesis process. Power-constant dual-rail logic, as the DES data-and key-path, must be synthesized carefully. We base our WDDL design on the following dualization of a look-up-table (LuT) f : the dual gate g of f satisfies:

g(x) . = f (x) . (1)
This corresponds to a 0x0 spacer for the netlist precharge. For the spacer to propagate, LuTs must satisfy the wave condition:

LuT(000

• • • 0) = 0 and LuT(111 • • • 1) = 1 . (2)
For the sake of example, we illustrate how Eq. ( 1) applies on Altera low-end FPGAs. The encoding for the Altera Stratix 4 → 1 LuTs is given in Tab. I for some representative gates.

Therefore, the dual of a LuT4 gate, such as the one described in Fig. 1, is obtained by replacing the look-up-table configuration mask: Now, the wave propagation constraint (2) further implies that not all gates are suitable for WDDL implementations. Indeed, amongst the 2 2 n gates (n bit → 1 bit), only one quarter (i.e. 2 2 n -2 ) is suitable for WDDL. The synthesis is thus less efficient than with a complete library. This issue is further discussed in Sec. IV. Now, to reduce the available gates, we need to find a way to constraint the synthesizer to use only some specified cells. This possibility exists only for ASIC synthesizers. Due to their internal heuristics, these tools require at least:

OR4 AND4 MUX2 MUX2N a + b + c + d a • b • c • d a • d + b • d a • d + b • d d c b a FFFE 8000 CCAA AACC 0 0 0 0 0 E 0 0 0 A 0 C 0 0 0 1 1 0 1 0 0 0 1 0 1 0 0 1 0 0 1 1 1 0 1 1 0 1 0 0 1 F 0 0 0 A 0 C 0 1 0 1 1 0 1 0 0 1 1 0 1 0 0 1 0 1 1 1 1 0 1 1 1 0 0 0 1 F 0 0 0 C 0 A 1 0 0 1 1 0 0 1 1 0 1 0 1 0 1 0 1 0 1 1 1 0 1 1 1 1 0 0 1 F 0 8 0 C 0 A 1 1 0 1 1 0 0 1 1 1 1 0 1 0 1 0 1 1 1 1 1 1 1 1 // One OR4
• one flip-flop (DFF -named fpga_fdr),

• one invertor (IV -named fpga_iv) and • one two-input gate (say AN2 -named fpga_an2). A typical duplication for a WDDL DES datapath netlist is illustrated in Tab. II. Regular 4 → 1 LuTs are named fpga_lut4.

D. Synthesis in WDDL or in "Positive" WDDL (aka WDDL+)

The property (2) is not enough to ensure the confidentiality of the data. The design must also be free of any glitch. As a consequence, every tabulated function must be positive. Otherwise, glitches can show up. As glitches are data-dependent, . The first function is a counter-example taken by Kris Tiri in the figure 8 of [START_REF] Tiri | Synthesis of Secure FPGA Implementations[END_REF]. This gate propagates the (0, 0, 0) spacer but not (1, 1, 1) and therefore does not respect condition [START_REF] Akishita | A Practical DPA Countermeasure with BDD Architecture[END_REF]. The second gate is WDDL-compliant since it does propagate the two spacers, but it still glitches.

If the function f is the true part of a WDDL pair of gates, then Fig. 2 represents the transition from the precharge state to the value (a, b, c) = (1, 1, 1). The functions f glitch iff their input a toggles before their input b or c, which introduces a data-dependent syndrome. Put differently, a DPL is no longer "power-constant" in the presence of glitches.

E. Overhead Incurred by WDDL Netlist Styles

We studied the performance of the WDDL and WDDL+ DES modules. All the DES modules share the same 8-bit VCI interface with an addressing range of 8 bits. They all embed 2,048 memory bits (a 256 bytes RAM); their area and maximal frequency is given in Tab. III. The throughput is computed in simple DES-ECB with 56-bit key and in triple-DES-OCB with 112-bit key modes of operation. To simplify the estimation, we assume that the memory is infinite, and thus neglect the initial latency caused by the loading of the key and the final latency associated with the last block saving in RAM. The encryption of one block lasts 16 clock cycles for the single-ended DES module, but 2 × 16 for the dual-rail modules.

III. EXPERIMENTAL EVALUATION OF WDDL SECURITY

A. State-of-the-Art about Attacks on FPGAs

The first attack on an FPGA (a handmade Xilinx Virtex 800 board) is reported in 2003 [START_REF] Berna Örs | Power-Analysis Attacks on an FPGA: First Experimental Results[END_REF]. The impact of the RTL architecture on the leakage is studied next year [START_REF] Franc ¸ois-Xavier | Power Analysis of an FPGA Implementation of Rijndael: Is Pipelining a DPA Countermeasure? In CHES[END_REF]. Some improvements, made possible by signal pre-processing (such as filtering and averaging), are presented in [START_REF] Standaert | Updates on the Security of FPGAs Against Power Analysis Attacks[END_REF]. The overall conclusion of these studies is that unprotected implementations of FPGAs are vulnerable to side-channel attacks, even if their dissipation process is different from that of ASICs. Some acquisition improvements have been done in 2007 [START_REF] Mulder | Differential power and electromagnetic attacks on a FPGA implementation of elliptic curve cryptosystems[END_REF]. On independent acquisition banks, an attack on AES programmed in an Altera Cyclone, is implemented successfully by exploiting EMA signals [START_REF] Carlier | Generalizing Square Attack using Side-Channels of an AES Implementation on an FPGA[END_REF]. The first attack on a complete systemon-chip embedding a cryptoprocessor is reported in [START_REF] Chaudhuri | Physical Design of FPGA Interconnect to Prevent Information Leakage[END_REF]. This study shows that even small cryptographic applications are at risk in FPGAs.

B. Evaluation Methodology

We have embedded a secured DES processor into the SecMat [START_REF]Circuits Multi-Projets[END_REF] system-on-chip (Soc). This setup represents a realistic usage of FPGAs as security devices. Additionally, the SoC was equipped with an unprotected DES processor, to serve as a reference.

C. Evaluation Board and its Customization

We chose a Parallax board, for its simplicity, and also because it can accommodate the whole SecMat SoC along with the DES co-processors. We illustrate the synthesis on the example of Altera, but the principle could be applied as well to any other tool that can read a structural netlist. The board is shown in Fig. 3. On the bottom left corner we can notice the small power shunt circuitry based on a coil-resistor impedance. The advantage of this device is that no coupling capacitors have to be removed and it allows to grab transient currents with enough sensitivity. This small intrusion allows to perform acquisitions with a differential probe at each side of the coil. The figure 4 shows a zoom on the "power drop" measurement ancillary printed circuit board (PCB).

D. Attacks on Experimental Power Traces

We attack the regular module with the Hamming distance model. This model corresponds to the CMOS power dissipation which is produced by a signal transition. The attack of the WDDL circuit considers the Hamming weight model which indicates that the dissipation corresponds to the signal level and not the transition. This is due to the fact that the Hamming distance between the precharge state (full zeroes) and the evaluation state degenerates into a Hamming weight. Two correlation power attacks, Differential Power Analysis (DPA) and Correlation Power Attack (CPA), as described in [START_REF] Guilley | Improving Side-Channel Attacks by Exploiting Substitution Boxes Properties[END_REF], are performed. A first acquisition campaign of 67,753 traces corresponding to the reference DES coprocessor activity, was performed. This module has been completely broken, as shown in Table IV, by attacking during either the first round or the last round of DES. Table IV shows the maximal correlation (for DPA) or covariance (for CPA) levels to get a reference to compared with the levels of the WDDL protected DES. The SNR indicator illustrates the ratio between the level obtained with the right key and those from the strongest wrong key. The CPA traces for every sbox are shown in Fig. 5. Similar attacks are led on protected DES modules. In a view to enhance the attacker's strength, we focused the acquisitions (cadenced at 20 Gsamples/s) around the first round of DES. Three sboxes of the non-positive WDDL module are recovered (see Tab. V). The correlation levels and the SNR of the attacks are far below those obtained with the regular DES. The CPA is more efficient than the DPA because the correlation is normalized and allows to recover the signal in a noisier environment. Only one of the WDDL+ sboxes is broken after 123,743 traces (see Tab. VI). The positive logic used in WDDL+ to remove the glitches provides then a greater robustness. However the fact one sbox can be broken shows that the countermeasure is not fully efficient and more sboxes could be broken by enhancing the acquisition platform sensitivity or the attack algorithm.

IV. SYNTHESIS OPTIMIZATION OF WDDL+ NETLISTS

A. Synthesis with Legacy Tools

Some substitution boxes are synthesized with various synthesizers. For DES and Kasumi (Feistel ciphers), the sboxes are given according to the standard. For AES (substitutionpermutation network), the sbox and its inverse are studied.

The RTL description is tabulated. We chose this solution to avoid any segregation between the sboxes based on their internal structure. More compact netlist could be obtained with description that takes advantage of the mathematical description of the sboxes of Kasumi or AES. The results are listed in Tab. VII for the Stratix using quartus version 7.1. Similar results for the Virtex-II using ise 9.2i are reported in Tab. VIII. The performance of bgx_shell (64-bit version v05.15-s095+1) is assessed in Tab. IX. The ASIC synthesizer rc (64-bit version v06.10-s017 1) is not as good as bgx_shell, as shown in Tab. X. The results obtained with ASIC synthesizers read as follows:

• The library "plain" contains all the 2 2 n cells: it is meant to provide a lower-bound for the area.

• The library "WDDL" contains all the 2 2 n -2 cells that satisfy [START_REF] Akishita | A Practical DPA Countermeasure with BDD Architecture[END_REF]. After synthesis, the inverters are removed, and the number of remaining gates is doubled.

• The library "WDDL positive" (WDDL+) contains the positive cells that, in addition, propagate 0 and 1, as per [START_REF] Akishita | A Practical DPA Countermeasure with BDD Architecture[END_REF]. The number of these functions is equal to the Dedekind numbers M (n) [START_REF] Neil | The On-Line Encyclopedia of Integer Sequences[END_REF] minus two (the two constant functions zero and one). Although Dedekind first considered this question in 1897, there is still no concise closed-form expression for M (n). There are 4 (resp. The ASIC synthesizers are tuned to spend the maximal effort on the area optimization. The synthesis TCL command for bgx_shell is given in Tab. XI and for rc in Tab. XII.

B. A Novel Heuristic to Compact DES WDDL+ Sboxes

We present a heuristic for achieving a better synthesis for 6 → 4 substitution boxes, such as that of DES. The goal is to reach a compact netlist in LuT4, restricted to WDDL+ gates. The heuristic consists in:

1) using a decoder for the two most significant bits (MSB) (a [START_REF] Chari | Template Attacks[END_REF], a [START_REF] Carlier | Generalizing Square Attack using Side-Channels of an AES Implementation on an FPGA[END_REF]) and in 2) keeping a multiplexor-tree architecture for the remaining least significant bits (LSB) (a [START_REF] Archambeau | Template Attacks in Principal Subspaces[END_REF], a [START_REF] Akishita | A Practical DPA Countermeasure with BDD Architecture[END_REF], a [START_REF] Agrawal | Templates as Master Keys[END_REF], a[0]). The head part consists in all the possible two-input functions. They are synthesized in LuT4, fed by (a t [START_REF] Chari | Template Attacks[END_REF], a t [START_REF] Carlier | Generalizing Square Attack using Side-Channels of an AES Implementation on an FPGA[END_REF]) and (a f [START_REF] Chari | Template Attacks[END_REF], a f [START_REF] Carlier | Generalizing Square Attack using Side-Channels of an AES Implementation on an FPGA[END_REF]). There are 16 of them, amongst which 6 are trivial: the constants 0 and 1, the identities a[5] = a t [START_REF] Chari | Template Attacks[END_REF] and a[4] = a t [START_REF] Carlier | Generalizing Square Attack using Side-Channels of an AES Implementation on an FPGA[END_REF] and the inverses a[5] = a f [START_REF] Chari | Template Attacks[END_REF] and a[4] = a f [START_REF] Carlier | Generalizing Square Attack using Side-Channels of an AES Implementation on an FPGA[END_REF]. Hence only 10 2-input gates lead to non-trivial LuT4s instances. All these 10 LuTs are instantiated, and shared between the 4 output bits tail logic.

The tail part consists in 2 multiplexor trees (one true and one false) of 16 inputs and 4 inputs. This tree can be synthesized with 2 × 4 × (8 + 4 + 2 + 1) = 120 two-input multiplexors. Now, multiplexors as such are not positive. However, a twoinput multiplexor can be implemented in positive logic if the selection signal is available both plain and inverted. This is actually the case, because the selection s is a[i], i ∈ [3 : 0], and that both a t [i] and f [i] are available. The multiplexing of inputs a and b with s, resulting in y . = a • s + b • s, fits into a single positive LuT4 as: y t = a t • s f + b t • s t (the four inputs are s f , s t , a t and a f ).

The overall construction requires 120 + 10 = 130 positive LuT4s. This figure, albeit close to that obtained by the bgx_shell and rc synthesizers, is better for all the eight DES sboxes (refer to the last line of Tab. IX and X). Moreover, it is likely that using some peculiarities of the 6 → 4 sboxes, the 130 LuT4s score can be improved. For instance, it might happen that some inputs of the tail 4-input multiplexor-tree be constant, or that some resources can be shared between the true or false dual networks.

In any case, we conclude that using ASIC synthesizers for generating positive logic is relevant, but that some optimizations are possible. As a perspective, we emphasize that there is a room for custom WDDL+ synthesizers or for enriching legacy synthesis tools with new heuristics when the mapping library is recognized as positive.

Finally, we note that the AES direct substitution box (SubBytes) is synthesized in respectively 758 and 792 LuT4s by respectively bgx_shell and rc. Once again, those figures are worse than hand-made syntheses, such as the ones presented in the dual-rail BDD optimized netlist [START_REF] Akishita | A Practical DPA Countermeasure with BDD Architecture[END_REF].

C. Comparison between bgx_shell and rc

As already shown in Tab. X and IX, bgx_shell is better than rc to synthesize substitution boxes. However, when it comes to simple blocks (everything but the sboxes), rc appears to produce more compact netlists than bgx_shell. For instance, a two-input XOR or a two-input multiplexor is synthesized in 4 LuT4 by bgx_shell, but in 2 LuT4 by rc. The solution found by rc is optimal. The XOR is mapped as the positive function f (a t , a f , b t , b f ) . = a t • b f + a f • b t , while the multiplexor is inferred as f (s t , s f , a t , b t ) . = a t • s f + b t • s t . Therefore, the area reported in Tab. III could be decreased, by using bgx_shell for the sboxes an rc for the rest.

V. CONCLUSION

The usage of power-constant logic styles to impede the power attacks in FPGA has been shown experimentally. Incidentally, we report the first attack against a non-positive WDDL DES co-processor implemented in an FPGA. The attack takes place by means of very little intrusive acquisition circuitry and by using DPA or CPA strategies. The positive WDDL version proves to be more secure than its non-positive counterpart. However the slight imbalance of this robust logic type should be detectable with a more sensitive acquisition platform. A custom tool based on both FPGAs and ASICs logic synthesizers has been build to get non-positive and positive WDDL netlists. The estimation of overhead is about a factor 2. But by using home-made heuristics, the area bloat can be reduced. We report a constructive method to generate 6 → 4 sboxes in a more compact way than ASIC synthesizers. We therefore expect a new market for secured synthesizers to appear.

•

  lut_mask="FFFE"; / * [OR4] Direct * / by • lut_mask="8000"; / * [AND4] Dual * /.

  not WDDL-compliant, since (2) is violated):LuT3 #2 (WDDL-compliant, since (2) is satisfied):

Fig. 2 .

 2 Fig. 2. Glitches in two non-positive gates.

Fig. 3 .

 3 Fig. 3. Board used to acquire side-channel information on the Stratix FPGA.

Fig. 4 .

 4 Fig. 4. Customization of the commercial board shown in Fig. 3 for better power measurement.

Fig. 5 .

 5 Fig. 5. Covariance factors obtained for the correct key hypothesis when attacking the first round of the reference DES module eight sboxes.

TABLE I LUT

 I MASKS ENCODING FOR ALTERA STRATIX FPGAS.

TABLE II DUPLICATION

 II OF A SENSITIVE WDDL NETLIST (DES DATAPATH).

	Resource	Single-ended	Duplication (see (1))	WDDL
	fpga_fdr	184	→ ×4 →	736
	fpga_iv	240	→ ×0 →	0
	fpga_an2	202	→ ×2 →	404
	fpga_lut4	1499	→ ×2 →	2998
	fpga_ *	2125		4138

TABLE III PERFORMANCES

 III OF THE REGULAR AND THE TWO DUAL-RAIL DES MODULES SYNTHESIZED BY CADENCE B G X_S H E L L .

	Implementation Single-ended DES WDDL DES WDDL+ DES
	Area	1,248 LEs	4,736 LEs	6,038 LEs
	Max. Frequency	74.95 MHz	68.65 MHz	55.85 MHz
	DES-ECB speed	300 Mbit/s	137 Mbit/s	111 Mbit/s
	3DES-OCB speed	99 Mbit/s	45 Mbit/s	37 Mbit/s

  ZOOMED ON THE FIRST ENCRYPTION ROUND) OF THE WDDL DES MODULE (NON-POSITIVE).

							TABLE IV
				ATTACK OF THE REGULAR DES MODULE.
			(a) Number of measurements to disclose (MTD) the key
	Analysis	\ Sbox #	S1		S2	S3	S4	S5		S6	S7	S8
	DPA on the first round	9,877	3,065 7,983 10,473 7,216 11,103 7,678	2,257
	DPA on the last round	11,540 4,150 4,861	6,031	4,580	2,881	4,539 19,743
	CPA on the first round	7,480	3,079 7,252	9,605	6,546 11,079 5,442	2,095
	CPA on the last round	11,804 3,408 4,880	6,027	3,433	2,874	3,994 19,988
			(b) Maximal correlation in µV (DPA) / covariance in % (CPA) factors
	Analysis	\ Sbox #	S1		S2	S3	S4	S5		S6	S7	S8
	DPA on the first round	46		51	48	39	44		37	37	66
	DPA on the last round	36		64	44	60	48		55	59	33
	CPA on the first round	5.58		6.23	5.84	4.78	5.42	4.47	4.58	8.23
	CPA on the last round	4.44		7.86	5.48	7.42	6.03	6.70	7.37	4.02
						(c) Maximal SNR
	Analysis	\ Sbox #	S1		S2	S3	S4	S5		S6	S7	S8
	DPA on the first round	6.23		6.41	6.34	6.76	6.37	5.29	4.56	8.07
	DPA on the last round	7.90		6.50	5.02	6.75	5.69	6.18	4.04	6.60
	CPA on the first round	6.22		6.41	6.23	7.03	6.37	5.29	4.57	8.08
	CPA on the last round	7.90		6.48	5.03	6.75	5.70	6.22	4.04	6.00
							TABLE V
	ATTACK ((a) Number of measurements to disclose (MTD) the key
	Analysis		\ Sbox #	S1	S2	S3	S4	S5	S6	S7	S8
	DPA on the first round	-	-	-	224,018	-	-	-	-
	CPA on the first round	99,943	-	193,028	73,524	-	-	-	-
			(b) Maximal correlation in µV (DPA) / covariance in % (CPA) factors
	Analysis		\ Sbox #	S1	S2	S3	S4	S5	S6	S7	S8
	DPA on the first round	17	19	12	4		11	18	12	12
	CPA on the first round	0.72	1.23	0.56	0.34	1.34 0.79 0.47	1.32
						(c) Maximal SNR
	Analysis		\ Sbox #	S1	S2	S3	S4	S5	S6	S7	S8
	DPA on the first round	2.66	2.67	2.49	3.94	3.40 2.56 3.73	2.97
	CPA on the first round	3.19	3.83	3.35	4.04	2.74 2.49 3.14	3.81
							TABLE VI
	ATTACK (ZOOMED ON THE FIRST ENCRYPTION ROUND) OF THE WDDL+ DES MODULE (POSITIVE).
			(a) Number of measurements to disclose (MTD) the key
	Analysis	\ Sbox #	S1	S2	S3	S4	S5		S6	S7	S8
	DPA on the first round	-	-	-	-	123,743	-	-	-
	CPA on the first round	-	-	-	-	-		-	-	-
			(b) Maximal correlation in µV (DPA) / covariance in % (CPA) factors
	Analysis	\ Sbox #	S1	S2	S3	S4	S5		S6	S7	S8
	DPA on the first round	13	12	11	13	11		12	12	13
	CPA on the first round	1.43 1.44 1.27 1.40	1.40		0.59	0.74 1.50
						(c) Maximal SNR
	Analysis	\ Sbox #	S1	S2	S3	S4	S5		S6	S7	S8
	DPA on the first round	3.46 4.97 3.62 3.85	3.59		2.53	3.44 3.32
	CPA on the first round	3.16 4.22 3.20 4.72	3.07		3.42	3.53 3.32

TABLE VII VARIOUS

 VII SUBSTITUTION BOXES AREA IN STRATIX ALTERA FPGA.

TABLE VIII VARIOUS

 VIII SUBSTITUTION BOXES AREA IN VIRTEX-II XILINX FPGA.

	Single	DES	Kasumi	AES
	-ended S1 S2 S3 S4 S5 S6 S7 S8 S7 S9	S S -1
	LuT4 15 12 18 10 15 15 12 15 71 132 131 131
	Slices 8 6 9 5 8 8 6 8 35 71	66 66
	Tiri [27] 14 15 14 8 13 15 15 13 30 32 174 -

TABLE XI SYNTHESIS

 XI SCRIPT FOR THE ASIC SYNTHESIZER B G X_S H E L L .

	do_optimize -flatten on -effort high \
	-priority area -max_area 0;

TABLE XII SYNTHESIS

 XII SCRIPT FOR THE ASIC SYNTHESIZER R C .

	synthesize -to_mapped -csa_effort high -eff high;
	remap -start 9 -end 11 $top_level;
	synthesize -to_mapped -eff high -incr;

Library


Camille Mougin

Eléonore Boyer

Mathilde Chataigner

Marion Guibourdenche

Boris Nicolas

Aurélie Berlin

Melissa Tran

Xavier Cnockaert

Corinne Zinetti

Fayçal Loumi

Flore Depeint

Hassan Younes

Dénutrition en EHPAD : les facteurs d'influence dans l'hôpital de Crèvecoeur-le-Grand

teaching and research institutions in France or abroad, or from public or private research centers.

INTRODUCTION

• 470 000 à 700 000 personnes âgés dénutris en France Axe de prévention majeur Une étude à plus grande échelle sur plusieurs établissements serait nécessaire afin de conforter ces résultats.

•
Actions: des ateliers de promotion de la santé ont été mis en place auprès de personnes âgées en EHPAD. Ceux-ci ont pour objectif la lutte contre la dénutrition à long terme. Des ateliers sur l'équilibre alimentaire, l'hydratation ou encore sur des notions de nutrition ont été réalisés.

  Etat des lieux en Picardie de la prévalence de la dénutrition dans les hôpitaux de Beauvais et Crèvecoeurle-Grand (9 EHPAD) Variabilité de 33 à 55% de dénutrition 1 Objectif : Identifier les différents facteurs influençant la prévalence de la dénutrition en EHPAD  Mise en place d'une étude observationnelle sur un établissement de référence CONCLUSIONS ET PERSPECTIVES L'étude d'observation sur une EHPAD de Crèvecoeur-le-Grand nous a permis d'identifier deux facteurs de risque et deux facteurs de prise en charge de la dénutrition des personnes âgées. D'autres variables, indépendantes des résidents, peuvent entrer en jeu telles que la préparation des repas ou encore la conservation et le transport des aliments.

  [1] POTIER G., 2015. Etude préliminaire de la prévalence de la dénutrition au niveau des EHPAD des hôpitaux de Beauvais et de Crèvecoeur-le-Grand ainsi que des différentes stratégies de prise en charge. Rapport de stage UniLaSalle. 73 p Iso-Ressource, HPHC : Hyperprotéiné Hypercalorique, CNO : Compléments nutritionnels Oraux Résultat 1: Description de la population  L'étude comparative n'a pas montré de différences significatives pour le sexe et l'âge des résidents. Cependant, il existe une différence significative pour l'IMC entre les deux groupes. Les résidents dénutris ont un IMC plus bas que les résidents non dénutris. Résultat 2: Identification de 4 variables explicatives  A partir des 11 items du cahier d'observation, l'analyse des corrélations a permis l'identification de 4 variables explicatives associées significativement à la dénutrition.  Ces variables caractérisent à la fois des facteurs de risque et des éléments de prise en charge de la dénutrition (préventif ou curatif) HYPOTHÈSES L'analyse des résultats a permis d'émettre les hypothèses suivantes :