Awaleh Houssein Meraneh

Christophe Clavier

Hélène Le Bouder

Julien Maillard

Gaël Thomas

Gaël Thomas Blind

Side Channel

Awaleh Houssein Meraneh

Blind Side Channel On The Elephant LFSR

Keywords: Blind Side Channel Analysis, Hamming Weight, Elephant, LFSR, NIST

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Internet of things (IoT) devices become more and more widespread within our day-to-day life. From military grade to general purpose hardware, the need for strong security raises. The cryptosystems implemented on those devices must ensure both security and low power consumption overhead. In this context, the National Institute of Standards and Technology (NIST) started the competition for lightweight cryptography candidates for authenticated encryption (NIST, 2018). An authenticated encryption algorithm should ensure confidentiality and integrity of the communications.

The security of authenticated encryption schemes can be supported by several strategies. Various approaches have been considered by the lightweight cryptography competition candidates:

• cryptographic permutation with sponge or duplex construction [START_REF] Daemen | Xoodyak, a lightweight cryptographic scheme[END_REF][START_REF] Beierle | Schwaemm and esch: lightweight authenticated encryption and hashing using the sparkle permutation family[END_REF][START_REF] Daemen | Xoodyak, a lightweight cryptographic scheme[END_REF],

• block cipher combined with a mode (e.g. AES combined with Galois/Counter Mode) [START_REF] Iwata | Duel of the titans: the romulus and remus families of lightweight aead algorithms[END_REF][START_REF] Beyne | Elephant v2. NIST lightweight competition[END_REF],

• stream cipher paradigms [START_REF] Hell | Grain-128aead, round 3 tweak and motivation[END_REF].

When discussing about the security of a cryptographic algorithm, numerous tools allow the cryptographers to prove the security of a cipher. Unfortunately those tools do not consider the interac-tion of the computing unit with its physical environment. Physical attacks are a real threat, even for cryptographic algorithms proved secure mathematically. Physical attacks are divided in two families: Side-Channel Analysis (SCA) and the fault injection attacks.

Motivations

Many attacks exist on the different traditional cryptographic algorithms, for example on AES [START_REF] Brier | Correlation power analysis with a leakage model[END_REF][START_REF] Giraud | DFA on AES[END_REF]. Lightweight cryptography, much younger and used in embedded devices, has been far less studied. For example, attacks on stream ciphers [START_REF] Rechberger | Stream ciphers and side-channel analysis[END_REF] or sponge functions [START_REF] Samwel | DPA on hardware implementations of ascon and keyak[END_REF] are less common. That is why we chose to study SCA against new authenticated encryptions. The chosen algorithm is the cryptosystem Elephant [START_REF] Beyne | Elephant v2. NIST lightweight competition[END_REF]. More precisely, in this paper, the focus is about using Linear Feedback Shift Registers (LFSR), in a block cipher combined with a mode construction. Some attacks exist yet as in [START_REF] Rechberger | Stream ciphers and side-channel analysis[END_REF][START_REF] Joux | Galois LFSR, Embedded Devices and Side Channel Weaknesses[END_REF][START_REF] Burman | LFSR based stream ciphers are vulnerable to power attacks[END_REF][START_REF] Chakraborty | Fibonacci LFSR vs. galois LFSR: which is more vulnerable to power attacks? In SPACE[END_REF][START_REF] Kazmi | Algebraic side channel attack on trivium and grain ciphers[END_REF][START_REF] Jurecek | Sidechannel attack on the a5/1 stream cipher[END_REF], but the main difference is in model of the attacker. To the best our knowledge, there is no blind side channel attack on LFSR in the context of authenticated encryption. So in this paper, a blind side channel attack targeting the LFSR of the Elephant algorithm, is presented.

Contribution

In this paper, we present the first theoretical blind side channel attack targeting the LFSR of the Elephant algorithm. We exploit the usage of intermediate variables that are statistically dependent to the secret (here the secret LFSR initial state) and show that this structure could eventually threaten the security of a cryptosystem's regarding side-channel analysis.

Also the study of the influence of the choice of the LFSR is presented.

Organisation

The paper is organized as follows. In section 2 the context about blind side channel attack and the Elephant are introduced. The theoretical attack is explained in section 3. Details of implementation attack are described in section 4. The section 5 presents experimental results and discussion about LFSR design. Finally, a conclusion is drawn in 6.

Context

In this section, first Elephant description is presented, then the context of blind SCA is introduced.

Elephant

An authenticated encryption algorithm should ensure confidentiality and integrity. It takes as input different parameters: a plaintext, data associated to the plaintext, a secret key, and an initialisation vector also called a nonce. The nonce is public but must be different for each new plaintext. The algorithm ensures confidentiality of the plaintext and integrity of both the plaintext and the associated data.

Elephant [START_REF] Beyne | Dumbo, Jumbo, and Delirium: Parallel Authenticated Encryption for the Lightweight Circus[END_REF][START_REF] Beyne | Elephant v2. NIST lightweight competition[END_REF] is a nonce-based authenticated encryption with associated data (AEAD) finalists to the NIST lightweight cryptography competition. It is an Encrypt-then-MAC construction that combines CTR-mode encryption with a variant of the protected counter sum [START_REF] Bernstein | How to Stretch Random Functions: The Security of Protected Counter Sums[END_REF][START_REF] Luykx | A MAC Mode for Lightweight Block Ciphers[END_REF].

It uses a cryptographic permutation masked with LFSRs in an Even-Mansour-like fashion [START_REF] Granger | Improved Masking for Tweakable Blockciphers with Applications to Authenticated Encryption[END_REF] in place of a blockcipher.

Let P be an n-bit cryptographic permutation, and ϕ an n-bit LFSR. Let the function mask : {0, 1} 128 × N × {0, 1, 2} → {0, 1} n be defined as follows: Let Split(X) be the function that splits the input X into n-bit blocks, where the last block is zero-padded. Let Trunc t (X) be the t left-most bits of X.

mask i,b K = (ϕ ⊕ id) b • ϕ i • P(K||0 n-128 ) (4) K || 0 * P mask 0,0 K ϕ N || A1 mask 1,0 K ϕ A2 P • • • • • mask -1,0 K • • • • • • A || 10 * P • • ϕ ⊕ id mask 0,1 K N || 0 * P • • • ϕ ⊕ id mask 1,1 K N || 0 * P • • ϕ ⊕ id mask -1,1 K N || 0 * P • • Trunc|M | M C M1 C1 M2 C2 • • • • • • C || 10 * P mask -1,2 K ϕ ⊕ id • P mask 1,2 K ϕ ⊕ id • P mask 0,2 K ϕ ⊕ id • • • • • • • P Trunct T • Figure
Encryption enc under Elephant gets as input a 128-bit key K, a 96-bit nonce N, associated data A ∈ {0, 1} * , and a plaintext M ∈ {0, 1} * . It outputs a ciphertext C as large as M, and a t-bit tag T . The description of enc is given in Algorithm 1 and is depicted on Figure 1.

Decryption dec gets as input a 128-bit key K, a 96-bit nonce N, associated data A ∈ {0, 1} * , a ciphertext C ∈ {0, 1} * , and t-bit tag T . It outputs a plaintext M as large as C if the tag T is correct, or the symbol ⊥ otherwise. The description of dec easily follows from that of enc.

Elephant comes in three flavours which differ on the n-bit cryptographic permutation P and the LFSR ϕ Dumbo :

(x 0 , • • • , x 19 ) → (x 1 , • • • , x 19 , x 0 ≪ 3 ⊕ x 3 ≪ 7 ⊕ x 13 ≫ 7) (1)
ϕ Jumbo : (x 0 , • • • , x 21 ) → (x 1 , • • • , x 21 , x 0 ≪ 1 ⊕ x 3 ≪ 7 ⊕ x 19 ≫ 7) (2) ϕ Delirium : (x 0 , • • • , x 24 ) → (x 1 , • • • , x 24 , x 0 ≪ 1 ⊕ x 2 ≪ 1 ⊕ x 13 ≪ 7) (3)
Algorithm 1 Elephant encryption algorithm enc

Input: (K, N, A, M) ∈ {0, 1} 128 × {0, 1} 96 × {0, 1} * × {0, 1} * Output: (C, T ) ∈ {0, 1} |M| × {0, 1} t 1: M 1 , • • • , M ℓ M ← Split(M) 2: for i ← 1 to ℓ M do 3: C i ← M i ⊕ P(N||0 n-96 ⊕ mask i-1,1 K ) ⊕ mask i-1,1 K 4: end for 5: C ← Trunc |M| (C 1 || • • • ||C ℓ M ) 6: T ← 0 n 7: A 1 , • • • , A ℓ A ← Split(N||A||1) 8: C 1 , • • • ,C ℓ C ← Split(C||1) 9: T ← A 1 10: for i ← 2 to ℓ A do 11: T ← T ⊕ P(A i ⊕ mask i-1,0 K ) ⊕ mask i-1,0 K 12: end for 13: for i ← 1 to ℓ C do 14: T ← T ⊕ P(C i ⊕ mask i-1,2 K ) ⊕ mask i-1,2 K 15: end for 16: T ← P(T ⊕ mask 0,0 K ) ⊕ mask 0,0 K 17: return (C, Trunc t (T ))
ϕ used, as well as the tag size t.

Dumbo uses the 160-bit permutation Spongentπ[160] [START_REF] Bogdanov | Spongent: a Lightweight Hash Function[END_REF], the LFSR ϕ Dumbo given by equation 1 and illustrated on Figure 2, and has tag size t = 64 bits.

Jumbo uses the 176-bit permutation Spongentπ[176] [START_REF] Bogdanov | Spongent: a Lightweight Hash Function[END_REF], the LFSR ϕ Jumbo given by equation 2 and illustrated on Figure 3, and has tag size t = 64 bits.

Delirium uses the 200-bit permutation Keccakf [200] [START_REF] Bertoni | The Keccak Reference[END_REF]NIST, 2015), the LFSR ϕ Delirium given by equation 3 and illustrated on Figure 4, and has tag size t = 128 bits.

The three n-bit LFSRs used for the variants of Elephant are the GF(2)-linear maps given at the bytelevel by the equations ( 1), ( 2) and (3).

Blind side channel analysis

Even if an algorithm has been proven to be mathematically secure, its implementation can open the gate to the so-called physical attacks. (SCA) are a subcategory of physical attacks. They exploit the fact that some physical values of a device depend on intermediate values of the computation. This is the so-called leakage of information of the circuit. It could be used to retrieve secrets, as a secret key.

Different kind of leakage can be exploited as times [START_REF] Handschuh | A timing attack on rc5[END_REF], power consumption or electromagnetic radiations [START_REF] Standaert | Introduction to side-channel attacks[END_REF]. In this paper, the leakage is power consumption. At each instant, the measurement of the intensity of the electric current reflects the activity of the circuit. The power consumption of a device is the sum of the power consumptions of each of its logic gates. An attacker therefore has the possibility of distinguishing a transition from 0 to 1 from a transition from 1 to 0.

A SCA is often leaded with a divide-and-conquer approach. Namely, the secret is divided into small pieces that are analysed independently. Different kind of analysis exist.

The Simple Power Analysis (SPA) [START_REF] Mangard | A simple power-analysis (spa) attack on implementations of the aes key expansion[END_REF] are called simple because they determine directly, from an observation of the power consumption, during a normal execution of an algorithm, information on the calculation performed or the data manipulated.

The family of Correlation Power Analysis (CPA) [START_REF] Kocher | Differential power analysis[END_REF][START_REF] Brier | Correlation power analysis with a leakage model[END_REF][START_REF] Gierlichs | Mutual information analysis[END_REF]) uses a mathematical model for the leakage. A confrontation between measurement and model is performed. More precisely, a statistic tool called distinguisher gives score to the different targets.

Template attacks are statistical categorizations [START_REF] Chari | Template attacks[END_REF]. No mathematical model is required.

The blind side channel analysis family is new improvement in SCA [START_REF] Joux | Galois LFSR, Embedded Devices and Side Channel Weaknesses[END_REF][START_REF] Burman | LFSR based stream ciphers are vulnerable to power attacks[END_REF][START_REF] Chakraborty | Fibonacci LFSR vs. galois LFSR: which is more vulnerable to power attacks? In SPACE[END_REF][START_REF] Linge | Using the joint distributions of a cryptographic function in side channel analysis[END_REF][START_REF] Bouder | A Multi-round Side Channel Attack on AES Using Belief Propagation[END_REF][START_REF] Clavier | Improved blind sidechannel analysis by exploitation of joint distributions of leakages[END_REF]. The main idea is to not use the data as plaintext or ciphertext. Only the leakage is used. The power consumption leakage is very correlated to the Hamming Weight (HW) of the data. So in blind SCA, a strong assumption is make. The attacker can retrieve HW with the leakage. More precisely, the power consumption can be seen as a noisy HW. In this paper, the considered adversary model is that: the HW of bytes can be obtained by an attacker. This model is made feasible by the fact that the attacker can average power traces.

The first theoretical result on SCA on LFSRs are [START_REF] Joux | Galois LFSR, Embedded Devices and Side Channel Weaknesses[END_REF] where the authors leverage the dependence between the leakage and the unique feedback bit of a Galois LFSR. The case of Fibonacci LFSRs where a single new value is computed at each iteration is studied in [START_REF] Burman | LFSR based stream ciphers are vulnerable to power attacks[END_REF]. Finally, both kind of LFSRs are theoretically and practically compared in [START_REF] Chakraborty | Fibonacci LFSR vs. galois LFSR: which is more vulnerable to power attacks? In SPACE[END_REF].

3 Theoretical attack

Goal

LFSRs are used in different lightweight cryptography candidates, and its initial state often depends on both the key and the nonce. As the nonce needs to be changed for each encryption, attacks on such schemes are limited to the decryption algorithm. In the case of Elephant, the LFSR only depends on the secret key, Consequently, our attack can be applied in an encryption scenario.

The goal of the presented attack is to retrieve the LFSR secret initial state. One has to remark three important points.

• Retrieving the initial state of the LFSR which is equal to mask 0,0 K is equivalent to retrieving the secret key. Indeed, the initial state is just the result of the known permutation P applied to the key.

• As the retroaction polynomial is publicly known, it is possible to shift the LFSR backwards: an attacker who knows 20 consecutive bytes of the secret stream is able to recover the initial state.

• The smaller the LFSR is, the more the attack is able to succeed. As a consequence, the Dumbo 2 instance is the most vulnerable instance: the focus is on Dumbo in the following of this paper.

Leakage in the LFSR

In this attack, it is assumed that the Hamming Weight of all bytes of the LFSR can be obtained by an attacker.

Let x be a byte, so x can take 256 values in [[0, 255]]. With the HW of x, the attacker reduces the list of possible values, as shown in Table 1. Since the LFSR generates a single new byte at each iteration, let x 0 , • • • , x 19 be the content of the Dumbo LFSR initialised with mask 0,0 K , and extend the notation for j ≥ 20, by letting x j be the new byte generated at iteration j -20. In other words, the attacker has the following relation (L1).

L1 x j+20 = (x j ≪ 3) ⊕ (x j+3 ≪ 7) ⊕ (x j+13 ≫ 7).
The first idea is to use the knowledge of the following Hamming weights:

HW (x j+20 ), HW (x j ) = HW (x j ≪ 3), HW (x j+3 ) and HW (x j+13 ).

Moreover, one has to remark that: HW (x j ) = HW (x j ≪ 3) .

(5)

So with the two equations (L1) and ( 5) the attacker has:

HW (x j+20 ) =              HW (x j ) HW (x j ) + 1 HW (x j ) -1 HW (x j ) + 2 HW (x j ) -2 (6)
Looking more precisely at equation (L1), it can be seen that the difference HW (x j+20 ) -HW (x j ) depends on only four bits. Letting x j [i] denote the i-th least significant bit of byte x j , these four bits are {x j+3 [0]; x j+13 [7]; x j [4]; x j [5]}. Table 2 gives the value of observed difference HW (x j+20 ) -HW (x j ) depending on the values of these four bits. In the worst case, there are only 6 possibilities left, out of 16.

(x j+3 [0], x j+13 [7]) = HW x j+20 -HW (x j ) (0, 0) (0, 1) (1, 0) (1, 1) (x j [4], x j [5]) = (0, 0) 0 +1 +1 +2 (1, 0) 0 +1 -1 0 (0, 1) 0 -1 +1 0 (1, 1) 0 -1 -1 -2 Table 2: Values of HW x j+20 -HW x j according to {x j+3 [0]; x j+13 [7]; x j [4]; x j [5]} .

Link between the different masks

The value mask i,1 K can be expressed in terms of mask * ,0 K as in (7).

mask i,1 K = (ϕ ⊕ id) mask i,0 K = ϕ mask i,0 K ⊕ mask i,0 K = mask i+1,0 K ⊕ mask i,0 K . (7)
Likewise, for mask i,2 K , equation ( 8) holds.

mask i,2 K = (ϕ ⊕ id) 2 mask i,0 K = (ϕ 2 ⊕ id) mask i,0 K = ϕ 2 mask i,0 K ⊕ mask i,0 K = mask i+2,0 K ⊕ mask i,0 K (8)
As in the case of mask i,0 K , let y j denote either the byte j of mask 0,1 K when 0 ≤ j ≤ 19, or the new byte obtained after j -20 iterations of the LFSR initialised with mask 0,1 K . Likewise, let z j denote either the byte j of mask 0,2 K when 0 ≤ j ≤ 19, or the new byte obtained after j -20 iterations of the LFSR initialised with mask 0,2 K . Equation ( 7) then translates to equation ( 9).

y j = x j ⊕ x j+1 (9)
Likewise, the equation 8 translates to (10).

z j = x j ⊕ x j+2 . ( 10
)
The evolutions of the LFSR are analogous to (L1):

y j+20 = (y j ≪ 3) ⊕ (y j+3 ≪ 7) ⊕ (y j+13 ≫ 7). ( 11
)
z j+20 = (z j ≪ 3) ⊕ (z j+3 ≪ 7) ⊕ (z j+13 ≫ 7). ( 12
)
The attacker can thus exploit two attack vectors: on the one hand, equations (L1), (11), and (12) coming from iterating the LFSR, and on the other hand, equations ( 9) and (10) coming from the different masks used for domain separation.

Attack strategy

The whole search space corresponding to the initial state of the LFSR is represented as a rooted tree. The nodes at depth j correspond to the all possible values for the bytes x 0 to x j of the LFSR. The tested candidates are denoted by

(x ′ 0 , • • • , x ′ 19 ).
The nodes in the graph of the search space are labelled as follows:

• the nodes at depth j correspond to the all possible values of (

x ′ 0 , • • • , x ′ j ); • the children of node (x ′ 0 , • • • , x ′ j ), are the nodes la- belled: (x ′ 0 , • • • , x ′ j , x ′ j+1
) for all values of x ′ j+1 . In practice, to reduce the number of nodes, only the nodes having the correct Hamming weights are considered. In other words, it suffices to consider nodes with HW (x ′ j ) = HW (x j ). An example of such

x 0 = 03 . . .

x 0 = 03 x 1 = 2F x 0 = 03 x 1 = 1F
. . .

x 0 = 03 x 1 = F8 x 0 = 03 x 1 = 2F x 2 = 17 x 0 = 03 x 1 = 2F x 2 = 0F
. . .

x 0 = 03 x 1 = 2F x 2 = F0 x 0 = 03 x 1 = 1F x 2 = F0
. . .

x 0 = 03 x 1 = 1F x 2 = 17 x 0 = 03 x 1 = 1F x 2 = 0F
. . .

x 0 = 03 x 1 = F8 x 2 = 0F x 0 = 03 x 1 = F8 x 2 = 17
. . . tree is given on Figure 5.

x 0 = 03 x 1 = F8 x 2 = F0 HW (x2) = 4 HW (x1) = 5 HW (x0) = 2
A backtracking algorithm is used. The tree is traversed in a depth-first manner. For each step, the attacker tests whether the current candidate (x ′ 0 , • • • , x ′ j ) satisfies the different conditions given by the observed Hamming weights. This test is given by algorithm 2. return false

Algorithm 2 isvalid(x ′ 0 , • • • , x ′ j ) Input: Byte-wise partial candidate (x ′ 0 , • • • , x ′ j ) of length 1 ≤ j + 1 ≤ 20 Assumes isvalid(x ′ 0 , • • • , x ′ j-1 ) is true. Output: true if candidate (x ′ 0 , • • • , x ′ j ) is
3: end if 4: if HW (x ′ j ⊕ x ′ j-1 ) ̸ = HW (y j-1 ) then 5: return false 6: end if 7: if HW (x ′ j ⊕ x ′ j-2 ) ̸ = HW (z j-2 ) then 8:
return false 9: end if

# Hamming weights of the feedbacks

10: if |HW (x ′ j ≪ 3) -HW (x j+20 )| > 2 then 11: return false 12: end if 13: if |HW (x ′ j-3 ≪ 3 ⊕ x ′ j ≪ 7) -HW (x j+17 )| > 1 then 14: return false 15: end if 16: if HW (x ′ j-13 ≪ 3 ⊕ x ′ j-10 ≪ 7 ⊕ x ′ j ≫ 7) ̸ = HW (x j+7 ) then 17:
return false 18: end if 19: return true If the test succeeds, the algorithm goes down to the next layer to test the values of the byte x ′ j+1 . If it reaches the bottom of the tree, then a good candidate has been found, and can be saved. The algorithm then iterates upon the next untested node.

If, at some point, the Hamming weights conditions do not hold for the current (partial) candidate, then no node in the sub-tree rooted at that node can lead to a good candidate. Thus, it can be pruned from the whole tree, saving the cost of searching it. Finally, the algorithm ends when the whole tree has been searched. A pseudocode of the attack is given by algorithm 3.

To improve the efficiency of algorithm 3, the attacker can overlook some of the first iterations of the LFSR, and start the attack at a time they deem more satisfying. Indeed, the complexity of the attack de-Algorithm 3 Attack Input: Observed Hamming weights HW (x 0 ), • • • , HW (x 19 ), HW (y 0 ), • • • , HW (y 18 ), and HW (z 0 ), • • • , HW (z 17 ). For the sake of clarity, they are seen as global variables. Output: S set of keys compatible with the observed Hamming weights 1:

(x ′ 0 , • • • , x ′ 19 ) ← (0, • • • , 0) 2: ℓ ← 0 3: S ← {} 4: while true do 5: if j < 19 and isvalid(x ′ 0 , • • • , x ′ j ) then 6: j ← j + 1 7: x ′ j ← 0 8: else 9: if j = 19 and isvalid(x ′ 0 , • • • , x ′ j ) then 10: S ← S ∪ {(x ′ 0 , • • • , x ′ j )} 11: end if 12:
while j ≥ 0 and x ′ j = FF do 13:

j ← j -1 14:
end while 15:

if j ≥ 0 then 16:

x ′ j ← x ′ j + 1 17: else 18: break 19: end if 20:
end if 21: end while 22: return S pend on the number of nodes visited in the tree. Looking only at the first four layers, that number, denoted by N 4 , can be expressed using binomial coefficients as a function of (HW (x 0 ), HW (x 1 ), HW (x 2 ), HW (x 3 )):

N 4 = 8 HW (x 0 ) 8 HW (x 1 ) 8 HW (x 2 ) 8 HW (x 3 )
.

The idea is then to look at the quadruplet at the next iteration, namely (HW (x 1 ), HW (x 2 ), HW (x 3 ), HW (x 4 )), and so on, until the number of nodes in the first four layers of the tree is sufficiently small. One has to remark that the number 4 is arbitrary here, and the attacker can choose whatever value they might prefer.

The question is now, what bound on N 4 does the attacker choose? We have chosen to fix a threshold at N 4 ≤ 1, 756, 160. With this, about 25% of the all quadruplets are kept. Luckily, the probability to find such a quadruplet in the LFSR rapidly increases to one when iterating, because of the good statistical properties of LFSRs.

Results and discussion

Elephant attack

We have simulated the attack on N runs = 560 randomly generated Dumbo keys. For each, the number N nodes of nodes effectively traversed in the tree has been counted. This number roughly corresponds to the time complexity of the attack. Among those nodes, we have specifically counted the number N keys of nodes on the last layer; i.e. nodes that correspond to plausible guesses that remain to be brute forced to finish the attack.

Unfortunately, only just above half (53.57%) of the runs have ended after two days, and about a quarter has been still running after a week. On average, for the runs that finished after two days, the number of nodes traversed is N nodes = 2 41.82 , and the number of remaining keys is N keys = 2 36.59 .

Impact of the generation of masks

The natural question is about what could be done to mitigate this attack. Outside of using generic countermeasures, like e.g. boolean masking, there seem to be two possibilities for improvement. Indeed, the attacker gains information from two sources:

• from equations ( 7) and (8) used to derive the masks for domain separation;

• from the LFSR state update equation (L1).

Thus either the mask derivation, or the LFSR can be changed, or both. This section studies the former case.

We ran two experiments, similar to that in section 5.1 except that the attacker does not gain information on every Hamming weights. In the first experiment, they only know the values of the HW (x j ), and the HW (y j ) for sufficiently j. In other words, compared to the experiment in section 5.1, they lost the knowledge of the HW (z j ). Likewise, in the second experiment, they only know the values of the HW (x j ) for sufficiently j. Unfortunately, in both cases, none of the N runs = 120 runs done has terminated after a week.

From these experiments, it seems that the knowledge of the HW (x j ), HW (y j ), and HW (z j ) contributed heavily on the success of the attack. It would then seem a good idea to tweak the cryptographic mode of operation by finding another way of generating masks for domain separation.

Studies on different LFSRs

This section is dedicated to the study of the influence of the choice of the LFSR. To keep the spirit of the original Elephant, only Fibonacci-like LFSRs, at the byte level, are considered. More specifically, LF-SRs considered are: LFSRs where a single new byte is computed from a combination of three bytes using byte-wise shifts and rotations. As usual, the associated feedback polynomial must be primitive to ensure only maximum-length sequences can be generated. Among all possible candidates, different behaviours can be triggered.

In this paper, the type of an LFSR is defined as the sequence of number of bits unknown to the attaquer at each depth in the tree where a new feedback occurs.

Looking at equation (L1), it can be seen that:

HW (x j+20 ) -HW (x j ≪ 3) ≤ 2
since there are only 2 bits that are modified by:

x j+3 ≪ 7 ⊕ x j+13 ≫ 7.
Thus, if other feedback function are used, with more bits involved, it can be expected to have an impact on the attack. Later in the attack, when at depth 3 in the tree, the same idea can be applied to check whether: HW (x j+17 ) -HW (x j-3 ≪ 3 ⊕ x j ≪ 7) ≤ 1 since now only the single bit x ≫ 7 is unknown. In conclusion, the type of the Dumbo LFSR is [2, 1].

LFSR with different types can be a first criterion when testing our attack.

A second criterion can be: how far apart the feedback bytes are. Indeed, the tighter they are, the faster the attacker can use equation (L1) at its full potential. In the case of Dumbo, the feedback bytes are at indices 0, 3, and 13. We call 13 the depth, this is simply the highest index of the feedbacks.

We chose LFSR based on these two criteria. Types is defined from [2, 1] to [8,8]. For types [2, 1], and [5, * ], we looked at all the possible LFSRs in order to study the influence of their depth.

The state update function of the different LFSR tested are given by equations (L2) to (L21). Their type and depth are given at the second, respectively third, column of Table 3

. L2 x j+20 ← x j ≪ 3 ⊕ x j+1 ≪ 7 ⊕ x j+11 ≫ 7 L3 x j+20 ← x j ≪ 3 ⊕ x j+14 ≫ 3 ⊕ x j+17 ≫ 7 L4 x j+20 ← x j ≪ 1 ⊕ x j+3 ≫ 3 ⊕ x j+13 ≫ 7 L5 x j+20 ← x j ≪ 1 ⊕ x j+9 ≫ 3 ⊕ x j+15 ≫ 7 L6 x j+20 ← x j ≪ 3 ⊕ x j+9 ≪ 4 ⊕ x j+19 ≫ 7 L7 x j+20 ← x j ≪ 3 ⊕ x j+1 ≪ 5 ⊕ x j+3 ≫ 6 L8 x j+20 ← x j ≪ 1 ⊕ x j+4 ≫ 3 ⊕ x j+19 ≫ 5 L9 x j+20 ← x j ≪ 1 ⊕ x j+7 ≫ 3 ⊕ x j+18 ≫ 5 L10 x j+20 ← x j ≪ 1 ⊕ x j+3 ≫ 3 ⊕ x j+9 ≫ 5 L11 x j+20 ← x j ≪ 3 ⊕ x j+1 ≫ 7 ⊕ x j+17 ≪ 4 L12 x j+20 ← x j ≪ 3 ⊕ x j+5 ≫ 7 ⊕ x j+19 ≫ 3 L13 x j+20 ← x j ≪ 1 ⊕ x j+5 ≪ 7 ⊕ x j+16 ≪ 3 L14 x j+20 ← x j ≪ 1 ⊕ x j+1 ≫ 7 ⊕ x j+9 ≫ 3 L15 x j+20 ← x j ≪ 1 ⊕ x j+13 ≪ 5 ⊕ x j+19 ≪ 3 L16 x j+20 ← x j ≪ 3 ⊕ x j+14 ≫ 7 ⊕ x j+17 ≫ 3 L17 x j+20 ← x j ≪ 3 ⊕ x j+4 ≪ 1 ⊕ x j+5 ≫ 6 L18 x j+20 ← x j ≪ 1 ⊕ x j+3 ≫ 1 ⊕ x j+9 ≪ 1 L19 x j+20 ← x j ≪ 1 ⊕ x j+4 ≫ 1 ⊕ x j+5 ≪ 1 L20 x j+20 ← x j ≪ 3 ⊕ x j+1 ≫ 1 ⊕ x j+8 ≪ 7 L21 x j+20 ← x j ≪ 3 ⊕ x j+3 ≪ 5 ⊕ x j+4 ≪ 5
We ran the same experiment as in section 5.1 for every considered LFSR with N tests = 120. For each LFSR, we noted the proportion of runs finished after two days of computations, the average number of nodes effectively traversed in the tree, and average number of remaining keys. Results are summarized in Table 3.

From these experiments, it seems that the depth has a much more relevant impact than the type. Yet, this seems to be quite tailored to our particular attack. Changing the generation of the different masks is generally more impactful, since it can cut down in three the amount of information given to the attacker.

Conclusion

In this paper, a theoretical blind side channel attack targeting the LFSR of the Elephant algorithm has been presented. Elephant is a good target. First, Elephant is a finalist to the (NIST) competition for lightweight cryptography candidates for authenticated encryption. Moreover, Elephant is an interesting target because the internal LFSR only depends on the secret key. In other words, in the use-case of Elephant, retrieving the encryption key is equivalent to retrieving the initial state of the LFSR.

Our attack is based on the fact that an attacker can retrieve the Hamming weights of the different bytes in the LFSR. The Elephant design, where there exist relations between the different internal states of the LFSR, is an added vulnerability to our attack. In half the cases, the key is retrieved in less than two days. Different tweaking options have been considered. Going from the most impactful to the least, they are: changing the mask derivation for domain separation; modifying the LFSR, looking at the importance of depth and type.

Future works may include the inclusion of noise in the simulations, or even better performing the attack on an actual implementation.

  Figure 1: Elephant associated data authentication (top), plaintext encryption (middle), and ciphertext authentication (bottom).

Figure 4 :

 4 Figure 4: 200-bit LFSR ϕ Delirium .

Figure 5 :

 5 Figure 5: Example of the tree representation of the LFSR initial state for the Hamming weights given at the bottom. Only the first three layers of the subtree rooted at x ′ 0 = 03 are shown.

  compatible with the observations, false otherwise # Hamming weights of the xors 1: if HW (x ′ j ) ̸ = HW (x j ) then 2:

Table 1 :

 1 Number of possible values for an Hamming weight.

	HW (x) 0 1	2	3	4	5	6	7 8
	#x	1 8 28 56 70 56 28 8 1

Table 3 :

 3 Type, depth, proportion of runs finished after two days of computations, average number of nodes traversed, and number of remaining keys for Dumbo (L1), and LF-SRs (L2) to (L21).

	LFSR type depth finished N nodes	N keys
	(L1)	[2, 1]	13	53.57%	2 41.82	2 36.59
	(L2)	[2, 1]	11	82.5%	2 41.23	2 36.39
	(L3)	[5, 1]	17	0.83%	2 42.89	2 34.68
	(L4)	[5, 1]	13	94.17%	2 39.68	2 33.68
	(L5)	[5, 1]	15	28.33%	2 42.13	2 35.25
	(L6)	[5, 1]	19	11.67%	2 42.38	2 36.77
	(L7)	[5, 2]	3	100.0%	2 30.93	2 24.93
	(L8)	[5, 3]	19	0.83%	2 43.99	2 37.59
	(L9)	[5, 3]	18	0.0%	-	-
	(L10)	[5, 3]	9	95.83%	2 40.32	2 34.0
	(L11)	[5, 4]	17	0.83%	2 43.58	2 35.6
	(L12)	[5, 5]	19	0.0%	-	-
	(L13)	[5, 5]	16	0.0%	-	-
	(L14)	[5, 5]	9	82.5%	2 41.43	2 34.95
	(L15)	[5, 5]	19	0.0%	-	-
	(L16)	[5, 5]	17	0.0%	-	-
	(L17)	[8, 2]	5	100.0%	2 35.53	2 29.17
	(L18)	[8, 7]	9	78.75%	2 41.56	2 34.79
	(L19)	[8, 7]	5	100.0%	2 35.41	2 29.42
	(L20)	[8, 8]	8	79.17%	2 41.59	2 35.78
	(L21)	[8, 8]	4	100.0%	2 34.76	2 29.29

Acknowledgments

This research is part of the chair CyberCNI.fr with support of the FEDER development fund of the Brittany region.


Sughosh Deshpande

Anna Carla Araujo
email: araujo@insa-toulouse.fr

Pierre Lagarrigue

Yann Landon

EXPERIMENTAL ANALYSIS OF CIRCULAR MILLING FOR MATERIAL IDENTIFICATION IN AEROSPACE INDUSTRY

In the airplane design, thousand holes should be manufactured by machining leading this process in the first place for process optimization. Recently, the stack materials used in this application are sheet layers of Titanium alloy, Aluminum alloy and CFRP, which normally are machined under different cutting conditions. There are two main solutions when drilling stacks: using the more conservative ones or changing the parameters for each layer. In orbital drilling, the forces are lower with better quality but with longer machining time compared to drilling, allowing the measurement and control of the process. Smart machining techniques can be applied for recognising and adapting the cutting parameters in real time, depending on a database for decision-making. In this paper, a technique is proposed to identify the cutting material based on the cutting and feed components of the machining force in a circular milling process. Experiments consist of machining separately Titanium and Aluminium alloy workpieces in a similar range of cutting speed and feed, measuring forces and the position of the cutting tool (X,Y, SP) using the machine-tool data. The results show that it is possible to identify the materials using the calculated tangential and radial force components in the tool referential frame because the values of specific cutting and feed force are significantly different for each material. A specific force map is used as a signature to distinguish the materials in real time machining which can be used for orbital drilling in the next step of the research.

Introduction

Multi stack drilling is one of the major operations in aircraft assemblies and it demands lots of time and resources to achieve high-quality holes. Usually, Titanium and Aluminium stacked materials are drilled before aircraft assembly and this poses a major challenge in machining due to the different machinability of materials. Some of the drilling challenges include poor finishing, burr formation and rapid tool wear [START_REF] Zhu | Evaluation of novel tool geometries in dry drilling aluminium 2024-T351/titanium Ti6Al4V stack[END_REF]. However, hole quality aspects like exit burrs can have a significant influence during assembly and also affect productivity [START_REF] Gillespie | Burrs produced by drilling[END_REF].

As an alternative for axial drilling operation, orbital drilling, an helical milling process, can be applied. This process shows advantages regarding the process flexibility and ability to produce high-quality holes on different materials [START_REF] Bruno | A review of helical milling process[END_REF][START_REF] Morales | Study of the Influence of Helical Milling Parameters on the Quality of Holes in the UNS R56400 Alloy[END_REF]. Sun et al [START_REF] Sun | Hole-making processes and their impacts on the microstructure and fatigue response of aircraft alloys[END_REF] data shows that the fatigue life of holes produced by helical milling showed better life compared to conventional drilling. The burr height at the hole exits was considerably lower in orbital drilling compared to conventional drilling [START_REF] Lacombe | Influence du procédé de perçage sur l'intégrité de surface et la tenue en fatigue de pièces percées en AA[END_REF]. However, helical milling alone will not completely eliminate the problems faced in stacked hole making operations.

The environmental protection initiatives, such as ISO 14001 and lean manufacturing ideology, push researchers to develop flexible and smart processes to improve efficiency and productivity to reduce costs [START_REF] Cao | The concept and progress of intelligent spindles: A review[END_REF]. It is a fact that thousands of holes have to be drilled for assembling an airplane, so smart drilling is a key point for performance maximization. Hence, increasing the feed rate or cutting speed on the layer that presents higher machinability is directly related to this goal [START_REF] Geier | Advanced cutting tools and technologies for drilling carbon fibre reinforced polymer (cfrp) composites: A review[END_REF].

Smart machining refers to real time adaptation of cutting parameters for process optimization. It involves identifying the material accurately and then adapting the proper cutting parameters in real time for process optimization. In this area, Pardo et al [START_REF] Pardo | Assessment of decision-making algorithms for adaptive drilling of aerospace stacks[END_REF] discusses decision making strategies in order to identify the tool position in stack drilling for adaptation of cutting parameters. A force sensorless method is proposed by Fang et al [START_REF] Fang | A Force Sensorless Method for CFRP/Ti Stack Interface Detection during Robotic Orbital Drilling Operations[END_REF] in stacked orbital drilling of CFRP and Titanium in order to determine the tool position across different layers. Also, Wenkler et al [START_REF] Wenkler | Intelligent characteristic value determination for cutting processes based on machine learning[END_REF] developed a way of predicting specific cutting force by Artificial Neutral Network which can be implemented in process planning or smart manufacturing.

Mechanistic force models can provide quantitative cutting force predictions based on the uncut chip thickness principle. Once experimental tests are made, the cutting force models enable estimating the specific cutting coefficients for a different set of variables. In this area, numerous papers predict cutting forces by considering different factors to improve the model accuracy. Armarego et al [START_REF] Armarego | Computerized Predictive Cutting Models for Forces in End-Milling Including Eccentricity Effects[END_REF], for example, developed a force model considering tool run out to accurately predict cutting forces. Montgomery et al [START_REF] Montgomery | Mechanism of Cutting Force and Surface Generation in Dynamic Milling[END_REF] included tool workpiece vibrations into the model to calculate cutting forces and specific force coefficients based on the chip load. Geometry of chip formation and prediction of forces in circular milling is discussed by Banerjee et al [START_REF] Banerjee | Geometry of chip formation in circular end milling[END_REF]. Wu et al [START_REF] Wu | Cutting force prediction for circular end milling process[END_REF] discussed force models for circular milling taking into account the uncut chip thickness and feed rates variation at the corners. The cutting coefficients calculation in circular milling models can be further extended for helical milling adding vertical feed.

The specific cutting coefficients data can be used to identify the material being machined. They can act as material signatures to adapt proper cutting parameters in real time. These data could directly improve the process productivity and hole quality if appropriate cutting parameters are applied for the specific material. There are many articles proposing methodologies to calculate cutting forces and cutting coefficients, but rarely on a data map of specific force coefficients of different materials. Similar data maps were developed recently by our team for axial drilling [START_REF] Clara | Smart drilling: material identification using specific force map[END_REF].

This article proposes a technique for material identification in circular milling process of Aluminium and Titanium alloys used in aerospace industry. Our work also introduces integration of external sensor to identify cutting flute position in real time which can be helpful in smart machining applications.

The materials used for the experiments were Aluminum 2017A and Titanium Ti6Al4V, being subjected to a common set of cutting conditions. In the following sections, the force model and cutting coefficients are presented, along with material and methods, followed by experimental results and identification maps for both the materials.

Force model and specific force coefficients

The forces for a general orthogonal cutting can be described by a mechanistic force model, as described by [START_REF] Altintas | [END_REF], considering only cutting action of the cutting edge neglecting ploughing and chisel edge effects.

In this way, the machining force ⃗ F m is calculated considering the small finite elements of the cutting flute in the cutting edge referential frame decomposed: tangential (dF c ), radial (dF r ) and axial (dF z ) components.

⃗ dF m =   dF c dF r dF z   (1)
The local force at point P of the cutting edge is a function of the uncut chip thickness h and the specific force coefficients: K c , K r and K z , as presented in Eq. 1.

dF c = K c (P ).h(P )db (2)
dF r = K r (P ).h(P )db (3)

dF z = K z (P ).h(P )db (4)
where h(P )db is the elementary uncut chip load calculated on the reference point P in db elemental length of the cutting edge.

For each rotating tool machining process, there are some assumptions in order to identify a global value for specific force coefficients: milling and circular milling, as follows in the next subsections.

Milling

In milling, in order to determine the cutting coefficients of the tool-workpiece pair, the local cutting force dF c (t) and the radial force dF r (t) are analyzed considering the variation of the uncut chip thickness (h) along the tool rotation.

The angle of local position ϕ of the flute i can be expressed considering the tool helix angle λ, the angle between flutes ϕ p = 2π N , where N is the number of flutes and a p the axial depth of cut.

ϕ(θ 2 , i) = θ 2 -(i -1)ϕ p (5)
Martellotti equation [START_REF] Martellotti | An analysis of the milling process[END_REF] described the chip thickness h(ϕ) as a function of feed per tooth (f z ) and ϕ, calculated considering the tool rotation angle (θ 2 ), and given by the equation:

h(ϕ) = f z sin (ϕ(θ 2 , i)) (6)
When summing the force contributions of each elemental cutting part db, dF c (t) and dF r (t), the directions are not the same and a change to a fixed referential is necessary. From there, dF x (t) and dF y (t) can be calculated.The forces in axial direction (dF z ) can be neglected, if the helix angle is small.

As in any machining process, some assumptions should be made for the identification of specific cutting force and specific radial force. It is considered that the maximum force is achieved in the position of θ 2 when the average uncut chip thickness along the cutting edge is higher. The reference frame is now fixed in the rotating tool θ 2 and not in each element. Then, the approximation done lead to:

K c = F c (θ 2 ) A c (θ 2 ) -→ K c = F c(max) A c(max) ≈ F c(max) h ′ (max) .a p (7) 3 K r = F r (θ 2 ) A c (θ 2 ) -→ K r = F r(max) A c(max) ≈ F r(max) h ′ (max) .a p (8)
where A c is chip cross section area , h ′ max is maximum uncut chip thickness and a p is axial depth of cut.

Circular Milling

Unlike in linear milling, circular milling involves movement of tool around a centered fixed point in clockwise or anticlockwise direction to enlarge a existing hole diameter. Figure 1(b) shows the circular milling tool trajectory (at θ 1 = 0) and the associated geometric parameters. A tool of diameter D t with center C is moving around the hole center O. D 1 refers to pre hole diameter and D is the final diameter to be achieved after circular milling. R tt is the tool trajectory radius with reference to hole center O [START_REF] Araujo | Analytical and experimental investigations on thread milling forces in titanium alloy[END_REF]. In circular milling, cutting forces at the cutting edge have different referential frames that have to be analyzed in order to determine the cutting coefficients of the tool-workpiece pair. The cutting forces exerted by the tool on the workpiece can be seen in Figure 1(a). Feed motion produces F tan and F rad forces and the cutting action gives rise to tangential (F t ), radial (F r ) and axial forces (F z ) at the cutting edge. It can be noted that the direction of feed forces in circular milling changes continuously unlike in linear milling where feed direction and feed force direction remain unchanged. In circular milling context, forces in axial direction (F z ) can be neglected.

X Y F t F r F t F a F r
Figure 2 shows chip formation in circular milling indicating entry and exit of cutting flute with the workpiece. θ 2 is measured from fixed referential frame of rotating tool with flute 1 of the end mill. The angle ψ is the swept angle of the flute which is determined by the entry and exit of the cutting flute as shown in the Fig. 2. The uncut chip thickness varies from h min to h max as the flute rotates in clockwise direction. The chip load at h max generates maximum cutting force and is considered for the calculation of cutting coefficients as indicated in Eq. 7 and 8. h * is the side edge of the uncut chip thickness generated because of the helical flute profile and also circular motion of the tool trajectory. The local position of the flute in circular milling can be expressed relating to tool trajectory position as indicated below:

ϕ(θ 1 , θ 2 , i) = θ 2 -θ 1 -(i -1)ϕ p ( 9
)
Equation 6 can be rewritten considering instantaneous position of the flute at angle ϕ calculated, in this case, as also a function of θ 1 :

h(ϕ) = f z sin (ϕ(θ 1 , θ 2 , i)) if ϕ ≤ ψ ( 10
)
The forces measured during experiments by the dynamometer are in XY referential frame: F X and F Y as shown in Figure 1(a). The tool rotates around the hole center O in clockwise direction given by angular position θ 1 and around its own axis given by θ 2 , also in clockwise direction. The forces F X and F Y can be transformed using a rotation matrix (Eq. 11) to deduce F tan and F rad at the tool center. F tan and F rad are significant to understand tool deflection effects on hole quality. To calculate F t and F r at the cutting edge, the rotation matrix as a function of θ 2 and the dynamometer referential frame components (F X and F Y ) presented in Eq. 12 can be applied. The specific cutting coefficients K c and K r (N/mm 2 ) are identified by analyzing F t and F r maximum values for a particular set of tool revolutions using Eq.7 and Eq.8.

[

F rad F tan ] = [ Cos(-θ 1 ) -Sin(-θ 1 ) Sin(-θ 1 ) -Cos(-θ 1 )
] .

[

F X F Y ] (11)
[ F t (θ 2 ) F r (θ 2 ) ] = [ -Sin(-θ 2 ) -Cos(-θ 2 ) -Cos(-θ 2 ) -Sin(-θ 2 )
] .

[

F X F Y ] ( 12
)
3 Materials and methods

In this section, circular milling experiments in Aluminium (2017A) alloy and Titanium (Ti6Al4V) alloy workpieces measuring cutting forces are presented along with external sensor integration. The experiments were carried out for a specific range of cutting conditions, following the experimental setup and the design of experiments described below.

Experimental setup

Circular milling experiments were carried out on a CNC milling center DMU85-DMG mono block machine. The tool used for the experiment is carbide end mill of 8 mm diameter from Fraisa [START_REF] Fraisa | Catalogue fraisa[END_REF]. A prehole of 11 mm diameter is already drilled before by a drill tool. The workpieces were fixed on a 9257B Kistler dynamometer, as shown in figure 3(a), using only its internal measuring region, connected to a 5070 Kistler amplifier.

Cutting edge position identification

The external photoelectric sensor is utilized to detect flute position by the principle of light emission and detection on a reflective tape attached to the tool holder as shown in figure 4(b). The sensor produces a voltage high when it detects reflective tape positioned in line with the cutting flute. Also, the CNC machine has a spindle encoder reference (defined by the machine builder) which is used to identify the spindle position in rotary motion. This is illustrated in figure 4(a). It should be noted that there is no physical identification mark of encoder reference on the actual machine spindle but it is internally defined by the machine builder. The spindle position data can be traced in real time from the CNC machine by Sinucom Trace. The position of the reflective tape is cross checked and validated by making a test cut in order to compare flute position and force peak at a particular time stamp.

The data from the external sensor and machine trace is analysed to find the angular relation (δ) between the cutting flute position and machine encoder reference point in order to deduce cutter rotation angle θ 2 as shown in the figure 4(a). Figure 4(c) shows the schematic of instrumentation setup in order to acquire the real time data from the CNC machine as well as external photoelectric sensor. In order to precisely deduce the angular relation between cutting flute position and machine encoder point, it is significant to read both of acquired data (Machine data and external sensor data) on the same platform in the same time frame. PLC from the CNC machine can be integrated to Labview via OPC UA1 [START_REF] Liu | A Cyber-Physical Machine Tools Platform using OPC UA and MTConnect[END_REF] which can facilitate to access machine data on Labview along with external sensor data. Our work is ongoing in order to integrate data acquired from different platforms in a common window like OPC UA for better decision making.

This article used a method to deduce δ (Fig. 4(a)) by identifying the common time stamps from two systems and then comparing the signals obtained in the same time frame. Clock from external sensor system and machine trace system is set identical. The set of data points having common time stamps from both the systems is then super imposed as shown in the Figure 5 to identify angular difference between cutting flute and spindle encoder reference position. The sensor signal peak in the graph denotes a cutting flute detection and the corresponding value of the spindle position is found to be consistently between 153 -158 o . Since, the above technique involves integrating two separate platforms with different time frames, the value of δ identified varies in a range but this work proposes novel ways to identify cutting edge position in real time for application in smart machining techniques.

Design of Experiments

Table 1 summarizes the cutting conditions on Aluminium and Titanium along with tool details for circular milling operations. The machining responses were compared for a constant cutting velocity and a range of feed rates as indicated in the Table 1. Feed as low as 0.02 mm/tooth which is the minimum feed value for any monoblock carbide tool to perform is included in the cutting parameters range. Each test is repeated twice and care is taken that, same feed rate test is not carried out successively twice but in a random order, to eliminate chances of rapid tool wear (if any) at higher feed rate values. Circular milling was carried out on the previously drilled hole with an axial depth of 1 mm and a radial width of cut of 1.9 mm. This leads to a final milled hole diameter of 14.8 mm in order to have a cutting continuity coefficient c less than 1 [START_REF] Araujo | Modeling thread milling forces in mini-hole in dental metallic materials[END_REF].

Experimental results

The following subsections present the results of experimental forces for circular milling. Circular milling forces are presented in terms of tool angular position θ 1 (around O) which is taken as a reference for all the feed rates and cutting speed values tested. It should be noted that the trajectory rate (θ 1 /time) changes based on variation in feed rate values.

Forces in Circular Milling

The forces components F X and F Y obtained with the dynamometer during circular milling can be seen in the Figure 6. The graph shows the variation of force components (XY reference on the dynamometer) along time, represented by the tool trajectory angle θ 1 . Figure 7 shows tangential (F t ) and radial (F r ) forces components (aligned to the cutting edge) and its variation along θ 1 evolution. A window of two tool revolutions is presented (one revolution : θ 2 = [0 -360 o ]). Eight peaks can be observed in the cutting force components for a 4 flute end mill for Aluminium and Titanium alloys experiments. The cutting forces from dynamometer were transformed as previously indicated in Eq. 12. Each peak corresponds to cutting flute (F l i ) and swept angle (ψ i ) as shown in the figure 7(a).

Identification map

After acquiring the experimental forces for circular milling, the specific cutting force coefficients were estimated. They are presented in the form of identification map in this section. It is important to claim that the circular milling experiments were done on pre drilled hole. As one of the the goal of this paper is the material identification based on the data, the range of feed per tooth was narrowed to 0.10 and 0.18 mm/th, where the values of forces were closer. Also, low feed rate values as 0.02 mm/tooth are very rarely used in the industry for these materials. K c and K r values are estimated by considering maximum values of F t and F r values respectively, for a specific set of tool revolutions. Figure 8 shows the identification map of specific cutting coefficients estimated for Aluminium and Titanium alloys. The data includes values calculated at several tool angle positions θ 1 at different feed rates and constant cutting velocity with the objective of having a representative value with larger spectrum of experimental variability and noise. A clear distinction between both materials and force coefficient values can be identified in different regions of the map presented in Fig. 8. Thus, the clear distinction between Titanium and Aluminium regions presented in identification map, can be further applied for material identification in smart machining processes.

ψ R ψ 3 ψ 2 ψ 1 ψ 4 ψ 3 ψ 2

Conclusions

The article focuses on kinematics of circular milling and introduces a model to identify cutting coefficients for developing an identification map in smart machining applications. This work also proposes an idea of detecting cutting flute position in real time for instantaneous calculation of cutting forces and specific coefficients. Research is ongoing in order to improve the accuracy of this model since it involves integrating two different data acquisition platforms with its own time frame. However, proposed method could still identify approximately angular difference between cutting flute and spindle reference position which can be interesting for online monitoring applications.

The specific force coefficients are identified in different regions of the map for Titanium and Aluminium due to the materials distinct machinability. Hence, the gap between the cutting force coefficients for both materials makes it suitable for applying smart machining techniques using data monitoring in hole making processes of stacked materials made out of Aluminium and Titanium.

Similar data maps can be developed in orbital drilling by online monitoring of cutting force and cutting flute position for material identification in stacked aerospace applications of Aluminium and Titanium alloys.

Figure 1 :

 1 Figure 1: Referential Frames in X and Y indicating cutting forces and tool trajectory in circular milling

Figure 2 :

 2 Figure 2: Chip geometry in circular milling

Figure 3 (

 3 b) shows Titanium alloy sample with milled dimensions. Analogical data of force is converted to digital using a 9201 National Instruments acquisition module with 10 kHz acquisition rate. The measured forces were filtered using a low pass Butterworth filter with cutoff frequency of 700 Hz (appropriated to the maximum spindle speed). In order to detect cutting flute position, an external photoelectric sensor (reference: WL150-P132 from Sick) is connected to a DC power supply and the sensor output is connected to data acquisition card NI 9215 from National Instruments via BNC cable. Sensor data is read and written on Labview platform connected to NI DAQ through USB. The CNC milling center in use has Sinumerik controller from Siemens which is connected to Sinucom NC Trace software via ethernet connection to trace machine related data. The working principle of external sensor along with tracing of machine data is explained in the next subsection.

  (a) Experimental elements (Tool, workpiece, Fixture and Dynamometer) (b) Milled dimensions: 14.8 and 11.0 mm (in Titanium)

Figure 3 :

 3 Figure 3: Experimental setup

Figure 4 :

 4 Figure 4: Cutting flute angular position identification

Figure 5 :

 5 Figure 5: Identification of δ

Figure 6 :

 6 Figure 6: Experimental forces F X and F Y during circular milling of Aluminium as an example (f z -0.1 mm/th and V c -40m/min)

  Fr for Titanium.

Figure 7 :Figure 8 :

 78 Figure 7: Calculated F t and F r during 2 revolutions in circular milling of Aluminium and Titanium (window on θ 1 = [200 o -213 o ]) at f z = 0.1 mm/th and V c = 40 m/min

Table 1 :

 1 Design of Experiments: Cutting conditions

	Operation	Workpiece Cutting speed	Feed (mm/th)
			(m/min)
	Milling	Aluminium 40	0.02 / 0.10 / 0.18
	( 8 mm, 4 flutes, λ = 30 o )	Titanium	40	0.02 / 0.10 / 0.18

Open Platform Communication Unified Architecture


Katrien Eger

Dora Paroczai

Alison Bacon

Florence Schleich

Svetlana Sergejeva

Arnaud Bourdin

Isabelle Vachier

Eleftherios Zervas

Konstantinos Katsoulis

Dimosthenis Papapetrou

The effect of the COVID-19 pandemic on severe asthma care in Europe -will care change for good?

niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.