Attachment A - Statement of Work (SOW).pdf

Solicitation Number: 1333ND25QNB770258

Statement of Work (SOW) Title: Side Channel Analysis Precision Control System

I. Background Information

The Computer Security Division within the Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) develops cryptographic algorithms and defines the cryptographic validation programs that global security standards. While these algorithms are grounded in rigorous mathematical foundations, real-world security failures occur not by breaking the math — but by exploiting weaknesses in system implementations. Side Channel Attacks (SCA), leverage hardware-based leakage such as timing variations, power consumption, electromagnetic emissions, cache behavior, and fault injection remain among the most practical, and scalable attacks against cryptographic systems. The Side Channel attacks are a type of security vulnerability that exploits information unintentionally leaked by a system or device during its normal operation. These attacks do not target the primary functionality of a system but rather focus on the side of unintended channels that inadvertently reveal information about the system's internal operations, such as cryptographic keys or data by analyzing system characteristics timing, power consumption, EM radiation, or other unintentional information leaks These attacks bypass cryptographic hardness assumptions entirely, directly targeting the physical and operational characteristics of systems. The new equipment will augment the existing lab to analyze, study and measure “leakage resiliency,” which will help build comprehensive guidance on protection against side-channel attacks, enabling industry to design, implement, and validate systems that are resistant not only to mathematical attacks, but to real-world adversarial techniques that operate at the intersection of hardware and software Attackers use special equipment or techniques to collect system data while the target system is performing sensitive operations, e.g., cryptographic processing. The attackers then analyze the data to discover patterns, variations, and/or correlate activities, e.g., attackers analyze power consumption patterns to reveal sensitive information. To protect against side-channel attacks, countermeasures are typically built into the designs.

II. Purpose

The purpose of this requirement is to acquire equipment and necessary training to analyze side channel attack vulnerabilities.

III. Specific Requirements

The vendor shall provide commercial off-the-shelf equipment that will build and enhance NIST’s ability to analyze side channel attack vulnerabilities with the following capabilities:

• Ability to capture, analyze, filter signals, perform transforms, e.g., Fourier, or apply statistical techniques to extract and correlate information.

• Ability to view signals, through specialized oscilloscopes and probes that capture and analyze signals and corelate it with changes to inputs, signal strength, other changes in the overall system.

• Ability to classify the data, recognize patterns and correlate so sensitive information can be extracted or inferred. This is typically done through special software.

• Ability to analyze pre-silicon implementation for side channel and fault injection weaknesses or vulnerabilities must be available or be on the roadmap with dates of availability clearly identified.

TASKS

The Contractor shall:

CLIN 0001 - Electromagnetic Probe System

• Provide a high-precision electromagnetic probe capable of capturing Electromagnetic emissions from different regions of a Device Under Test (DUT).

• Include a precision-controlled positioning system for the probe or DUT with sub-millimeter accuracy.

• Support repeatable, programmable motion for automated test sequences.

CLIN 0002 - Real-Time Oscilloscope System

• Oscilloscope must be upgradeable and meet the following minimum specifications:

o 14 GHz bandwidth o 16 G Samples/s sampling rate on at least 4 independent channels o 100 million points (Mpts) memory per channel

• Must include an integrated waveform generator for custom stimulus generation.

• Real-time event identification software and real-time spectrum analysis functionality must be included.

CLIN 0003 - Signal Acquisition and Processing Software

• Deliver easy-to-use software for signal acquisition, capture, processing, and visualization.

• Must support a floating site license model for flexibility in usage across multiple systems at the same location.

• Support exporting captured data in standard formats, e.g., CSV, Excel, matlab, for further analysis.

CLIN 0004 - Vulnerability Analysis Tools

• Provide tools or integrated features for identifying vulnerabilities, including side-channel analysis and fault injection.

• Software must support correlation analysis frequency-domain analysis, and comparative trace analysis.

• Analyze and perform tests like Test Vector Leakage Assessment (TVLA), First Order

Analysis, Known Key Correlation to help identify vulnerabilities.

CLIN 0005 - Installation, Training, and Support

• Perform onsite installation and system configuration at the government-designated facility.

• Provide comprehensive training for personnel, including:

o Training boards and supplies o Operational training on hardware and software o Hands-on exercises in fault injection and side channel analysis

• Provide technical support services including software updates, troubleshooting, and system maintenance for a minimum of 12 months post-installation.

NOTE: The available tools must be relevant and applicable to modern day and future Post Quantum Crypto algorithms. The capabilities must be matured and tested on real-world products.

All items must be new. Used or remanufactured equipment will not be considered.

Experimental, prototype, or custom items will not be considered. The use of “gray market” components not authorized for sale in the U.S. by the offeror is not acceptable.

All line items shall be shipped in the original manufacturer’s packaging and include all original documentation and software, when Applicable.

Site Preparation: NA

Delivery Terms:

Delivery shall be FOB destination and shall occur within 30 days after receipt of order. FOB Destination means: The contractor shall pack and mark the shipment in conformance with carrier requirements, deliver the shipment in good order and condition to the point of delivery specified in the purchase order, be responsible for any loss of and/or damage to the goods occurring before receipt and acceptance of the shipment by the consignee at the delivery point specified in the purchase order; and pay all charges to the specified point of delivery. Delivery shall be made to the NIST Shipping and Receiving address identified below. The delivery will then be directed to the equipment’s final destination, also identified below.

NIST Shipping & Receiving 100 Bureau Drive Building 301 Gaithersburg, MD 20899-0001

Final Destination:

National Institute of Standards and Technology 100 Bureau Drive, Building 222, Room A348 Gaithersburg, MD 20899-1640

IV. Assembly and Installation

The equipment shall be assembled and installed by the Contractor at the NIST Gaithersburg campus. The day and time for installation shall be coordinated between the Contractor and the COR on a mutually agreeable day and time. The Contractor shall install the system within 15 business days following the day of delivery.

Training on the acquired equipment shall be provided to NIST employees and associates (NTE 10 personnel) by the vendor and/or equipment provider within 90 days of installation.

V. Inspection, Acceptance and Training

In addition to the inspection and acceptance terms articulated in 52.212-4, the Government reserves the right to perform such performance tests and evaluations as defined below to verify specified system performance. Such tests and evaluations, if performed, shall be conducted within the environment that the system is to be operated. The Contractor has the right to be present during the tests and evaluations, if performed, at the Contractor’s expense.

The scope of general inspection includes:

• Structural, mechanical, and electrical evaluation of product,

• An operational evaluation of the unit,

• Evaluation of the system’s performance and software interfacing.

• A visual inspection of the equipment.

Test System will be performed by the NIST COR to identify defects or any form of indication that the system was damaged during transport to NIST. The Government shall have sole discretion to require repair or replacement of damaged and/or nonconforming supplies at no cost to the Government. The Government at any time prior to acceptance shall reject the system due to defects and/or nonconformance.

The vendor is responsible for latent defects discovered any time after final inspection. However, the extent of its liability shall be prorated over the useful life of the time tagging unit.

The place of acceptance shall be:

100 Bureau Drive Building 222, Room A348 Gaithersburg, MD 20899

Ownership (title) of the time tagging unit shall transfer to NIST upon acceptance.

Vendor is responsible for providing appropriate training on the equipment to NIST employees and associates. The training will be scheduled based on availability of NIST employees and vendor within a period of not exceeding 3 mos. of installation of the equipment.

VI. Section 508 Compliance

All Electronic and Information Technology (EIT) as defined at FAR 2.101, supplied under this order must conform to the Architectural and Transportation Barriers Compliance Board Electronic and Information Technology Accessibility Standards (36 CFR Part 1194). The applicable standards are available at http://www.access-board.gov/sec508/508standards.htm.

The following standards are applicable to this requirement:

• 36 CFR § 1194.3 General Exceptions

• § 1194.3(c) Not required at a workstation of a Fed employee who is not disabled

• § 1194.3(d) Not required public access http://www.access-board.gov/sec508/508standards.htm

VII. Warranty

The contractor shall provide a commercial warranty on the entire system in accordance with the Original Equipment Manufacturers (OEM) standard commercial item warranty and shall be in accordance with terms in FAR 52.212-4. Warranty shall commence upon acceptance of the system by the Government.

VIII. General Requirements

Safety: The Contractor shall be responsible for knowing and complying with all installation safety prevention regulations. Such regulations include, but are not limited to, general safety, fire prevention, and waste disposal.

Security: NIST is a restricted campus. An identification badge is required for access for entry into buildings and is shown to the armed Security Police when entering the campus.

Regular Business Hours: Regular business hours are Monday through Friday, (8:30 am to 5:00

pm) Eastern Time, excluding Federal holidays and NIST closures.

Identification Badges: Contractor employees must comply with NIST identification and access requirements. Each Contractor employee must wear a visible identification badge provided by the NIST Security Office.

Vehicle Registration: All Contractor employees must register their vehicles with the NIST Security Office to gain access to the campus. A valid driver’s license, Government-furnished civilian ID, proof of insurance and current registration must be presented to the NIST Security Office, at which time a NIST vehicle pass will be issued. The pass must be displayed on the vehicle in accordance with NIST Security Office instructions.

IX. Payment Schedule

Advance payment is not authorized. The Contractor must invoice in arrears according to the following payment schedule. The Contractor shall be paid, in accordance with Net 30-day payment terms, upon receipt and acceptance of a proper invoice, in accordance with the following schedule:

• 100% after receipt and acceptance by the TPOC of all CLINs

NOTE: Partial shipments and partial invoices will not be accepted, unless otherwise requested and accepted by the Contracting Officer prior to award. Proposed payment schedules shall be submitted with vendor’s response to the RFQ for consideration.