Extensive Laser Fault Injection Profiling of 65 nm FPGA

Abstract

Fault injection attacks have been widely investigated in both academia and industry during the past decade. In this attack approach, the adversary intentionally induces This paper is an extension of the paper entitled "Comprehensive Laser Sensitivity Profiling and Data Register Bit-Flips for Cryptographic Fault Attacks in 65 nm FPGA," presented at SPACE'16 conference. This version contains an extended related work, covers chip preparation in more details, discusses compatibility with cryptographic fault injection attacks, and presents a countermeasure against laser profiling. computational faults in the security components of the integrated circuit (IC) for deducing the confidential information processed or stored inside the device. However, the internal architecture of real-world devices is typically unknown to the attacker and the insufficient information about the device internals often cannot satisfy requirements of a practical fault injection attack. In this paper, we target Field Programmable Gate Array (FPGA) that is widely used in hardware security applications. By analyzing the faulty outputs of implemented algorithms, the scale of logic arrays and the sensitive logic cells can be precisely profiled. Using the outcome of this work, practical attacks can be significantly accelerated, without a need of time-consuming chip-scale injection scan. In addition, the observed fault models are compatible with most of the previously proposed fault models for differential or algebraic fault attacks (DFA/AFA). Moreover, a low-cost and highly sensitive logic-level countermeasure for predicting the laser fault injection attempt is described, which can be applied into any digital IC with a minimal overhead. Jakub

Simulation and Experimental Demonstration of the Importance of IR-Drops During Laser Fault Injection

“…Because we could identify (following the work described in [43]) the RO position with preliminary experiments we can be sure that Fig. 14c and Fig.…”

How Practical Are Fault Injection Attacks, Really?

“…For thinning the substrate, a mechanical delayering is necessary, often involving expensive devices (e.g. UltraTec ASAP-I was used in [46]). However, if the chip can be properly prepared, optical fault injection offers a very precise and repeatable way to induce errors [47].…”