Optical Fault Injection Attacks against Radiation-Hard Shift Registers

Abstract

If devices are physically accessible optical fault injection attacks pose a great threat since the data processed as well as the operation flow can be manipulated. Successful physical attacks may lead not only to leakage of secret information such as cryptographic private keys, but can also cause economic damage especially if as a result of such a manipulation a critical infrastructure is successfully attacked. Laser based attacks exploit the sensitivity of CMOS technologies to electromagnetic radiation in the visible or the infrared spectrum. It can be expected that radiation-hard designs, specially crafted for space applications, are more robust not only against high-energy particles and short electromagnetic waves but also against optical fault injection attacks. In this work we investigated the sensitivity of radiation-hard JICG shift registers to optical fault injection attacks. In our experiments, we were able to trigger bit-set and bit-reset repeatedly changing the data stored in single JICG flip-flops despite their high-radiation fault tolerance.

Sensitivity of Standard Library Cells to Optical Fault Injection Attacks in IHP 250 nm Technology

“…In our experiments with radiation-hard shift registers two duplicated transistors that are placed at a distance of 9 µm, have to be influenced simultaneously to manipulate the logic state by illumination. The successful experiment was reported in [14]. We were able to manipulate the logic state of the cell using the single-mode laser with 5× and 20× magnification objectives.…”

“…a flip-flop cell of a shift register working at a clock signal frequency of 10MHz, for more than 10 clock cycles. But this experiment was successful and published in [14] and [15].…”

“…Credibility essentially requires reproducibility of the results achieved. In the past we reported [18] that in many publications important information such as details about the equipment used are missing. Unfortunately even if these parameters are reported reproducibility is not really ensured as often parameters are vendor specific, i.e.…”

“…Unfortunately many papers do not allow reproducibility. In [18] we reported on missing information about experimental set-ups which disregards the rules of good scientific practice and prevents other researches form verifying results reported. But even if all these data are given the reproducibility is often limited as the parameters are vendor specific i.e.…”

Implications of Physical Fault Injections on Single Chip Motes

“…Section II-B, we are not concerned with the simplest attack technique using a UV lamp or a camera flash for erasure. Even when a camera flash with a magnification lens or a laser is used, state-ofthe art attacks are proved to be successful on microprocessors fabricated using 350 nm, 250 nm, 130 nm and 90 nm CMOS process [22], [25]. However, there is no proof -to the best of our knowledge -that these techniques can succeed with more advanced fabrication technology such as the 65 nm process used to fabricate today's single chip motes.…”