RDS: FPGA Routing Delay Sensors for Effective Remote Power Analysis Attacks

Abstract

State-of-the-art sensors for measuring FPGA voltage fluctuations are time-to-digital converters (TDCs). They allow detecting voltage fluctuations in the order of a few nanoseconds. The key building component of a TDC is a delay line, typically implemented as a chain of fast carry propagation multiplexers. In FPGAs, the fast carry chains are constrained to dedicated logic and routing, and need to be routed strictly vertically. In this work, we present an alternative approach to designing on-chip voltage sensors, in which the FPGA routing resources replace the carry logic. We present three variants of what we name a routing delay sensor (RDS): one vertically constrained, one horizontally constrained, and one free of any constraints. We perform a thorough experimental evaluation on both the Sakura-X side-channel evaluation board and the Alveo U200 datacenter card, to evaluate the performance of RDS sensors in the context of a remote power side-channel analysis attack. The results show that our best RDS implementation in most cases outperforms the TDC. On average, for breaking the full 128-bit key of an AES-128 cryptographic core, an adversary requires 35% fewer side-channel traces when using the RDS than when using the TDC. Besides making the attack more effective, given the absence of the placement and routing constraint, the RDS sensor is also easier to deploy.

1LUTSensor: Detecting FPGA Voltage Fluctuations using LookUp Tables

“…Spielmann et al [SGS23] proposed to use FPGA routing delays to detect FPGA voltage fluctuations. The routing delay sensor (RDS) proposed in [SGS23] consisted of 32 LUTs, 24 carry chain elements and 32 latches for calibration. The output of the calibration signal is connected to 128 flip-flops to sample FPGA voltage fluctuations.…”

“…The output of the calibration signal is connected to 128 flip-flops to sample FPGA voltage fluctuations. According to the authors in [SGS23], the routing delays between the calibration module output and flip-flop inputs can sense voltage fluctuations. The RDS sensor proposed in [SGS23] uses general-purpose segments to create routing delays (incur in FPGA switch boxes)…”

“…The state-of-the-art on-chip sensors often operate at lower frequencies. The TDC sensor proposed in [SGMT18] operated at maximum 96 MHz, the RO-voltage sensor proposed in [GDTL19] operated at maximum 250 MHz, the VITI sensor proposed in [UJS + 22a] operated at a maximum of 96 MHz, the PPWM sensor proposed in [UJS + 22b] operated at maximum 96 MHz and the RDS sensor proposed in [SGS23] operated at maximum 200 MHz. Therefore, the proposed 1LUTSensor has demonstrated the ability to operate at more than 2× the operating frequency of the state-of-the-art on-chip sensors.…”

“…Five differing on-chip sensors have been thus far utilized to perform RPA attacks. These are Time to Digital Converter (TDC) [SGMT18], Ring Oscillator (RO) voltage sensor [GDTL19], Voltage Induced Time Interval (VITI) [UJS + 22a] sensor, Power Pulse Width Modulation (PPWM) [UJS + 22b] sensor and Routing Delay Sensor (RDS) [SGS23] sensor. TDC and RO were originally created more than a quarter century ago for the measurement of signal delays [ABC + 18] and have been successfully used to measure FPGA power fluctuations such that RPA attacks can be carried out [ZSZF13,SGMT18].…”

“…1LUTSensor proposed in this paper uses the FPGA LUT construct to form a delay line (which can also be adjusted at run-time for tuning the proposed sensor) to sense FPGA voltage fluctuations which only consume ¼ of an FPGA Slice (1 LUT and 1 flipflop). Therefore, 1LUTSensor is 136×, 512×, 4×, 3× and 160× more area efficient when compared to state-of-the-art TDC [SGMT18], , VITI [UJS + 22a], PPWM [UJS + 22b] and RDS [SGS23] sensors, respectively. 1LUTSensor uses FPGA LUT multiplexers to form a run-time adjustable delay line to sense FPGA voltage fluctuations to conduct RPA attacks.…”