Time Resolved Imaging: From logical states to events, a new and efficient pattern matching method for VLSI analysis

Bascoul, Guillaume; Perdu, Philippe; Benigni, Andrea; Dudit, Sylvain; Celi, Guillaume; Lewis, Dean

doi:10.1016/j.microrel.2011.06.043

Cited by 8 publications

(5 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Specifically in the failure analysis community, hotcarrier luminescence has primarily been used to characterize implementation and manufacturing faults and defects [8,18]. Here, the technologies of choice to perform backside analysis are PICA (Picosecond Imaging Circuit Analysis) [1] and SSPDs (Superconducting Single Photon Detectors) [19]. Both technologies are able to capture photonic emissions with high performance in their respective field, but carry the downside of immense cost and complexity.…”

Section: Related Workmentioning

confidence: 99%

“…The key bytes affecting the round 2 SBox accesses: (a) for state byte 1, (b) for state byte 3. Note that the key bytes on the diagonal (1,6,11,16) determine the state bytes of the 1 st column at the end of round 1, and the key bytes on the left and right columns determine the 2 nd round key.…”

Section: The Solvermentioning

confidence: 99%

“…we use equation (1) only to investigate the effect of changing the voltage, or the current, of the transistor. According to [15] an SRAM access during the first round of AES occurs once every ≈ 800ns and all 16 accesses are presented in a 13000ns trace.…”

Section: The Photonic Emissions Simulatormentioning

confidence: 99%

See 2 more Smart Citations

Simple Photonic Emission Attack with Reduced Data Complexity

Carmon

Seifert

Wool

2016

Constructive Side-Channel Analysis and Secure Design

View full text Add to dashboard Cite

This work proposes substantial algorithmic enhancements to the SPEA attack of Schlösser et al. [16] by adding cryptographic postprocessing, and improved signal processing to the photonic measurement phase. Our improved approach provides three crucial benefits: (1) For some SBox/SRAM configurations the original SPEA method is unable to identify a unique key, and terminates with up to 2 48 key candidates; using our new solver we are able to find the correct key regardless of the respective SBox/SRAM configuration. (2) Our methods reduce the number of required (complex photonic) measurements by an order of magnitude, thereby shortening the duration of the attack significantly. (3) Due to the unavailability of the attack equipment of Schlösser et al. [16] we additionally developed a novel Photonic Emission Simulator which we matched against the real equipment of the original SPEA work. With this simulator we were able to verify our enhanced SPEA attack by a full AES recovery which uses only a small number of photonic measurements.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: The Solvermentioning

confidence: 99%

See 1 more Smart Citation

Simple Photonic Emission Attack with Reduced Data Complexity

Carmon

Seifert

Wool

2016

Constructive Side-Channel Analysis and Secure Design

View full text Add to dashboard Cite

show abstract

“…In the failure analysis community hot-carrier luminescence has been used primarily to characterize implementation and manufacturing faults and defects [6,15]. In this field the technology of choice to perform backside analysis is PICA [1] and superconducting single photon detectors [17]. Both technologies are able to capture photonic emission with high performance in their respective field, but carry the downside of immense cost and complexity.…”

Section: Related Workmentioning

confidence: 99%

Simple Photonic Emission Analysis of AES

Schlösser

Nedospasov

Krämer

et al. 2012

Lecture Notes in Computer Science

View full text Add to dashboard Cite

This work presents a novel low-cost optoelectronic setup for time-and spatially resolved analysis of photonic emissions and a corresponding methodology, Simple Photonic Emission Analysis (SPEA). Observing the backside of ICs, the system captures extremly weak photoemissions from switching transistors and relates them to program running in the chip. SPEA utilizes both spatial and temporal information about these emissions to perform side channel analysis of ICs. We successfully performed SPEA of a proof-of-concept AES implementation and were able to recover the full AES secret key by monitoring accesses to the S-Box. This attack directly exploits the side channel leakage of a single transistor and requires no additional data processing. The system costs and the necessary time for an attack are comparable to power analysis techniques. The presented approach significantly reduces the amount of effort required to perform attacks based on photonic emission analysis and allows AES key recovery in a relevant amount of time.

show abstract

“…Various techniques have been implemented by our team to help design debug and failure analysis process [3,4].…”

Section: Introductionmentioning

confidence: 99%

Signal propagation analysis by Digital Lock-in Time Resolved Imaging

Bascoul

Perdu

Lewis

2012

2012 19th IEEE International Symposium on the Physical and Failure Analysis of Integrated Circuits

View full text Add to dashboard Cite

Time Resolved Imaging (TRI) allows real time imaging of transitions in CMOS gates. This technique has been validated down to low power 45 nm technology. TRI is very useful to analyze signal propagation after a clock edge. Nevertheless, TRI dimensional (x, y, t) data are not well adapted for direct visualization of propagation times: (x, y, t) data allows either a movie output or a slice by slice visualization for each time step or a chosen spot chronograms. To overcome these limitations, we have developed and validated a new signal propagation analysis technique by Digital Lock-in Time Resolved Imaging. It gives a 2D image of propagation time that can be used for accurate analysis of signal propagation.

show abstract

Time Resolved Imaging: From logical states to events, a new and efficient pattern matching method for VLSI analysis

Cited by 8 publications

References 10 publications

Simple Photonic Emission Attack with Reduced Data Complexity

Simple Photonic Emission Attack with Reduced Data Complexity

Simple Photonic Emission Analysis of AES

Signal propagation analysis by Digital Lock-in Time Resolved Imaging

Contact Info

Product

Resources

About