Voltage Contrast SEM Observations with Microprocessor Controlled Device Timing

Bindell, J. B.; McGinn, J. N.

doi:10.1109/irps.1980.362912

Cited by 2 publications

(3 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Note that VC also works with positive ions in a Focused Ion Beam (FIB), since only the difference in charge is important. Using VC with positive ions from a FIB achieves better results 1 and the voltage interpretation of brightness and darkness is reversed compared to the SEM VC [5][6][7]. VC analysis needs the chip to be depackaged to gain access to the die surface.…”

Section: Voltage Contrastmentioning

confidence: 99%

“…With an external clock, this can be done in a trivial manner. In more complex scenarios, clock stretching [7], invasive mechanical probing or even EM based attacks on ring oscillators [4] could be feasible. By reducing the size of the ROI in the SEM a clock speed of some Hz to some kHz might be possible, as only this small region is charged and read-out.…”

Section: Dynamic Voltage Contrastmentioning

confidence: 99%

See 1 more Smart Citation

Finding the AES Bits in the Haystack: Reverse Engineering and SCA Using Voltage Contrast

Kison

Frinken

Paar

2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

In this paper, we demonstrate how the Scanning Electron Microscope (SEM) becomes a powerful tool for Side Channel Analysis (SCA) and Hardware Reverse Engineering. We locate the AES hardware circuit of a XMEGA microprocessor with Capacitive-Coupled Voltage Contrast (CCVC) images and use them in a powerful Voltage Contrast Side Channel Analysis (VCSCA). This enables an attacker to locate AES bit-wires in the top metal-layer and thus, to recover valuable netlist information. An attacker gets a valuable entry-point to look for weaknesses or Intellectual Property (IP) in the AES circuit. Additionally we show the great potential of the VCSCA in a non-invasive Side Channel Analysis for Reverse Engineering (SCARE) approach. Finally, we recover the full key of the AES hardware-engine in a practical template-based VCSCA and a no-plaintext, no-ciphertext and no-key Simple Side Channel Analysis (SSCA). We show that future VCSCA attacks present a big hardware security-risk that IC vendors need to consider. Keywords: Side channel analysis• SCA • hw reverse engineering • Voltage contrast • AES • Full key recovery • Scare

show abstract

Section: Voltage Contrastmentioning

confidence: 99%

Section: Dynamic Voltage Contrastmentioning

confidence: 99%

Finding the AES Bits in the Haystack: Reverse Engineering and SCA Using Voltage Contrast

Kison

Frinken

Paar

2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Various techniques have been developed to enhance the visibility and information content of dynamic voltage contrast images including: synchronous, quasi-static,18 stroboscopic.22,23 clock stretching modes 24. …”

mentioning

confidence: 99%

The Practical Implementation of Voltage Contrast as a Diagnostic Tool

Bertsche

Charles

1982

20th International Reliability Physics Symposium

View full text Add to dashboard Cite

The various modes of voltage contrast, their basic theory of operation, and the techniques and equipment necessary for their practical implementation in a small multipurpose scanning electron microscope (SEM) are described in detaiL The voltage contrast modes considered include: static, dynamic, quasistatic, clock stretching, synchronous, stroboscopic, and full quantitative. Details of SEM mounts and signal interconnection schemes both internal and external are presented. Techniques for mounting dual inline packages and ceramic chip carriers (C3) have proven particularly useful and are easily adaptable to most SEM types.The selection of the proper operating parameters necessary to achieve successful voltage contrast operation and micrographs is presented in detail.For example, investigations of dynamic range, voltage sensitivity, and the little described floating ground levels were performed in the case of static voltage contrast. Similarly, the effects of changing frequency and device gromund level were explored for the synchronous voltage contrast modes. Experimental devices ranged from simple transistors where the bias and signal flows could easily be understood to more complex integrated circuit chips with their multiplicity of current paths and dynamic signal patterns. The extension of the theory, fixturing and operation to even more complex devices such as LSI and VLSI circuits is discussed.

show abstract

Voltage Contrast SEM Observations with Microprocessor Controlled Device Timing

Cited by 2 publications

References 0 publications

Finding the AES Bits in the Haystack: Reverse Engineering and SCA Using Voltage Contrast

Finding the AES Bits in the Haystack: Reverse Engineering and SCA Using Voltage Contrast

The Practical Implementation of Voltage Contrast as a Diagnostic Tool

Contact Info

Product

Resources

About