Contactless Electromagnetic Active Attack on Ring Oscillator Based True Random Number Generator

Abstract

International audienceTrue random number generators (TRNGs) are ubiquitous in data security as one of basic cryptographic primitives. They are primarily used as generators of con fidential keys, to initialize vectors, to pad values, but also as random masks generators in some side channel attacks countermeasures. As such, they must have good statistical properties, be unpredictable and robust against attacks. This paper presents a contactless and local active attack on ring oscillators (ROs) based TRNGs using electromagnetic fields. Experiments show that in a TRNG featuring fifty ROs, the impact of a local electromagnetic emanation on the ROs is so strong, that it is possible to lock them on the injected signal and thus to control the monobit bias of the TRNG output even when low power electromagnetic fields are exploited. These results confi rm practically that the electromagnetic waves used for harmonic signal injection may represent a serious security threat for secure circuits that embed RO-based TRNG

Towards an Oscillator Based TRNG with a Certified Entropy Rate

“…It was shown in [12] that ring oscillators are sensitive to signal injection attack which lead to synchronization of the ring oscillators and a dramatic reduction in the entropy rate of the TRNG. Further analyses (see [2], [6]) showed that even in the absence of signal injection, ring oscillators can lock on small common harmonics of their frequency. It so happens that it is possible to internally compute small common harmonics of a couple of ring oscillators and, as a consequence, predict and detect the most probable frequency-lock occurrences.…”

Electromagnetic Transmission of Intellectual Property Data to Protect FPGA Designs

“…Previous works on the electromagnetic attacks targeting true random number generators (TRNGs) showed that electromagnetic radiation can be used very efficiently for both active (fault injection [29]) and passive (side channel analysis [30]) attacks. Compared to power analysis, the attacker measuring the near-field electromagnetic emissions can obtain additional partial information about the device, since, unlike measurement of power consumption, electromagnetic radiation can be measured locally.…”

“…Moreover the electromagnetic test bench is not expensive (less than US$ 10K without an oscilloscope, which is the most expensive component). Last but not least, a spectral analysis of the electromagnetic radiation provides information on the oscillating structure such as a ring-oscillator [30]. For all these reasons, we use the electromagnetic channel for our IC/IP identification scheme.…”

Design and testing methodologies for true random number generators towards industry certification

“…For example, in [4] Markettos and Moore could manipulate "random" numbers generated in a secure commercial processor by injecting a periodic signal to its power supply. In [5], Bayon et al could manipulate numbers generated by a set of 50 ring oscillators even to a bigger extent by using strong electromagnetic fields. And in [6], Martin et al investigated the impact of power and clock glitches, temperature and underpowering on a TRNG design implemented on an FPGA.…”