Fault model of electromagnetic attacks targeting ring oscillator-based true random number generators

Abstract

International audienceMany side channels including power consumption, electromagnetic emanation, optical radiation, and even sound have been studied since the first publication of a side channel attack at the end of the 1990s. Most of these channels can be relatively easily used for an overall analysis of the cryptographic system (implementation of efficient passive attacks) or for injection of faults. Until recently, only the optical channel allowed both analysis of locally leaked information and precise injection of faults (single-bit errors). Recent works showed that the near-field electromagnetic channel enables similar results to be obtained. Like the optical channel, the near-field electromagnetic channel allows both active and passive attacks, which, in addition, can be theoretically non-invasive and contactless. However, the cost of the attack bench that is needed to exploit the near-field electromagnetic channel is less than that of an optical channel. Recently, we showed that it is possible to use the near-field electromagnetic channel to perform an efficient active attack targeting the true random number generator (TRNG) based on ring oscillators. In cryptography, TRNGs are chiefly used to generate encryption keys and other critical security parameters, so the proposed active attack could have serious consequences for the security of the whole cryptographic system. Here, we present the coupling of a passive attack and an active attack. The proposed coupled attack first uses a spectral differential analysis of the TRNG electromagnetic radiation to obtain valuable information on the position of ring oscillators and their frequency range. This information is then used to tune the electromagnetic harmonic signal to temporarily synchronize the ring oscillators. In this paper, we propose a fault model of the entropy extractor which shows that the behavior of the ring oscillators changes, and that it occurs additional and unwanted “fake rising edges” of the clock signal which disturb the flip-flops involved in such TRNGs. The effectiveness of our proposed coupled attack questions the use of ring oscillators in the design of TRNGs

Taxonomy and Challenges of Out-of-Band Signal Injection Attacks and Defenses

“…The term (sensor) spoofing [8], [9], [14], [43] was also Injection [5], [13], [35], [38], [41]- [44] Intentional Interference [5], [10], [12], [36], [38], [40], [42], [49] Non-Linearity [11], [54], [55], [68] Spoofing [8], [9], [14], [43] Other (See Text) [7], [53], [67] avoided for similar reasons: it has an overloaded meaning in authentication contexts and with in-band signal injection attacks [6], [52]. Moreover, it does not capture the physical aspect of injections, and does not accurately describe coarsegrained attacks which lead to saturation of a sensor.…”

“…Early research into the properties of MEMS gyroscopes had shown that high-power acoustic noise at or near the resonant 2 Much like the original work by Markettos and Moore [35]. However, Bayon et al [36], [49] targeted a more realistic TRNG composed of 50 ROs. frequency can degrade the performance of the sensor [126]- [128].…”

Towards a Dependable True Random Number Generator With Self-Repair Capabilities

“…• Attack countermeasures: TRNGs are susceptible to many different attacks because of their paramount im-portance in critical systems. In recent times, several attacks have been presented against some specific TRNGs [29][14] [24]. Some of these attacks can be thwarted by adding lightweight countermeasures in the original design.…”

Hardware Security For and Beyond CMOS Technology

“…Therefore, fault injection can also support or advance side-channels attacks. Fault-injection attacks cover direct, invasive fault injection, e.g., by laser light [18] or electromagnetic waves [8,11], as well as indirect fault injection, e.g., by repetitive writing to particular memory locations [19] or by deliberate "misuse" of dynamic voltage and frequency scaling (DVFS) features [9].…”