When Failure Analysis Meets Side-Channel Attacks

Abstract

Abstract. The purpose of failure analysis is to locate the source of a defect in order to characterize it, using different techniques (laser stimulation, light emission, electromagnetic emission...). Moreover, the aim of vulnerability analysis, and particularly side-channel analysis, is to observe and collect various leakages information of an integrated circuit (power consumption, electromagnetic emission ...) in order to extract sensitive data. Although these two activities appear to be distincted, they have in common the observation and extraction of information about a circuit behavior. The purpose of this paper is to explain how and why these activities should be combined. Firstly it is shown that the leakage due to the light emitted during normal operation of a CMOS circuit can be used to set up an attack based on the DPA/DEMA technique. Then a second method based on laser stimulation is presented, improving the "traditional" attacks by injecting a photocurrent, which results in a punctual increase of the power consumption of a circuit. These techniques are demonstrated on an FPGA device.

Why Cryptography Should Not Rely on Physical Attack Complexity

“…To show that photonic side channel attacks are a real threat to cryptographic devices, other researchers suggested further research in this direction as well: "An interesting point for future research will be to re-do these experiments on [...] low-cost systems to validate the real benefit of them" [59]. We accomplished this task and showed that successful photonic side channel attacks do not require an awfully expensive measurement system.…”

“…In 2011, an integrated PICA system and laser stimulation techniques were used to attack a DES implementation on an FPGA [59]. The authors show that the optical side channel can be used for differential analysis.…”

“…Again, no attacks using temporal information were demonstrated, but emission images for ⊕ operations were successfully analyzed. In 2011, a fragment of the DES algorithm on an FPGA was attacked with a differential photonic emission analysis [59]. The authors partially recovered the secret key using temporally resolved measurements.…”

Smart Grid Cyber Security: An Overview of Threats and Countermeasures

“…3.2.1 Electromagnetic Attacks These attacks deal with discerning the encoded plaintext of a power line message through the leakage of electromagnetic radiation [63,64]. These attacks use special probes placed at various locations along the unit or circuit in question.…”

“…These faults can be anything from unusual environmental conditions (increased heat, for example), the injection of a laser beam at the appropriate frequency [64], or the injection of data packets that collide with legitimate packets [71]. The work of Yuan and Liu [72][73][74] has shown the load redistribution attack.…”