attack on dfa protected aes by simultaneous laser fault injections · 2 aes instances, one clock...

Attack on DFA protected AES by Simultaneous LaserFault Injections

Bodo Selmkea, Johann Heyszla, Georg Siglb, 08 / 16 / 2016

aFraunhofer Institue AISECbTechnische Universität München

� Laser Fault Injection

� Protected Hardware Implementation

� Symmetric algorithm (AES)

2xLFI on AES | Bodo Selmke | 08 / 16 / 2016 | 1

FA Countermeasures

1. Direct detection by specialized sensors

2. Handling of faults with various forms of redundancy (Time, Space)

Detection Raise an alarm (interrupt signal)→ Discard output of faulty ciphertext

Infection Transform ("infect") ciphertext→ Render analysis of output by DFA impossible

Our practical Investigation

Demonstrate successful attack against AES with duplication-basedcountermeasure using two simultaneous laser shots

� AES on FPGA

� Protection by a countermeasure based on hardware duplication

� Determine locations for Laser Fault Injection→ AES state registers

� Carry out Fault Injections into AES

� Apply DFA on record of output data→ Determine if attack is feasible (We used the DFA by Saha et al.)

Redundant AES DesignFeatures

AES core

� 2 AES instances, one clock cycle per round

� Infection Countermeasure based on the design by Lomné et al.

� 48 MHz clock frequency

Redundant AES DesignInfection Scheme

state 0

Δ state

outputstate 0

state 1

I state

state 1

state 0

Δ state

outputstate 0

I state

state 1 outputstate 1

state 0

Δ state

outputstate 0

state 1

I state

state 1

Redundant AES DesignFeatures cont’d

AES core

� 2 AES instances, one clock cycle per round

� Infection Countermeasure based on the design by Lomné et al.

� 48 MHz clock frequency

Generation of Trigger Signal

� Implemented on FPGA

� Adjustable delay counters, initiated with the start-signal of the AES

Device Under Test

� Xilinx Spartan-6 FPGA

� 45 nm feature size

Used Laser System

� 2× infrared (1064 nm) laserwith 800 ps pulse length

� Beams independentlypositionable by laser scanners

� Combination of both beamsby beam splitter

� 4 µm spot size

Preliminary InvestigationLocating the AES State Registers

� Attack requires knowledge of register location

� Use of dedicated FPGA-design to locate individual flip-flops

� Precision of the Laser sufficient to inject matching fault?

� 3-Step Approach to find the flip-flops of interest:1. Locate a BRAM near the area where the relevant slices are assumed2. Evaluate optimal focal plane for maximum precision3. Scan area to locate the specific flip-flops

Preliminary InvestigationFF-Verification Design

Slice n

D5FF DFF

C5FF CFF

B5FF BFF

A5FF AFF

Slice n +1

D5FF DFF

C5FF CFF

B5FF BFF

A5FF AFF

Slice #527

-30.0 -25.0 -20.0 -15.0 -10.0 -5.0 0.0 5.0 10.0 15.0 20.0 25.0 30.0x [µm]

no faultslogic errordifferent slicebit 0bit 1bit 2bit 3bit 4bit 5bit 6bit 7

� scan field 60 µm×30 µm

� step size 200 nm

� 2 laser shots per location:flip-flops initialized to 0 and 1

Slice #526

-30.0 -25.0 -20.0 -15.0 -10.0 -5.0 0.0 5.0 10.0 15.0 20.0 25.0 30.0x [µm]

Set (0→ 1) and Reset (1→ 0) sensitive areas

-30.0 -25.0 -20.0 -15.0 -10.0 -5.0 0.0 5.0 10.0 15.0 20.0 25.0 30.0x [µm]

no faults

logic error

Performing the attack on the AESProcedure

Preparation

� Positioning of both lasers according to the previous results

� Evaluation of correct timing for the fault injection

Attack

� Start AES computation

� Inject fault into state registers during round 7

� Record output

� Test if attack was successful (Perform DFA based on ciphertext pair)

Performing the attack on the AESResults

Shots Non-ExploitableFaults

Exploitable Faults Attack SuccessRatio

80000 21845 229 0.29 %

� Low success rate

� Single successful FI is sufficient

� Time to success: ≈ 5min

Problems:

� Jitter of laser shot

� Drift of laser spot location

Performing the attack on the AESFeasibility of the Attack in practice

� The attack required knowledge of the location of the state registers� Activity-Analysis can reveal location of the AES cores

� Reverse-Engineering Methods can identify locations of registers

� Matching flip-flops can be found by exhaustive search(128 combinations)

� Stress on the device is low enough (All FI on single DUT)

DiscussionCountermeasures

Prevent this attack on state registers:� Fault Space Transformation (Patranabis et al.a)

� Add an additional MixColumns / InvMixColumns Operation to one branch� The associated state register stores MixColumns-transformed version of

state� FI in the combinatorial path might be feasible

� Parity Check for altered register contents

Raising attack complexity:

� Scrambling of the flip-flop locations

� Varying timing between both AES cores

aUsing State Space Encoding To Counter Biased Fault Attacks on AES Countermeasures,2015

Conclusion

� We successfully show how two lasers can be used in an attack

� As example, broke duplication-based infective countermeasures

� Results principally affect most hardware duplication-basedcountermeasures!

Thank your for your attentionQuestions?

Contact Information

Dipl.-Ing. Bodo Selmke

Department Hardware Security (HWS)

Fraunhofer-Institute forApplied and Integrated Security (AISEC)

Address: Parkring 485748 Garching (near Munich)Germany

Internet: http://www.aisec.fraunhofer.de

Phone: +49 89 3229986-132Fax: +49 89 3229986-222E-Mail: bodo.selmke@aisec.fraunhofer.de

Backup Slides

-100.0 -80.0 -60.0 -40.0 -20.0 0.0 20.0 40.0 60.0 80.0 100.0x [µm]

no data

no faults

logic error

other flipflop

-100.0 -80.0 -60.0 -40.0 -20.0 0.0 20.0 40.0 60.0 80.0 100.0x [µm]

no data

no faults

logic error

other flipflop

Backup Slides

Slice #562

-30.0 -25.0 -20.0 -15.0 -10.0 -5.0 0.0 5.0 10.0 15.0 20.0 25.0 30.0x [µm]

Backup Slides

Total number of bit faults

-30.0 -25.0 -20.0 -15.0 -10.0 -5.0 0.0 5.0 10.0 15.0 20.0 25.0 30.0x [µm]

no faults

logic error

1 flip-flop

2 flip-flops

Backup Slides

plaintext

ciphertext

SubBytes ShiftRows MixColumns

roundkey

Key-Schedule

Backup Slides

-4.0 -3.0 -2.0 -1.0 0.0 1.0 2.0 3.0 4.0x in µm

Address = 0, Bit = 0

set + other bit(s)

rst + other bit(s)

toggle

toggle + other bit(s)

other bit(s)

no faults

-4.0 -3.0 -2.0 -1.0 0.0 1.0 2.0 3.0 4.0x in µm

set + other bit(s)

rst + other bit(s)

toggle

other bit(s)

no faults

-4.0 -3.0 -2.0 -1.0 0.0 1.0 2.0 3.0 4.0x in µm

set + other bit(s)

rst + other bit(s)

toggle

other bit(s)

no faults

Pulse energy 1.0 nJ

attack on dfa protected aes by simultaneous laser fault injections · 2 aes instances, one clock...

Documents

aes emea generation business review aes corporation · aes...

aes corp ( aes ) 10âˆ’k - university of houston law...

aes updated

presentasi aes

aes aes phr.fr i vendredi 20 août 2021

aes 2007ar

algoritmos aes

common aes reporting problems/concerns. l proper format...

aes eletropaulo_samp_algoritmo

programming bbram and efuses - xilinx.com · aes key zynq...

perfil consumidor aes eletropaulo e aes sul

amcs case study aes · 2017-09-03 · aes achieves the...

a fruitful relationship with frank gambale has resulted in...

atomic-aes: a compact implementation of the aes encryption...

aes corporation © 2014 · aes corporation © 2014 4 ....

aes 01192006

apollo mcu rtc - fujitsu...apollo2 apollo2 blue cpu...

aes brouillon

relato integrado na aes anefac arial, corpo 30 · pdf...

aes proxy08