Jrn-Marc Schmidt joern-marc.schmidt@iaik.tugraz.at Fault Injection - - PowerPoint PPT Presentation

▶
j rn marc schmidt
SMART_READER_LITE
LIVE PREVIEW

Jrn-Marc Schmidt joern-marc.schmidt@iaik.tugraz.at Fault Injection - - PowerPoint PPT Presentation

Sep 05, 2023 265 likes •608 views

Jrn-Marc Schmidt joern-marc.schmidt@iaik.tugraz.at Fault Injection Plaintext Faulty Ciphertext But how to inject a fault? Fault: Injection Model Exploitation Non-invasive Device is not altered physical Semi-invasive

slide-1
SLIDE 1

Jörn-Marc Schmidt

joern-marc.schmidt@iaik.tugraz.at

slide-2
SLIDE 2

Plaintext Ciphertext Fault Injection Faulty

But how to inject a fault?

slide-3
SLIDE 3

Fault:

  • Injection
  • Model
  • Exploitation
slide-4
SLIDE 4

Non-invasive Device is not altered physical Semi-invasive De-packaging, no electrical contact Invasive No limits

slide-5
SLIDE 5

Active (Fault Attacks) Passive (Observing Attacks) Non-Invasive Glitch attacks, Power Spikes, … Side-Channel Attacks Semi-Invasive Optical Fault Injection, … Optical inspection (ROM, …) Invasive Permanent circuit changes, … Probing, …

slide-6
SLIDE 6

Probing station Oscilloscope Focused Ion Beam (FIB) Microscope

slide-7
SLIDE 7
slide-8
SLIDE 8
  • Class I

Clever Outsider

  • Class II

Knowledgeable Insider

  • Class III

Funded Company

slide-9
SLIDE 9
slide-10
SLIDE 10
slide-11
SLIDE 11
slide-12
SLIDE 12

Decapsulation Procedure:

1. Mill a hole 2. Etch with Fuming Nitric Acid 3. Clean with Ultrasonic treatment in Acetone

slide-13
SLIDE 13
slide-14
SLIDE 14
  • Light creates electron / hole pair
  • Near np junction: hole moves to p, electron to n region
  • Results in current and maybe a transition of a transistor
  • Called Optical Beam Induced Current (OBIC)

Light n region p region Electron Hole

slide-15
SLIDE 15
slide-16
SLIDE 16
  • Fault Type

–Transient –Permanent –Destructive

  • Timing
  • Precision

(Bit, Byte, Word)

  • Set, Flip, Program Flow..
slide-17
SLIDE 17

pq d M pq q d M p d M CRT Sig mod mod ) mod , mod ( = = pq p d M pq q d M p d M CRT Sig mod mod ) mod , mod ( ∆ + = + = δ ) , ( pq Sig Sig GCD p − =

p, q: large primes M: message to sign d: secret key

a random fault

slide-18
SLIDE 18

Manipulation of:

– Loops – Checks

  • Repeat

transmit (*MSG_address); MSG_length+ + ; MSG_address+ + ; until(MSG_length= = 5);

slide-19
SLIDE 19
slide-20
SLIDE 20
slide-21
SLIDE 21
slide-22
SLIDE 22
slide-23
SLIDE 23
slide-24
SLIDE 24
slide-25
SLIDE 25

AddRoundKey SubBytes ShiftRows AddRoundKey … Ciphertext MixColumns

  • Alter Ciphertext
  • Set Bit before SB
  • Fault before MC

(𝜀, 0,0,0)

slide-26
SLIDE 26

Error Messages Timing Electromagnetic Emanation Power Consumption Fault Injection

slide-27
SLIDE 27
slide-28
SLIDE 28
slide-29
SLIDE 29

0 =

R

slide-30
SLIDE 30
slide-31
SLIDE 31
  • An adversary can inject more than a single fault.
  • Can we do better than doubling?
  • How to built efficient side-channel and fault

countermeasures?

slide-32
SLIDE 32
  • Fault attacks are powerful
  • Possible attacks depend on adversary
  • Stick to realistic fault models