Electromagnetic Fault Injection Research Articles

Analysis of EM Fault Injection on Bit-sliced Number Theoretic Transform Software in Dilithium

Bitslicing is a software implementation technique that treats an N -bit processor datapath as N parallel single-bit datapaths. Bitslicing is particularly useful to implement data-parallel algorithms, algorithms that apply the same operation sequence to every element of a vector. Indeed, a bit-wise processor instruction applies the same logical operation to every single-bit slice. A second benefit of bitsliced execution is that the natural spatial redundancy of bitsliced software can support countermeasures against fault attacks. A k -redundant program on an N -bit processor then runs as N/k parallel redundant slices. In this contribution, we combine these two benefits of bitslicing to implement a fault countermeasure for the number-theoretic transform (NTT) . The NTT efficiently implements a polynomial multiplication. The internal symmetry of the NTT algorithm lends itself to a data-parallel implementation, and hence it is a good candidate for the redundantly bitsliced implementation. We implement a redundantly bitsliced NTT on an advanced 667MHz ARM Cortex-A9 processor, and study the fault coverage for the protected NTT under optimized electromagnetic fault injection (EMFI) . Our work brings two major contributions. First, we show for the first time how to develop a redundantly bitsliced version of the NTT. We integrate the protected NTT into a full Dilithium signature sequence. Second, we demonstrate an EMFI analysis on a prototype implementation of the Dilithium signature sequence on ARM Cortex-M9. We perform a detailed EM fault-injection parameter search to optimize the location, intensity and timing of injected EM pulses. We demonstrate that, under optimized fault injection parameters, about 10% of the injected faults become potentially exploitable. However, the redundantly bitsliced NTT design is able to catch the majority of these potentially exploitable faults, even when the remainder of the Dilithium algorithm as well as the control flow is left unprotected. To our knowledge, this is the first demonstration of a bitslice-redundant design of the NTT that offers distributed fault detection throughout the execution of the algorithm.

Software countermeasures against the multiple instructions skip fault model

In this work, we proposed two software countermeasures (CMs) for the detection of multiple instructions skips caused by Fault Injection (FI). The first CM is based on code duplication and uses a hardware dedicated counter. The implementation of this method consists in the duplication of instructions previously turned into an idempotent form and the insertion of dedicated instructions incrementing a hardware counter in between the groups of duplicated instructions. The second CM is based on the insertion of Sensitive instruction (SI)s into a block of instructions as sensors of instruction skips. The SI is chosen based on the observed Fault Model (FM) at bit level. We experimentally validated the effectiveness of the two CMs in a 32-bit Microcontroller Unit (MCU) using Laser Fault Injection (LFI) and Electromagnetic Fault Injection (EMFI). First, the skip of multiple instructions was obtained with a fault rate of 100%. The FM at bit level was identified to be bit-reset rather than bit-set. Second, we carried out LFI and EMFI experiments to the protected codes to validate the effectiveness of the CMs. In both cases, the results showed that the proposed methods are effective to detect multiple instructions skip faults.

Experimental EMFI detection on a RISC-V core using the Trace Verifier solution

Physical attacks are powerful threats that can cause changes in the execution behavior of a program. Control-Flow Integrity (CFI) is used to check the program’s flow execution, ensuring that it remains unaltered by these attacks. The RISC-V Trace Encoder (TE) provides valuable information about the user program’s execution path, and is used as part of a CFI solution. An enhanced version of the TE specifications permits detecting intricate fault models such as the corruption of any discontinuity instruction, using an additional Trace Verifier (TV) hardware module. In this paper, we present a buffer overflow software attack simulation and experimental ElectroMagnetic Fault Injection (EMFI) attacks conducted on an Field Programmable Gate Array (FPGA) board that implements a RISC-V core linked to the enhanced TE and TV modules. Unlike existing CFI solutions, our proposed approach does not require modifications to the RISC-V compiler, user application code or the RISC-V core. The average overhead of our solution in terms of hardware area, memory and power consumption are equal to 13.6%, 3.5% and 9% respectively.

Fiddling the Twiddle Constants - Fault Injection Analysis of the Number Theoretic Transform

In this work, we present the first fault injection analysis of the Number Theoretic Transform (NTT). The NTT is an integral computation unit, widely used for polynomial multiplication in several structured lattice-based key encapsulation mechanisms (KEMs) and digital signature schemes. We identify a critical single fault vulnerability in the NTT, which severely reduces the entropy of its output. This in turn enables us to perform a wide-range of attacks applicable to lattice-based KEMs as well as signature schemes. In particular, we demonstrate novel key recovery and message recovery attacks targeting the key generation and encryption procedure of Kyber KEM. We also propose novel existential forgery attacks targeting deterministic and probabilistic signing procedure of Dilithium, followed by a novel verification bypass attack targeting its verification procedure. All proposed exploits are demonstrated with high success rate using electromagnetic fault injection on optimized implementations of Kyber and Dilithium, from the open-source pqm4 library on the ARM Cortex-M4 microcontroller. We also demonstrate that our proposed attacks are capable of bypassing concrete countermeasures against existing fault attacks on lattice-based KEMs and signature schemes. We believe our work motivates the need for more research towards development of countermeasures for the NTT against fault injection attacks.

(Adversarial) Electromagnetic Disturbance in the Industry

Faults occur naturally and are responsible for reliability concerns. Faults are also an interesting tool for attackers to extract sensitive information from secure chips. In particular, non-invasive fault attacks have received a fair amount of attention. One easy way to perturb a chip without altering it is the so-called Electromagnetic Fault Injection (EMFI). Such attack has been studied in great depth, and nowadays, it is part and parcel of the state-of-the-art. Indeed, new capabilities have emerged where EM experimental benches are used to cryptanalyze chips. The progress of this “field” is fast, in terms of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">reproducibility</i> , <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">accuracy</i> , and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">number of use-cases</i> . However, there is too little awareness about such advances. In this paper, we aim to expose the true harmfulness of EMFI (including reproducibility) to enable reasonable security quotations. We also analyze protections (at hardware/firmware/system levels) in light of their efficiency. We characterize the specificity of EM fault injection compared to other injection means (laser, glitch, probing).

Guest Editorial: Selected papers from the 24th International Conference on Information Security and Cryptology (ICISC 2021)

Guest Editorial: Selected papers from the 24th International Conference on Information Security and Cryptology (ICISC 2021)

An evolutionary fault injection settings search algorithm for attacks on safe and secure embedded systems

In this paper, we present a novel method for exploiting vulnerabilities in secure embedded bootloaders, which are the foundation of trust for modern vehicle software systems, by using a genetic algorithm to successfully identify the correct parameters to perform an electromagnetic fault injection attack. Specifically, we demonstrate the feasibility of code execution attacks by leveraging a combination of software and hardware weaknesses in the secure software update process of electronic control units (ECUs), which is standardized across the automotive industry. Our method utilizes an automated approach, eliminating the need for static code analysis, and does not require any hardware modifications to the targeted systems. Through our research, we successfully demonstrated our attack on three distinct ECUs from different manufacturers used in current vehicles. Our results prove that the use of a genetic algorithm for finding the fault parameters reduces the number of attempts necessary for a successful fault to obtain arbitrary code execution via "wild jungle jumps" by approximately 100 times compared to a naive random search.

Experimental evaluation of differential fault attack on lightweight block cipher PIPO

The recent development of Internet of Things (IoT) devices has increased related security issues. Because of the rapid increase in the use of these devices, the possibility of accessing and hijacking cryptographic devices is increasing. Consequently, active research on cryptographic technologies capable of providing a safe environment even in resource-constrained environments has been undertaken. As a result of their physical accessibility, devices are becoming more vulnerable to Side-channel analysis (SCA) security issues. To address these issues, PIPO, a lightweight block cipher, was recently proposed in ICISC 2020. The PIPO has the characteristic of providing robust security strength while having less overhead when using the SCA countermeasures. A Differential fault attack (DFA) is a type of SCA that induces fault in cryptographic operations and utilises difference information that occurs. Differential fault attacks on the PIPO have not yet been studied. For the first time, this study proposed a single-bit flip-based DFA on the PIPO. Through 64 fault ciphertexts, the proposed attack has a 98.8% probability of recovering the correct secret key of PIPO 64/128. We evaluated the proposed attack not only through simulation but also through electromagnetic fault injection (FI). Hereinafter, we were able to confirm that our attack is capable of being applied to real world devices. Therefore, the PIPO without FI countermeasure provides no security against differential fault attacks. When using the PIPO cipher on IoT devices, designers must use appropriate countermeasures against FI attacks.

SIPFA: Statistical Ineffective Persistent Faults Analysis on Feistel Ciphers

Persistent Fault Analysis (PFA) is an innovative and powerful analysis technique in which fault persists throughout the execution. The prior prominent results on PFA were on SPN block ciphers, and the security of Feistel ciphers against this attack has received less attention. In this paper, we introduce a framework to utilize Statistical Ineffective Fault Analysis (SIFA) in the persistent fault setting by proposing Statistical Ineffective Persistent Faults Analysis (SIPFA) that can be efficiently applied to Feistel ciphers in a variety of scenarios. To demonstrate the effectiveness of our technique, we apply SIFPA on three widely used Feistel schemes, DES, 3DES, and Camellia. Our analysis reveals that the secret key of these block ciphers can be extracted with a complexity of at most 250 utilizing a single unknown fault. Furthermore, we demonstrate that the secret can be recovered in a fraction of a second by increasing the adversary’s control over the injected faults. To evaluate SIPFA in a variety of scenarios, we conducted both simulations and real experiments utilizing electromagnetic fault injection on DES and 3DES.

Single-Byte Error-Based Practical Differential Fault Attack on Bit-Sliced Lightweight Block Cipher PIPO

With the recent development of the Internet of Things (IoT), related device use is increasing rapidly. As a result, accessing and hijacking the devices is an increasing security threat. The challenges of side-channel security of IoT devices are having a way of coming to the surface due to this physical accessibility. Accordingly, there is active research on lightweight block ciphers to provide security even in resource-scarce environments situations such as IoT. The bit-sliced structure increases memory and time efficiency using an implementation method that replaces a lookup table with a bit-wise operation. Therefore, it is a widely-used design technique for lightweight block ciphers. In this paper, we show a differential fault attack study, a type of side-channel analysis, targeting bit-sliced block ciphers. In particular, it proposes a novel attack rationale on the recently proposed lightweight block cipher PIPO and shows that it applies sufficiently to other bit-sliced block ciphers. The proposed attack is based on a more alleviated attacker&#x2019;s assumption than the previously proposed attack, and it shows that less than 32 fewer fault ciphertext may fully recover the 128-bit of the PIPO 64/128 secret key. It proves that the attack is practical by verifying the attack through the actual electromagnetic fault injection. It also discusses the applicability of various bit-sliced block ciphers and shows how redundancy-based countermeasures might improve fault-robustness. Therefore, when using the bit-sliced block ciphers on IoT devices, we recommend applying appropriate countermeasures against fault injection attacks.

Practical Multiple Persistent Faults Analysis

We focus on the multiple persistent faults analysis in this paper to fill existing gaps in its application in a variety of scenarios. Our major contributions are twofold. First, we propose a novel technique to apply persistent fault apply in the multiple persistent faults setting that decreases the number of survived keys and the required data. We demonstrate that by utilizing 1509 and 1448 ciphertexts, the number of survived keys after performing persistent fault analysis on AES in the presence of eight and sixteen faults can be reduced to only 29 candidates, whereas the best known attacks need 2008 and 1643 ciphertexts, respectively, with a time complexity of 250. Second, we develop generalized frameworks for retrieving the key in the ciphertext-only model. Our methods for both performing persistent fault attacks and key-recovery processes are highly flexible and provide a general trade-off between the number of required ciphertexts and the time complexity. To break AES with 16 persistent faults in the Sbox, our experiments show that the number of required ciphertexts can be decreased to 477 while the attack is still practical with respect to the time complexity. To confirm the accuracy of our methods, we performed several simulations as well as experimental validations on the ARM Cortex-M4 microcontroller with electromagnetic fault injection on AES and LED, which are two well-known block ciphers to validate the types of faults and the distribution of the number of faults in practice.

QuadSeal: Quadruple Balancing to Mitigate Power Analysis Attacks with Variability Effects and Electromagnetic Fault Injection Attacks

Side channel analysis attacks employ the emanated side channel information to deduce the secret keys from cryptographic implementations by analyzing the power traces during execution or scrutinizing faulty outputs. To be effective, a countermeasure must remove or conceal as many as possible side channels. However, many of the countermeasures against side channel attacks are applied independently. In this article, the authors present a novel countermeasure (referred to as QuadSeal ) against Power Analysis Attacks and Electromagentic Fault Injection Attacks (FIAs), which is an extension of the work proposed in Reference [27]. The proposed solution relies on algorithmically balancing both Hamming distances and Hamming weights (where the bit transitions on the registers and gates are balanced, and the total number of 1s and 0s are balanced) by the use of four identical circuits with differing inputs and modified SubByte tables. By randomly rotating the four encryptions, the system is protected against variations, path imbalances, and aging effects. After generating the ciphertext, the output of each circuit is compared against each other to detect any fault injections or to correct the faulty ciphertext to gain reliability. The proposed countermeasure allows components to be switched off to save power or to run four executions in parallel for high performance when resistance against power analysis attacks is not of high priority, which is not available with the existing countermeasures (except software based where source code can be changed). The proposed countermeasure is implemented for Advanced Encryption Standard (AES) and tested against Correlation Power Analysis and Mutual Information Attacks attacks (for up to a million traces), and none of the secret keys was found even after one million power traces (the unprotected AES circuit is vulnerable for power analysis attacks within 5,000 power traces). A detection circuit (referred to as C-FIA circuit) is operated using the algorithmic redundancy presented in four circuits of QuadSeal to mitigate Electromagnetic Fault Injection Attacks. Using Synopsys PrimeTime, we measured the power dissipation of QuadSeal registers and XOR gates to test the effectiveness of Quadruple balancing methodology. We tested the QuadSeal countermeasure with C-FIA circuit against Differential Fault Analysis Attacks up to one million traces; no bytes of the secret key were found. This is the smallest known circuit that is capable of withstanding power-based side channel attacks when electromagnetic injection attack resistance, process variations, path imbalances, and aging effects are considered.

Electromagnetic fault injection against a complex CPU, toward new micro-architectural fault models

The last years have seen the emergence of fault attacks targeting modern central processing units (CPUs). These attacks are analyzed at a very high abstraction level and, due to the modern CPUs complexity, the underlying fault effect is usually unknown. Recently, a few articles have focused on characterizing faults on modern CPUs. In this article, we focus on the electromagnetic fault injection (EMFI) characterization on a bare-metal implementation. With this approach, we discover and understand new effects on micro-architectural subsystems. We target the BCM2837 where we successfully demonstrate persistent faults on L1 instruction cache, L1 data cache and L2 cache. We also show that faults can corrupt the memory management unit (MMU). To validate our fault model, we realize a persistent fault analysis to retrieve an AES key.

Modeling and Simulating Electromagnetic Fault Injection

Electromagnetic fault injection (EMFI) has recently gained popularity as a mean to induce faults because of its inherent advantages. Despite this popularity, there is only a little information on how EMFI generates faults. Within this context, this article aims at filling this lack by proposing a complete understanding and modeling of EM induction on integrated circuits (ICs). The presented model is confronted to experiments to endorse its soundness.

Detecting Electromagnetic Injection Attack on FPGAs Using In-situ Timing Sensors

With the proliferation of embedded systems and our ever-increasing dependence on them, their security has never been more critical. Electromagnetic fault injection (EMFI) has garnered significant attention after it was found that electromagnetic (EM) pulses can cause faults in hardware and can be used to break security algorithms. In this work, we present an EMFI detector that excels at all quality metrics of a detection mechanism, namely, precision, accuracy, detection rate, and specificity. We developed this detector after careful evaluation of the most recent existing techniques for EMFI detection. We have conducted these evaluations on two different FPGA platforms and presented them in this paper. One of the most unexpected results of our study is that a previously designed sensor that was built based on a particular bit-set/reset fault model and achieved a relatively high-quality detection was, in fact, performing the detection based on a timing/sampling fault model. We conclude that despite the mixed interpretations in the previous work, the timing/sampling fault model is the most plausible way to describe EMFI effects. This work suggests that the EMFI attacks act like localized timing attacks in FPGAs, and we can detect them with low false-positive and false-negative rates using the newly proposed in-situ timing sensors. Our proposed sensors have low cost, are scalable, and can be integrated into any digital design with ease.

Improved Differential Fault Attack on LEA by Algebraic Representation of Modular Addition

Recently, as the number of IoT (Internet of Things) devices has increased, the use of lightweight cryptographic algorithms that are suitable for environments with scarce resources has also increased. Consequently, the safety of such cryptographic algorithms is becoming increasingly important. Among them, side-channel analysis methods are very realistic threats. In this paper, we propose a novel differential fault attack method on the Lightweight Encryption Algorithm (LEA) cipher which became the ISO/IEC international standard lightweight cryptographic algorithm in 2019. Previously proposed differential fault attack methods on the LEA used the Single Bit Flip model, making it difficult to apply to real devices. The proposed attack method uses a more realistic attacker assumption, the Random Word Error model. We demonstrate that the proposed attack method can be implemented on real devices using an electromagnetic fault injection setup. Our attack method has the weakest attacker assumption among attack methods proposed to date. In addition, the number of required fault-injected ciphertexts and the number of key candidates for which exhaustive search is performed are the least among all existing methods. Therefore, when implementing the LEA cipher on IoT deivces, designers must apply appropriate countermeasures against fault injection attacks.

Electromagnetic fault injection: the curse of flip-flops

Electromagnetic (EM) waves have been recently pointed out as a medium for fault injection within integrated circuits (IC). Indeed, it has been experimentally demonstrated that an EM pulse (EMP), produced with a high-voltage pulse generator and an injector similar to that used to perform EM analyses, was susceptible to create faults exploitable from a cryptanalysis viewpoint. An analysis of the induced faults revealed that they originated from timing constraint violations. In this context, this paper demonstrates that EM injection, performed with enhanced injectors, can produce not only timing faults but also bit-set and bit-reset faults on an IC at rest. This first result clearly extends the range of the threats associated with EM fault injection. It then demonstrates, considering two different ICs under operation: an FPGA and a modern microcontroller, that faults produced by EMP injection are not timing faults but correspond to a different model which is presented in this paper. This model allows to explain experimental results introduced in all former communications.