Hardware Security: Advanced Topics and Trends

Among fault injection attacks, which correctly pairs the characteristics of methods using a laser and methods using electromagnetic pulses?

  1. AA laser is often shone with near-infrared light from the back of a decapsulated chip and can target places very precisely. EM pulses are applied with a coil and sometimes work without decapsulation, but the area they affect is relatively wide
  2. BA laser passes through the package resin, so it can hit a chosen single transistor without decapsulating the chip. EM pulses cannot be used unless the chip is ground down to expose the wiring
  3. CBoth lasers and EM pulses suddenly raise the temperature of part of the chip and melt wiring or transistors, changing the circuit's function by causing permanent damage
Show answer and explanation

Answer: A. A laser is often shone with near-infrared light from the back of a decapsulated chip and can target places very precisely. EM pulses are applied with a coil and sometimes work without decapsulation, but the area they affect is relatively wide

The bandgap of silicon is about 1.12 eV, and light with wavelengths longer than about 1.1 µm is hardly absorbed. Near-infrared light around 1 µm is only weakly absorbed, so it penetrates deep from the back of a thinned substrate and is partly absorbed near the transistors, creating electron–hole pairs. The front side is covered by many metal wiring layers, so laser fault injection usually shines from the back, using the photocurrent to make specific transistors or SRAM cells malfunction. With EM pulses, a large current is passed through a coil briefly to create a strong change in magnetic field, which induces voltages in the chip's wiring and power grid and causes malfunctions. Countermeasures combine sensors that detect light or electromagnetic fields, duplication of critical computations and mechanisms that erase keys when errors are detected.

  • A. Correct. Lasers stand out for precise targeting and EM pulses for the convenience of not needing decapsulation.
  • B. A laser generally requires decapsulation, while EM pulses sometimes work without it, so this is close to the reverse.
  • C. Neither melts anything with heat; both cause temporary malfunctions through charge or induced voltage.
Practice this topic Back to topic

Books on Hardware Security: Advanced Topics and Trends Ad

As an Amazon Associate I earn from qualifying purchases.

More Hardware Security: Advanced Topics and Trends questions

  1. A fault injection attempt succeeds with a probability of 0.1% each time, and the results of attempts are independent. Which is closest to the probability of at least one success in 1,000 attempts?
  2. Suppose a firmware signature check is skipped by a single fault injection attempt with a probability of 1/1,000. The same check is now done in two places, so that the attack succeeds only if both are skipped. If one attempt can target both places at once and each is skipped independently with probability 1/1,000, what is the expected number of attempts until the attack succeeds?
  3. Among the TEEs used in confidential computing, which correctly describes the difference between VM-based TEEs that protect a whole virtual machine (such as AMD SEV-SNP and Intel TDX) and enclave-based TEEs that protect part of an application (such as Intel SGX)?
  4. Why was encrypting virtual machine memory alone considered insufficient in VM-based TEEs, so that mechanisms protecting memory integrity were added, as in AMD SEV-SNP?
  5. Consider a circuit that adds tamper detection and replay protection to memory encryption. For every 64-byte cache line, an 8-byte MAC (a code for detecting tampering) and an 8-byte counter that increases on every write are stored in main memory. Ignoring the tree that protects the counters, what is the extra storage needed as a proportion of the amount of data protected?