Electromagnetic Fault Injection (EMFI) has become an established technique for fault injection in embedded systems. EMFI has several advantages compared to other fault injection techniques and its effectiveness has been proven in practice. Currently, the application of non-trivial EMFI experiments is limited by the high cost of advanced lab equipment and therefore unavailable for broader security research. We propose AutoPulse, a cost-effective and complete EMFI research platform based on commercial 3D printer hardware and publish the project documentation and software as open source. We show that our platform significantly reduces the cost of EMFI in practice and conduct a comprehensive literature survey to conclude that our platform specifications are sufficient to attack even modern SoCs with high clock rates. We evaluate AutoPulse by characteriizing the ESP32 micro controller and reproducing an EMFI attack on the execution pipeline. Our key observations imply that the publication of faults and attacks requires careful assessment of the parameter space and the commonly published fault maps strongly depend on process parameters that should be specified.
Fault Injection Attacks (FIAs) pose significant security threats to embedded devices, compromising the security of critical systems. Although the implications of Fault Injection (FI) are well understood for embedded platforms exhibiting Reduced Instruction Set Computer (RISC) architectures, Complex Instruction Set Computer (CISC) platforms have received much less attention in security research. Modern x86 processors employ variable-length instructions spanning 1 to 15 bytes, creating unique vulnerability patterns that remain largely unexplored in existing FI research.We present the first systematic study of Electro-Magnetic Fault Injection (EMFI) attacks against variable-length Instruction Set Architectures (ISAs), highlighting misalignment effects. Our research introduces a novel fault model that demonstrates how strategically induced bit flips in instruction opcodes cause decoder misalignment, ultimately leading to the execution of completely different code sequences. We provide proof-of-concept evidence on Intel N100 hardware, showing how EMFI can transform a NOP instruction sequence into an equivalent-length ADD sequence, demonstrating novel misalignment vulnerabilities specific to variable-length ISAs.
Machine learning and neural networks experience growing usage in resource-constrained devices. However, moving neural networks to small devices also brings new requirements regarding the reliability and security of the networks and their hardware. In many areas, such as autonomous driving, the device must detect possible errors during execution to ensure safe functionality. Moreover, an adversary can gain physical access to the device, opening the door for hardware attacks like fault injections that target misclassification or parameter retrieval. This work proposes a fault detection mechanism for software implementations of neural networks running on a microcontroller to increase the reliability and security of the neural network. Our technique uses AN-codes, a type of error-detecting code, to detect errors in calculations within the neural network without any implications on the accuracy of protected networks. In addition, signature checking ensures the integrity of the control flow. Simulations and real-world testing show that our mechanism successfully detects faults in all possible locations in the neural network’s program code. Despite the robustness of our fault detection mechanism, it has an overhead in code size of only about 10%, independent of the implemented network. The memory usage increases by at most 232 bytes independently of the neural network size, ensuring that the mechanism is not overly burdensome for the memory.
Fault injection attacks pose a critical threat to embedded systems by intentionally inducing hardware-level disturbances that cause unintended program behavior. While software-based tools offer a fast and platform-independent approach for detecting such vulnerabilities, existing instruction set emulation (ISE)-based tools can produce misclassifications due to incomplete system emulation. Moreover, the lack of standardized benchmarks impedes fair evaluation of these tools. In this work, we address these limitations by introducing a rehosting technique that significantly improves the accuracy of ISE-based fault vulnerability detection. Our approach reconstructs memory and register states by executing the target binary in QEMU or native machine, capturing its runtime state, and importing it into the emulator. This enables accurate reproduction of system initialization, including ELF relocations, memory-mapped I/O, and architecture-specific alias regions. We conduct a comprehensive evaluation of seven open-source tools, including the state-of-the-art tool FaultFinder, using the Fault Injection and Simulation Secure Collection (FISSC) dataset and multiple fault models. Compared to the original FaultFinder, our rehosted version eliminates all false negatives related to state initialization and achieves 99%-100% recall while maintaining precision above 88%. Additionally, we construct a labeled benchmark dataset by aggregating and manually verifying the vulnerabilities detected by the tools, which reduces the manual inspection space-originally requiring full instruction coverage-by over 83%. Our findings establish a new baseline for fair and accurate evaluation of software-based fault vulnerability detection tools and demonstrate the effectiveness of rehosting in enhancing emulator fidelity.
In nonce-based authenticated encryption schemes, fault attacks such as differential fault analysis are not applicable to due to the uniqueness of the nonce. In this context, Dobraunig et al. (SAC 2018) showed that Statistical Ineffective Fault Attacks (SIFA) remain applicable and powerful. The authors proposed a SIFA-based attack strategy targeting the initialization in nonce-based authenticated encryption schemes and demonstrated its practicality using a common fault method: instruction skip.In this work, we provide a more in-depth analysis of this attack strategy, with a focus on instruction skip as the fault method. First, we model common instruction skip scenarios in practice and formalize the probability that a fault is ineffective. Our analysis reveals that this probability depends on the instruction type and the device architecture. Notably, we show that it is practically inefficient to obtain a sufficient number of ineffective faults for SIFA when skipping an XOR instruction on 32-bit or 64-bit systems, where register data tends to be uniformly distributed. Second, we prove that, in certain authenticated encryption implementations, the intermediate value targeted by the attack unexpectedly remains unbiased under ineffective faults, making SIFA inapplicable. As a case study, we demonstrate this behavior in an 8-bit Ascon implementation.
The FLASH interface is a crucial component in modern Microcontrollers (MCUs), serving as an intermediary for transferring instructions between the processor and program memory. Previous studies have demonstrated the effectiveness of Electromagnetic Fault Injection (EMFI) and Laser Fault Injection (LFI) in disrupting the operation of FLASH accelerators, leading to instruction line replay and skip faults. However these studies are limited to the case of sequential code and to a single FLASH interface configuration of the target MCU. In this work, we present an investigation on the impact of Body Bias Injection (BBI) on the FLASH accelerator in a 32-bit MCU.The experiments confirm that BBI can similarly induce instruction line replay and skip faults. A detailed analysis of the fault manifestations under various operational configurations of the FLASH accelerator is provided. The study has also extended the fault model to the case of branch operation (non-sequential code).This research contributes a refined understanding of FLASH interface fault behavior under BBI, and highlights the security implication of the decorrelated design between the Program Counter and the FLASH interface.
The Unbalanced Oil and Vinegar (UOV) construction is the foundation of several post-quantum digital signature algorithms currently under consideration in NIST’s standardization process for additional post-quantum digital signature schemes. This paper introduces new single fault injection attacks against the signing procedure of deterministic variants of signature schemes based on the UOV construction. We show how these attacks can be applied to attack MAYO and PROV, two signature schemes submitted to the NIST call for additional post-quantum signature schemes. The attacks are demonstrated with reference implementations that run on an ARM Cortex-M4 processor. Our attacks do not require precise triggering or precise fault injection capabilities. Any type of fault in large portions of the code has the potential to result in successful key recovery. We demonstrate our attacks with very cheap equipment and simple clock glitching techniques, enabling the recovery of the secret key with either two faulty signatures or one correct signature and one faulty signature in the case of MAYO and one correct signature and two faulty signatures in case of PROV. The fact that our attacks do not require precise fault injection capabilities and can be successful with only a few signatures makes them particularly powerful, hence harmful for the implementation security of post-quantum digital signature schemes.
Fault injection simulators are essential tools for evaluating the robustness of software programs against hardware faults. Instruction-level simulators offer high speed but lack accuracy, whereas register-transfer level (RTL) simulators provide high accuracy but are slow. This paper demonstrates that the accuracy of instruction-level simulators can be significantly improved by modeling fault effects observed in RTL-level simulations and incorporating those models into the instruction-level simulator. The fault effect models are designed to capture only architecturally visible changes to the CPU state. We first introduce a model based on characterization on the probabilities of observed fault effects, which improves upon traditional models such as NOP and instruction bitflip. By observing how faults affect specific CPU registers, we improve this further and define the ‘regonly’ model. This model achieves significantly higher accuracy than the other models with respect to RTL-level simulations, without incurring the computational overhead associated with RTLbased simulations.
Modern mobile devices such as smartphones make use of complex Systems-on-Chip (SoC) that often come with a DRAM chip stacked above the SoC. This packaging method that was designed to increase space efficiency is called a Package-on-Package (PoP). PoP has also an incidental impact on local Fault Injection methods such as Electromagnetic Fault Injection (EMFI). This paper shows that conventional EMFI may not always be the most effective approach for inducing faults into a SoC implemented in a PoP. We provide and compare methodologies to successfully induce faults within this kind of target. A PoP DRAM can be removed while keeping the SoC operationnal during the first boot stages. We applied this method and used conventional EMFI on a SoC without DRAM. We also present a new way to induce voltage glitches on the target power supply rail by using EM pulses. Conventional voltage glitches are also performed in order to compare the faults obtained. It appeared that faults injected by EM-induced glitches are closer to faults obtained with conventional EMFI than faults induced by conventional voltage glitches.
MAYO is a multivariate signature scheme notable for its efficiency and compact key size. Targeting NIST security level I, MAYO features a public key size of 1168 bytes and a signature size of 321 bytes, making it more compact than leading lattice-based signature schemes like Falcon and Dilithium, thereby easing integration into embedded systems. With the deployment of MAYO in embedded systems, studying the resilience of MAYO implementations against fault injection attacks is of increasing importance. In this paper, we investigate the security of MAYO against fault injection attacks, and present the first end-to-end fault injection attack on the multivariate scheme. The attack introduces a loop-abort fault in the sampling of the vinegar vector. We present two variants: A zero-ing attack, in which the skipped sampling results in an all-zero vinegar vector, and a differential fault attack. In both variants, the faulted signature reveals an oil vector, allowing for full key recovery through techniques borrowed from the reconciliation attack in a few seconds.
While several approaches exist to locate spatial coordinates on a chip that are susceptible to Side-Channel Analysis (SCA), e.g., Test Vector Leakage Assessment (TVLA), so far, an equivalent for localized Electro-Magnetic (EM) based Fault Injection Analysis (FIA) is missing. This work analyzes the spatial relationship between EM emanation and Electro-Magnetic Fault Injection (EMFI) susceptibility and effect. Our experiments are based on a two-step approach where we first capture a heatmap based on a single trace per location, which is then used to find promising spatial EMFI positions. We chose an STM32F303 microcontroller, which shows that the injection locations that result in data modification are almost entirely contained within areas of high Signal-to-Noise Ratio (SNR). An EMFI based attack can be accelerated up significantly using this relationship.
Module Lattice Digital Signature Algorithm (ML-DSA) is a post-quantum digital signature algorithm currently being standardised by the NIST. Devices making use of ML-DSA are expected to soon become generally available in various environments. It is thus important to assess the resistance of ML-DSA implementations to physical attacks. This paper presents a fault injection attack on hedged ML-DSA in ARM Cortex-M4. First, voltage glitching is performed to skip computation of a seed during the generation of the signature. We identified settings that allowed us to consistently skip the necessary function without crashing the device. After the fault injection, the secret key vector s(1) is derived directly from the resulting faulty signature. The attack succeeds in recovering s1 from a single trace with a probability of around 53%. We also propose countermeasures against the presented attack.
Flip-chip BGA (ball grid array) implementation offers advantages such as shorter signal wires and a smaller footprint compared to conventional wire-bonding face-up packaging technology. These characteristics are also well-suited for advanced packaging technologies such as 2.5D or 3D packaging. Si-substrate backside of IC chips are open and exposed in flip-chip packaging. In the context of hardware security, attackers can access to the backside of an IC chip easily and use the Si-substrate backside as a contact point for fault injection and side-channel attacks. In this paper, we show that high voltage pulsing (HVP) injection over Si-substrate backside could be a serious threat as IC chips become thinner for low profile and chip stacking. First, using simulations comparing injection from the frontside and from the backside, we show that the HVP injection from the backside has the characteristic ability to induce faults in targeted circuits over a small area and explain the physical mechanism behind this ability. It is also shown that this ability becomes more pronounced as IC chips become thinner. Secondly, we prepare a Si prototype chip and confirm this characteristic ability by experimental results. It is shown that HVP over Si-substrate backside can target flip-flops (the size of each flip-flop is about 13 m times 3 mu m) in the area with an accuracy of about 50 mu m times 50 mu m and reproducibly causes bit flips associated with the targeted bytes. Finally, the threat of this attack is demonstrated by performing differential fault analysis (DFA) on AES-128bit and obtaining entire secret key bytes.
The success of deep learning across a variety of applications, including inference on edge devices, has led to increased concerns about the privacy of users’ data and deep learning models. Secure multiparty computation allows parties to remedy this concern, resulting in a growth in the number of such proposals and improvements in their efficiency. The majority of secure inference protocols relying on multiparty computation assume that the client does not deviate from the protocol and passively attempts to extract information. Yet clients, driven by different incentives, can act maliciously to actively deviate from the protocol and disclose the deep learning model owner’s private information. Interestingly, faults are well understood in multiparty computation-related literature, although fault attacks have not been explored. Our paper introduces the very first fault attack against secure inference implementations relying on garbled circuits as a prime example of multiparty computation schemes. In this regard, laser fault injection coupled with a model-extraction attack is successfully mounted against existing solutions that have been assumed to be secure against active attacks. Notably, the number of queries required for the attack is equal to that of the best model-extraction attack mounted against the secure inference engines under the semi-honest scenario.
Embedded devices commonly rely on digital signatures to ensure both integrity and authentication. For example, digital signatures are typically verified during the boot process or firmware updates to verify the integrity of a system. They are also used to ensure authenticity of a communication party in secure protocols. Fault injection can be used to tamper with a device in order to cause malfunctioning during cryptographic computations. For example, fault injections can be used to disturb digital signing operations. With the right type of fault an attacker can compute private keys from faulted signatures. However, fault injections can also be used during verification to get maliciously crafted digital signatures accepted during signature verification with catastrophic consequences for the security of an embedded device. In this paper, we introduce new non-obvious fault injection attacks on the verification routines of Dilithium and Falconsignature schemes, which allow an attacker to get signatures for arbitrary messages accepted by fault injection. We demonstrate the feasibility of our attacks by simulations using an ARM Cortex-M4 and the pqm4 library as a target of evaluation and pinpoint vulnerable instructions. Finally, we propose and discuss possible countermeasures against these attacks.
Fault injection attacks are used to overcome security mechanisms of embedded devices. While this can be done with low-cost equipment for simple targets and attack types, more sophisticated targets require a higher precision and better equipment. Precise parameters can also help to increase reliability and thus minimize the probability of damage, which is essential for forensic data extraction. In this work, we present a novel iterative method for finding suitable parameter combinations for fault injection attacks based on Voronoi tessellation, an algorithm for partitioning a space into cells based on the given input points. This method can reduce the number of parameter combinations to be tested before finding a successful combination, while preserving optimal candidate solutions. We show that the method can work with an arbitrary number of parameters and arbitrary result shapes. In addition, we show some algorithmic refinements that can help reduce computation time for high-dimensional parameter spaces. This allows not only the optimization of parameter-intensive attack types, but also the inclusion of non-essential parameters to further improve the reliability of the results. Simulation results show the potential of the proposed method, especially when it comes to minimizing the number of resets performed. Likewise, we discuss the problems encountered when applying this method to sensitive real devices and propose solutions to overcome them.
Post-quantum cryptosystems are often designed s ng from a public key encryption algorithm and augmented with widely reco: ed cryptographic constructions, which in turn are shared among the majority of proposals and create common targets for fault attacks, but also opportunities for overarching countermeasures. In this talk, we survey the fault resilience of these recurring structures in both Key Encapsulation Methods (KEMs) and signature schemes, taking as case studies both the current KEMs selected for the fourth round in the US NIST standardization process, and its on-ramp for post-quantum signatures.
White-box cryptography aims at protecting software implementations of cryptographic algorithms when the attacker has complete control over the execution environment. Since the early 2000's, white-box implementations of block ciphers have received great interest from the community. Nevertheless and despite the needs of the industry, asymmetric cryptography has not really been studied in this context for many years. Indeed, it was only in 2020 that Zhou et al. published the very first asymmetric white-box design which aims at protecting ECDSA implementations. Their publication was a great step forward for the community which could finally tackle the subject of asymmetric white-box. In this paper, we study the security of this scheme and we exhibit efficient ways to recover the private key by using fault analysis. Indeed, we detail two different attacks which require two fault injections only to obtain the corresponding ECDSA private key. Finally, we also suggest a countermeasure that prevents both our attacks without impacting the size of the white-box or the performances of the scheme.
Voltage glitches are a fault injection technique that aim at disrupting the power supply such that the data or instruction flow in a chip can be modified. In 2019, a new class of voltage glitches was introduced based on arbitrary voltage supply waveforms that are generated by polynomial interpolation over randomly chosen points. Despite their demonstrated success in practical studies, many questions remained unanswered, e.g., what are the relevant characteristics of the waveform that enable this success? To answer this, we investigate the waveform generation process itself, prior to applying any type of automated search. In addition, we perform an in-depth analysis of (non-)working voltage glitches. Furthermore, we introduce the notion of specificity for glitches, by studying how waveforms can be generated that achieve very specific goals, such as a double instruction skip. We compare our results based on a real-world benchmark for firmware extraction and demonstrate that our insights lead to a reset/success ratio that is improved by a factor of 13.5 compared to previous work. This amplifies the threat of this class of voltage glitches.
DeepCover [6] is a secure authenticator circuit family developed by Analog Devices. It was designed to provide cryptographic functions, true random number generation, and EEPROM secure storage. DS28C36 is one of the DeepCover family, which is widely used in secure boot and secure download for IoT. It has been recently deployed in the Coldcard Mk4 hardware wallet [3] as a second secure element to enhance its security. In this paper, we present for the first time, a detailed evaluation for the DS28C36 secure EEPROM against Laser Fault Injection (LFI). In the context of a black box approach, we prove by experimental results that the chip resists single fault attacks. In order to overcome this, we present the use of leakage detection such as Welch's T-test to facilitate finding the correct moments for injecting successful faults, which is not common in Fault Injection (FI) as this method has been used only for Side-Channel Attacks (SCAs). By using this knowledge, we found two moments for injecting laser pulses to extract the protected EEPROM user pages with 99% success rate. The attack can be reproduced within a day. The presented attack negatively impacts the users of DS28C36 (including Coldcard Mk4).
