True random number generators (TRNGs) are ubiquitous in data security as one of basic cryptographic primitives. They are primarily used as generators of confidential keys, to initialize vectors, to pad values, but also as random masks generators in some side channel attacks countermeasures. As such, they must have good statistical properties, be unpredictable and robust against attacks. This paper presents a contactless and local active attack on ring oscillators (ROs) based TRNGs using electromagnetic fields. Experiments show that in a TRNG featuring fifty ROs, the impact of a local electromagnetic emanation on the ROs is so strong, that it is possible to lock them on the injected signal and thus to control the monobit bias of the TRNG output even when low power electromagnetic fields are exploited. These results confirm practically that the electromagnetic waves used for harmonic signal injection may represent a serious security threat for secure circuits that embed RO-based TRNG.

The electromagnetic (EM) side channel is a well known source of information leakage. It may be used to conduct passive attacks in order to retrieve sensitive data handled by a secure device. However, the EM medium may also be used to conduct active attacks. Two kinds of near-field EM perturbations are usually considered: tran- sient pulses and harmonic emissions. We report in this talk our most recent results related to transient pulses. We provide a detailed in- sight into the use of two different techniques dedicated to the injec- tion of transient faults into a running circuit. Such faults permit us to mount successfully standard differential fault analysis against AES and DES. Fault injection experiments on microcontrollers, FPGA and ASICs will be describe. We also report first explanations on the fault injection mechanism.

The paper aims at demonstrating experimentally that the tiny Electro Magnetic (EM) coupling between the tip end of a micro-antenna is sufficient to locally and directly inject power into CMOS Integrated Circuits (IC). More precisely, experimental results show that such electrical couplings are sufficient to disturb, with and without removing the IC package, the behavior of 90nm CMOS Ring Oscillators, a representative structure of CMOS logic but also a constituting element of some True Random Number Generators (TRNGs) or clock generator.

Electro-Magnetic Analysis has been identified as an efficient technique to retrieve the secret key of cryptographic algorithms. Although similar mathematically speaking, Power or Electro-Magnetic Analysis have different advantages in practice. Among the advantages of EM Analysis, the feasibility of attacking limited and bounded area of integrated systems is the key one. Within this context, the contribution of this paper is a countermeasure against local EM attack performed with tiny magnetic probes. The basic idea is to design circuits such that all datapaths and D-type Flip-Flops, involved in the computation of intermediate values of cryptographic elements, randomly change within a set of logically equivalent electrical paths that are spatially distributed within the Integrated Circuit (IC) die.