Philippe Maurine

Contactless electromagnetic active attack on ring oscillator based true random number generator

True random number generators (TRNGs) are ubiquitous in data security as one of basic cryptographic primitives. They are primarily used as generators of confidential keys, to initialize vectors, to pad values, but also as random masks generators in some side channel attacks countermeasures. As such, they must have good statistical properties, be unpredictable and robust against attacks. This paper presents a contactless and local active attack on ring oscillators (ROs) based TRNGs using electromagnetic fields. Experiments show that in a TRNG featuring fifty ROs, the impact of a local electromagnetic emanation on the ROs is so strong, that it is possible to lock them on the injected signal and thus to control the monobit bias of the TRNG output even when low power electromagnetic fields are exploited. These results confirm practically that the electromagnetic waves used for harmonic signal injection may represent a serious security threat for secure circuits that embed RO-based TRNG.

Transition time modeling in deep submicron CMOS

As generally recognized, the performance of a CMOS gate, such as propagation delay time or short circuit power dissipation, is strongly affected by the nonzero input signal transition time. This paper presents an analytical model of the transition time of CMOS structures. The authors first develop the model for inverters, considering fast and slow input signal conditions, over a large design range of input-output coupling capacitance and capacitive load. They then extend this model to more complex gates. The validity of the presented model is demonstrated through a comparison with HSPICE simulations on a 0.18 /spl mu/m CMOS process.

Temperature- and Voltage-Aware Timing Analysis

In the nanometer era, the physical verification of a CMOS digital circuit becomes a long, tedious, and complex task. Designers must indeed account for numerous new factors that impose a drastic change in validation and physical-verification methods. One of these major changes in timing verification to handle process variation lies in the progressive development of statistical static-timing engines. However, the statistical approach cannot capture accurately the deterministic variations of both the voltage and temperature variations. Therefore, we define a novel method, based on nonlinear-derating coefficients, to account for these environmental variations. Based on temperature- and voltage-drop computer-aided-design tool reports, this method allows computing the propagation delay of logical paths considering the operating conditions of each cell. As the statistical timing analysis does, the proposed approach reduces design margins compared to worst/best case corner analysis with fixed voltage and temperature values, a gain of 10% on the delay has been observed for critical paths

Static Implementation of QDI Asynchronous Primitives

To fairly compare the performance of an asynchronous ASIC to its homologous synchronous one requires the availability of a dedicated asynchronous library. In this paper we present TAL_130nm a standard cell library dedicated to the design of QDI asynchronous circuits. Cell selection and sizing rules applied to develop TAL_130nm are detailed. It is shown that significant area and power savings as well as speed improvements can be obtained.

Near-Field Mapping System to Scan in Time Domain the Magnetic Emissions of Integrated Circuits

This paper introduces a low cost near-field mapping system. This system scans automatically and dynamically, in the time domain, the magnetic field emitted by integrated circuits during the execution of a repetitive set of instructions. Application of this measurement system is given to an industrial chip designed with a 180nm CMOS process. This application demonstrates the efficiency of the system but also the helpfulness of the results obtained to identify paths followed by the current, enabling to locate the potential IR drop zones.

Logical effort model extension to propagation delay representation

The logical effort method is widely recognized as a pedagogical way allowing designers to quickly estimate and optimize single paths by modeling equivalently propagation delay and transition time. However, this method necessitates a calibration of all the gates of the library and appears suboptimal in real combinatorial paths for satisfying tight timing constraints. This is due to the inability of the logical effort model in capturing I/O coupling and input ramp effects that distinguish the transition time from the propagation delay. Using an analytical modeling of the supply current that flows in simple gates during their switching process, this paper introduces an extension of the logical effort model that considers the I/O coupling capacitance and the input ramp effect. Validation of this model is performed on 130-nm STMicroelectronics technology. A compact representation of CMOS library timing performance is given as a possible application of the proposed model. The choice of sampling points to be used in look-up tables as representative steps of the design range is also discussed

Efficiency of a glitch detector against electromagnetic fault injection

The use of electromagnetic glitches has recently emerged as an effective fault injection technique for the purpose of conducting physical attacks against integrated circuits. First research works have shown that electromagnetic faults are induced by timing constraint violations and that they are also located in the vicinity of the injection probe. This paper reports the study of the efficiency of a glitch detector against EM injection. This detector was originally designed to detect any attempt of inducing timing violations by means of clock or power glitches. Because electromagnetic disturbances are more local than global, the use of a single detector proved to be inefficient. Our subsequent investigation of the use of several detectors to obtain a full fault detection coverage is reported, it also provides further insights into the properties of electromagnetic injection and into the key role played by the injection probe.

Improvement of dual rail logic as a countermeasure against DPA

Dual rail logic is considered as a relevant hardware countermeasure against Differential Power Analysis (DPA) by making power consumption data independent. In this paper, we deduce from a thorough analysis of the robustness of dual rail logic against DPA the design range in which it can be considered as effectively robust. Surprisingly this secure design range is quite narrow. We therefore propose the use of an improved logic, called Secure Triple Track Logic, as an alternative to more conventional dual rail logics. To validate the claimed benefits of the logic introduced herein, we have implemented a sensitive block of the Data Encryption Standard algorithm (DES) and carried out by simulation DPA attacks.

Embedding statistical tests for on-chip dynamic voltage and temperature monitoring

All mobile applications require high performances with very long battery life. The speed and power consumption trade-off clearly appears as a prominent challenge to optimize the overall energy efficiency. In MultiProcessor System-On-Chip architectures, the trade-off is usually achieved by dynamically adapting the supply voltage and the operating frequency of a processor cluster or of each processor at fine grain. This requires monitoring accurately, on-chip and at runtime, the supply voltage and temperature across the die. Within this context, this paper introduces a method to estimate, from on-chip measurements, using embedded statistical tests, the supply voltage and temperature of small die area using low-cost digital sensors featuring a set of ring oscillators solely. The results obtained, considering a 32nm process, demonstrate the efficiency of the proposed method. Indeed, voltage and temperature measurement errors are kept, in average, below 5mV and 7°C, respectively.

Side Channel Attacks

This chapter presents the main Side-Channel Attacks, a kind of hardware cryptanalytic techniques which exploits the physical behavior of an IC to extract secrets implied in cryptographic operations. We show in this chapter the main modern concepts about Side Channel Attacks (Simple and Differential Power Analysis) and how they can be deployed on FPGA architecture. We give also a set of details on platform and equipment needed to conduct such type of experiments. Then we propose a discussion about the leakage model of digital IC, comprising FPGA, and we illustrate these attacks on a set of real case study. We conclude this chapter by giving the latest information and link toward new efficient Side Channel Attacks.