Thomas Ordas

Near-Field Mapping System to Scan in Time Domain the Magnetic Emissions of Integrated Circuits

This paper introduces a low cost near-field mapping system. This system scans automatically and dynamically, in the time domain, the magnetic field emitted by integrated circuits during the execution of a repetitive set of instructions. Application of this measurement system is given to an industrial chip designed with a 180nm CMOS process. This application demonstrates the efficiency of the system but also the helpfulness of the results obtained to identify paths followed by the current, enabling to locate the potential IR drop zones.

Voltage Spikes on the Substrate to Obtain Timing Faults

Fault attacks are widely deployed against secure devices by hardware evaluation centers. While the least expensive fault injection techniques, like clock or voltage glitches, are well taken into account in secure devices by dedicated hardware counter-measures, more advanced techniques, such as light based attacks, require huge investments. This paper presents a new way to induce faults at a moderate cost that may defeat already in place hardware counter-measures. To demonstrate its effectiveness we applied this technique on an ASIC component. For this demonstration, fault exploitation is operated using the classic Bell core attack applied on a modular exponentiation supported by a modular arithmetic co-processor.

Assessment of the Immunity of Unshielded Multi-Core Integrated Circuits to Near-Field Injection

This paper presents a comparative assessment of the electromagnetic immunity of 4 integrated logic cores to near-field injection. These cores, located on the same die, are identical from a functional point of view, but differ by their design strategies. The injection is performed above each core according to the 6 components of the electromagnetic field, using appropriate probes. These results demonstrate that the die and bondwires of an integrated circuit can be sensitive to both magnetic and electric fields, and that some design rules can improve the immunity of integrated circuits to near-field interference.

Enhancing Electromagnetic Analysis Using Magnitude Squared Incoherence

This paper demonstrates that magnitude squared incoherence (MSI) analysis is efficient to localize hot spots, i.e., points at which focused electromagnetic (EM) analyses can be applied with success. It is also demonstrated that MSI may be applied to enhance differential EM analyses (DEMA) based on difference of means (DoM).

Modeling time domain magnetic emissions of ICs

ElectroMagnetic (EM) radiations of Integrated Circuits (IC) is for many years a main problem from an ElectroMagnetic Compatibility (EMC) point-of-view. But with the increasing use of secure embedded systems, and the apparition of new attacks based on the exploitation of physical leakages of such secure ICs, it is now also a critical problem for secure IC designers. Indeed, EM radiations of an IC, and more precisely the magnetic component, can be exploited to retrieve sensible data such as, the secret key of cryptographic algorithms. Within this context, this paper aims at introducing a magnetic field simulation flow allowing predicting, with high spatial and time resolutions, the magnetic radiations of IC cores. Such a flow being mandatory to predict the robustness of secure ICs before fabrication against EM attacks.

Triple Rail Logic Robustness against DPA

Side channel attacks are known to be efficient techniques to retrieve secret data. Within this context, the scope of this paper is to evaluate, on and for FPGA, the robustness of triple rail logic against power analyses. More precisely, this paper aims at demonstrating that the basic concepts on which leans this logic are valid and may provide interesting design guidelines to obtain DPA (differential power analysis) resistant circuits.

Evaluation of countermeasures against electromagnetic analysis

The scope of this paper is twofold. (1) It aims at introducing a low cost near-field mapping system. This system scans automatically and dynamically, in both time and frequency domains, the magnetic field emitted by integrated circuits during the execution of any repetitive sequence of instructions. In the time domain, this system is used to automatically obtain a full chip Simple ElectroMagnetic Analysis (SEMA). (2) To describe the application of this system for the evaluation of certain design and technological countermeasures against malicious electromagnetic analyses.