ElectroMagnetic Radiations of FPGAs: High Spatial Resolution Cartography and Attack of a Cryptographic Module

Laurent Sauvage (1) , Sylvain Guilley (1) , Yves Mathieu (1)

1 LTCI - Laboratoire Traitement et Communication de l'Information

Since the first announcement of a side-channel analysis (SCA) about ten years ago, considerable research has been devoted to studying these attacks on ASICs, such as smartcards or TPMs. In this paper, we compare power-line attacks with electromagnetic (EM) attacks, specifically targeting FPGAs, as those devices are becoming widely used for sensitive applications involving cryptography. We show experimentally that electromagnetic analysis (EMA) is always faster than the historical differential power-line analysis (DPA) to retrieve keys of symmetric ciphers. In addition, these analyses prove to be very convenient to conduct, as they are totally non-invasive. Research reports indicate that EMA can be conducted globally, typically with macroscopic home-made coils circling the device under attack, with fair results.However, as accurate professional EM antennas are now becoming more accessible, it has become commonplace to carry out EM analyses locally. Cartography has been carried out by optical means on circuits realized with technology greater than 250~nanometers. Nonetheless, for deep submicron technologies, the feature size of devices that are spied upon is too small to be visible with photographic techniques. In addition, the presence of the 6+ metallization layers obviously prevents a direct observation of the layout. Therefore, EM imaging is emerging as a relevant means to discover the underlying device structure. We present in this paper the first images of deep-submicron FPGAs. The resolution is not as accurate as photographic pictures: we notably compare the layout of toy design examples placed at the four corners of the FPGAs with the EM images we collected. We observe that EM imaging has the advantage of revealing active regions, which can be useful to locate a particular processor (visible while active -- invisible when inactive). In the context of EM attacks, we stress that the exact localization of the cryptographic target is not necessary: the coarse resolution we obtain is sufficient. We note that the EM imaging does not reveal the exact layout of the FPGA, but instead directly guides the attacker towards the most leaking areas. We achieve attacks with an accurate sensor, both far from (namely on a SMC capacitor on the board) and close to (namely directly over the FPGA) the encryption co-processor. As compared to the previously published attacks, we report a successful attack on a DES module in fewer than 6,300 measurements, which is currently the best cracking performance against this encryption algorithm implemented in FPGA.

Mots clés: security.

Mots clés: SCA; DPA; EMA; FPGA; cartography; security

Domaines: Micro et nanotechnologies/Microélectronique

Laurent Sauvage, Sylvain Guilley, Yves Mathieu. ElectroMagnetic Radiations of FPGAs: High Spatial Resolution Cartography and Attack of a Cryptographic Module. 2008. ⟨hal-00319164⟩