Issue No. 03 - March (2018 vol. 67)
Pawel Swierczynski , Horst Görtz Institute for IT Security, Ruhr-Universität Bochum, Bochum, Germany
Georg T. Becker , Digital Society Institute (DSI), ESMT, Berlin, Germany
Amir Moradi , Horst Görtz Institute for IT Security, Ruhr-Universität Bochum, Bochum, Germany
Christof Paar , Horst Görtz Institute for IT Security, Ruhr-Universität Bochum, Bochum, Germany
This contribution is concerned with the question whether an adversary can automatically manipulate an unknown FPGA bitstream realizing a cryptographic primitive such that the underlying secret key is revealed. In general, if an attacker has full knowledge about the bitstream structure and can make changes to the target FPGA design, she can alter the bitstream leading to key recovery. However, this requires challenging reverse-engineering steps in practice. We argue that this is a major reason why bitstream fault injection attacks have been largely neglected in the past. In this paper, we show that malicious bitstream modifications are i) much easier to conduct than commonly assumed and ii) surprisingly powerful. We introduce a novel class of bitstream fault injection (BiFI) attacks which does
not require any reverse-engineering. Our attacks can be automatically mounted without any detailed knowledge about either the bitstream format or the design of the crypto primitive which is being attacked. Bitstream encryption features do not necessarily prevent our attack if the integrity of the encrypted bitstream is not carefully checked. We have successfully verified the feasibility of our attacks in practice by considering several publicly available AES designs. As target platforms, we have conducted our experiments on Spartan-6 and Virtex-5 Xilinx FPGAs.
Table lookup, Field programmable gate arrays, Hardware, Circuit faults, Encryption
P. Swierczynski, G. T. Becker, A. Moradi and C. Paar, "Bitstream Fault Injections (BiFI)–Automated Fault Attacks Against SRAM-Based FPGAs," in IEEE Transactions on Computers, vol. 67, no. 3, pp. 348-360, 2018.