Superscalar processors exploit Instruction-Level Parallelism (ILP) in programs by executing several instructions in parallel to increase performance. Out-of-order issue and register renaming are two strategies to exploit ILP even more but their area cost and power consumption deter their usage in an embedded context. Allowing instructions to end execution out-oforder is another way to increase performance while still issuing instructions in-order.Write-After-Write (WAW) dependences between instructions are one of the causes of ILP loss. We propose a mechanism to eliminate the related hazards. Added to out-of-order execution completion, it increases the overall processor performance. Our solution has been implemented in CVA6, an open-source superscalar RISC-V processor. We have run many benchmarks, synthesis and power simulation. Our solution results in a performance gain of 4.2% in average, and up to 17% depending on the benchmark. It also resulted in an core area reduction by 2.9%. It reduced power consumption by 6% on the key generation of a NIST-standardized PQC signature algorithm, Dilithium 3, while increasing its execution speed by 3.4%.

This paper introduces a novel sensor that is capable of detecting faults injected by electromagnetic disturbances. The sensor has been designed from an understanding of the physical mechanisms of ElectroMagnetic Fault Injection (EMFI). A recent study has identified an EMFI mechanism based on the timing violation fault model, which highlights the coexistence of two distinct mechanisms: electromagnetic disturbances that are coupled to the target’s power distribution network, which can cause timing faults by extending the propagation time of logic gates beyond the clock period, and disturbances that are coupled to the target’s clock distribution network, which can cause timing constraint violations due to EMFI-induced voltage glitches within the target’s clock tree. Building on this work, we have investigated the mechanism of EMFI-induced clock glitches, providing useful insights for designing a new sensor. The sensor incorporates two dummy clock paths that are maintained in a frozen state within the circuit. Both paths are respectively capable of detecting both positive and negative EMFI-induced glitches along these paths. The proposed sensor offers significant advantages, including full digitization, ease of implementation, low cost in terms of silicon area, low power consumption, and a high fault detection rate. Accurate design and experimental tests were performed on an FPGA board. Validation experiments were supported by spatial and temporal sensitivity maps covering the full-frequency spectrum of the target, which confirmed the effectiveness of the sensor.

Fault injection attacks can be carried out against an operating circuit by exposing it to EM perturbations. These attacks can be detected using embedded digital sensors based on the EM fault injection mechanism, as the one introduced by El Baze et al. [1] which uses the sampling fault model [2], [3]. We tested on an experimental basis the efficiency of this sensor embedded in the AES accelerator of an FPGA. It proved effective when the target was clocked at moderate frequency (the injected faults were consistent with the sampling fault model). As the clock frequency was progressively increased, faults started to escape detection, which raises warnings about possible limitations of the sampling model. Further tests at frequencies close to the target maximal frequency revealed faults injected according to a timing fault model. Both series of experimental results ascertain that EM injection can follow at least two different fault models. Undetected faults and the existence of different fault injection mechanisms cast doubt upon the use of sensors based on a single model.

As the number of IoT objects is growing fast, power consumption and security become a major concern in the design of integrated circuits. Lightweight Cryptography (LWC) algorithms aim to secure the communications of these connected objects at the lowest energy impact. To reduce the energy footprint of cryptographic primitives, several LWC hardware implementations embedding hybrid CMOS/MRAM-based cells have been investigated. These architectures use the non-volatile characteristic of MRAM to store data manipulated in the algorithm computation. We provide in this work a security evaluation of a hybrid CMOS/MRAM hardware implementation of the ASCON cipher, a finalist of the National Institute of Standards and Technology LWC contest. We focus on a simulation flow using the current EDA tools capable of carrying out power analysis for side-channel attacks, for the purpose of assessing potential weaknesses of MRAM hybridization. Differential Power Analysis (DPA) and Correlation Power Analysis (CPA) are conducted on the postroute and parasitic annoted netlist of the design. The results show that the hybrid implementation does not significantly lower the security feature compared to a reference CMOS implementation.

Investigating the dynamics and mechanisms of Electromagnetic Fault Injection (EMFI) attacks, which expose an active circuit to electromagnetic disturbances, presents a persisting challenge due to the diverse and complex fault mechanisms involved. An improved understanding of EMFI modeling is paramount for developing proficient on-chip detection sensors, serving as countermeasures to these attacks. In light of this, our research evaluated the effectiveness of EMFI detection sensors, introduced by Elbaze et al., which rest on the premise that the sampling fault model accounts for EMFI. To assess the functionality of these sensors, we integrated them into an Advanced Encryption Standard (AES) accelerator of a Field-Programmable Gate Array (FPGA) and performed a series of experiments. The resulting evidence suggests that the explanation for EMFI is not a singular fault model but rather, two underlying mechanisms are implicated. At high frequencies, which corresponds to low slack, electromagnetic disturbances, in tandem with the target's Power Distribution Network (PDN), initiated timing constraint violations. This violation subsequently increased the logic propagation times, surpassing the clock period. Contrarily, at low to moderate frequencies, the induced faults generally aligned with the sampling fault model. However, certain deviations from the theoretical framework called into question the model's validity. Upon a deeper examination of the results, we determined that these faults, rather than being sampling faults, were tied to a different mechanism. Electromagnetic disturbances, when coupled with a target's Clock Distribution Network (CDN), can cause timing constraint violations due to EMFI-induced voltage glitches within the target's clock tree. By integrating the mechanisms of EMFI-induced clock glitches and timing faults into the timing violations fault model, we attain a holistic comprehension of EMFI mechanisms. It encapsulates both mechanisms induced by EMFI, spanning the full-frequency spectrum of the target.

Control-Flow Integrity (CFI) is used to check a program execution flow and detect whether it is correctly executed and not altered by software or physical attacks. This paper presents a CFI verification system for programs executed on RISC- V cores. Our solution is based on the RISC- V instruction Trace Encoder (TE). The TE provides information about the execution path of the user program. Two approaches are proposed. One is consistent with the RISC- V TE standard. It permits to detect instruction skip attacks on function calls, on their returns and on branch instructions. The second implies an evolution of the RISC- V TE specifications to detect more complex fault models as the corruption of any discontinuity instruction. We implemented both approaches on a RISC-V core and simulated their efficiency against Fault Injection Attacks (FIA). Compared to existing CFI solutions, our methodology does not modify the user application code nor the RISC- V compiler.

This work reports LFI experiments carried out on custom CMOS 65 nm digital test gates, aiming at tuning the parameters of a compact electrical model. Like in previous works, we observed a difference in behavior in the induced faults when using nanosecond and picosecond range laser pulse duration. However, our experimental results showed that the laser-sensitive areas were restricted to the PMOS transistors for ns laser pulses, contrary to what was previously stated in the literature. For ps pulse duration, these works outline the sensitivity of both the NMOS and PMOS of an SRAM cell following the theoretical model of LFI. These experiments help to calibrate the parameters of a compact electrical model, allowing the simulation of LFI attacks (using SPICE-like CAD tools). This compact model is built upon previous works, with simplifications to facilitate its use. Once tuned, simulations using the proposed compact model exhibit a good correlation with the experimental results.

Studies on laser induced IR-drop are recent and still not much covered. Since laser-induced IR-drop can amplify the well-known effects of induced photoelectric currents in ICs, this work aims to present important characteristics of such effect. Understanding the characteristics and effects of laser induced IR-drop in ICs allows the elaboration of more accurate simulation models, and consequently helps in the design of countermeasures that mitigate the effects of laser illumination. Simulations and experiments were performed in order to understand the relationship of the laser pulse width and the decoupling capacitance of the power supply network with the induced IR-drop. The results showed that the maximum variation of the supply voltage depends on the laser pulse duration, and on other circuit characteristics, such as RLC parameters of the supply network. It was possible to observe by simulations and experiments that, for the proposed circuit, the maximum variation of the supply voltage occurred for a laser pulse greater than or equal to 1 μs. Regarding the decoupling capacitance variation, the results showed that for a decoupling capacitor up to 100 pF, the IR-drop becomes even more relevant with a variation up to 97% of VDD.

Laser injection is a powerful fault injection technique with a high spatial accuracy which allows an adversary to efficiently extract the secret information from an electronic device. The control and the repeatability of faults requires the attacker to understand the relation of the fault model to the setup (notably the laser spot size) and the process node of the target device. Most studies on laser fault injection report fault models resulting from a photo-electric current in CMOS transistors. This study provides a black-box analysis of the effect of a photo-electric current in floating-gate transistors of two embedded NOR Flash memories from two different manufacturers. Experimental results demonstrate that single-bit bit-set faults can be injected in code and data without corrupting the Flash memory, even with a laser spot of more than 20 μm in diameter, which is several orders of magnitude larger than the process node of the floating-gate transistors in the experiments. This article also presents the specifics of performing a "safe-error" attack on AES, leveraging the previously detailed single-bit bit-set fault model.

Fault injection techniques allow an attacker to alter the behavior of an electronic device in order to extract confidential information or be granted unauthorized privileges. To this end, local electromagnetic fault injections (EMFI) are commonly used to corrupt or prevent the execution of instructions. However, little attention is devoted to practical data corruption. This article investigates the local effects of EMFI on data transfer from the Flash memory to the 128-bit data buffer of a cortex-M microcontroller. We demonstrate that the corrupted bits are closely related to the location of the injection probe, allowing us to set or reset from 0 to 128 bits with a byte-level precision. Moreover, the spatial and temporal accuracy of the injection technique allowed us to target the data prefetch mechanism without corrupting the code execution. We highlight the efficiency of the derived fault model with three practical case studies. Firstly, we demonstrate precise key-zeroing and key-setting capability, with further extension to a DFA on the secret key of a cipher from Biham and Shamir, that was never implemented practically. Next, we report practical persistent faults on ARM microcontroller, which allows an attacker to retrieve the secret key of a cipher with a single successful injection.

Fault Attacks methods like Electro-Magnetic PulseInjection or Body Biasing Injection have recently been demon-strated to be efficient against smartcards and Systems on Chip. As of now, security is a main constraint in product development, even for low-cost products riding the trend of the IoT (mostof these devices operate in hostile environments). Unfortunately, the implementation of hardware countermeasures has a costin silicon area, design time and performance. Therefore, it isimportant to develop protections while taking into account theircosts and easyness of implementation. One way to achieve theseends would be to have an all-in-one fully digital detector whoseintegration is compliant with the standard cell design flow. Inthis perspective, we propose an enhanced sensor to detect severaltypes of attacks by exploiting analog phenomena induced at thegate level, instead of the attack itself. This paper describes thedesign and the implementation into FPGAs of this sensor, as wellas experimental tests demonstrating its effectiveness for detectingelectro-magnetic and body bias fault injection attempts.

Laser fault injection into SRAM cells is a widely used technique to perform fault attacks. In previous works, Roscian and Sarafianos studied the relations between the layout of the cell, its different laser-sensitive areas and their associated fault model using 50 ns duration laser pulses. In this paper, we report similar experiments carried out using shorter laser pulses (30 ps duration instead of 50 ns). Laser-sensitive areas that did not appear at 50 ns were observed. Additionally, these experiments confirmed the validity of the bit-set/bit-reset fault model over the bit-flip one. We also propose an upgrade of the simulation model they used to take into account laser pulses in the picosecond range. Finally, we performed additional laser fault injection experiments on the RAM memory of a microcontroller to validate the previous results.

Supply voltage glitches are a well-known fault injection method used to attack electronic circuits. The aim of this paper is to identify the specific threats of mixed signal systems and to provide some solutions to ensure their security. Indeed, many Systems on Chip use both analog and digital circuits but, most of the time, the security of such application is considered only from an exclusively digital or sometimes analog point of view. However, in mixed-signals systems, analog and digital solutions coexist and must be considered as a unique system to ensure the security of the whole application. In this purpose, this paper gives an overview of voltage glitch attacks effects and countermeasures for analog and digital blocks as part of Mixed-Signal SoCs (AMS-SoCs). It also emphasizes the unique behavior of mixed-signal circuits during glitch attacks and suggest some guidelines to associate efficiently analog and digital solutions to secure a mixed-signal system.

A study on power consumption of a digital synchronous circuit in advanced CMOS technology is performed. These technologies target low power applications allowing accurate power analysis. A model of power signature is developed to identify data related consumption using current consumption and power delivery network capacitance at design phase. In addition to digital power characterization tool, device junction capacitance is extracted and used to provide an accurate power signature. Simulations are compared to experimental traces on a synchronous digital circuit to validate the approach. This model can also be used for complex analog/digital circuit. Finally two countermeasures masking and decoupling capacitance flattening are analyzed with our methodology in early design phase allowing to anticipate silicon tests.

Differential Fault Analysis (DFA) is a real threat for elliptic curve cryptosystems. This paper describes an elliptic curve cryptoprocessor unit resistant against fault injection. This resistance is provided by the use of parity preserving logic gates in the operating structure of the ECC unit, which is based on borrow-save adders. The proposed countermeasure provides a high coverage fault detection and induces an acceptable area overhead (+ 38 %).

Differential fault attacks become a threat of increasing importance against cryptographic devices. One of the most efficient hardware countermeasures for block ciphers to prevent such attacks relies on duplication. Novel techniques to implement a duplication scheme for the AES are proposed. Remarkably, the proposed techniques do not impact on the throughput/area ratio and better withstand a large variety of known fault attacks.

The widening spectrum of applications and services provided by portable and embedded devices brings a new dimension of concerns in security. Most of those embedded systems (pay-TV, PDAs, mobile phones, etc.) make use of external memory. As a result, the main problem is that data and instructions are constantly exchanged between memory (RAM) and CPU in clear form on the bus. This memory may contain confidential data like commercial software or private contents, which either the end-user or the content provider is willing to protect. The paper describes the problem of processor-memory bus communications in this regard and the existing techniques applied to secure the communication channel through encryption. Performance overheads implied by those solutions are discussed extensively.

Summary form only given. This work presents the design of complex arbitration modules, like those required in SoC communication systems. Clock-less, delay-insensitive arbiters are studied from the perspective of making easier and more practical the design of future GALS or GALA SoCs. This work focuses on high-level modeling and delay-insensitive implementations of low-power and reliable fixed and dynamic priority arbiters.