Voltage glitches are a fault injection technique that aim at disrupting the power supply such that the data or instruction flow in a chip can be modified. In 2019, a new class of voltage glitches was introduced based on arbitrary voltage supply waveforms that are generated by polynomial interpolation over randomly chosen points. Despite their demonstrated success in practical studies, many questions remained unanswered, e.g., what are the relevant characteristics of the waveform that enable this success? To answer this, we investigate the waveform generation process itself, prior to applying any type of automated search. In addition, we perform an in-depth analysis of (non-)working voltage glitches. Furthermore, we introduce the notion of specificity for glitches, by studying how waveforms can be generated that achieve very specific goals, such as a double instruction skip. We compare our results based on a real-world benchmark for firmware extraction and demonstrate that our insights lead to a reset/success ratio that is improved by a factor of 13.5 compared to previous work. This amplifies the threat of this class of voltage glitches.

Battery-backed security enclosures that are permanently monitored for penetration and tampering are common solutions for providing physical integrity to multi-chip embedded systems. This paper presents a well-tailored measurement system for a batteryless PUF-based capacitive enclosure. The key is derived from the PUF and encrypts the underlying system. We present a system concept for combined enclosure integrity verification and PUF evaluation. The system performs differential capacitive measurements inside the enclosure by applying stimulus signals with a 180° phase shift that isolate the local variation in the femtofarad range. The analog circuitry and corresponding digital signal processing chain perform precise PUF digitization, using a microcontroller-based digital lock-in amplifier. The system's measurement range is approximately ±73 fF, the conversion time per PUF node is less than 0.6 ms, and the raw data shows a measurement noise of 0.3 fF. This is the base for a high-entropy key generation while enabling a short system startup time. The system is scalable to the enclosure size and has been experimentally verified to extract information from 128 PUF nodes, using a system prototype. The results show that our concept forms a cornerstone of a novel batteryless PUF-based security enclosure.