Laser-based fault injections are currently the most efficient technique that can be used to attack a secure system, since they have very high timing and location precision. Several papers have shown that a secret key may be recovered from ASICs and countermeasures have been proposed. But little research has been addressed at the specific case of secure protected implementations in SRAM-based FPGAs. This paper presents the results of laser-based fault injections on an architecture computing the AES encryption algorithm, protected by an error detection scheme, and implemented on a Virtex device. The results are compared to previous emulated fault injection campaigns and prove the criticality of remnant errors in the configuration of a FPGA used for secure applications. An improved countermeasure is also proposed and validated with a new experimental campaign.

Programmable devices like SRAM-based FPGAs, thanks to their low cost and high flexibility, are increasingly used for security applications; the mam drawback is their configuration memory, sensitive to perturbations. Symmetric cryptosystems are highly vulnerable to fault injections [1], but very few papers have reported laser-based fault attacks onto a secure implementation on a SRAM-based FPGA.

In the field of the Side Channel Analysis (SCA), the electromagnetic radiation of a cryptographic device is the richest source of information. Indeed, it permits to be more accurate by positioning smartly the EM probe near a given logic, filtering the signal that is not useful regarding a given attack. But this advantage can become easily a drawback if the attacker is unable to position her probe onto the device. Our contribution consists in giving an accurate method detecting an hot spot onto the device, i.e. the position where a correlation electromagnetic attack (CEMA) should be the most successful. This strategy is based on an indicator evaluated during a cartography. Its performance has been tested on an hardware AES implemented on an Altera Stratix II.

In this paper, we study the security of Schnorr based identification and signature schemes. Like the carry attack of Fouque et al. at CHES last year, we exploit the carry knowledge from fault attack on other public-key schemes like DSA and other ECDSA signature scheme, Schnorr and GPS authentication and signature schemes. These attacks can be used to recover very efficiently the secret key and it is worth noticing that the complexity of the attack depends on the equation involving the secret key. We also present different techniques to learn the carry leakage using fault analysis.

SRAM-based FPGAs are an appealing platform to implement many systems, including secure ones. However, secure systems are subject to attacks and one of the main threats is fault-based attacks using lasers. The sensitivity of the configuration memory in a SRAM-based FPGA has to be studied in this context. This paper reports on the characterization of the effective laser spot, or effective sensitive area, with respect to the laser focus and to the attacked configuration bits. The test vehicle is a Virtex II FPGA. It is shown in particular that the initial value of the bit has a strong influence on the effective sensitive area of the spot. Such data can be used to better understand the actual effects of an attack and to design more efficient counter-measures. Also, it is shown that attacks based on single bit flips in the configuration are possible in practice even with relatively large laser spots.

In the field of the side channel analysis, hardware distortions such as glitches and random frequency are classical countermeasures. A glitch influences the side channel amplitude while a random frequency damages the signal both in time and in amplitude. For minimizing these countermeasures effects, some trace treatments based on peak extraction or auto-correlation methods exist. However, none of them takes into account the amplitude mistake. In this paper, we show that this amplitude mistake is created by glitches but also by a random frequency. We propose then a reshaping processing that erases these effects on side channel traces both on the time and amplitude axis. The solution reconstructed a side channel signal, avoiding the hardware countermeasures and the clock relativity consequences which can be meaningful for Side Channel Attacks. Its efficiency is demonstrated on a Differential Power Attack performed on a DES implementation and on a Template Attack performed on a RSA implementation.

In this paper, we present a new fault attack on elliptic curve scalar product algorithms. This attack is tailored to work on the classical Montgomery ladder method when the $y$-coordinate is not used. No weakness has been reported so far on such implementations, which are very efficient and were promoted by several authors. But taking into account the twist of the elliptic curves, we show how, with few faults (around one or two faults), we can retrieve the full secret exponent even if classical countermeasures are employed to prevent fault attacks. It turns out that this attack has not been anticipated as the security of the elliptic curve parameters in most standards can be strongly reduced. Especially, the attack is meaningful on some NIST or SECG parameters.

Due to their reconfigurability and their high density of resources, SRAM-based FPGAs are more and more used in embedded systems. For some applications (Pay-TV,Banking, Telecommunication ...), a high level of security is needed. FPGAs are intrinsically sensitive to ionizing effects, such as light stimulation, and attackers can try to exploit faults injected in the downloaded configuration. Previous studies presented the results obtained with multiple laser shots across different elements of the device. The exact effect of a single laser shot was not studied; a global picture of the type of generated errors was rather drawn. This work analyses the effects of a single laser shot onto the configuration memory. Results take into account several diameters of pulsed laser spots targeted on several types of logical blocks and compare theirs effects.