Cryptology ePrint Archive: Report 2016/641

Bitstream Fault Injections (BiFI) – Automated Fault Attacks against SRAM-based FPGAs

Pawel Swierczynski and Georg T. Becker and Amir Moradi and Christof Paar

Abstract: This contribution is concerned with the question whether an adversary can automatically manipulate an unknown FPGA bitstream realizing a cryptographic primitive such that the underlying secret key is revealed. In general, if an attacker has full knowledge about the bitstream structure and can make changes to the target FPGA design, she can alter the bitstream leading to key recovery. However, this requires challenging reverse-engineering steps in practice. We argue that this is a major reason why bitstream fault injection attacks have been largely neglected in the past. In this paper, we show that malicious bitstream modifications are i) much easier to conduct than commonly assumed and ii) surprisingly powerful. We introduce a novel class of bitstream fault injection (BiFI) attacks which does not require any reverse-engineering. Our attacks can be automatically mounted without any detailed knowledge about either the bitstream format of the design or the crypto primitive which is being attacked. Bitstream encryption features do not necessarily prevent our attack if the integrity of the encrypted bitstream is not carefully checked. We have successfully verified the feasibility of our attacks in practice by considering several publicly available AES designs. As target platforms, we have conducted our experiments on Spartan-6 and Virtex-5 Xilinx FPGAs.

Category / Keywords: FPGA security, bitstream fault injection, automated key recovery, AES, bitstream encryption vulnerability

Original Publication (with minor differences): IEEE Tran­sac­tions on Com­pu­ters

Date: received 20 Jun 2016, last revised 28 Dec 2016

Contact author: pawel swierczynski at rub de

Available format(s): PDF | BibTeX Citation

Version: 20161228:194013 (All versions of this report)

Short URL: ia.cr/2016/641

Discussion forum: Show discussion | Start new discussion


[ Cryptology ePrint archive ]