Paper 2011/391

On the Portability of Side-Channel Attacks - An Analysis of the Xilinx Virtex 4, Virtex 5, and Spartan 6 Bitstream Encryption Mechanism

Amir Moradi, Markus Kasper, and Christof Paar

Abstract

This paper is a short summary of our real-world side-channel analysis of the bitstream encryption mechanism provided by Xilinx FPGAs. This work covers our results analyzing the Virtex 4, Virtex 5, and Spartan 6 family showing that the encryption mechanism can be completely broken with moderate effort. The presented results provide an overview of a practical real-world analysis and should help practitioners to judge the necessity to implement side-channel countermeasures. We demonstrate sophisticated attacks on off-the-shelf FPGAs that go far beyond schoolbook attacks on 8-bit AES S-boxes. We were able to perform the key extraction by using only the measurements of a single power-up. Access to the key allows cloning and manipulating a design, which has been encrypted to protect the intellectual property and to prevent fraud. As a consequence, the target product faces serious threats like IP theft and more advanced attacks such as reverse engineering or the introduction of hardware Trojans. To the best of our knowledge, this is the first successful attack against the bitstream encryption of Xilinx Virtex 4, Virtex 5, and Spartan 6 reported in the open literature.

Metadata
Available format(s)
PDF
Category
Implementation
Publication info
Published elsewhere. Unknown where it was published
Keywords
Side-Channel Analysis
Contact author(s)
amir moradi @ rub de
History
2011-11-07: revised
2011-07-20: received
See all versions
Short URL
https://ia.cr/2011/391
License
Creative Commons Attribution
CC BY

BibTeX

@misc{cryptoeprint:2011/391,
      author = {Amir Moradi and Markus Kasper and Christof Paar},
      title = {On the Portability of Side-Channel Attacks - An Analysis of the Xilinx Virtex 4, Virtex 5, and Spartan 6 Bitstream Encryption Mechanism},
      howpublished = {Cryptology {ePrint} Archive, Paper 2011/391},
      year = {2011},
      url = {https://eprint.iacr.org/2011/391}
}
Note: In order to protect the privacy of readers, eprint.iacr.org does not use cookies or embedded third party content.