Cryptology ePrint Archive: Report 2012/296

In the blink of an eye: There goes your AES key

Sergei Skorobogatov and Christopher Woods

Abstract: This paper is a short summary of a real world AES key extraction performed on a military grade FPGA marketed as 'virtually unbreakable' and 'highly secure'. We demonstrated that it is possible to extract the AES key from the Actel/Microsemi ProASIC3 chip in a time of 0.01 seconds using a new side-channel analysis technique called Pipeline Emission Analysis (PEA). This new technique does not introduce a new form of side-channel attacks (SCA), it introduces a substantially improved method of waveform analysis over conventional attack technology. It could be used to improve upon the speed at which all SCA can be performed, on any device and especially against devices previously thought to be unfeasible to break because of the time and equipment cost. Possessing the AES key for the ProASIC3 would allow an attacker to decrypt the bitstream or authenticate himself as a legitimate user and extract the bitstream from the device where no read back facility exists. This means the device is wide open to intellectual property theft, fraud and reverse engineering of the design to allow the introduction of a backdoor or Trojan. We show that with a very low cost hardware setup made with parts obtained from a local electronics distributor you can improve upon existing SCA up to a factor of x1,000,000 in time and at a fraction of the cost of existing SCA equipment.

Category / Keywords: secret-key cryptography / AES Key extraction; Side-channel analysis; FPGA bitstream encryption; Power analysis; PEA technique

Publication Info: not published anywhere yet

Date: received 28 May 2012

Contact author: sps32 at cam ac uk

Available format(s): PDF | BibTeX Citation

Version: 20120603:193705 (All versions of this report)

Short URL:

[ Cryptology ePrint archive ]