Far-Field $Singing$ FPGAs: Repurposing Routing Fabrics into 100 m Covert Radiators

Udi Alush; Roey Amitay; Erez Danieli; Itamar Levi

Paper 2025/2299

Far-Field $Singing$ FPGAs: Repurposing Routing Fabrics into 100 m Covert Radiators

Udi Alush, Bar-Ilan University

Roey Amitay, Bar-Ilan University

Erez Danieli, Bar-Ilan University

Itamar Levi

, Bar-Ilan University

Abstract

FPGAs rely on highly dense and symmetric internal routing networks to interconnect their configurable logic ele- ments. In standard applications, these interconnects are used solely for digital signal transfer within the device, leaving many routing paths idle. We study the surprising ability of configurable FPGA routing fabrics to act as intentional radiators when struc- tured and driven coherently. Building on prior near-field demon- strations (few centimeters), we (i) present a practical toolchain and methodology for synthesizing “fabric-only” antennas using constrained placement/routing; (ii) demonstrate reliable far-field reception for extremely long ranges (≤ 100 m) and quantified bit-error performance at meter-scale ranges using ASK/FSK modulation and simple ECC; and (iii) analyze the security implications by formalizing adversary capabilities, enumerating novel multi-tenant attack vectors, and outlining detection and mitigation strategies. Our work bridges implementation engineer- ing, complex physical-layer measurement (with a set of complex Far-Field measurement apparatus), and security analysis, and highlights the urgent need for screening and runtime monitoring in shared FPGA environments. We have systematically shaped and combined unused paths into a contiguous structure, such as {Fractal, loop, Dipole, Snake, Spiral, Array}-Antennas, which required building an automation tool-chain. When energized, this embedded structure emits measurable electromagnetic energy that can serve as a stealth communication channel. We’ve extended this concept far beyond previous near-field demonstra- tions, achieving reliable reception in the Far-Field, demonstrated rigorously with various measurements setups - a first for this class of long-range FPGA-based antennas without any external radiating RF hardware from a tiny ∼ 1x1 cm2 device. We further show a Trojan example while triggering it with rare events attacking a Decryption Oracle model

Metadata

Available format(s): PDF
Category: Implementation
Publication info: Preprint.
Keywords: FPGA interconnect embedded antenna covert communication far-field hardware security side-channels routing
Contact author(s): udi alush @ biu ac il
roey amitay @ biu ac il
erez danieli @ biu ac il
itamar levi @ biu ac il
History: 2025-12-22: approved; 2025-12-21: received; See all versions
Short URL: https://ia.cr/2025/2299
License: CC BY

BibTeX

@misc{cryptoeprint:2025/2299,
      author = {Udi Alush and Roey Amitay and Erez Danieli and Itamar Levi},
      title = {Far-Field $Singing$ {FPGAs}: Repurposing Routing Fabrics into 100 m Covert Radiators},
      howpublished = {Cryptology {ePrint} Archive, Paper 2025/2299},
      year = {2025},
      url = {https://eprint.iacr.org/2025/2299}
}