In modern cryptanalysis, an active attacker may induce errors during the computation of a cryptographic algorithm and exploit the faulty results to extract information about the secret key in embedded systems. This kind of attack is called a fault attack. There have been various attack mechanisms with diff erent fault models proposed in the literature. Among them, clock glitch faults support practically dangerous fault attacks on cryptosystems. This thesis presents an FPGA-based practical testbed for characterizing exploitable clock glitch faults and uniformly evaluating cryptographic systems against them. Concentrating on Advanced Encryption Standard (AES), simulation and experimental results illustrates proper features for the clock glitches generated by the implemented on-chip glitch generator. These glitches can be injected reliably with acceptably accurate timing. The produced faults are random but their eff ect domain is finely controllable by the attacker. These features makes clock glitch faults practically suitable for future possible complete fault attacks on AES. This research is important for investigating the viability and analysis of fault injections on various cryptographic functions in future embedded systems.

In modern cryptanalysis, an active attacker may induce errors during the computation of a cryptographic algorithm and exploit the faulty results to extract information about the secret key in embedded systems. This kind of attack is called a fault attack. There have been various attack mechanisms with diff erent fault models proposed in the literature. Among them, clock glitch faults support practically dangerous fault attacks on cryptosystems. This thesis presents an FPGA-based practical testbed for characterizing exploitable clock glitch faults and uniformly evaluating cryptographic systems against them. Concentrating on Advanced Encryption Standard (AES), simulation and experimental results illustrates proper features for the clock glitches generated by the implemented on-chip glitch generator. These glitches can be injected reliably with acceptably accurate timing. The produced faults are random but their eff ect domain is finely controllable by the attacker. These features makes clock glitch faults practically suitable for future possible complete fault attacks on AES. This research is important for investigating the viability and analysis of fault injections on various cryptographic functions in future embedded systems.

In our daily life, we are increasingly putting our trust in embedded software applications, which run on a range of processor-based embedded systems from smartcards to pay-TV units. This trend expands the threat model of embedded applications from software into hardware. Over the last 20 years, fault attacks have emerged as an important class of hardware attacks against embedded software security. In fault attacks, an adversary breaks the security by injecting well chosen, targeted faults during the execution of embedded software, and systematically analyzing softwares fault response. In this work, we propose cycle-accurate and fully digital techniques that can efficiently detect different types of fault attacks. The detection methods are low-cost regarding the area and power consumption and can be easily implemented using the standard cell based VLSI design flow. In addition to the architecture of the detectors, we present a detailed analysis of the design considerations that affect the cost and accuracy of the detectors. The functionality of the detectors is validated by implementing on ASIC and FPGA platforms (Spartan-6, Cyclone IV). Additionally, the proposed detection methods have demonstrated to successfully detect all of the injected faults without any false alarm. / Master of Science

Computer hardware researchers have perennially focussed on improving the performance of computers while stipulating the energy consumption under a strict budget. While several innovations over the years have led to high performance and energy efficient computers, more challenges have also emerged as a fallout. For example, smaller transistor devices in modern multi-core systems are afflicted with several reliability and security concerns, which were inconceivable even a decade ago. Tackling these bottlenecks happens to negatively impact the power and performance of the computers. This dissertation explores novel techniques to gracefully solve some of the pressing challenges of the modern computer design. Specifically, the proposed techniques improve the reliability of on-chip communication fabric under a high power supply noise, increase the energy-efficiency of low-power graphics processing units, and demonstrate an unprecedented security loophole of the low-power computing paradigm through rigorous hardware-based experiments.

Si un algorithme cryptographique peut être mathématiquement sûr, son implémentation matérielle quant à elle est souvent la cible de nombreuses attaques. Cette thèse porte sur l'étude des mécanismes d'injection de fautes pouvant permettre une cryptanalyse physique des circuits sécurisés et sur la conception de contre-mesures matérielles pour empêcher ces attaques.Dans un premier temps une mise en pratique d'injection de fautes sur une implémentation matérielle de l'AES a été menée à l'aide d'attaques physiques : variations statiques et dynamiques de la tension, de la fréquence, de la température et de l'environnement électromagnétique. La comparaison des fautes injectées nous a permis de conclure que ces différentes attaques partagent un mécanisme d'injection identique : la violation de contraintes temporelles.La conception et l'implémentation d'un voltmètre intégré nous a permis d'observer les perturbations internes dues aux attaques par variations transitoires de la tension. Ces observations ont permis une meilleure compréhension du mécanisme d'injection de fautes associé et une amélioration de la précision temporelle de ces injections.Ensuite, un détecteur a été implémenté et son efficacité face à des attaques électromagnétiques a été étudiée. Du fait de la localité spatiale de ces attaques, la zone effectivement protégée par le détecteur est limitée. Une implémentation de plusieurs détecteurs a été suggérée.Enfin, un nouveau chemin d'attaque exploitant la sensibilité du détecteur a été proposé et validé expérimentalement. / Even if a cryptographic algortihm could be mathematically secure, its physical implementation could be targeted by several attacks. This thesis focus on time-based fault injection mechanisms used for physical cryptanalysis of secure circuits.First, practical fault injections have been performed on a hardware AES implementation using non-invasive attacks : static and dynamic variations of the power supply voltage, frequency, temperature and electromagnetic environement. Then a comparison of these obtained faults led us to conclude that these different injection means share a common injection mecanism : timing constraints violations.An on-chip voltmeter has been designed and implemented to observe internal disturbences due to voltage glitchs. These observations led to a better understanding of the fault injection mecanism and to a better temporal accuracy.Then, a contermeasure has been designed and its effectiveness against electromagnetic attacks has been studied. Because of the electromagnetic pulses local effects, the aera effectively protected by the countermeasure is limited. The implementation of several countermeasures has been considered in order to extend the protected aera.Finally, a new attack path using the countermeasure detection threshold variations has been proposed and experimentaly validated. This attack exploit the electrical coupling between the AES and the coutnermeasure. Because of this coupling the countermeasure sensitivity variations are related to data handled by the AES.

Security of cryptographic algorithms relies on the computational difficulty of deriving the secret key using public information. Cryptanalysis, including logical and implementation attacks, plays an important role in allowing the security community to estimate their cost, based on the computational resources of an attacker. Practical implementations of cryptanalytic systems require complex designs that integrate multiple functional components with many parameters. In this thesis, methodologies are proposed to improve the design process of cryptanalytic systems and reduce the cost of design space exploration required for optimization. First, Bluespec, a rule-based HDL, is used to increase the abstraction level of hardware design and support efficient design space exploration. Bluespec is applied to implement a hardware-accelerated logical attack on ECC with optimized modular arithmetic components. The language features of Bluespec support exploration and this is demonstrated by applying Bluespec to investigate the speed area tradeoff resulting from various design parameters and demonstrating performance that is competitive with prior work. This work also proposes a testing environment for use in verifying the implementation attack resistance of secure systems. A modular design approach is used to provide separation between the device being tested and the test script, as well as portability, and openness. This yields an open-source solution that supports implementation attack testing independent of the system platform, implementation details, and type of attack under evaluation. The suitability of the proposed test environment for implementation attack vulnerability analysis is demonstrated by applying the environment to perform an implementation attack on AES. The design of complex cryptanalytic hardware can greatly benefit from better design methodologies and the results presented in this thesis advocate the importance of this aspect. / Master of Science

Les circuits cryptographiques peuvent etre victimes d'attaques en fautes visant leur implementation materielle. elles consistent a creer des fautes intentionnelles lors des calculs cryptographiques afin d'en deduire des informations confidentielles. dans le contexte de la caracterisation securitaire des circuits, nous avons ete amenes a nous interroger sur la faisabilite experimentale de certains modeles theoriques d'attaques. nous avons utilise un banc laser comme moyen d'injection de fautes.dans un premier temps, nous avons effectue des attaques en fautes dfa par laser sur un microcontroleur implementant un algorithme de cryptographie aes. nous avons reussi a exclure l'effet logique des fautes ne correspondants pas aux modeles d’attaque par un jeu precis sur l'instant et le lieu d'injection. en outre, nous avons identifie de nouvelles attaques dfa plus elargies.ensuite, nous avons etendu nos recherches a la decouverte et la mise en place de nouveaux modeles d'attaques en fautes. grace a la precision obtenue lors de nos premiers travaux, nous avons developpe ces nouvelles attaques de modification de rondes.en conclusion, les travaux precedents constituent un avertissement sur la faisabilite averee des attaques par laser decrites dans la litterature scientifique. nos essais ont temoigne de la faisabilite toujours actuelle de la mise en place des attaques mono-octets ou mono-bits avec un faisceau de laser qui rencontre plusieurs octets ; et egalement reveler de nouvelles possibilites d’attaque. cela nous a amenes a etudier des contre-mesures adaptees. / Cryptographic circuits may be victims of fault attacks on their hardware implementations. fault attacks consist of creating intentional faults during cryptographic calculations in order to infer secrets. in the context of security characterization of circuits, we have examined practical feasibility of some theoretical models of fault attacks. we used a laser bench as a means of the fault injection.at the beginning, we performed laser fault injections on a microcontroller implementing an aes cryptographic algorithm. we succeeded to exclude the logical effect of mismatched faults by temporal and spatial accuracy in fault injection. moreover, we identified extended new dfa attacks.then, we extended our research to identify and to implement new fault attack models. with the precision obtained in our earlier work, we developed new round modification analysis (rma) attacks.in conclusion, the experiments give a warning for the feasibility of described attacks in the literature by laser. our tests have demonstrated that single-byte or single-bit attacks are still feasible with a laser beam that hits additional bytes on the circuit when the laser emission is accurate and associated with other techniques. they also revealed new attack possibilities. therefore, it conducted us to study of appropriate countermeasures.

Les domaines d'application de la cryptographie embarquée sont très divers et se retrouvent au croisement de toutes les applications personnelles, avec un besoin évident de confidentialité des données et également de sécurité d'accès des moyens de paiement. Les attaques matérielles invasives ont fait de tous temps partie de l'environnement industriel. L'objectif de cette thèse est de proposer de nouvelles solutions pour protéger les circuits intégrés contre ces attaques physiques. La première partie décrit les notions d'attaques par canaux cachés, d'attaques invasives et de retro-conception. Plusieurs exemples de ces types d'attaques ont pu être mis en œuvre pendant le travail de recherche de cette thèse, ils sont présentés en détail dans cette partie. La deuxième partie est consacrée à des propositions de différentes contre-mesures pour contrer des attaques par canaux cachés ayant pour vecteur la consommation de courant. La troisième partie est dédiée à la protection contre les attaques invasives en utilisant divers types de boucliers et capteurs. Nous conclurons ce manuscrit de thèse par la proposition d'un bouclier actif cryptographique inviolable ayant pour but premier de contrer Je sondage, mais aussi celui de détecter l'injection de fautes et d'être immunisé contre les analyses par consommation de courant. / Embedded security applications are diverse and at the center of all personal embedded applications. They introduced an obvious need for data confidentiality and security in general. Invasive attacks on hardware have always been part of the industrial scene. The aim of this thesis is to propose new solutions in order to protect embedded circuits against some physical attacks described above. ln a first part of the manuscript, we detail the techniques used to achieve side-channel, invasive attacks and reverse engineering. I could implement several of these attacks during my thesis research, they will be detailed extensively. ln the second part we propose different hardware countermeasures against side-channel attacks. The third part is dedicated to protection strategies against invasive attacks using active shielding and we conclude this work by proposing an innovative cryptographic shield which is faulty and dpa resistant.

L'exportation et la mutualisation des industries de fabrication des circuits intégrés impliquent de nombreuses interrogations concernant l'intégrité des circuits fabriqués. On se retrouve alors confronté au problème d'insertion d'une fonctionnalité dissimulée pouvant agir de façon cachée : on parle de Cheval de Troie Matériel (CTM). En raison de la complexité d'un circuit intégré, repérer ce genre de modification se révèle particulièrement difficile. Le travail proposé dans ce manuscrit s'oriente vers une technique de détection non destructrice de CTM. L’approche consiste à utiliser les temps de calculs internes du système étudié comme canal permettant de détecter des CTM. Dans ces travaux, un modèle décrivant les temps de calcul est défini. Il prend notamment en compte deux paramètres importants que sont les conditions expérimentales et les variations de procédés.Des attaques en faute par glitchs d’horloge basée sur la violation de contraintes temporelles permettent de mesurer des temps de calcul internes. Des cartes fiables sont utilisées pour servir de référence. Après avoir validé la pertinence de ce canal d’étude concernant l’obtention d’informations sur le comportement interne du circuit cible, on procède à des détections expérimentales de CTM insérés à deux niveaux d’abstraction (niveau RTL et après l'étape de placement/routage). Des traitements avec prise en compte des variations de procédés permettent d'identifier si les cartes testées sont infectées par un CTM. / The globalization of integrated circuits fabrication involves several questions about the integrity of the fabricated circuits. Malicious modifications called Hardware Trojans (HT) can be introduced during the circuit production process. Due to the complexity of an integrated circuit, it is really difficult to find this kind of alterations.This work focuses on a non-destructive method of HT detection. We use the paths delays of the studied design as a channel to detect HT. A model to describe paths delays is defined. It takes into account two important parameters which are the experimental conditions and the process variations.Faults attacks by clock glitches based on timing constraints violations have been performed to measure data paths delays. Reliable circuits are used for reference. After validating the relevance of this channel to get information on the internal behavior of the targeted design, experimental detections of HT inserted on two different abstraction levels (RTL and after place and route) were achieved. Process variations are taken into consideration in the studies to detect if the tested circuits are infected.

Indiana University-Purdue University Indianapolis (IUPUI) / Blömmer, Otto, and Seifert presented a fault attack on elliptic curve scalar multiplication called the Sign Change Attack, which causes a fault that changes the sign of the accumulation point. As the use of a sign bit for an extended integer is highly unlikely, this appears to be a highly selective manipulation of the key stream. In this thesis we describe two plausible fault attacks on a smart card implementation of elliptic curve cryptography. King and Wang designed a new attack called counter fault attack by attacking the scalar multiple of discrete-log cryptosystem. They then successfully generalize this approach to a family of attacks. By implementing King and Wang's scheme on RSA, we successfully attacked RSA keys for a variety of sizes. Further, we generalized the attack model to an attack on any implementation that uses NAF and wNAF key.