# Laser Fault Injection on power off devices

Paul Grandamme, Lilian Bossuet, Jean-Max Dutertre

► To cite this version:

Paul Grandamme, Lilian Bossuet, Jean-Max Dutertre. Laser Fault Injection on power off devices. RADLAS 2024: 6th Workshop on Laser Testing of Radiation Effects on Components and Systems, Sep 2024, Noordwijk, Netherlands. hal-04935042

HAL Id: hal-04935042

https://hal.science/hal-04935042v1

Submitted on 7 Feb 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Paul Grandamme<fnref n="1" />,<fnref n="2" />, Lilian Bossuet<fnref n="1" />, Jean-Max Dutertre<fnref n="2" />

<figure><img src="image_2.png" /></figure>

LABORATOIRE
HUBERT CURIEN

UMR CNRS-S116 - SAINT-ÉTÉNNE

<figure><img src="image_3.png" /></figure>

<figure><img src="image_4.png" /></figure>

MINES
Saint-Étienne

Une école de l'IMT

<figure><img src="image_5.png" /></figure>

<figure><img src="image_6.png" /></figure>

RADES

September 11, 2024

<footnote n="1">¹Laboratoire Hubert Curien, Université Jean Monnet</footnote>

<footnote n="2">²Mines Saint-Étienne, CEA-Leti</footnote>
Symmetric crypto

<figure><img src="image_7.png" /></figure>
Symmetric crypto

<figure><img src="image_8.png" /></figure>
# Fault Attack and Fault Model

## Fault Attack

Disturbing the integrated circuit to **modify its behavior** in order to obtain information or disable internal protection mechanisms

<figure><img src="image_9.png" /></figure>

## Fault Model

Abstractions used to model the **impact** of a fault attack on a **circuit**
Context

State of the art

Almost all of the attacks performed on powered devices

<figure><img src="image_10.png" /></figure>
Context

State of the art

Almost all of the attacks performed on powered devices

<figure><img src="image_11.png" /></figure>
Context

State of the art

Almost all of the attacks performed on powered devices

<figure><img src="image_12.png" /></figure>
Context

State of the art

Almost all of the attacks performed on powered devices

<figure><img src="image_13.png" /></figure>
Problem

How to bypass the sensors?
# Context

## Problem

How to bypass the sensors?

## Solution

Attack unpowered devices
# Context

## Problem

How to bypass the sensors?

## Solution

Attack unpowered devices

## Ideas

* Damage the device: break the sensors

* Corrupt stored information: Non-Volatile Memories (Flash)
# Plan

1. Flash memories

2. Fault model

3. Experiments & Results

4. Conclusion
# Floating gate transistors in Flash memories

<figure><img src="image_14.png" /><figcaption>Discharged cell.</figcaption></figure>

<figure><img src="image_15.png" /><figcaption>Charged cell.</figcaption></figure>
# Read mechanism

<figure><img src="image_16.png" /></figure>

Convention:

* Charged = ‘0’

* Discharged = ‘1’

<figure><img src="image_17.png" /><figcaption>I-V characteristics.</figcaption></figure>
Read mechanism

<figure><img src="image_18.png" /></figure>

<figure><img src="image_19.png" /></figure>

Convention:

* Charged = ‘0’

* Discharged = ‘1’

I-V characteristics.

<figure><img src="image_20.png" /></figure>

Read operation of a Flash memory.
# Plan

1. Flash memories

2. Fault model

3. Experiments & Results

4. Conclusion
<figure><img src="image_21.png" /></figure>
# Physical level

* Laser beam energy ⇒ Temperature increase
  ⇒ Floating gate discharge

Intensity of the laser beam:

$$I(r) = I_0 \cdot e^{-\frac{2r^2}{\omega_0^2}} \quad (1)$$

with:

$$\omega_0 = \frac{2\lambda}{\pi \times NA} \quad (2)$$

Full-Width-at-Half-Maximum
criterion ⇒

$$d_0 = \omega_0 \sqrt{\frac{\ln 2}{2}} \approx 5 \, \mu\text{m} \quad (3)$$

<figure><img src="image_22.png" /></figure>

Heatmap induced by the laser
exposition (numerical simulation
with $\lambda = 1064$ nm and $NA = 0.16$).
<figure><img src="image_23.png" /></figure>
Logical level

From the physical level:

<figure><img src="image_24.png" /></figure>

To the logical level:

<figure><img src="image_25.png" /></figure>

⇒ Unidirectional and data-dependent fault model

⇒ Bitsets for our target

⇒ Persistent faults (possible to reprogram the memory)
<figure><img src="image_26.png" /></figure>
## Code corruption (ARMv7 ISA)

<table><tr><td>31</td><td>30</td><td>29</td><td>28</td><td>27</td><td>26</td><td>25</td><td>24</td><td>23</td><td>22</td><td>21</td><td>20</td><td>19</td><td>18</td><td>17</td><td>16</td><td>15</td><td>14</td><td>13</td><td>12</td><td>11</td><td>10</td><td>9</td><td>8</td><td>7</td><td>6</td><td>5</td><td>4</td><td>3</td><td>2</td><td>1</td><td>0</td></tr><tr><td colspan="32">Generic MOVW</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>imm4</td><td>0</td><td>imm3</td><td>Rd</td><td>imm8</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td colspan="32">MOVW,RO,0</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td colspan="32">MOVW,RO,4</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr></table>

Examples of possible corruptions on a MOVW instruction<fnref n="1" />.

<footnote n="1">¹Brice Colombier et al. “Laser-induced Single-bit Faults in Flash Memory: Instructions Corruption on a 32-bit Microcontroller”. In: *IEEE International Symposium on Hardware Oriented Security and Trust, HOST 2019, McLean, VA, USA, May 5-10, 2019*. IEEE.</footnote>
Code corruption (ARMv7 ISA)

<table><thead><tr><th>31</th><th>30</th><th>29</th><th>28</th><th>27</th><th>26</th><th>25</th><th>24</th><th>23</th><th>22</th><th>21</th><th>20</th><th>19</th><th>18</th><th>17</th><th>16</th><th>15</th><th>14</th><th>13</th><th>12</th><th>11</th><th>10</th><th>9</th><th>8</th><th>7</th><th>6</th><th>5</th><th>4</th><th>3</th><th>2</th><th>1</th><th>0</th></tr></thead><tbody><tr><td colspan="31">Generic MOVW</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>imm4</td><td>0</td><td>imm3</td><td>Rd</td><td>imm8</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td colspan="31">MOVW,RO,0</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td colspan="31">MOVW,RO,4</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td colspan="31">MOVW,R1,0</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr></tbody></table>

Examples of possible corruptions on a MOVW instruction<fnref n="1" />.

<footnote n="1">¹Brice Colombier et al. “Laser-induced Single-bit Faults in Flash Memory: Instructions Corruption on a 32-bit Microcontroller”. In: *IEEE International Symposium on Hardware Oriented Security and Trust, HOST 2019, McLean, VA, USA, May 5-10, 2019*. IEEE.</footnote>
Code corruption (ARMv7 ISA)

<table><tbody><tr><td>31</td><td>30</td><td>29</td><td>28</td><td>27</td><td>26</td><td>25</td><td>24</td><td>23</td><td>22</td><td>21</td><td>20</td><td>19</td><td>18</td><td>17</td><td>16</td><td>15</td><td>14</td><td>13</td><td>12</td><td>11</td><td>10</td><td>9</td><td>8</td><td>7</td><td>6</td><td>5</td><td>4</td><td>3</td><td>2</td><td>1</td><td>0</td></tr><tr><td colspan="31">Generic MOVW</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>imm4</td><td>0</td><td>imm3</td><td>Rd</td><td>imm8</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td colspan="31">MOVW,RO,0</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td colspan="31">MOVW,RO,4</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td colspan="31">MOVW,R1,0</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td colspan="31">MOVWT,RO,0</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>1</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr></tbody></table>

Examples of possible corruptions on a MOVW instruction<fnref n="1" />.

<footnote n="1">¹Brice Colombier et al. “Laser-induced Single-bit Faults in Flash Memory: Instructions Corruption on a 32-bit Microcontroller”. In: *IEEE International Symposium on Hardware Oriented Security and Trust, HOST 2019, McLean, VA, USA, May 5-10, 2019*. IEEE.</footnote>
Memory level

Code corruption (ARMv7 ISA)

<table><thead><tr><th>31</th><th>30</th><th>29</th><th>28</th><th>27</th><th>26</th><th>25</th><th>24</th><th>23</th><th>22</th><th>21</th><th>20</th><th>19</th><th>18</th><th>17</th><th>16</th><th>15</th><th>14</th><th>13</th><th>12</th><th>11</th><th>10</th><th>9</th><th>8</th><th>7</th><th>6</th><th>5</th><th>4</th><th>3</th><th>2</th><th>1</th><th>0</th></tr></thead><tbody><tr><td colspan="31">Generic MOVW</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>i</td><td>1</td><td>0</td><td>1</td><td>0</td><td>0</td><td>imm4</td><td>0</td><td>imm3</td><td>Rd</td><td>imm8</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td colspan="31">MOVW,RO,0</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td colspan="31">MOVW,RO,4</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td colspan="31">MOVW,R1,0</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td colspan="31">MOVW,R1,0</td></tr><tr><td>1</td><td>1</td><td>1</td><td>1</td><td>0</td><td>0</td><td>1</td><td>0</td><td>1</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr></tbody></table>

Examples of possible corruptions on a MOVW instruction<fnref n="1" />.

⇒ Also possible to corrupt permanent data

<footnote n="1">¹Brice Colombier et al. “Laser-induced Single-bit Faults in Flash Memory: Instructions Corruption on a 32-bit Microcontroller”. In: *IEEE International Symposium on Hardware Oriented Security and Trust, HOST 2019, McLean, VA, USA, May 5-10, 2019*. IEEE.</footnote>
<figure><img src="image_27.png" /></figure>
# Plan

1. Flash memories

2. Fault model

3. Experiments & Results

4. Conclusion
Laser fault injection setup

<figure><img src="image_28.png" /></figure>

* Same setup as powered laser fault injection

* 1064 nm laser source (near-IR)

* Pulse of 0.9 s

* 5 µm spot with a x20 magnifying lens

* Backside view with an IR camera
# Hardware target

* STM32F1 open on the backside (32-bit microcontroller)

* Same device preparation as powered laser fault injection

* 128 pages of 1 kB of Flash memory

* 2048 bitlines and 512 wordlines

* No memory protection mechanism

<figure><img src="image_29.png" /><figcaption>Board (left) and infrared image (right) of the hardware target.</figcaption></figure>
Power OFF mapping of injected faults

Require: $X_{min}, X_{max}, X_{step}, Y_{min}, Y_{max}, Y_{step}$

1: **for** $x \in range(X_{min}, X_{max}, X_{step})$ **do**

2: **for** $y \in range(Y_{min}, Y_{max}, Y_{step})$ **do**

3: **reset target memory**

4: **do**

5: **move laser to (x,y)**

6: **power target off**

7: **for** $i \in [0, ..., 999]$ **do**

8: **laser shot**

9: **power target on**

10: **dump target memory**

11: **while** \#faults == 0

12: **mapping[x][y] = \#faults**

13: **return** mapping[x][y]
Power OFF laser sensitivity map

* Memory initialized to 0x00000000 (programmed) before the laser exposure

<figure><img src="image_30.png" /></figure>

Mapping of obtained faults. $P_{laser} = 1$ W, $f_{laser} = 1$ Hz, $T_{pulse} = 0.9$ s.

⇒ Fault address and fault value known for each position

* bitsets obtained
Experimental distribution

<figure><img src="image_31.png" /></figure>

Experimental distribution of the number of injected
faults.

* 2.2 faulty bits on average on 0x00000000 data (median value of 2.2)

* Single bit faults in 33% of cases

* No correlation between #shots and #faults
<figure><img src="image_32.png" /></figure>

Reverse engineering of the Flash memory mapping: page-level.
<figure><img src="image_33.png" /></figure>

Reverse engineering of the Flash memory mapping: bit-level.
<figure><img src="image_34.png" /></figure>
# Plan

1. Flash memories

2. Fault model

3. Experiments & Results

4. Conclusion
# Conclusion

* Switching Off your Device Does Not Protect Against Fault Attacks

* Semiconductor manufacturers must include systematically memory protection mechanisms

* Same countermeasures for Power ON and Power OFF
Thank you for your attention !

This work was supported by research grants of the projects POP (ANR-21-CE39-0004) and PROPHY (ANR-22-CE39-0008) from the french Agence Nationale de la Recherche

<figure><img src="image_35.png" /></figure>
Paul Grandamme<fnref n="1" />,<fnref n="2" />, Lilian Bossuet<fnref n="1" />, Jean-Max Dutertre<fnref n="2" />

<figure><img src="image_36.png" /></figure>

LABORATOIRE
HUBERT CURIEN

UMR CNRS-S116 - SAINT-ÉTÉNNE

<figure><img src="image_37.png" /></figure>

<figure><img src="image_38.png" /></figure>

MINES
Saint-Étienne

Ute école de l'IMT

<figure><img src="image_39.png" /></figure>

<figure><img src="image_40.png" /></figure>

<figure><img src="image_41.png" /></figure>

September 11, 2024

<footnote n="1">¹Laboratoire Hubert Curien, Université Jean Monnet</footnote>

<footnote n="2">²Mines Saint-Étienne, CEA-Leti</footnote>
* Persistent fault injection on the S-box

* Statistical study on the bytes of the ciphertexts

<figure><img src="image_42.png" /></figure>

<figure><img src="image_43.png" /></figure>

<figure><img src="image_44.png" /></figure>

Without fault.

<figure><img src="image_45.png" /></figure>

With one faulty byte.

<footnote n="2">²Fan Zhang et al. "Persistent Fault Analysis on Block Ciphers". In: *IACR Trans. Cryptogr. Hardw. Embed. Syst.* 2018.3 (2018), pp. 150-172.</footnote>
<figure><img src="image_46.png" /></figure>

Number of appearance of byte values for byte 0.
* Firmware reverse engineering
  ⇒ S-box stored between 0x080012F4 and 0x080013F3

* From the previous mapping
  ⇒ the position (x,y) = (44.3,300) is in the S-box range

* Laser fault injection
  ⇒ fault 0x00000002 at the address 0x08001310
  32^nd^ value of S-box faulted (0xC2 instead of 0xC0)

⇒ Successful PFA