Fault Injection Attacks

Question 1

Types of fault classifications

Answer 1

duration, controllability, fault resolution

Question 2

duration faults

Answer 2

• Transient - happens once and goes away
• Permanent - the device now forever has this error
• Destructive - we can no longer use the device

Question 3

controllability faults

Answer 3

• Precise - can control time / location of fault
• Loose - some control, but not very precise
• No-control -

Question 4

Fault resolution

Answer 4

how much impact did the fault have on the data - bits, few bits, bytes/words

Question 5

Stuck-at faults

Answer 5

bits are permanently the same value, no amount of reading or writing can change their value

Question 6

Bit-flip faults

Answer 6

all bits are flipped

Question 7

Random faults

Answer 7

bits are changed randomly

Question 8

Set/reset faults

Answer 8

can change the value of a bit in only one direction
○ All bits become 1s (set)
○ All bits become 0s (reset)

Question 9

Three ways to create faults

Answer 9

Clock glitches, voltage spikes, underpowering

Question 10

clock glitches

Answer 10

• Temporarily overclock or make one cycle faster

- Processor does not have enough time to finish all the work it has to do => wrong values get set in the registers, etc

Question 11

voltage spikes

Answer 11

• Temporarily increase or decrease in power

- Can cause circuitry to fault because it lacks power/has too much power

Question 12

Underpowering

Answer 12

• Reduce supply voltage for a long period of time
• Can be transient or permanent
• Makes circuitry slower => sometimes is doesn’t complete what it was supposed to complete during a clock cycle

Question 13

7 Effects of Glitches and Spikes

Answer 13

• Replacement (or skipping) of instructions
  
  • Tampering with loops or conditionals
  • Change of program counter
  • Effects on data flow
    ○ Use value from the wrong register
  • Computation errors
    ○ Produce 7+2 = 11
  • Corrupt memory pointers
  • No bit transitions on data bu

Question 14

does it take longer to switch a bit in one direction vs the other?

Answer 14

Changing 0->1 takes shorter length glitches than 1->0

Question 15

Categories of Fault-Injections

Answer 15

non, semi-, and invasive

Question 16

Heating fault injections cons

Answer 16

Not the most accurate, hard to control, and chip can only be heated so many times

Question 17

What are cooling attacks aimed at?

Answer 17

devices that are designed to lose data when powered off

Question 18

Optical Fault Injection

Answer 18

Can switch transistor by exposing it to light. semi-invasive, but very configurable

Question 19

Electromagnetic Fault Injection

Answer 19

induce Eddy current, switch transistors

Question 20

Countermeasures to fault injections

Answer 20

cannot prevent, so want to make things harder!

• Hide sensitive parts of the chip (physically or via encryption)
• Add filters/security sensors to detect if someone is trying to raise power, etc

Question 21

RSA encryption

Answer 21

rewatch