2003 | Sergei P. Skorobogatov and Ross J. Anderson
The paper by Sergei P. Skorobogatov and Ross J. Anderson introduces a new class of attacks on secure microcontrollers and smartcards, known as optical fault induction attacks. These attacks involve illuminating a target transistor with light, causing it to conduct and inducing a transient fault. The authors demonstrate that such attacks are practical and can be performed using inexpensive equipment, such as a flashgun and a laser pointer. They show that this method can be used to set or reset any individual bit in an SRAM cell, potentially leading to errors in cryptographic computations and protocols, and disrupting the processor's control flow.
To counter these attacks, the authors propose a technology based on self-timed dual-rail circuit design, where logical 1s and 0s are encoded by combinations of signals on pairs of lines rather than single high or low voltages. This design makes it difficult for single-transistor failures to lead to security breaches. The authors also discuss the implications of these attacks and the need for new defensive measures, emphasizing the potential commercial impact on the industry. They conclude that hardware countermeasures will be essential to protect against these optical probing attacks.The paper by Sergei P. Skorobogatov and Ross J. Anderson introduces a new class of attacks on secure microcontrollers and smartcards, known as optical fault induction attacks. These attacks involve illuminating a target transistor with light, causing it to conduct and inducing a transient fault. The authors demonstrate that such attacks are practical and can be performed using inexpensive equipment, such as a flashgun and a laser pointer. They show that this method can be used to set or reset any individual bit in an SRAM cell, potentially leading to errors in cryptographic computations and protocols, and disrupting the processor's control flow.
To counter these attacks, the authors propose a technology based on self-timed dual-rail circuit design, where logical 1s and 0s are encoded by combinations of signals on pairs of lines rather than single high or low voltages. This design makes it difficult for single-transistor failures to lead to security breaches. The authors also discuss the implications of these attacks and the need for new defensive measures, emphasizing the potential commercial impact on the industry. They conclude that hardware countermeasures will be essential to protect against these optical probing attacks.