Electromagnetic Fault Injection (EMFI) has recently gained popularity as a mean to induce faults because of its inherent advantages. Despite this popularity, there is only little information on how EMFI generates faults. Within this context, this paper aims at filling this lack by proposing a complete understanding and modeling of EM induction on Integrated Circuits (IC). The presented model is confronted to experiments to endorse its soundness.

In the nanometer era, the physical verification of a CMOS digital circuit becomes a long, tedious, and complex task. Designers must indeed account for numerous new factors that impose a drastic change in validation and physical-verification methods. One of these major changes in timing verification to handle process variation lies in the progressive development of statistical static-timing engines. However, the statistical approach cannot capture accurately the deterministic variations of both the voltage and temperature variations. Therefore, we define a novel method, based on nonlinear-derating coefficients, to account for these environmental variations. Based on temperature- and voltage-drop computer-aided-design tool reports, this method allows computing the propagation delay of logical paths considering the operating conditions of each cell. As the statistical timing analysis does, the proposed approach reduces design margins compared to worst/best case corner analysis with fixed voltage and temperature values, a gain of 10% on the delay has been observed for critical paths

Dual rail logic is considered as a relevant hardware countermeasure against Differential Power Analysis (DPA) by making power consumption data independent. In this paper, we deduce from a thorough analysis of the robustness of dual rail logic against DPA the design range in which it can be considered as effectively robust. Surprisingly this secure design range is quite narrow. We therefore propose the use of an improved logic, called Secure Triple Track Logic, as an alternative to more conventional dual rail logics. To validate the claimed benefits of the logic introduced herein, we have implemented a sensitive block of the Data Encryption Standard algorithm (DES) and carried out by simulation DPA attacks.

Electromagnetic attacks, which in fact exploit essentially the magnetic field generated by ICs, are commonly used by adversaries to retrieve secret information manipulated by integrated circuits. Due to the increasing resolution and effectiveness of EM equipment used to perform these attacks, it is becoming increasingly difficult to design secure circuits robust enough to resist these attacks. The contribution of this article is threefold. First, it describes a simulation flow of the magnetic field radiated by ICs. The introduced flow is based on an industrial voltage drop tool: ANSYS RedHawk. Second, it introduces a methodology to localize the root cause of leakages in ICs as well as EM hotspots, i.e., positions above the IC surface, where an adversary can place its probe to capture secrets. The latter contribution is based on the concept of noise to add, which is introduced in this article in order to overcome the absence of noise in simulations (noise which is omnipresent in practice) that limits their interpretability. Finally, the article demonstrates the soundness of the proposed solution by confronting simulation results with measurements.

Electro-Magnetic Analysis has been identified as an efficient technique to retrieve the secret key of cryptographic algorithms. Although similar mathematically speaking, Power or Electro-Magnetic Analysis have different advantages in practice. Among the advantages of EM Analysis, the feasibility of attacking limited and bounded area of integrated systems is the key one. Within this context, the contribution of this paper is a countermeasure against local EM attack performed with tiny magnetic probes. The basic idea is to design circuits such that all datapaths and D-type Flip-Flops, involved in the computation of intermediate values of cryptographic elements, randomly change within a set of logically equivalent electrical paths that are spatially distributed within the Integrated Circuit (IC) die.