Felix Uhle
Horst Görtz Institute for IT Security, Ruhr-Universität Bochum, Bochum, Germany

Nicolai Müller
Horst Görtz Institute for IT Security, Ruhr-Universität Bochum, Bochum, Germany

Thorben Moos
UCLouvain, Louvain-la-Neuve, Belgium

Philipp Günther
Langer EMV-Technik GmbH, Bannewitz, Germany

Amir Moradi
Technische Universität Darmstadt, Darmstadt, Germany

Keywords: ASIC, Fault Analysis, EMFI, Impeccable Circuits, Coil, Sensor, Error Detection, Error Correction

Abstract

Fault injection attacks target cryptographic primitives implemented in hardware by deliberately inducing faults, leading to abnormal behavior that can be exploited to extract sensitive information. To mitigate these threats, practical and lowoverhead countermeasures, whether at the algorithmic or physical level, are essential. However, the real-world effectiveness of these countermeasures remains uncertain, as it is not always clear whether, or to what extent, their underlying security assumptions hold in practice. Therefore, a thorough evaluation under realistic attack scenarios, including recent techniques such as Electromagnetic Fault Injection (EMFI), is crucial. In this work, we demonstrate the resistance of a protected real-world target chip against EMFI. Specifically, our fabricated 65 nm CMOS ASIC employs concurrent error correction based on the techniques described in Impeccable Circuits II as an algorithm-level countermeasure. At the physical level, the chip integrates multiple coils of varying sizes and positions that serve as sensors for electromagnetic fields. We employ a practical and affordable attack setup featuring a commercial faultinjection probe mounted on an XYZ stage for precise positioning over the ASIC. This setup allows us to investigate the effects of various attack parameters, including the probe’s position, pulse polarity, and voltage level. Our results highlight that the coils serve as a lightweight and effective countermeasure for the practical detection of EMFI attempts. In contrast, for concurrent error correction, a gap between theory and practice emerges: the protection overhead actually makes such designs more susceptible to EMFI in real-world scenarios.