feature article
Subscribe Now

Fending Off Evil

Protecting Your FPGA Against DPA

It’s 3AM, and you wake unexpectedly.  They’re out there… the Evildoers.  You can almost feel them.  They’re out there right now holding a copy of your latest board – with the FPGA sitting right in the middle.  It’s the same one you put in your design.  Reverse-engineering the board is easy – or heck, they may just have a way to sneak a few off the assembly line where they’re being made.  You know the place – you were nervous when purchasing made the deal.  The prices were a little too low and the opacity was a bit too high.  That’s why you have it set up so your FPGA bitstream doesn’t get loaded until the product gets back to your facility.

Nonetheless, they’re out there.  They’re looking at your board right now, and they’re trying to figure out how they can steal your design – or your customers’ data.  You took precautions, of course.  Maybe your bitstream is encrypted with the FPGA-vendor’s security features.  Your customers’ data is definitely encrypted.  You can go back to sleep now, right?  They won’t be able to get your encryption keys.  

As you try to fall back asleep again, you remember what they’re probably doing.  You’ve heard about Differential Power Analysis (DPA) attacks at some conference one time.  Maybe you didn’t stay for the whole talk.  They were analyzing the power supply, finding the exact point where the encryption keys are loaded, running some DSP on them, and gradually decoding the encryption keys with clever filtering.  That wouldn’t work with a complicated design in a device like an FPGA would it?

Oh yes.  It would.

Cryptography Research has been thinking about DPA attacks for a long time now.  In fact, they apparently invented the attacks themselves, back in 1997. (They prefer to use the euphemism “discovered” DPA.) Now, before you start your rant about how people shouldn’t be inventing dangerous things just so they can sell you a defense against them, remember that “security by obscurity” doesn’t work.  If they didn’t “discover” DPA, somebody else would. (In fact, there are rumored to be others that knew about DPA even before Cryptography Research went about patenting their defenses.)  What’s more – they weren’t doing it to help people jack your FPGA design – honest.  They had bigger fish to fry.  You know the smart cards that are used in financial transactions all over the world?  Yeah.  If you were a bad guy – would you rather crack those or somebody’s FPGA-based automotive infotainment system?

DPA is about as clever and devious a scheme as you can imagine.  It doesn’t require disassembly of the circuit.  It doesn’t require fancy equipment – a digital scope and a decent PC will get you up and running.  All it requires is a working copy of the system.  Using a divide-and-conquer approach, you find the time where the encryption keys are being loaded, run a few experiments, and the bits start dropping out like one of those TV-show scenes where the hacker is getting the secret password character-by-character and all of us in the audience with any technical background are rolling our eyes in disdain.

DPA is actually the “middle-child” of power-analysis attacks.  There is also simple power analysis (SPA) and high-order differential power analysis (HO-DPA).  For most real-world designs, SPA is too primitive to get results easily, and HO-DPA is too complicated to manage efficiently.  DPA, on the other hand, is just right.  

Power analysis attacks are also more sinister because we generally cannot detect them and because physical barriers are ineffective in stopping them.  The only effective countermeasures are those that logically interfere with the analysis process.

Countermeasures include things you might expect – such as injecting additional noise into the operation, randomizing sequences of events, altering timing, and changing the algorithm – all of which are designed to increase the signal-to-noise ratio and make the attack more difficult. The problem is – you can’t create effective countermeasures against DPA unless you are an expert at doing DPA.  (No, just sticking a big capacitor on your power pins to smooth out the noise won’t work.  The bad guys thought of that already.)

Cryptography research has a variety of countermeasures available in various forms – most of which boil down to licensing you some specialized IP or consulting with you on your particular project.  If you were counting on the fact that you have an FPGA in your design making it safer – you were mostly right.  FPGAs can be used to mitigate many of the known techniques for stealing your and your customers’ IP.  Side-channel attacks such as DPA, however, are intriguing and dangerous beasts.  If your design needs to be safe from these threats, your only two options are really 1) become an expert in security yourself (not a viable option for most of us that have other things to do with our career – like design stuff) or 2) enlist the services of security experts such as Cryptography Research.  

As with any engineering decision, the effort you put into security is a trade-off – balancing the consequences of a successful attack against the cost of preventing one.  In most cases, it also pays to understand the motivation level of a likely attacker.  If your likely attackers are two guys in a basement with an oscilloscope trying to see if they can crack your design for fun, you might invest a different amount than if the likely attacker is a government with immense resources available to break your circuit for national security reasons.  The starting point for this decision, however, is awareness of the threat in the first place, and thusly – our work here is done.

You can go back to sleep now. 

Leave a Reply

featured blogs
Sep 30, 2022
When I wrote my book 'Bebop to the Boolean Boogie,' it was certainly not my intention to lead 6-year-old boys astray....
Sep 30, 2022
Wow, September has flown by. It's already the last Friday of the month, the last day of the month in fact, and so time for a monthly update. Kaufman Award The 2022 Kaufman Award honors Giovanni (Nanni) De Micheli of École Polytechnique Fédérale de Lausanne...
Sep 29, 2022
We explain how silicon photonics uses CMOS manufacturing to create photonic integrated circuits (PICs), solid state LiDAR sensors, integrated lasers, and more. The post What You Need to Know About Silicon Photonics appeared first on From Silicon To Software....

featured video

PCIe Gen5 x16 Running on the Achronix VectorPath Accelerator Card

Sponsored by Achronix

In this demo, Achronix engineers show the VectorPath Accelerator Card successfully linking up to a PCIe Gen5 x16 host and write data to and read data from GDDR6 memory. The VectorPath accelerator card featuring the Speedster7t FPGA is one of the first FPGAs that can natively support this interface within its PCIe subsystem. Speedster7t FPGAs offer a revolutionary new architecture that Achronix developed to address the highest performance data acceleration challenges.

Click here for more information about the VectorPath Accelerator Card

featured paper

Algorithm Verification with FPGAs and ASICs

Sponsored by MathWorks

Developing new FPGA and ASIC designs involves implementing new algorithms, which presents challenges for verification for algorithm developers, hardware designers, and verification engineers. This eBook explores different aspects of hardware design verification and how you can use MATLAB and Simulink to reduce development effort and improve the quality of end products.

Click here to read more

featured chalk talk

Hot-Swap and Power Protection -- Mouser Electronics and Analog Devices

Sponsored by Mouser Electronics and Analog Devices

When it comes to our always-on, critical systems we need to carefully consider power protection and maintainability. In this episode of Chalk Talk, Amelia Dalton and Dwight Larson investigate the issues that surround hot-plugging into an energized power supply, the best solutions to consider, what the different hot-swap circuit topologies look like for a variety of applications and why the MAX15090B/C with its innovative current foldback startup may be the best solution for your next design.

Click here for more information about Maxim Integrated MAX15090B/MAX15090C Hot Swap ICs