Optical attack reveals secret data in FPGA partial reconfiguration
The Achilles' Heel of Partial Reconfiguration: Optical Side-Channel Leakage on the 7-Series ICAP
Cryptography and Security
Summary
FPGAs, special chips used for configurable electronics, protect their setup data with encryption. The authors show that even advanced encryption methods can be bypassed during partial reconfiguration, when only part of the chip is changed. They use special optical tools to see and extract secret configuration data without touching the chip. This means protective shields embedded in the chip’s design can be vulnerable to physical spying methods. The work reveals a weak spot in current FPGA security arrangements.
What this means in practice
- •For hardware security engineers: Evaluate and improve FPGA design security by accounting for optical side-channel vulnerabilities during partial reconfiguration.
- •For fpga system integrators: Prevent unintended data leaks by avoiding or protecting against optical probing on configuration interfaces during dynamic updates.
Authors
Antonio Saavedra, Jan Caspar Marx, Lars Renkes, Jean-Pierre Seifert
Abstract
Major FPGA manufacturers have incorporated bitstream encryption to protect sensitive configuration data. However, for the most widely used FPGA families, multiple attacks against unpatchable protection schemes hard-wired into the devices can bypass or fully break them, making patchable schemes desirable. In this work, we present a proof-of-concept implementation of an AMD-proposed asymmetric key encryption scheme for bitstream protection for 7-Series FPGAs, using partial reconfiguration from the Programmable Logic. We analyze the security implications and hardware overhead of this implementation. We then propose and demonstrate an optical side-channel attack that is able to recover plain-text configuration data during the dynamic reconfiguration process. This attack leverages Photon Emission Microscopy and Electro-Optical Probing to first locate and then contactlessly extract the plain-text data from the ICAP interface, which internally connects the Programmable Logic with the configuration logic. We located the ICAP buses in an AMD XC7A200T device and show that the data on it can be extracted with Electro-Optical Probing. We claim that even advanced encryption schemes utilizing Partial Reconfiguration and custom cryptographic engines are vulnerable to optical attacks, as reconfiguration is only possible via hard-wired, vulnerable configuration interfaces.