Abstract

This talk presents a low-cost approach to optical side-channel attacks on secure semiconductor chips. By using an inexpensive CCD camera to monitor the emission from operating chip, information stored in SRAM , EEPROM and Flash was successfully recovered. Initially demonstrated on a 0.9-micron microcontroller, this technique was later adapted for a 0.13-micron secure FPGA with AES decryption engine used for code protection. This shows the danger of optical emission analysis attacks to modern deep-submicron chips. Optical emissions from an operating chip also have a good correlation with power analysis traces and can therefore be used to estimate the contribution of different areas within the chip. Optical emission analysis can also be used for partial reverse engineering of the chip structure by spotting the active areas. This can assist in carrying out optical fault injection attacks later, thereby saving the time otherwise required for exhaustive search. Practical limits for optical emission analysis in terms of sample preparation, operating conditions and chip technology will be discussed. Like with the introduction of probing attacks in the mid-1990s, power analysis attacks in the late 1990s and optical injection attacks in the early 2000s, optical emission attacks will very likely result in the need to introduce new countermeasures during the design of semiconductor chips.