Macroeconomics

Computer hardware

Information leakage

Engineering

Advanced Encryption Standard

Embedded system

Computer security

Encryption

Leakage (economics)

Operating system

Economics

Computer science

Side channel attack

Cloud computing

Electronic circuit

Computer network

Power analysis

Computer architecture

Static random-access memory

Cryptography

Channel (broadcasting)

Field-programmable gate array

Electrical engineering

Key (lock)

As FPGA use becomes more diverse, the shared use of these devices becomes a security concern. Multi-tenant FPGAs that contain circuits from multiple independent sources or users will soon be prevalent in cloud and embedded computing environments. The recent discovery of a new attack vector using neighboring long wires in Xilinx SRAM FPGAs presents the possibility of covert information leakage from an unsuspecting user's circuit. The work described in this paper makes two contributions that dramatically extend this finding. First, we rigorously evaluate several Intel SRAM FPGAs and confirm that long wire information leakage is also prevalent in these devices. Second, we present the first successful attack on an unsuspecting circuit in an FPGA using information passively obtained from neighboring long-lines. Information obtained from a single AES S-box input wire combined with analysis of encrypted output is used to rapidly expose an AES key. This attack is performed remotely without modifying the victim circuit, using electromagnetic probes or power measurements, or modifying the FPGA in any way. We show that our approach is effective for three different FPGA devices. Our results demonstrate that the attack can recover encryption keys from AES circuits running at 10MHz, and has the capability to scale to much higher frequencies.

FPGA Side Channel Attacks without Physical Access