Laser Fault Injection on a Budget: RP2350 Edition
courk.ccI did not know that about laser fault injection, at all. What practical uses has this technique found? Analysis of foreign military hardware? Cracking into secured systems?
You can recover information about bits of keys, lowering the security of an implementation of a crypro algorithm, although in principle you could use it to recover other
My god they shot him mid sentence
The attack is on code that is not fault hardened. Had there been masked values and random delays used for every conditional and function call (plus call counters) this would have been impossible with his hardware.
However the expertise and diligence required to solve so many problems in building the platform is absolutely exceptional!!
The GaN hemt would make sense for a second board iteration where you drive the 75V straight through the diode with a very short (variable) pulse like in this EPC reference design:
https://epc-co.com/epc/products/evaluation-boards/epc9172
That way the 1.4 Ohm resistor doesn't eat like 60-80% of the energy (40amps drop around 60V for an instant 240W in the resistor vs the foward voltage of the diode which is like 1.5V or so for the 60W peak).
Just watched a talk on this topic from last December: https://media.ccc.de/v/39c3-of-boot-vectors-and-double-glitc...
I'm more interested in the 3D printed platform made to to hold up the chip and the fact that this seemed to be done in a garage. I thought anything laser related would require much more precision but the article has pretty much everything ordered online.
Openflexure is really cool-- I have a couple openflexure microscopes. https://openflexure.org/
Building optically precise platforms with bearings and sliding surfaces is annoying and difficult. But it turns out you can do pretty dang well with applying force to bendy metal or plastic.
Below around 1 micron scales... sliding bearing surfaces can start to get less predictable, and more expensive. People get around the issue by combining different sets of precise and wide-range rough-motion systems. https://www.pi-usa.us/en/
There are also easier options if you spend some time with a specific use case. =3
Previously discussed: https://news.ycombinator.com/item?id=42708682