Clock-glitch Fault Characterization by Timing Comparison with Laser Fault Injection
DOI:
https://doi.org/10.64552/wipiec.v12i2.135Keywords:
Fault attack, Laser fault injection, Clock glitch, Fault characterizationAbstract
Since clock-glitching and the voltage-glitching are nonlocalized techniques of fault injection, it is difficult to accurately characterize their fault effects. In contrast, laser fault injection is a localized technique in which the targeted element of the microprocessor is known. In this article, we present a method that exploits the advantages of laser fault injection to characterize the glitch fault effects. We first make an hypothesis about the physical location of the sensitive part that induces the fault by glitch injection. Then we compare the fault timing and execution timing for glitch and laser platforms. If the delay between the fault and the execution is the same for both platforms, the initial hypothesis is supported.
References
N. Beringuier-Boher, K. Gomina, D. Hély, J. Rigaud, V. Beroulle, A. Tria, J. Damiens, P. Gendrier, and P. Candelier, “Voltage glitch attacks on mixed-signal systems,” in 17th Euromicro Conference on Digital System Design, DSD 2014, Verona, Italy, August 27-29, 2014. IEEE Computer Society, 2014, pp. 379–386.
B. Yuce, N. F. Ghalaty, H. Santapuri, C. Deshpande, C. Patrick, and P. Schaumont, “Software fault resistance is futile: Effective single-glitch attacks,” in 2016 Workshop on Fault Diagnosis and Tolerance in Cryptography, FDTC 2016, Santa Barbara, CA, USA, August 16, 2016. IEEE Computer Society, 2016, pp. 47–58.
L. Claudepierre, P.-Y. Péneau, D. Hardy, and E. Rohou, “TRAITOR: A low-cost evaluation platform for multifault injection,” in ASSS ’21: Proceedings of the 2021 International Symposium on Advanced Security on Software and Systems, Virtual Event, Hong Kong, 7 June, 2021.
L. Rivière, Z. Najm, P. Rauzy, J.-L. Danger, J. Bringer, and L. Sauvage, “High precision fault injections on the instruction cache of ARMv7-M architectures,” in IEEE International Symposium on Hardware Oriented Security and Trust, HOST 2015, Washington, DC, USA, 5-7 May, 2015. IEEE Computer Society, 2015, pp. 62–67.
A. Barenghi, L. Breveglieri, I. Koren, G. Pelosi, and F. Regazzoni, “Countermeasures against fault attacks on software implemented AES: effectiveness and cost,” in Proceedings of the 5th Workshop on Embedded Systems Security, WESS 2010, Scottsdale, AZ, USA, October 24, 2010. ACM, 2010, p. 7.
M. Dumont, P. Moëllic, R. A. C. Viera, J. Dutertre, and R. Bernhard, “An overview of laser injection against embedded neural network models,” in 7th IEEE World Forum on Internet of Things, WF-IoT 2021, New Orleans, LA, USA, June 14 - July 31, 2021. IEEE, 2021, pp. 616–621.
M. Dumont, M. Lisart, and P. Maurine, “Modeling and simulating electromagnetic fault injection,” IEEE Trans. Comput. Aided Des. Integr. Circuits Syst., vol. 40, no. 4, pp. 680–693, 2021.
I. Alshaer, G. Burghoorn, B. Colombier, C. Deleuze, V. Beroulle, and P. Maistri, “Cross-layer analysis of clock glitch fault injection while fetching variable-length instructions,” J. Cryptogr. Eng., vol. 14, no. 2, pp. 325–342, 2024.
J. Laurent, C. Deleuze, F. Pebay-Peyroula, and V. Beroulle, “Bridging the gap between RTL and software fault injection,” ACM J. Emerg. Technol. Comput. Syst., vol. 17, no. 3, pp. 38:1–38:24, 2021.
M. S. Kelly, K. Mayes, and J. F. Walker, “Characterising a CPU fault attack model via run-time data analysis,” in 2017 IEEE International Symposium on Hardware Oriented Security and Trust, HOST 2017, McLean, VA, USA, May 1-5, 2017. IEEE Computer Society, 2017, pp. 79–84.
Jonah Alle Monne, Guillaume Bouffard, “Synthesis of rtl-based characterization programs for fault injection,” in IEEE International Symposium on Hardware Oriented Security and Trust, HOST 2026, Washington, USA, May 4-7, 2026, 2026.
T. Trouchkine, G. Bouffard, and J. Clédière, “Fault injection characterization on modern cpus,” in Information Security Theory and Practice - 13th IFIP WG 11.2 International Conference, WISTP 2019, Paris, France, December 11-12, 2019, Proceedings, ser. Lecture Notes in Computer Science, M. Laurent and T. Giannetsos, Eds., vol. 12024.
Springer, 2019, pp. 123–138.
N. Moro, A. Dehbaoui, K. Heydemann, B. Robisson, and E. Encrenaz, “Electromagnetic fault injection: Towards a fault model on a 32-bit microcontroller,” in 2013 Workshop on Fault Diagnosis and Tolerance in Cryptography, Los Alamitos, CA, USA, August 20, 2013, W. Fischer and J.-M. Schmidt, Eds. IEEE Computer Society, 2013, pp. 77–88.
A. Gicquel, L. Claudepierre, D. Hardy, K. Heydemann, and E. Rohou, “Chapati: End-to-end methodology to conduct multi-faults injection campaigns,” in IEEE International Symposium on Hardware Oriented Security and Trust, HOST 2026, Washington, USA, May 4-7, 2026.
C. O’Flynn and Z. D. Chen, “Chipwhisperer: An open-source platform for hardware embedded security research,” in Constructive Side-
Channel Analysis and Secure Design - 5th International Workshop, COSADE 2014, Paris, France, April 13-15, 2014. Revised Selected Papers, ser. Lecture Notes in Computer Science, E. Prouff, Ed., vol. 8622. Springer, 2014, pp. 243–260.
J. Balasch, B. Gierlichs, and I. Verbauwhede, “An in-depth and blackbox characterization of the effects of clock glitches on 8-bit mcus,” in 2011 Workshop on Fault Diagnosis and Tolerance in Cryptography, DTC 2011, Tokyo, Japan, September 29, 2011, L. Breveglieri, S. Guilley, I. Koren, D. Naccache, and J. Takahashi, Eds. IEEE Computer Society, 2011, pp. 105–114.
I. Alshaer, B. Colombier, C. Deleuze, V. Beroulle, and P. Maistri, “Variable-length instruction set: Feature or bug?” in 25th Euromicro Conference on Digital System Design, DSD 2022, Maspalomas, Spain, August 31 - Sept. 2, 2022. IEEE, 2022, pp. 464–471.
A. Marotta, R. Lashermes, G. Bouffard, O. Sentieys, and R. Dafali, “Characterizing and modeling synchronous clock-glitch fault injection,” in Constructive Side-Channel Analysis and Secure Design - 15th International Workshop, COSADE 2024, Gardanne, France, April 9-10, 2024, Proceedings, ser. Lecture Notes in Computer Science, R. Wacquez and N. Homma, Eds., vol. 14595. Springer, 2024, pp. 3–21.
B. Colombier, A. Menu, J.-M. Dutertre, P.-A. Moëllic, J.-B. Rigaud, and J.-L. Danger, “Laser-induced single-bit faults in flash memory: Instructions corruption on a 32-bit microcontroller,” in IEEE International Symposium on Hardware Oriented Security and Trust, HOST 2019, McLean, VA, USA, May 5-10, 2019. IEEE, 2019, pp.1–10.
H. Perrin, J. Dutertre, and J. Rigaud, “Betrayed by light: How photon emission microscopy empowers register bit-level laser attacks on microcontrollers,” in IEEE International Symposium on Hardware Oriented Security and Trust, HOST 2025, San Jose, CA, USA, May 5-8, 2025, pp. 35–45.
T. Trouchkine, S. K. Bukasa, M. Escouteloup, R. Lashermes, and G. Bouffard, “Electromagnetic fault injection against a system-on-chip, toward new micro-architectural fault models,” CoRR, vol. Abs/1910.11566, 2021.
S. Casavecchia, D. Aboulkassimi, J. Clédière, J.-M. Dutertre, and S. Pontié, “Exploring laser fault injection in system-on-chips: A new approach for cpu and cache attacks,” in IEEE International Symposium on Hardware Oriented Security and Trust, HOST 2026, Washington, USA, May 4-7, 2026.
Downloads
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Ludovic Claudepierre, Edna Rocio Ferrucho-Alvarez, Laurent Le Brizoual, Laurent Pichon
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
License Terms:
Except where otherwise noted, content on this website is lincesed under a Creative Commons Attribution Non-Commercial License (CC BY NC)
Use, distribution and reproduction in any medium, provided the original work is properly cited and is not used for commercial purposes, is permitted.
Copyright to any article published by WiPiEC retained by the author(s). Authors grant WiPiEC Journal a license to publish the article and identify itself as the original publisher. Authors also grant any third party the right to use the article freely as long as it is not used for commercial purposes and its original authors, citation details, and publisher are identified, in accordance with CC BY NC license. Fore more information on license terms, click here.