In this chapter, we describe a complete attack on a ring oscillator (RO) based true random number generator using the electromagnetic side channel. First, we analyze the frequency of the oscillators and their placement in the device. This analysis leads to the active attack that modifies the behavior of the random number generator using a strong electromagnetic field. We show that it is possible to dynamically control the bias of a RO based random number generator implemented in logic devices.

Chapter Contents:

• 14.1 Introduction
• 14.2 Background
• 14.2.1 TRNG model and implementation
• 14.3 Figures
• 14.3.1 Attack scenario
• 14.4 Retrieving information on the RO-TRNG: passive electromagnetic attack
• 14.4.1 Electromagnetic analysis platform
• 14.4.2 Frequency analysis
• 14.4.3 Differential frequency analysis
• 14.4.4 Experiments
• 14.4.4.1 Design setup
• 14.4.4.2 Acquisition setup
• 14.4.5 Experimental results
• 14.4.5.1 Results of Experiments #1 and #2: retrieval of the RO frequency and localization of RO
• 14.4.5.2 Results of Experiment #3: retrieval of the sampling frequency
• 14.5 Modifying the RO-TRNG behavior: active electromagnetic attack
• 14.5.1 Injection platform
• 14.5.2 Experiments
• 14.5.3 Attack description
• 14.5.4 Effect of the electromagnetic waves on the Ros-Target #1
• 14.5.4.1 Choice of the injected signal frequency
• 14.5.4.2 Proof of effectiveness
• 14.5.4.3 Phase reduction
• 14.5.5 Effect of the electromagnetic waves on the TRNG-Target #2
• 14.5.5.1 Impact of the dependence between ROs on the random bitstream
• 14.5.5.2 Control of the bias
• 14.5.6 Discussion
• 14.6 Conclusion
• References

Inspec keywords: cryptography; logic devices; random number generation; oscillators

Other keywords: cryptographic application; on-chip oscillators; electromagnetic side channel; logic device; random number generator; ring oscillator attack

Subjects: Logic circuits; Oscillators