Loading [a11y]/accessibility-menu.js
Test-mode-only scan attack using the boundary scan chain | IEEE Conference Publication | IEEE Xplore

Test-mode-only scan attack using the boundary scan chain


Abstract:

Boundary-scan is a very popular technology with wide applications in product life cycle that ranges from product design, prototype debugging, production to field service....Show More

Abstract:

Boundary-scan is a very popular technology with wide applications in product life cycle that ranges from product design, prototype debugging, production to field service. However, when it comes to securing a product such as smart card, RFID tag, set-top-box, etc., the technology can be targeted by an attacker to reveal the secret information of the chip. In this paper, for the first time, we will show that the boundary scan chain can be used to bypass the mode-reset countermeasure, which is used to thwart all the scan attacks that rely on switching between the normal mode and the test mode of the chip. We propose two attacks on the AES core. The first attack uses the boundary scan chain to apply input plaintexts to the first round of AES, whereas the second attack targets the final round by applying the inputs through the internal scan chain(s) and the round output is captured in the boundary scan chain. The attacks not only bypass the mode-reset countermeasure but also circumvent the affect of stimulus decompressor (first attack) or the response compactor (second attack). Both attacks retrieve the 128-bit secret key within one minute of execution.
Date of Conference: 26-30 May 2014
Date Added to IEEE Xplore: 08 July 2014
Electronic ISBN:978-1-4799-3415-7

ISSN Information:

Conference Location: Paderborn, Germany

Contact IEEE to Subscribe

References

References is not available for this document.