Black-Box Laser Fault Injection on a Secure Memory

Overview: Olivier Ndiaye and the Donjon security research lab at Ledger present an advanced black-box Laser Fault Injection (LFI) evaluation against a commercial secure memory microcontroller. Secure memory chips are widely deployed across IoT devices to safeguard cryptographic keys, certificates, and authentication PINs without incurring the heavy financial or NDA overhead of certified secure elements. The researchers demonstrate how backside silicon preparation and precision near-infrared laser fault injection bypass internal hardware access flags, extracting confidential secrets in plaintext within minutes.

Key Topics: - Architecture of hardware secure memories, memory zoning, and access control policies - Decapsulation and backside silicon sample preparation using optical microscopy - Electromagnetic and power side-channel synchronization for precise laser glitch triggering - Laser-induced state corruption of access control flags and hardware countermeasures

Technical Details: The evaluated secure memory divides its physical storage into three core zones: the Configuration Zone, the Data Zone (split into isolated cryptographic slots), and the One-Time Programmable (OTP) Zone. Slot access control is determined by immutable configuration flags permanently committed via OTP fuses, designating slots as plaintext readable, encrypted read (requiring active symmetric session keys), or completely locked as "Secret" (only usable for internal cryptographic authentication without export). The chip incorporates robust physical defenses, including internal clock generation to neutralize clock glitching and an active top-layer metal shield that prevents front-side microprobing.

To circumvent front-side defenses, the researchers targeted the silicon substrate from the backside. Because silicon is transparent to near-infrared (NIR) wavelengths, laser pulses can penetrate the active logic layer from the rear without tripping the top metal shield. The sample preparation involved precise mechanical milling and scalpel scraping of the plastic epoxy packaging, followed by selective chemical etching to expose the bare die. The testbench integrated a 1064 nm infrared pulsed laser, an optical microscope objective, a motorized sub-micron XYZ motion stage, and an FPGA test controller communicating via I2C.

Because the target was approached strictly as a black box without firmware source code, the researchers used an oscilloscope to capture power consumption traces during memory read transactions. These power side-channel measurements revealed distinct operational phases, allowing them to pinpoint the precise instruction execution window where the chip's internal logic reads slot access flags. By firing localized infrared laser pulses during this critical window, they induced transient photoelectric faults that corrupted the flag evaluation logic. This caused the chip to misinterpret "Secret" or "Encrypted" slot states as plaintext accessible, directly dumping protected master keys and authentication PINs over the communication bus in under two minutes.

Key Takeaways: Hardware manufacturers cannot rely solely on front-side active metal shields and clock jitter to protect sensitive cryptographic boundaries. Silicon architectures must integrate distributed backside optical sensors (photodiodes) that detect laser exposure and trigger immediate tamper zeroization. Firmware and hardware state machines should implement redundant, multi-cycle double-checks with randomized execution delays when evaluating security-critical access control flags, ensuring that single-event transient faults cannot downgrade cryptographic enforcement.

(AI summary — Gemini Flash)