Fault Injection Caused by Phase-Locked Loop Compromised With IEMI

Intentional electromagnetic interference (IEMI) based fault injection is a hardware security threat that noninvasively generates temporary faults by causing a glitch in the clock supplied to a cryptographic module. Previous discussions of this threat have assumed that the glitch is supplied directly to the cryptographic module and that modules with clocks supplied by a phase-locked loop (PLL) are immune to this threat. However, for PLLs in general-purpose devices, which are required to output a stable clock frequency over a wide frequency bandwidth, a glitch may cause steep frequency fluctuations in the output clock. If these fluctuations exceed the maximum operating frequency of the module, a fault due to a timing violation caused by a PLL compromised with IEMI will occur. This article investigates the possibility of IEMI fault injection in cryptographic modules operated by a clock output from PLLs with wide-loop bandwidths implemented in general-purpose devices. Specifically, we focus on the phase comparison of the clock by the PLL and inject EM waves to temporarily increase the output clock frequency by controlling the occurrence time of the clock glitch. In experiments, we applied IEMI fault injection to a PLL implemented in a field-programmable gate array and demonstrated that it is possible to cause a fault due to a timing violation, leading to the extraction of the secret key. In addition, as a countermeasure against this threat, a method to suppress PLL output frequency fluctuations due to glitches was investigated.