Timing-Controlled EM Fault Injection Method Focusing on EM Leakage from Communication Channel

Fault injection attacks against cryptographic modules have been identified as a significant threat, as they can be used to extract secret keys by inducing temporary fault at a specific timing during cryptographic operations. Conventional fault injection methods typically involve fault triggering by exploiting signals that indicate the execution time of cryptographic operations or common-mode currents that are highly relevant to these operations and then injecting electromagnetic (EM) waves synchronized with these signals. However, inducing faults only for a specific process is challenging owing to delays between observing trigger signals and injecting EM waves. In addition, countermeasures against side-channel attacks may prevent sensitive information from leaking outside the cryptographic module, making conventional methods ineffective in certain scenarios. To address these challenges, this study proposes a fault injection method that leverages common-mode currents generated during the communication process as trigger signals to induce faults at arbitrary times during cryptographic operations. The method was validated on a device implemented with AES-128. The probability of fault injection at a particular process was approximately 50%. To further enhance precision, the transmission time of ciphertext from the cryptographic module was considered. Our proposed method can successfully generate the faults required to extract secret keys, ultimately allowing for the retrieval of these keys.