MCU reverse engineering

Abstract

There has been considerable recent interest in the level of tamper resistance that can be provided by low cost embedded security devices such as contact and contactless smartcards. These devices are widely deployed in consumer and financial systems, making their physical and cryptographic security a critical research topic. It is well known that high-end semiconductor analysis laboratories can reverse engineer smartcard hardware and firmware with professional chip testing equipment. However, building and operating a state-of-the-art semiconductor laboratory requires capital investment reaching millions of US dollars, which places such capabilities out of reach for most individual attackers and small groups. In this paper, we describe a diverse set of practical security attacks that can be successfully mounted by adversaries with limited financial resources and basic technical infrastructure. Three major attack categories rely on special yet affordable low-cost equipment: differential fault analysis via signal glitching, permanent chip memory rewriting, and cryptographic key recovery through memory remanence effects. There also exists a class of exploitable attacks based on traditional protocol design failures, and these methods may not require any specialized hardware or laboratory equipment whatsoever. We systematically describe the working principle, implementation procedure, and real-world application examples of each attack vector in detail. Some of our proposed attacks deliver significant performance improvements over the previously established state-of-the-art techniques in embedded security research. Other attack cases serve as valuable cautionary tales for hardware designers, protocol engineers, and security evaluators. Collectively, all the attack scenarios and experimental findings presented in this paper conclusively demonstrate that building robust tamper-resistant hardware devices, implementing secure firmware logic, and deploying these devices effectively in real systems is far more complex and challenging than industry practitioners commonly perceive.

1 Introduction

An increasing number of large-scale, mission-critical digital systems rely heavily on the tamper resistance properties of smartcards and dedicated specialist security processors. These systems span multiple industrial domains, including subscription-based pay-TV broadcasting networks, global GSM cellular mobile communication systems, prepaid gas and electricity utility meters, and contactless smartcard electronic wallet platforms used for retail payments. Each of these systems depends on embedded security hardware to isolate cryptographic keys, prevent firmware tampering, and block unauthorized access to internal sensitive data. This widespread dependency makes the reliability of tamper resistance mechanisms a foundational concern for the entire embedded security ecosystem.

It is important to clarify that hardware tamper resistance is never an absolute, foolproof property. A well-funded opponent with full access to professional semiconductor test and probing equipment can extract secret key material from a smartcard chip through direct physical observation of transistor-level structures and precise electrical manipulation of on-chip hardware components. The security community generally accepts a core consensus: given unlimited time and sufficient financial investment, any chip-sized tamper-resistant embedded device can be fully penetrated and reverse engineered using destructive physical analysis. Prior academic literature has also documented a small set of low-cost technical techniques for attacking specific commercial tamper-resistant devices and embedded security processors [2].

Based on this background, the effective tamper resistance level offered by any commercial security product can be quantitatively measured by two core metrics: the total time cost and financial penalty that the device’s built-in protective mechanisms impose on a potential attacker. Accurately estimating these two penalties is therefore a vital task for security risk assessment and product certification. Unfortunately, this specific evaluation problem has received far less research attention from academic security researchers, industrial evaluators, and hardware engineers than its practical importance deserves. The relatively short list of published references provided at the end of this article serves as direct evidence of this research gap in the existing literature.

To standardize attacker classification and guide the design of security systems that partially rely on hardware tamper resistance, we adopt the classic adversary taxonomy originally proposed by IBM’s embedded security research team [1]. This classification framework divides potential attackers into three distinct categories based on their knowledge, equipment, and funding level.

Class I (clever outsiders): These adversaries are often highly intelligent and possess strong self-learning capabilities in embedded electronics. However, they lack comprehensive internal knowledge of the target security system’s proprietary design details. They can only access moderately sophisticated commercial-off-the-shelf equipment that is affordable for individual users. Their attack strategy typically focuses on exploiting pre-existing inherent weaknesses in system deprotection logic, rather than designing and manufacturing new hardware tools to create exploitable vulnerabilities from scratch. Most hobbyist hackers and independent security researchers fall into this category.

Class II (knowledgeable insiders): These actors hold formal specialized technical education and years of professional experience in embedded hardware or cryptography. They possess deep partial understanding of critical segments of the target system and have potential physical and logical access to most of the device’s functional modules. They can utilize highly sophisticated custom tools and precision measurement instruments for hardware analysis, bus traffic monitoring, and cryptographic reverse engineering. Professional industrial hackers and senior embedded engineers with malicious intent are typical Class II adversaries.

Class III (funded organisations): These entities can assemble cross-functional teams of specialists with complementary skills covering hardware analysis, cryptanalysis, firmware reverse engineering, and protocol hacking. Their operations are backed by substantial and continuous funding resources that support long-term research and tool development. They are capable of conducting in-depth structural analysis of complex security systems, designing highly customized sophisticated attack methodologies, and deploying the most advanced semiconductor analysis tools available on the market. They often recruit Class II knowledgeable insiders as core members of their dedicated attack teams to accelerate vulnerability exploitation.

In this paper, we present, formalize, and expand a series of low-cost attack techniques that can render mainstream smartcards and commercial tamper-resistant embedded devices vulnerable to Class II attackers, and in many simplified scenarios, even budget-limited Class I attackers. All techniques proposed in this work avoid the expensive semiconductor laboratory infrastructure required by traditional physical attacks, making them practically deployable by ordinary adversaries.

2 Differential Fault Analysis

In a landmark publication [5], Biham and Shamir introduced a classic differential fault analysis attack targeting the DES block cipher. Their original attack required 200 faulty ciphertexts, where each ciphertext contained intentional one-bit data errors induced by controlled environmental stress applied to the cryptographic processor. The foundational fault model adopted in their research was first proposed by Boneh and his research colleagues in [11], and the practical effects of this fault model were further validated and expanded in subsequent studies [16, 10]. This theoretical model assumes that exposing an embedded cryptographic processor to low-intensity ionizing radiation or equivalent electrical stress can induce isolated one-bit flip errors in runtime data, particularly in the secret key material processed during successive encryption rounds of block ciphers.

Subsequent research [6] demonstrated that this traditional data-oriented fault analysis method could be extended to reverse engineer proprietary block cipher algorithms whose internal round structures and S-box layouts are completely unknown to the attacker. Across all these early studies, the core critical observation remains consistent: random bit errors occurring in the final few encryption rounds of a cipher leak critical information about the secret encryption key or the underlying algorithm structure. This information leakage forms the mathematical basis for all differential fault analysis attacks.

Further refined research outcomes were presented in [7], which optimized the fault injection position for symmetric cipher attacks. The study proved that if precise fault injection is limited to only the last one or two rounds of the target algorithm, the total number of required faulty ciphertext samples can be drastically reduced. Boneh’s earlier work [11] also extended the fault model to asymmetric cryptosystems, proving that public-key encryption and signature schemes are equally vulnerable to fault injection. Most notably, an RSA composite modulus can be fully factored with a small set of intentionally faulty digital signatures generated by the target device.

Despite these promising theoretical results, all the aforementioned proposed attacks shared a critical practical limitation: no prior research had successfully demonstrated the real-world feasibility of their idealized one-bit random fault model. This limitation severely restricted their real-world application on commercial security processors. In most mainstream smartcard security processors, the secret key material is permanently stored in on-chip EEPROM alongside several kilobytes of executable operating system and cryptographic library code. This dense memory layout means that a randomly induced one-bit error is far more likely to trigger a full processor crash, corrupt executable firmware, or produce completely uninformative garbage output than to generate the specific faulty ciphertexts required for traditional differential fault analysis. This made early academic fault attacks largely theoretical rather than practical for real smartcard hacking.

In this section of the paper, we introduce a different, physically realistic fault model that delivers significantly more powerful and reliable cryptographic attacks than the traditional radiation-induced data-bit fault model. In the subsequent sections, we will explore additional fault types that can be easily induced by low-budget Class I attackers using homemade or low-cost commercial tools. We will prove that these alternative fault vectors also enable highly feasible, field-deployable attacks on commercial tamper-resistant devices. Most of our proposed attacks can be further adapted to scenarios where the deployed encryption algorithm is initially unknown, or where the attacker possesses incomplete technical documentation of the target embedded system. All these attack techniques perfectly fit the operational definition of actions that a resource-limited Class I opponent can perform without industrial-grade laboratory equipment.

2.1 A Realistic Differential Attack

In our prior industry-focused research [2], we documented a practical fault attack that had already been widely adopted by amateur hobbyist hackers to compromise pay-TV subscription smartcards. The core principle of this attack is to inject a controlled electrical glitch — a narrow, high-speed transient signal — into either the clock input pin or the power supply rail of the target microcontroller chip. The most common implementation involves modifying the standard 5 MHz reference clock signal supplied to a smartcard, inserting one or more short-duration 20 MHz overclocked pulses during specific program execution stages.

Due to inherent hardware variations within the chip, this clock glitch produces selective signal distortion. Different internal logic paths feature unique gate delay values, and on-chip circuit components have diverse RC time constant parameters. As a result, the injected transient only distorts a subset of internal logic signals instead of corrupting the entire chip operation. By fine-tuning the precise timing offset and pulse duration of the injected glitch, the attacker can force the device’s CPU to execute a range of unintended, incorrect machine instructions that deviate from the original firmware logic.

The exact set of mis-executed instructions varies between individual chips of the same model due to manufacturing process variations and minor silicon imperfections. However, these exploitable glitch parameters can be reliably identified through systematic brute-force search using simple hardware circuits that can be fully assembled at home with components costing less than one hundred US dollars. This low entry barrier makes the attack accessible to any skilled electronics hobbyist.

We do not claim original invention of this glitching attack technique. It first emerged within the global pay-TV hacking community and had been actively used in underground circles for at least one year before our formal academic documentation. In the basic implementation detailed in our previous work [2], the attack targets a simple firmware loop designed to transmit a fixed memory segment to the device’s serial communication port.

The original assembly-level loop logic is structured as follows:

1 b = answer_address

2 a = answer_length

3 if (a == 0) goto 8

4 transmit(*b)

5 b = b + 1

6 a = a - 1

7 goto 3

8 ...

The hacker’s objective is to find a specific glitch timing that allows the program counter to increment normally but mutates either the conditional jump instruction on line 3 or the loop counter decrement operation on line 6 into an unintended instruction opcode. By repeatedly injecting this calibrated glitch during loop execution, the attacker can bypass memory access restrictions and dump the entire contents of the chip’s protected internal memory to the external serial interface.

When this instruction-level glitching attack is applied to cryptographic algorithm execution rather than basic control flow code, it exhibits even higher effectiveness for key extraction. The most impactful conclusion from this research is clear: fault attacks based on corrupting CPU instruction execution are significantly easier to implement and produce more information-rich leakage than traditional attacks that only corrupt runtime data bits. This is the core advantage of our realistic differential attack over prior theoretical work.

2.2 Attacking RSA

The Lenstra variant of our instruction glitch attack provides an extremely efficient method to break RSA signature implementations on commercial smartcards. Most embedded RSA accelerators compute a signature S for message M modulo the composite modulus n = pq using the Chinese Remainder Theorem (CRT). The device first calculates intermediate signature values modulo the two prime factors p and q separately, then combines the two results to generate the final valid signature for the composite modulus.

If a precise electrical glitch is injected during either of the two prime-modulo computation stages, the attacker can immediately factor the RSA modulus n without complex mathematical computation. Let e denote the public encryption exponent of the RSA scheme. If the generated signature S = M^d (mod pq) is mathematically correct modulo prime p but contains a single induced error modulo prime q, the prime factor p can be directly computed using the greatest common divisor function: p = gcd(n, S^e − M) (1).

This vulnerability makes CRT-based RSA implementations an ideal target for low-cost glitch attacks. The smartcard dedicates the majority of its cryptographic processing time to computing the signature values modulo p and modulo q. Almost any random glitch that distorts the output of either computation stage will create the faulty signature required for modulus factorization. The attacker does not need to precisely target specific instructions within the algorithm code, which drastically reduces the complexity of glitch parameter calibration.

Most critically, this attack only requires a single faulty signature sample to complete modulus factorization. This enables fully online, real-time exploitation in live transaction environments. A malicious retail point-of-sale (POS) terminal operated by criminal organizations can inject the required glitch during a normal customer transaction, factor the bank’s RSA modulus in milliseconds, compute the mathematically correct valid signature, and forward the legitimate transaction data to the bank backend without any detectable abnormality.

As a result, criminal groups can stealthily extract the bank’s RSA secret keys without the customer or the banking backend system detecting any anomalous behavior in the transaction log. The practical threat is amplified by the deployment strategy of the new EMV electronic purse standard. Issuing banks only maintain 10,000 unique RSA secret key pairs for their entire customer card population [14]. Once a single key set is compromised via this glitch attack, criminals can forge cloned smartcards for a large portion of the bank’s user base, leading to large-scale financial fraud.

2.3 Attacking DES

When an attacker gains the ability to selectively induce faults in targeted individual CPU instructions, multiple straightforward and efficient attack paths become available against the DES block cipher. The most intuitive method targets the key mixing stage in the final two encryption rounds of DES. An attacker can disable one of the 8-bit XOR operations that combine round subkeys with the S-box input data by corrupting the corresponding instruction opcode via glitching.

By repeating this targeted glitch to disable each key byte XOR operation in sequence, the attacker obtains a series of distinct faulty ciphertext outputs. Each faulty output typically differs from the legitimate ciphertext in the output values of two S-boxes, and occasionally three S-boxes in rare cases. Applying classic differential cryptanalysis techniques to these faulty samples allows the attacker to extract approximately five bits of secret key information for each disabled key byte operation.

In practical terms, collecting six faulty ciphertexts generated by glitching the final DES rounds yields roughly 30 bits of the 56-bit master key. The remaining unknown key bits can be recovered via brute-force exhaustive search with minimal computational overhead on modern consumer hardware. This reduces the computational complexity of DES key recovery to a trivial task for low-budget attackers.

An even faster variant of this attack targets the loop control logic of the DES round function. The attacker corrupts the loop iteration variable or the round-termination conditional jump instruction via glitching, forcing the algorithm to terminate after only one or two encryption rounds instead of the standard sixteen rounds. With the full round structure disabled, the secret key can be directly identified through visual inspection of the truncated encryption output. The practical performance of this simplified attack depends slightly on the specific firmware implementation of the DES loop structure.

Overall, full DES key recovery via instruction glitching only requires between one and ten faulty ciphertext samples, representing a massive improvement over the 200 samples demanded by traditional data-bit differential fault analysis. This raises a critical practical question: how feasible is it for a low-cost attacker to precisely target specific individual instructions within the embedded firmware?

In nearly all commercial smartcards, the manufacturer preloads a set of fixed cryptographic and communication routines into immutable on-chip ROM memory. Although vendors often market this ROM code as a lightweight embedded operating system, it functionally operates as a fixed function library and development toolkit for application programmers. These built-in routines almost always include a standardized implementation of the DES algorithm or a proprietary alternative such as the Telepass encryption scheme.

A Class I attacker can purchase the official manufacturer’s smartcard development toolkit for a one-time cost of only a few thousand US dollars. This toolkit includes complete technical documentation of the ROM library, full firmware debugging interfaces, and physical sample cards for parameter testing. With this information, the attacker can accurately locate and target individual DES assembly instructions for precise glitch injection with high reliability.

When facing a completely unknown or undocumented firmware implementation, the attacker must conduct limited experimental testing to map the device’s instruction timing windows. This calibration step is already required for every new card model to determine valid glitch voltage and timing parameters. However, the total search space for usable glitch configurations is relatively small.

After analyzing a small number of common DES firmware implementations, it becomes easy for attackers to recognize the output patterns generated by disabling individual instructions in the final two rounds. In fact, many non-key-mixing instructions in the round function leak nearly as much key information as the official subkey XOR instructions when disabled via glitching. This further simplifies unknown implementation attacks for novice adversaries.

2.4 Reverse Engineering an Unknown Block Cipher

Attackers can leverage clock and power supply glitches to systematically reduce the effective number of rounds in an unknown proprietary block cipher. Simple statistical correlation tests can monitor the relationship between plaintext input bits and ciphertext output bits. A sudden strong statistical dependency indicates that the encryption round count has been successfully reduced via instruction corruption.

This round-reduction attack remains practical even when the attacker has zero prior knowledge of the algorithm’s implementation details. This capability opens up a powerful use case: attackers can reverse engineer classified, unpublished block ciphers such as Skipjack without relying on expensive semiconductor delayering and electron microscopy analysis equipment.

Biham and Shamir previously explored this reverse engineering scenario using their traditional one-bit random data error fault model [6, 7]. Their methodology identifies faulty ciphertexts with a low Hamming distance from legitimate outputs, which correspond to errors limited to the final encryption rounds. By analyzing these samples, attackers can separate the ciphertext into left and right data halves and map bit propagation across round transformations.

For S-box-based ciphers like DES, this analysis quickly reveals the internal Feistel structure. Collecting 500 faulty ciphertexts allows recovery of the algorithm’s gross structural layout, while approximately 10,000 samples enable full reconstruction of all S-box lookup table entries. This process requires significant data collection and computational processing time.

Our instruction-corruption glitch technique outperforms this traditional method for unknown cipher reverse engineering. Attackers can systematically target the last instruction, then the second-last instruction, and continue backward through the round function step by step. This ordered approach produces structured leakage that simplifies structural analysis, while requiring roughly the same number of ciphertext samples as Biham and Shamir’s data-fault method.

To demonstrate real-world applicability, we analyze the classified Red Pike block cipher as a practical case study. Red Pike was designed by the UK’s GCHQ to encrypt government data classified at the Restricted level. The UK Department of Health planned to deploy Red Pike for encrypting confidential patient medical records across national healthcare systems.

The British Medical Association opposed this deployment, arguing that healthcare encryption should use open, peer-reviewed algorithms that had withstood public cryptanalytic attacks for at least two years. Preferred candidates included 3DES, Blowfish, SAFER K-128, and WAKE, all of which had extensive public security validation histories.

To demonstrate Red Pike’s cryptographic robustness to the BMA, the UK government commissioned an independent security review conducted by four academic cryptographers [18]. The published review document contains limited descriptive hints about the algorithm’s internal structure without releasing the full source code or specification.

The official review states that Red Pike utilizes the same core primitive operations as the RC5 block cipher (page 4). Its round function is limited to three simple arithmetic operations: integer addition, bitwise exclusive OR, and circular left bit shifting. The algorithm contains no static lookup tables, features a minimal key schedule, and can be implemented in only five lines of high-level code (page 4).

Additional published hints reveal that each key bit’s cryptographic influence rapidly cascades across the data state during encryption (page 10). A full Red Pike encryption operation requires approximately one hundred atomic arithmetic instructions to complete (page 19). These clues allow us to estimate the glitch attack complexity by drawing direct comparisons to the well-documented RC5 algorithm [19].

Disabling the final key addition operation of RC5 via glitch corruption produces a distinct output pattern. The right data half transforms into (B XOR A) shl A, where A and B represent the left and right Feistel state halves respectively. This unique output signature immediately reveals that the cipher uses a balanced Feistel structure without a final post-processing permutation layer.

Disabling the subsequent circular shift instruction exposes the 32-bit shift width while hiding the data-dependent shift rotation parameters. Corrupting the following XOR operation produces transparent output changes that confirm the bitwise mixing function. Disabling the penultimate round’s key addition fully exposes the mathematical structure of RC5’s famous data-dependent rotation mechanism.

After observing these patterned outputs, an attacker can accurately deduce the algorithm’s core round function structure:

A = ((A XOR B) shl B) op key

B = ((B XOR A) shl A) op key

Fully reverse engineering RC5’s complex key schedule requires separate single-step instruction tracing via additional glitching. However, if the attacker correctly guesses that the unknown operation "op" is integer addition, all round subkey bits can be directly recovered by working backward through the truncated encryption rounds.

This analysis leads to a critical security conclusion: excluding its complex key schedule, RC5 is one of the worst algorithm choices for secret-hardware embedded applications. Devices implementing RC5 are highly vulnerable to low-cost instruction glitch attacks by Class I adversaries. If Red Pike shares this simple round structure with a simplified key schedule, it will be even more susceptible to our proposed low-cost fault attacks.

It is important to note that the UK government plans to eventually release Red Pike as open software, so this analysis does not constitute a direct criticism of the algorithm’s fundamental cryptographic design. It merely highlights vulnerabilities specific to closed hardware-only deployments of simple lightweight block ciphers.

Our findings provide clear guidance for secure hardware designers. Proprietary secret algorithms implemented in tamper-resistant chips should incorporate increased structural complexity to raise attack costs. Large custom S-box tables stored in dedicated EEPROM memory (physically separated from program memory) are an effective countermeasure that increases the hardware complexity required for successful glitch attacks.

Additional prudent defensive measures include runtime instruction error detection logic, threshold multi-encryption with voting verification, and complex key schedule design that ensures partial round key leakage cannot be used to recover the full master secret key.

3 Chip Rewriting Attacks

When an attacker possesses full documentation of a target device’s firmware and hardware layout, multiple low-cost techniques exist to extract secret cryptographic keys by targeting specific hardware components. These methods include manipulating embedded fuse bits, altering individual logic gate states, and overwriting critical data stored in non-volatile memory regions. Prior research by Bovenlander documented a classic smartcard attack using two precision microprobe needles to bridge a permanently blown security fuse on the chip die [12].

This fuse is intentionally blown during the factory end-of-test cycle to permanently disable the chip’s debug and memory readback interfaces. By electrically shorting the fuse with microprobes, the attacker re-enables the locked factory test routines. These restored test functions allow full readout of the chip’s protected program and data memory contents with no cryptographic restrictions.

Even when fuse bridging is blocked by additional hardware locks, individual memory cells can still be targeted and modified via low-cost physical techniques. All attacks in this category can be executed with a modest budget accessible to individual Class I attackers, without requiring million-dollar semiconductor fabrication facilities.

3.1 ROM overwrite attacks

The immutable mask ROM memory commonly used to store smartcard operating systems and cryptographic libraries is not completely immune to physical modification. Individual single bits within ROM cells can be selectively flipped using a standard laser cutter microscope, a device commonly available in university laboratory facilities.

For well-documented algorithms such as the standard DES implementation, attackers can identify specific critical bits within the ROM code. Flipping these carefully selected single bits enables trivial secret key extraction with minimal follow-up computation. The exact bit positions vary slightly between different vendor implementations, but universal vulnerable bit patterns exist across most mainstream ROM-based DES codes.

A common exploitation example is modifying a conditional branch instruction to become an unconditional jump instruction. This simple bit change bypasses the round iteration logic and forces DES to terminate encryption after only one or two rounds, making the key directly visible in runtime memory. Attackers can also progressively disable key-mixing XOR instructions by flipping individual opcode bits within the ROM program code.

When the attacker has incomplete documentation of the target firmware, ROM overwrite attacks still offer powerful exploitation paths. The fixed DES S-box lookup tables stored in ROM can be easily identified via their known statistical bit distribution patterns. Selectively overwriting multiple S-box bits transforms the non-linear DES substitution function into a simple linear transformation over the binary field GF(2).

Once the encryption function is linearized via ROM modification, the complete 56-bit DES master key can be mathematically extracted using only a single known plaintext-ciphertext pair. This eliminates the need for multiple fault samples or complex cryptanalysis algorithms.

3.2 EEPROM modification attacks

Many modern smartcards store application firmware and cryptographic algorithms in rewritable EEPROM memory rather than fixed mask ROM. This flexible storage scheme enables field firmware updates but introduces additional physical attack surfaces. Attackers can use two fine-tipped microprobing needles to forcibly set or reset any individual bit within the EEPROM memory array [17].

This microprobe bit manipulation technique can replicate all the ROM overwrite attacks described previously on rewritable memory devices. The unique advantage of EEPROM targeting is bidirectional bit control: attackers can both set 0 bits to 1 and reset 1 bits to 0, creating far more flexible exploitation strategies than one-way ROM bit flipping.

A practical exploitation leverages the standard odd-parity rule enforced by all official DES implementations. Every 8-bit DES key byte requires odd parity as an integrity check mechanism. Compliant security devices reject any loaded key containing even-parity bytes and return a explicit key parity error message to the host interface.

Banking security modules such as the VISA PIN processing hardware strictly enforce this parity rule to prevent unauthorized key manipulation. Assume an attacker knows the fixed memory address of a target DES key stored in EEPROM but cannot directly read the protected memory region via standard software commands. This scenario is extremely common, as smartcard firmware developers frequently place secret keys at fixed low-address EEPROM locations for easy runtime access.

The attacker can execute a simple bit-guessing attack using microprobes. First, the attacker forces the first bit of the target key byte to a logic 1 state using the microprobe needle. The attacker then triggers an encryption operation using the modified key and observes the device’s response.

If the encryption operation completes successfully without errors, the original native bit value was already 1. If the device returns a key parity error notification, the original native bit value was 0. The attacker repeats this procedure sequentially for every bit across all eight key bytes to fully reconstruct the secret DES master key.

This attack works even if the attacker does not fully understand the device’s proprietary key redundancy protocol. If modifying a bit triggers an unexpected error state unrelated to parity, the attacker simply reverts the bit to its original state and proceeds to the next position. This self-correcting process ensures zero permanent damage to the target device during key recovery.

The required hardware for this attack is widely accessible. Microprobe stations are standard equipment in university electrical engineering departments, while laser cutter microscopes are commonly found in cellular biology laboratories for tissue sample processing. Undergraduate students often obtain unsupervised after-hours access to these devices for academic projects. External Class I attackers can purchase refurbished versions of these tools on the secondary market for a total cost of no more than a few thousand US dollars.

3.3 Gate destruction attacks

At the rump session of the 1997 Fast Software Encryption workshop, Eli Biham and Adi Shamir presented an innovative physical attack targeting hardware-implemented block ciphers. Their technique uses a precision laser cutter to permanently destroy a single individual logic gate within the cryptographic processor’s hardware circuit layout.

Their demonstration focused on hardware-accelerated DES implementations, which follow a common iterative structure. Most DES hardware cores contain combinational logic for executing a single encryption round, paired with a dedicated state register. This register stores the output of round k and feeds it back as the input data state for round k+1 to complete the iterative process.

Biham and Shamir proved that destroying the least significant bit (LSB) feedback path of this state register forces the LSB of all round function outputs to become permanently stuck at logic 0. This single-bit hardware fault creates a persistent bias in all subsequent encryption outputs.

By statistically comparing the least significant six bits of the left and right data halves across multiple faulty ciphertexts, the attacker can recover several individual bits of the secret round subkeys. Collecting approximately ten ciphertexts from the physically damaged chip provides sufficient data for differential cryptanalysis to deduce the majority of the round key material.

With most of the round keys recovered, the remaining unknown bits of the 56-bit master key can be found via trivial brute-force search on consumer hardware. This attack was the first proven method to break DES hardware implementations when the plaintext input data remains completely unknown to the attacker.

This plaintext-agnostic capability makes the attack particularly dangerous for real-world smartcard applications. Most payment smartcards use internal transaction state data as encryption plaintext, meaning the input values are never exposed to external parties during normal operation.

We propose a simple, low-cost hardware countermeasure to block this gate destruction attack. A chip modified by selective gate damage loses the mathematical property that encryption and decryption are inverse operations. Designers can add a lightweight runtime self-test routine that validates this inverse relationship automatically during device boot.

The self-test executes a simple verification sequence: generate a random plaintext block, encrypt it with a temporary test key, decrypt the resulting ciphertext, and compare the decrypted output to the original plaintext. A mismatch indicates permanent hardware tampering, and the device can permanently lock all secret key material to prevent further exploitation. One of our industrial clients has already implemented this self-test mechanism in a new secure chip currently under development.

4 Memory Remanence Attacks

In a foundational USENIX conference paper [15], Gutman comprehensively documented the physical mechanisms behind memory remanence, the phenomenon where both static RAM (SRAM) and dynamic RAM (DRAM) retain previously stored data values for a significant time after power removal. This persistent data retention effect raises critical security questions for engineers designing tamper-resistant key storage systems.

A responsible security engineer must analyze how real-world memory remanence characteristics impact the protection of cryptographic keys stored in embedded security hardware. We conducted a practical case study targeting legacy banking security modules widely deployed in global ATM networks to quantify this risk in operational financial systems.

Most international banks adopt a standardized PIN management system originally designed by IBM and later refined by VISA for ATM transaction security [4]. This system governs how customer personal identification numbers (PINs) are generated, stored, and verified within dedicated hardware security modules (HSMs).

The customer PIN is mathematically derived from their primary bank account number using a standardized cryptographic process. First, the account number is encrypted with a dedicated 64-bit DES PIN key. The binary ciphertext output is then decimalized into a digit string. A fixed non-carry decimal offset value is added to this intermediate result to generate the final user PIN code. The offset parameter allows banks to let customers customize their own memorable PIN values without altering the underlying cryptographic derivation logic.

The official standardized calculation example from VISA’s security specification [4] is as follows:

Account number: 8807012345691715

PIN key: FEFEFEFEFEFEFEFE

Result of DES: A2CE126C69AEC82D

Result decimalised: 0224126269042823

Natural PIN: 0224

Offset: 6565

Customer PIN: 6789

The banking HSM executes all PIN derivation, verification, and key management operations within physically tamper-resistant trusted hardware. This hardware isolation enforces the dual-control security policy, which mandates that no single bank staff member can obtain full access to any customer’s plaintext PIN at any point during transaction processing [20].

To enforce this policy, the HSM restricts command authorization based on key ownership classes. For example, the device only executes a PIN verification command if the submitted PIN value is encrypted with a unique key assigned exclusively to the requesting ATM terminal or affiliated bank branch. This access control prevents bank software developers from abusing the HSM as a cryptographic oracle to conduct brute-force exhaustive searches against customer PIN values.

All internal keys within the HSM are classified into distinct functional groups. Each working key is encrypted with 3DES using one of twelve pairs of master DES keys stored in the HSM’s low-address SRAM memory region. ATM communication keys are encrypted under master key pairs 14 and 15, while inter-bank settlement keys use master pairs 6 and 7 for isolation.

The encrypted blob values of long-term keys such as the critical PIN derivation key are embedded directly within the HSM’s application firmware binary. These encrypted key blobs are fully visible to all bank programming staff with access to the firmware source code, meaning the only layer protecting the underlying plaintext keys is the HSM’s physical tamper resistance.

Physical tamper protection is implemented via internal lid security switches. Opening the HSM’s metal enclosure triggers the switches, which immediately cut power to the SRAM key storage region to erase all plaintext master keys instantly. The device requires battery replacement every few years during routine maintenance, and trusted bank security personnel reload the split-component master keys after each service operation.

We obtained and tested one legacy HSM unit manufactured in the late 1980s for our memory remanence experiment. After fully powering down the device for an extended period and then restoring power, we discovered that the master key values stored in SRAM remained almost completely intact.

Only 5% to 10% of the key bits experienced random corruption due to remanence decay over the power-off period. We are prohibited from disclosing the exact correct master key values, the partial remanent key readings, the operating bank name, and the device manufacturer due to non-disclosure agreements signed prior to the research study.

This moderate bit error rate from memory remanence is already alarming on its own. However, the combination of this remanence effect with DES’s built-in odd parity check creates an extremely dangerous vulnerability that drastically reduces the complexity of key recovery attacks.

If a recovered double-DES key contains approximately five corrupted bits from SRAM remanence, a naive security analyst might assume the brute-force search complexity equals the combinatorial cost of correcting 10 erroneous bits across the 112-bit key space. This would involve calculating (112 choose 10) total DES operations, which appears computationally expensive at first glance.

Each candidate key guess requires two computational steps: first, decrypt the publicly known encrypted PIN key blob using the candidate double-DES key. Second, for candidates with valid odd parity, encrypt a test account number to verify whether the decimalized output matches the target customer PIN. The total theoretical workload approximates 3 × (112 choose 10) DES operations, equivalent to roughly 2^50 computational complexity.

Direct hardware-accelerated brute-force search against the exposed PIN key would still be cheaper than executing this complex theoretical search flow. However, the byte-granular parity redundancy of DES reduces the actual attack complexity by multiple orders of magnitude via targeted pruning of invalid key candidates.

If no individual key byte contains two simultaneous bit errors (the most common scenario), the attacker only needs seven guesses per observed even-parity byte to restore valid parity. For a standard 10-byte double-DES key, the total complexity reduces to 3 × 7^10 ≈ 2^30 operations, which is trivial for modern consumer-grade computing hardware.

Even in the worst case where one key byte contains two bit errors, the total search complexity only rises to approximately 2^38 DES operations. This workload is fully feasible for a dedicated Class I attacker using inexpensive GPU-based password cracking rigs available on the consumer market.

DES parity checking has a well-documented history of creating security vulnerabilities rather than enhancing protection. In one historical incident, Kerberos’s parity-enforced DES code was integrated into an encrypted Telnet application. Session keys derived from Diffie-Hellman key exchange are randomly generated, so only 1 out of 256 generated keys satisfied DES odd parity requirements.

All other key exchange attempts failed during loading, and since the firmware did not check function return codes, the encrypted session would proceed using uninitialized garbage key material, creating catastrophic security exposure [8]. In another banking incident, a misunderstanding led multiple institutions to use ASCII-based passwords with forced odd parity as their operational PIN keys.

ASCII characters always have a zero in the most significant bit position, while DES parity checks only the least significant bit of each byte. This mismatch reduces the effective entropy of password-derived keys below the theoretical 2^48 limit, further weakening security against dictionary attacks [13]. These historical cases prove that key parity redundancy consistently introduces unforeseen attack surfaces when poorly integrated into real systems.

5 Protocol Failure

Cryptographic protocol design flaws are a far more prevalent attack vector than most security professionals recognize [3]. Many protocol vulnerabilities require no high-end laboratory hardware to exploit, and some can be abused using only basic software modifications or simple passive signal monitoring.

A classic example targets commercial satellite pay-TV decoders, which adopt a dual-chip hardware architecture. A dedicated cryptographic coprocessor handles the computationally intensive decryption of broadcast video streams, while a main microcontroller manages all communication between the coprocessor and the subscriber’s key-containing smartcard.

When a customer terminates their subscription payment, the broadcast operator transmits a targeted over-the-air management message designed to permanently disable the customer’s smartcard and block future video decryption. The famous "Kentucky Fried Chip" hack exploited this simple protocol logic by replacing the device’s main microcontroller with a modified aftermarket unit.

The modified microcontroller contained custom firmware that identifies and discards the subscription-disable broadcast message before it reaches the smartcard. This trivial hardware swap completely bypasses the operator’s remote access control system at zero recurring cost for the attacker [3].

Another well-documented protocol failure attack targets the Dallas Semiconductor DS5002FP secure embedded microcontroller, as detailed in our prior research [2]. This device uses encrypted off-chip memory to protect external firmware and data storage. A critical protocol flaw in the memory authentication logic allows attackers to fully bypass the encryption boundary and read all external memory contents in plaintext with no physical device manipulation required.

The most severe protocol attacks require no specialized hardware whatsoever, relying purely on flawed transaction logic and access control loopholes. We discovered one such zero-equipment vulnerability originating from a custom software modification deployed on a major bank’s hardware security module fleet.

The bank initiated a core banking system upgrade that required changing the numerical format of all customer account numbers across its transaction database. Since the standard customer PIN is cryptographically derived directly from the account number, this format change would automatically alter every user’s default natural PIN value.

To avoid the customer dissatisfaction and support costs associated with mass PIN resets, the bank sought a method to retain existing customer PINs after the account number migration. The security team planned to calculate customized decimal offset values for each account such that the final user PIN remained identical before and after the database migration.

The factory-default firmware of the bank’s HSM did not include a transaction command to compute these migration offsets. This intentional omission was a security feature designed to prevent PIN derivation manipulation via arbitrary account number remapping.

The bank contacted the hardware manufacturer to request a custom firmware patch implementing the required offset-calculation transaction. The manufacturer delivered the modified binary with a clear written warning: the custom command was extremely dangerous for general use and should only be executed once during the batch migration process, then permanently deleted from the HSM firmware.

The manufacturer did not explicitly document the specific security risks introduced by the custom command, leaving the bank’s engineering team unaware of the full vulnerability scope. Due to unplanned internal personnel rotations and project timeline delays, the account number migration project was postponed indefinitely.

As a result, the dangerous custom firmware patch remained permanently installed on all of the bank’s production HSM units with no scheduled removal date. This left a critical protocol backdoor open for any insider with basic HSM command access privileges.

Approximately twelve months after the patch was deployed, a low-level bank software programmer discovered the critical vulnerability in the custom transaction syntax. The undocumented command had the following functional structure: given an original account number X and existing offset Y, compute a new offset Z that preserves the original PIN value for a target account number.

The malicious programmer could input any target customer’s account number and their current public offset value (most defaulted to zero) as parameters X and Y. He then entered his own personal account number as the target value Z. The HSM returned the required offset to copy the target’s PIN onto his account instantly.

Using this simple protocol exploit, the insider could trivially calculate and retrieve the plaintext PIN of any customer account in the bank’s database with no physical hardware tampering, no cryptographic cracking, and no elevated system permissions.

Fortunately for the bank and its customers, the ethical programmer responsibly reported the protocol vulnerability to the bank’s information security leadership team instead of exploiting it for financial gain or data theft. This incident serves as a powerful case study on the dangers of undocumented custom firmware modifications in trusted security hardware.

6 Conclusions

In this paper, we have significantly advanced the state-of-the-art of differential fault analysis for embedded security devices. Our instruction-oriented fault model reduces the number of faulty ciphertexts required for full DES key recovery from the traditional 200 samples to only between one and ten samples, drastically lowering the barrier for low-cost attackers.

We have demonstrated that CRT-based RSA implementations can be fully broken with just a single faulty signature generated via real-time glitching attacks, enabling invisible on-the-spot modulus factorization during normal retail transactions. This creates immediate threats to global EMV payment card security.

Our technique also enables efficient reverse engineering of completely unknown proprietary block ciphers. For compact software-based algorithms such as RC5, our instruction-corruption method outperforms Biham and Shamir’s classic data-bit fault analysis in both speed and simplicity of implementation.

Unlike many prior academic fault attack studies relying on idealized theoretical fault models, all techniques presented in this work use physically realistic, experimentally validated fault mechanisms. Every attack described has been successfully implemented in laboratory conditions and is directly applicable to commercially deployed tamper-resistant devices in the field.

The foundational conceptual breakthrough of our research is shifting fault injection from corrupting runtime data bits to corrupting CPU instruction execution flow. This simple paradigm shift creates more reliable leakage, broader attack coverage, and lower implementation costs for all embedded fault attacks.

We have also verified that common, low-cost laboratory equipment accessible to university students and individual hobbyists can be weaponized for chip surface physical attacks. Microprobes and laser cutters, available for only a few thousand dollars, enable key extraction from devices marketed as cryptographically secure and physically tamper-proof.

Our research confirms that cryptographic key redundancy mechanisms, such as the mandatory odd parity rule for DES keys, drastically amplify the impact of physical memory vulnerabilities. This reinforces the core lesson from prior embedded security research [9]: key redundancy design requires far more careful security analysis than it has historically received from algorithm designers.

A prominent real-world example is the dangerous interaction between DES byte parity rules and SRAM memory remanence effects in legacy banking HSMs. This combination allows low-skilled attackers to recover full master key sets from decommissioned or discarded security modules with minimal computational effort.

Based on this finding, we recommend strict operational policy: all decommissioned tamper-resistant security modules containing persistent key storage must undergo complete physical destruction, including SRAM chip pulverization, to prevent post-retirement key recovery attacks.

Finally, our work categorizes attacks into two complementary classes: physical hardware exploits and pure protocol-level vulnerabilities. Many critical security breaches bypass sophisticated physical tamper resistance mechanisms entirely by exploiting subtle logic flaws in communication and transaction protocols.

Collectively, all experimental results and case studies in this paper prove two core truths for the embedded security community. First, building truly robust tamper-resistant hardware devices is exponentially more difficult than mainstream industry understanding suggests. Second, programming secure firmware and deploying these devices correctly within complex distributed systems presents an equally challenging engineering problem.