Laser Fault Injection Lab

What laser fault injection is

When light of the right wavelength hits a transistor, it creates a short burst of current. A precisely aimed burst can flip a bit in a register, corrupt a value in memory or make the processor skip an instruction. Attackers use this to bypass security checks, unlock debug access or recover cryptographic keys through differential fault analysis.

Laser fault injection is the most targeted of the common fault-injection methods. EM pulses and voltage glitches affect a wide area or the whole chip. A laser focused to about a micrometre can hit one logic block at one clock cycle. Evaluators of secure elements, smart cards and security ICs rely on this precision. Chip designers use it to test their countermeasures.

Why most LFI is done from the back of the chip

Several layers of metal wiring cover the front of a modern chip and block light. Silicon lets infrared light through. Most LFI campaigns therefore open the package from the back. Analysts image the die through the silicon with an infrared camera and fire the laser from below. eShard's laser station transmits more than 90% of the infrared light for backside injection.

How an LFI campaign runs on esDynamic

esDynamic controls the equipment and supports analysis through each phase:

1. Image the die. Capture the back of the die with an infrared camera. Identify regions of interest, such as the CPU core, crypto engine or memory.
2. Synchronise with the target. Use the Pattern Detector to recognise the operation you want to attack in real time. Trigger the laser at the right moment.
3. Map the chip. Run automated spatial cartography. Move the stage across the die, fire at each position and record the chip's response. Heatmaps show where faults happen and where coverage is still missing.
4. Tune the parameters. Map timing, power and pulse settings. Find the conditions that produce useful, repeatable faults.
5. Exploit. Use the faults to recover a key through differential fault analysis or bypass a security check.
6. Document. Keep every step as a replayable notebook so analysts can check the result again on the same bench.

What's in the lab

Laser Microscope Station (LMS), powered by ALPhANOV

• 1 µm spot size, for targeting individual structures on the die
• More than 90% infrared transmission for backside injection
• Laser power that scales with the target
• Up to four lasers can be stacked, for multi-fault attacks in space and time

Imaging and positioning

• Infrared camera for die backside imaging, controlled through esDynamic
• Motorized XYZ stages for automatic positioning and cartography

Triggering and timing

• Pattern Detector: high-speed signal capture with live pattern matching for accurate triggering and synchronised acquisition
• Sub-nanosecond timing, and a 10 ps trigger resolution option with the Tombak trigger specialist, to target specific clock cycles on fast SoCs

Target handling

• Card reader for smart card targets and power measurement
• Cold Reset to power-cycle targets that crash during aggressive campaigns, allowing long runs to continue unattended

→ Full list: eShard Lab Equipment

The software: esDynamic

esDynamic controls the lab equipment and keeps campaign work in one workspace:

• One LFI workflow from backside imaging to exploitation
• Automated campaigns with ready-to-use notebooks for spatial cartography, parameter mapping and multi-fault injection
• Hardware-agnostic control of infrared cameras, motorized stages, laser sources, oscilloscopes and pulse generators from any vendor, with native integration of ALPhANOV optical systems
• Shared data so a team can work on the same notebooks, share remote access to the hardware and analyse gigabytes of campaign data together

Single faults, double faults and countermeasures

Modern secure chips are designed to detect a single fault. They duplicate computations, check results, or use light and glitch sensors that reset the chip when they detect a problem. Evaluations now use double-fault attacks to test these protections. The first pulse bypasses a check or silences a sensor. The second performs the attack, such as skipping an instruction or flipping a bit. With up to four stacked lasers, eShard's lab can place faults at different points on the die and at different moments in the same run.

Knowledge and starter kits

• Expertise modules: executable notebooks for bypassing modern fault-injection countermeasures, based on eShard's hardware attack experience
• Differential fault analysis (DFA): a notebook suite for DES, AES and RSA
• Starter kit, AES key recovery on an STM32 MCU: end-to-end DFA on software AES, from configuring the MCU to recovering the full key
• Starter kit, AES key recovery on an i.MX8 SoC: key recovery across three AES implementations, from software to the dedicated hardware AES engine.

Typical targets

Secure elements, smart cards, ASICs, SoCs and FPGAs.

Who uses an LFI lab

• Chip makers validating secure elements and crypto IP against high-end attacks
• Testing and certification laboratories
• Defence, space and government security teams
• Research groups working on fault attacks and countermeasures

Services and training

eShard also offers hardware security assessments against LFI for secure elements, ASICs, SoCs and FPGAs. It delivers replayable notebooks you can rerun on your own bench. Training runs remotely or on-site, from basic fault theory to fully automated multi-fault campaigns. Pertech arranges both in Israel.

Why get an LFI lab through Pertech

Pertech is eShard's partner in Israel. We help define the lab around your targets and evaluation goals. We coordinate configuration with eShard and ALPhANOV, arrange installation and training, and support your team locally.

Documentation

• eShard has not published a laser-specific brief. Pertech can send the full catalogue on request.

Questions and answers

What is laser fault injection?

Laser fault injection (LFI) fires a focused laser pulse at a precise point on a chip, usually through its back side, to cause a controlled fault. It tests whether the chip's security countermeasures detect or block the fault.

What spot size does eShard's laser station reach?

eShard's Laser Microscope Station, powered by ALPhANOV, reaches a 1 µm spot size. It provides more than 90% infrared transmission for backside injection.

Why inject faults from the back of the chip?

Metal layers on the front of a modern chip block light. Silicon lets infrared light through, so the back side gives direct optical access to the transistors.

How is laser fault injection different from EM fault injection?

Laser fault injection is far more localised than EM fault injection. A laser focused to about a micrometre can target one logic block, while an EM pulse affects a wider area. LFI usually needs the die exposed from the back; EM fault injection does not.

Can eShard evaluate my chip against laser fault injection?

Yes. eShard offers hardware security assessments of secure elements, ASICs, SoCs and FPGAs against LFI, delivered with replayable notebooks you can rerun on your own bench. Pertech can arrange this in Israel.

Can eShard's LFI lab do multi-fault attacks?

eShard's LFI lab supports multi-fault attacks with up to four stacked lasers. It can place faults at different points and different moments in the same run.

Why use double-fault campaigns?

Modern secure chips are built to detect a single fault. In a double-fault campaign, the first fault bypasses a check or silences a sensor and the second performs the attack. eShard's LFI lab supports this with up to four stacked lasers.

How precise is the timing on fast SoCs?

eShard's LFI lab offers sub-nanosecond timing, with an option for 10 ps trigger resolution using the Tombak trigger specialist. It also offers 1 µm spatial resolution. The Tombak option lets it target specific clock cycles on fast targets.

Can I use my own camera, stages or scope?

esDynamic controls third-party cameras, stages and oscilloscopes alongside eShard and ALPhANOV equipment. It is hardware-agnostic and also controls third-party pulse generators.

Who makes the laser in eShard's lab?

eShard's Laser Microscope Station is powered by ALPhANOV, a French optics and laser technology centre. The station is integrated into eShard's turnkey lab.

Where can I buy a laser fault injection lab in Israel?

You can buy eShard's laser fault injection lab from Pertech Embedded Solutions, eShard's partner in Israel. Pertech handles configuration, installation, training and support.