Glitching Fault Injection Lab

What glitching is

For a few nanoseconds, the supply voltage dips or the clock gets an extra edge. If the disturbance occurs at the right instruction, the chip may skip a check or corrupt data. Glitching tests whether a device detects and blocks this kind of attack.

What's in the lab

• A waveform generator to shape the glitch, and an oscilloscope to capture triggers, monitor power consumption and confirm faults on the wire
• esDynamic to control hardware, capture data, sweep parameters, analyse faults and automate campaigns
• Support for existing bench equipment, such as power supplies, signal generators and oscilloscopes from any vendor, alongside eShard hardware
• Starter kits with target hardware (an i.MX8 motherboard and modules), software and guided notebooks

→ Full list: eShard Lab Equipment

How a campaign works

You tune three parameters: delay (time after the trigger), pulse width and amplitude or depth. esDynamic sweeps these automatically to find settings that work despite system jitter. It displays the results as heatmaps so no part of the parameter space is missed.

Faults it looks for

• Instruction skips, for example bypassing a password check
• Program counter corruption, for example to escalate privileges
• Data corruption and bit flips, for example in cryptographic attacks

Starter kits

• STM32 readout-protection bypass through the system memory bootloader
• AES key recovery on an STM32 MCU
• AES key recovery on an i.MX8 SoC
• AES key recovery on a smart card

Typical targets

Secure microcontrollers, SoCs, FPGAs and cryptographic implementations.

Documentation

• Power & Clock Glitching solution brief (PDF)

Questions and answers

What is voltage glitching?

Voltage glitching is a fault injection technique that briefly disturbs a chip's power supply at a chosen moment. The resulting fault, such as a skipped instruction, shows whether an attacker could bypass the chip's security checks.

What is clock glitching?

Clock glitching inserts an irregular clock edge so the chip executes an instruction incorrectly. It tests the same kinds of weaknesses as voltage glitching, through the clock input. eShard's glitching lab covers both.

Which parameters does eShard's glitching lab sweep?

esDynamic sweeps the trigger delay, pulse width and glitch amplitude or depth in eShard's glitching lab. It plots the results as heatmaps.

Can I use my existing power supply and signal generator?

esDynamic lets you use your existing power supply and signal generator with eShard's glitching lab. It controls bench equipment from any vendor through one interface, alongside eShard hardware.

Where can I buy a glitching fault injection lab in Israel?

You can buy eShard's glitching fault injection lab from Pertech Embedded Solutions, eShard's partner in Israel.