Keywords: laser fault injection, fault model, AES

Laser fault injection through the front side (and consequently the metal-fills) of an IC is often performed with medium or small laser beams for the purpose of injecting bytewise faults. We have investigated in this paper the properties of fault injection with a larger laser beam (in the 100µm range). We have also checked whether the bit-set (or bit-reset) fault type still holds or whether the bit-flip fault type may be encountered. Laser injection experiments were performed during the last round of the Advanced Encryption Standard (AES) algorithm running on an ASIC. The gathered data allowed to investigate the obtained fault models, to conduct two usual Differencial Fault Attack (DFA) schemes and to propose a simple version of a third DFA.

Frontside Laser Fault Injection on Cryptosystems -Application to the AES' last round -Cyril Roscian * ,Jean-Max Dutertre * and Assia Tria †

I. INTRODUCTION

Secure circuits are prone to a wide range of physical attacks. Among them, fault attacks (FA) are based on the disturbance of the chip environmental conditions in order to induce faults into its computations. Fault injection may be achieved by using laser exposure [START_REF] Skorobogatov | Optical fault induction attacks[END_REF] [START_REF] Van Woudenberg | Practical optical fault injection on secure microcontrollers[END_REF], voltage [START_REF] Blömer | Fault based cryptanalysis of the advanced encryption standard (aes)[END_REF] or clock glitches [START_REF] Agoyan | When clocks fail: On critical paths and clock faults[END_REF], electromagnetic perturbation, etc. It exists a very efficient method called Differential Fault Attack (DFA) applied to encryption algorithms that takes advantage of a comparison between correct and faulted ciphertexts to retrieve the secret key used during the ciphering process. These different attack schemes involve strong constraints on the faults location, range, and injection-time. Nevertheless laser injection is often considered as one of the best means to inject faults in order to perform a DFA. Indeed, a laser source allows a precise control on repeatability, timings of injection (the shot instant and pulse duration) and focalization. It appears as a suitable tool to meet the constraints of the various DFA schemes. However, since the technology of Integrated Circuits (IC) is continuously evolving (more transistors are inside the effect area of a given laser beam, and more metal-fills are reflecting it) this statement has to be checked.

In this paper, we studied the effect of a large laser spot to inject faults into the calculations of our target: an ASIC implementing the AES [START_REF]NIST: Announcing the Advanced Encryption Standard (AES)[END_REF] algorithm. We also analysed the effects of front side injection on the properties of the injected faults (fault type, repeatability, fault range, etc.) The obtained data were used to perform two usual DFA [START_REF] Giraud | Dfa on aes[END_REF] [START_REF] Roche | Combined fault and side-channel attack on protected implementations of aes[END_REF]. Then, we simplified an existing DFA [START_REF] Lashermes | A dfa on aes based on the entropy of error distributions[END_REF] that allowed us to perform the analysis with less complexity. This approach took advantage of the experimental settings (i.e. the use of a large laser spot through the front side and its metal-fills).

The paper is organized as follows. The first part is a reminder of the different effects of laser on silicon: it emphasizes on the notion of laser-sensitive areas, and also gives a description of the fault injection process. The laser setup and the device used for the test are described in the second part followed by the display of the experimental results and their analysis about the observed fault model and its justification. The third part reports the use of two usual DFA on the experimental results and the simplification of a third DFA to enhance the efficiency. Finally, all these results are summarized in the conclusion with some perspectives.

II. FAULT INJECTION WITH A LASER SOURCE

Laser shots on ICs were firstly used to simulate radiationinduced faults [START_REF] Habing | The use of lasers to simulate radiation-induced transients in semiconductor devices and circuits[END_REF]. More recently the use of a laser to inject faults into the computations of a secure device was introduced by S. Skorobogatov and R. Anderson [START_REF] Skorobogatov | Optical fault induction attacks[END_REF]. In the following we first remind the main properties of the photoelectric effect created by a laser passing through silicon before describing the resulting fault injection process.

A. Laser effects on ICs and consequences

The photoelectric effect is generated by a laser beam passing through silicon provided that its photons energy is greater than the silicon bandgap [START_REF] Habing | The use of lasers to simulate radiation-induced transients in semiconductor devices and circuits[END_REF]. This effect creates electron-hole pairs along the laser path. Generally these pairs recombine and there is no noticeable effect on the IC's behaviour. However, under specific conditions, some undesired effects may appear: the so-called Single Event Effects (SEE).

A SEE happens when the charge carriers (i.e. electrons and holes) created by the laser beam are drifted in opposite directions by the electrical field found in the PN-junctions of CMOS transistors instead of recombining. As a consequence a transient current (i.e. moving charge carriers) is generated through the struck junction. This phenomenon is depicted in the left part of Fig. 1, where the PN-junction of an NMOS transistor in its "turned OFF" state is drawn. After the creation of the electron-hole pairs along the laser beam, two phenomena lead to the creation of the transient current: the prompt charge collection, or funnelling, and the diffusion. The first phenomenon stretches the depletion region (hence the extension of the electric field) along the laser beam, within a few picoseconds the charges nearby are collected giving a current peak. Then, in a second time, the remaining charges are collected in a longer diffusing scheme: the diffusion. The right part of Fig. 1 shows the transient current associated with these two phenomena as given in [START_REF] Wang | Single event upset: An embedded tutorial[END_REF]. It exists a strong electric field, sufficient to create a transient current as explained above, in any PN-junction of the transistors used in CMOS logic regardless of their state (i.e. turned "ON" or "OFF"). However, such a transient current may, or may not, have an effect on the target's logic signals depending on both its location and the data handled by the logic. These dependencies are usually explained by considering the inverter case (see figure 2). Consider the left part of Fig. 2 where the inverter's input is at a low logical level: its PMOS transistor is turned "ON" and its NMOS transistor is turned "OFF". Hence the inverter's output is at a high logical level and its output's capacitive load (dotted in Fig. 2) is charged. The inverter has four PN-junctions which are likely to give rise to a transient current if struck by a laser: the drains and sources of both PMOS and NMOS transistors. Nevertheless only a transient current originated in the NMOS' drain will result in a disturbance of the inverter's output (pointed out by a filled grey ellipse). In that case, the transient current is flowing from the drain to the substrate which is grounded (as drawn in the top part of Fig. 1). Hence the capacitive load is discharged provided that the transient current is big enough to overcome a charging current flowing through the "ON" PMOS transistor. As a result the output of the inverter passes temporarily to a low logical level. When the transient current vanishes, the capacitive load is charged again via the turned "ON" PMOS transistor. Thus, due to the transient current generated in the NMOS' drain, the output voltage of the inverter undergoes a transient voltage inversion. This transient voltage may then propagate through the downstream logic: a so-called Single Event Transient (SET). Any transient current created in the NMOS' source has no effect on the output since it is isolated from the output by the turned "OFF" NMOS. Regarding the transient currents created in the PMOS' diffusions, they create a leakage path to the N-well which is biased at the core supply voltage (i.e. Vdd). Hence they have no discharging effect on the output's capacitive load. To sum up, the only laser, or SEE, sensitive area of an inverter, when its input is in a low logical state, is the drain of the "OFF" NMOS transistor.

Likewise, when considering an inverter with its input at high level (right part of Fig. 2), a similar reasoning may be conducted. It results that the only laser, or SEE, sensitive area of an inverter when its input is in a high logical state is the drain of the "OFF" PMOS (underlined in grey).

As a conclusion, the laser sensitive area of a CMOS inverter is the drain of the "OFF" transistor, whose location is changing with the logical level of the inverter's input. In a more general way the laser sensitive areas of CMOS ICs are data-dependent. The occurrence of a laser-induced fault depends on the handled data.

B. Laser fault injection mechanism

As reminded in the previous section the laser illumination of an IC's sensitive area results in the propagation of a transient voltage in its logic. This SET may turn into a computational fault according two mechanisms.

The first mechanism is illustrated in figure 3. The SET becomes a fault as it is latched into a register (or D flip-flop, DFF) in place of the correct data. If it reaches the DFF's input outside its latching window (around the rising edge of the clock) the SET vanishes without any effect on DFF's output value and then on the target's calculations (denoted 1 st case in Fig. 3). On the contrary if it reaches the DFF's input during the latching window, it is latched: a fault is actually injected (denoted 2 nd case in Fig. 3) and change the DFF's output value. The second mechanism happens when the SET is generated inside a DFF or an SRAM. These memory elements are indeed made of cross-coupled inverters. As a consequence the SET will propagate from the struck inverter's output to its own input by passing through the cross-coupled inverter. As a result, the memorised data is inverted: a fault is injected. This fault injection mechanism is called a Single Event Upset (SEU).

Fault injection according these two mechanisms is also time-dependent. This statement is obvious regarding the propagation of an SET as exemplified in Fig. 3. A similar behaviour takes place for SEUs. The resulting false data, which is stored in a DFF, has to propagate and to induce at least one miscalculation in the logic. Then, it has to be latched into the subsequent registers bank to be turned into an actual fault. This process has timing requirements: if the SEU arises before and to close to the clock rising edge it will be soon overwritten by a correct data. Thus it may not have the time to reach the next register bank before the clock rising edge. Consequently the false data may propagate through the downstream logic nearly followed by a correct data: it may be overwritten before being latched at the next clock rising edge.

C. Discussion on the laser fault model

The properties of laser-induced faults reviewed in subsections II-A and II-B were established under the assumption that the effect range of the considered laser spots was circumscribed to one sensitive area. Under this assumption the fault injection process is data-dependent. More precisely the sensitive areas are changing with the data. For a given laser setting (location of the laser spot, energy level, timing of the injection), the fault may occur or not depending of the data processed by the target. This behaviour may be described as a bit-set or a bit-reset fault type [START_REF] Otto | Fault Attacks and Countermeasures[END_REF]. A data bit suffers from a bit-set (resp. a bit-reset) fault, if it is changed from 0 to 1 (resp. from 1 to 0), thus creating a calculation error. On the contrary, it remains unfaulted if its logical value was yet a 1 (resp. a 0). This fault type is very worrying as it makes it possible to mount safe error attacks against cryptosystems [START_REF] Loubet-Moundi | Static fault attacks on hardware des registers[END_REF].

The ability to obtain a bit-set or bit-reset fault in former technologies is well established [START_REF] Pouget | An overview of the applications of a pulsed laser system for seu testing[END_REF]. However, this ability is questionable in advanced CMOS processes. The first reason is that the minimal diameter of a laser spot could not be successfully decreased to smaller than 1µm due to optical constraints. Hence, in advanced technologies the laser spot could encompass several transistors violating our first assumption and induce a bit flip fault type (which refer to an inversion of the faulted bit regardless of its value) or impact several bits. Moreover as technologies are evolving the metal density over ICs increases due to metal-fill requirements [START_REF] Balasubramanian | Pulsed laser singleevent effects in highly scaled cmos technologies in the presence of dense metal coverage[END_REF]. Metal lines or fills are reflecting laser beams making it more and more difficult to access to sensitive areas from the front side. The main consequence is that most of laser fault injection are carried out through the rear side with a small spot size. This method is not easy, time consuming and a proper preparation of the chip (i.e. de-packaging) is needed. In the other side, laser fault injection, in front side with a large spot, is easier to perform but seems to be not consistent with bit-set or bit-reset fault injection. This is one point we have considered to explore in this work: the effect of a large laser spot (∼ 125µm * 125µm) through the metal coverage on the fault properties. The bit-flip fault type was also considered in this work.

III. EXPERIMENTAL SETUP

A. The Laser test bench

The fault injection experiments reported in this paper were performed front side with a green laser source of 532nm wavelength. The laser pulses it produces, have a constant duration of 5ns. Optical settings were chosen to obtain a square laser spot of 125µm * 125µm. The energy was tuned to 750nJ per shot. Hence, given the transmission coefficient of the optics, an energy density of 17pJ/µm 2 was achieved under the laser beam. For the sake of simplicity a trigger signal issued from the test chip was used to synchronize the laser shots with the AES encryptions. It made it possible to target the beginning of the AES last round with a jitter of + -5ns.

B. The target device

The target device is an ASIC implementing the AES algorithm [START_REF]NIST: Announcing the Advanced Encryption Standard (AES)[END_REF] in its 128-bits key length version (AES-128). The AES-128 is a substitution and permutation algorithm. It consists of 10 identical rounds after a short initial round; each round is a succession of four different transformation.

In our implementation, one round needs only one clock cycle to be achieved. The entire encryption is performed in 11 clock cycles. The ASIC was operated at 25 MHz during our experiments (although its maximum allowable frequency is 50 MHz). A picture of the silicon chip is given in figure 4. It was designed in a 6-metal layers, 0.13 µm technology. None of the circuit's functional blocks is identifiable at sight: the whole design was scrambled (glue logic). Fig. 4 also shows the partitioning of the target's surface into 36 shooting sectors corresponding of the laser spot's size. Laser fault injections were done according this partitioning.

C. Experimental results

In the following, the obtained faults are classified and analysed at byte level because they were induced during the AES' last round, corresponding cryptanalyses of which are considered byte-wise (see section IV).

A large fault injection experiment was conducted. For every shooting sector of Fig. 4, 10,000 encryptions were ran with random plaintexts but the same key. During these experiments no latch-up or reset of the component have been reported. Simultaneously the laser was fired and the output ciphertext (faulted or not) was retrieved. It was then analysed to establish whether it was erroneous or not. In case of an error the injected fault was recovered by reversing the encryption of the faulted ciphertext and also by comparison with a correct encryption (the key and the plaintexts were known). Despite the large spot size (125µm * 125µm), most of the induced faults were single-bit faults. Table I reports a synthesis of these results. For every byte of the AES state the faults of the shooting sector, corresponding to the highest error rate, are reported. The rates of the single-bit and most common faults are also given (e.g. consider byte 0 : 480 encryptions were faulted, amongst them 79% were single-bit faults and the most encountered fault appeared with a 74% rate). A second set of experiments was conducted for a location of the laser beam that gave rise to a relatively high error occurrence rate on byte number 5. 1,000 encryptions with the same previous constant key and random plaintexts were done simultaneously with laser injection. Its results are reported in table II. One of the previous plaintexts related to an actual injection of fault was then selected to conduct another set of 1,000 encryptions (i.e. the whole experimental settings were the same for each attempt). Table III

D. Analysis of the laser-induced faults

The fault occurrence rate reported in table III (for one given plaintext) is approximately twice the rate reported in table II (for several random plaintexts). The explanation lies in the data-dependent nature of laser-induced faults. A deeper analysis of the single-bit fault (i.e. 0x80) injected during these experiments revealed that the faulted bit was always a 0 turned into a 1. Moreover,among the 1,000 encryptions of table II no fault was injected when the original value of the faulted bit (i.e. the correct, or none faulted, bit value) was a 1. These results reveal a bit-set fault type. Moreover the faults occurrence rate grows from 7.1% to 14.2% when only the fault injection attempts consistent with a bit-set are considered.

However, a 16% faults occurrence rate is still low as laser fault injection is often considered as deterministic. The jitter of the laser setup is probably an (incomplete) explanation given the time-dependent nature of the fault injection mechanism (see subsection II-B). The fact that several laser-sensitive areas are under the laser spot is another hypothesis that would be worth studying.

Among the large amount of data we have processed, we also report here a further analysis of the result obtained on byte #3 during the first experiment. They are extensively reported in table IV. At bit-level, the fault occurrence rates of bits b 2 and b 1 were respectively 34.3% and 66%. A deeper analysis revealed that the fault types of bits b 2 and b 1 were respectively a bit-set and a bit-flip. These experiments showed that the bit-set (or bit-reset) and bit-flip fault types are both attainable for laser fault injection with a large spot from the front side of the target. Our explanation is that the metal-fills act as shutters that allow to stimulate only a few laser-sensitive areas. In some cases it is consistent with the bit-set or bit-reset fault type. For others two sensitive areas related to a common data bit are simultaneously stimulated: one by a bit-set fault type, the second by a bitreset. As a result a bit-flip fault type is achieved. An intended application of this phenomenon is reported in [START_REF] Balasubramanian | Pulsed laser singleevent effects in highly scaled cmos technologies in the presence of dense metal coverage[END_REF].

IV. DFA OF THE AES LAST ROUND

Two schemes of DFA are based on an analysis of the AES last round in the presence of faults [START_REF] Giraud | Dfa on aes[END_REF], [START_REF] Roche | Combined fault and side-channel attack on protected implementations of aes[END_REF]: they make it possible to retrieve its last round key. In this section we study the relevance of using these techniques to process our experimental data, especially with the data where the single-bit fault occurrence rate or repeatability are low. We also report and discuss the use of a DFA scheme on the AES last round recently introduced by [START_REF] Lashermes | A dfa on aes based on the entropy of error distributions[END_REF] with these data.

A. Notations

In the following M, C, D, K and E denote respectively the plaintext, the correct ciphertext, the faulty ciphertext, the secret key and the error value (calculated by Xoring C and D). Depending on the context they may refer to the whole AES state (16 bytes) or to a given single byte (corresponding to the fault location). The SubByte transformation of the AES is denoted SB. The AES state at the beginning of the j th round will be denoted by Mj -1 (e.g. M 9 denotes the state at the start of the last round). Kj refers to the round key of the j th round. For the sake of clarity the ShiftRows transformation is left out in the following equations. A subscript index i may be used to point to a given encryption among others. As there is no MixColumns transformation during the AES last round the cryptanalyses are performed bytewise.

B. Application of the Giraud's DFA Giraud [START_REF] Giraud | Dfa on aes[END_REF] has introduced the first DFA against the AES last round. It is based on a single-bit fault model, whose faults have to target M 9. The attack is performed bytewise: a byte of K10 is retrieved with a success rate of 97% from three pairs of correct and faulty ciphertexts (C i ,D i ) by solving equations 1 and 2.

C i = K10 ⊕ SB(M 9 i ) (1)
C i ⊕ D i = SB(M 9 i ) ⊕ SB(M 9 i ⊕ E) (2)
With the experimental results presented in III-C, only three byte of the AES state are compliant with the single-bit fault model of Giraud's DFA (bytes 1, 6, and 14 in tab. I). 13 bytes are close or beyond a single-bit occurrence rate of 80%. Hence a higher number of (C i ,D i ) pairs is needed to find the corresponding key bytes. However, the attack is still feasible.

Yet two bytes have single-bit rates around 65% and byte #3 is below 50%. For bytes presenting these statistics, Giraud's DFA may not be the most efficient scheme.

C. Application of the Roche et al. DFA

The DFA recently introduced by Roche et al. [START_REF] Roche | Combined fault and side-channel attack on protected implementations of aes[END_REF] was originally based on the injection of constant faults on the 9 th and 10 th round keys. From the equations of a correct and a faulty ciphertexts (C i and D i respectively) equation 3 is obtained:

SB(SB -1 (C i ⊕ K10) ⊕ E9) ⊕ K10 ⊕ E10 = D i (3)
where E9, E10, and K10 are unknown. The cryptanalysis is conducted bytewise. The success rate in retrieving K10 is higher than 90% with three pairs (C i ,D i ).

This technique was also extended to none-constant faults: as the fault repeatability is decreasing, the number of (C i ,D i ) pairs increases. Moreover, without any lack of generality, this attack may be expanded to the fault model used in our experiments (i.e. faults injected on M 9) by nullifying E10 in eq. 3.

The experimental data gathered in our experiments were analysed according this DFA scheme. Given the fault repeatability (i.e. the most common fault rate of table I's last column) 9 bytes required 6 or less (C i ,D i ) pairs to retrieve the corresponding key bytes because their fault repeatability was higher than 90%. Four bytes revealed a fault repeatability around 50%: they required 15 (C i ,D i ) pairs on average to discover their round key bytes. Likewise Giraud's DFA, this scheme makes it possible to retrieve the secret key. Despite this required more data to succeed. However, the corresponding fault model is less constraint than the single-bit requirement of Giraud's DFA. It may succeed where Giraud's DFA will fail.

D. Simplification of an existing DFA Lashermes et al. [START_REF] Lashermes | A dfa on aes based on the entropy of error distributions[END_REF] have introduced a DFA scheme that makes use of faults injected on M 9 at the beginning of the AES last round. Its originality compared with the DFA schemes of Giraud and Roche et al. resides in the bytewise analysis of the injected faults. From the equations of the correct ciphertext C i and the faulted ciphertext D i (equations 4 and 5 respectively):

C i = K10 ⊕ SB(M 9 i ) (4) D i = K10 ⊕ SB(M 9 i ⊕ E i ) (5)
where E i is the injected fault, the expression of E i (eq. 6) is obtained:

E i = SB -1 (C i ⊕ K10) ⊕ SB -1 (D i ⊕ K10) (6)
In eq. 6 C i and D i are known and E i and K10 are unknown. The DFA consists in building an error table (see table V): its columns represent the 256 round key feasible values (i.e. hypotheses k); for each line (called a realization of index i) the corresponding values of the injected fault e i,k = E i are calculated from eq. 6, the (C i ,D i ) pairs, and the key hypothesis k.

•• ••• ••• ••• ••• •••
Only one column of the error table corresponds to the correct key byte K10. This column also gives the faults that have been actually injected. [START_REF] Lashermes | A dfa on aes based on the entropy of error distributions[END_REF] provides a complete methodology based on the calculation of the entropy of the errors to discriminate the right key byte (i.e. the right column).

Table VI reports the error table obtained from the fault injection attempts on byte #3 (cf. tab. IV).

It is therefore easy to ascertain that the corresponding value of the key byte is '0xCD'. The faults values in every columns appear random except for the key hypothesis '0xCD' where

i '0x00' '0x01' ••• '0xCD' ••• '0xFF' 0 '0x63' '0x61' ••• '0x02' ••• '0x15' 1 '0xB2' '0x0A' ••• '0x06' ••• '0x59' 2 '0x0C' '0xBF' ••• '0x02' ••• '0x1E' ••• ••• ••• ••• ••• ••• ••• 158 '0x51' '0xFF' ••• '0x06' ••• '0x1A' ••• ••• ••• ••• ••• ••• ••• 3,578 '0xF2' '0x49' ••• '0x08' ••• '0x82' ••• ••• ••• ••• ••• ••• ••• 10,000 '0x09' '0x3B' ••• '0x0A' ••• '0x33'
the faults (outlined in bold) are restricted to the four least significant bits (see Table IV). This result is consistent with the design of our target IC: only four bits of byte #3 were affected by the laser beam because its logic blocks are scrambled. Only a few (C i ,D i ) pairs may be sufficient to find K10's byte. Figure 5 excerpted from [START_REF] Lashermes | A dfa on aes based on the entropy of error distributions[END_REF] gives the average number of faults needed to succeed as a function of the faults entropy. Average best attack Injection entropy Fig. 5. Average minimum number of faults needed to find the key for a given injection entropy [START_REF] Lashermes | A dfa on aes based on the entropy of error distributions[END_REF] The fault injection process on byte #3 has an entropy of 1.3. Thus 3.5 faults on average are needed to successfully retrieving the right key byte. Given the statistics of byte #3 (∼ 50% repeatability and single-bit occurrence rate) this approach appears more efficient than Giraud's and Roche et al.'s DFA (15 realizations are needed for the latter). However, this statement cannot be generalised. It holds when the injected fauls have a distinctive pattern and a low repeatability.

V. C ONCLUSION AND DISCUSSION

We have described in this paper experiments of laser fault injection through the front side of an IC implementing the AES-128. Because of the reflective effect of its metal fills a large laser beam (125 * 125µm 2 ) was used. Injection with a laser beam of a few micrometers would have been timeoverconsuming.

We have observed two fault types: bit-flip and bit-set (or bit-reset). The latter type was unexpected because it seemed more consistent with the use of a smaller beam affecting only one laser-sensitive area. The bit-flip type is explainable by the simultaneous illumination of two sensitive areas corresponding respectively to a bit-set and a bit-reset. These results are obtained because the metal fills behave as shutters: at byte level only one or very few sensitive areas are exposed to the laser. Moreover a large part of the induced faults were single-bit despite the size of the laser beam. This precision was achieved thanks to the metal coverage. The analysis of the injected faults had also corroborated the data-dependent and time-dependent nature of laser injection.

These fault injection experiments were performed at the beginning of the AES last round. The faults statistics allowed to recover the secret key by using either Giraud's DFA [START_REF] Giraud | Dfa on aes[END_REF] or Roche et al. DFA [START_REF] Roche | Combined fault and side-channel attack on protected implementations of aes[END_REF]. However, for faults with a low single-bit occurrence rate and/or a low repeatability, these two schemes of DFA are not the most efficient. We finally proposed a simple application of the DFA scheme introduced by Lashermes et al. [START_REF] Lashermes | A dfa on aes based on the entropy of error distributions[END_REF] that makes it possible to recover the secret key in a more efficient way.

Fig. 1 .

 1 Fig. 1. Photoelectric effect of a laser beam through a PN-junction (left) -Transient current resulting from charge collection after a laser shot [10] (rigth).

Fig. 2 .

 2 Fig. 2. Inverter's schematic with its data-dependent sensitive areas.

Fig. 3 .

 3 Fig. 3. Fault injection mechanism due to a SET.

Fig. 4 .

 4 Fig. 4. The AES-128 target device with its 36 shooting sectors

  displays its statistics.

ACKNOWLEDGEMENT

The research work of Cyril Roscian was partly funded by the "Conseil Regional PACA". The authors also would like to thank Ronan Lashermes for his help and his support.


Loïc Zussa
email: zussa@emse.fr

Jean-Max Dutertre
email: dutertre@emse.fr

Jessy Clédière
email: jessy.clediere@cea.fr

Assia Tria
email: assia.tria@cea.fr

Power supply glitch induced faults on FPGA: an in-depth analysis of the injection mechanism

Secure circuits are prone to a wide range of physical attacks. Among those are fault attacks based on modifying the circuit environment in order to change its behaviour or to induce faults into its computations. There are many common means used to inject such faults: laser shots, electromagnetic pulses, overclocking, chip underpowering, temperature increase, etc. In this paper we study the effect of negative power supply glitches on a FPGA. The obtained faults were compared to faults injected by clock glitches. As a result, both power and clock glitch induced faults were found to be identical. Because clock glitches are related to timing constraint violations, we shall consider that both power and clock glitches share this common fault injection mechanism. We also further studied the properties of this fault injection means.

I. INTRODUCTION

Physical attacks (or hardware attacks) target the integrated circuits (ICs) which implement cryptographic algorithms for the purpose of providing security features. Amongst these physical attacks, this work focuses on fault attacks (FA), which consists in modifying the circuit environment in order to change its behaviour or to induce faults into its computations. There are many common means used to inject such faults: laser shots, electromagnetic pulses, overclocking, chip underpowering, temperature increase, etc.

There are three main subclasses of fault attacks: code rerouting, safe error (not addressed in this paper) and differential fault analysis. Code re-routing consists in replacing instructions executed by a micro-controller [START_REF] Balasch | An in-depth and black-box characterization of the effects of clock glitches on 8-bit mcus[END_REF] to circumvent its security features (for example a PIN of a smartcard could be broken), or in weakening the strength of an iterative encryption algorithm by changing the number of its rounds [START_REF] Dutertre | Fault round modification analysis of the advanced encryption standard[END_REF]. Differential fault analysis (DFA) consists in retrieving the keys by comparing correct and faulted ciphertexts (i.e. ciphertexts obtained from a faulted encryption). This technique was first introduced for public key encryption algorithms [START_REF] Boneh | On the importance of checking cryptographic protocols for faults[END_REF], and rapidly extended to secret key algorithms [START_REF] Biham | Differential fault analysis of secret key cryptosystems[END_REF]. From that time, many DFA schemes have been proposed to attack various encryption algorithms. Except for DES, most of them are associated with strong timing, range and location requirements regarding the fault injection process. If the faults are not induced at the proper time in the algorithm, or affect the wrong bits, the entire DFA process fails.

As a consequence, the ability to control precisely the fault injection process is a key element in carrying out any fault attack. A fine understanding of the various fault injection mechanisms is also mandatory to enable the design of fault resistant ICs. That's the reason why this paper focuses on an in-depth investigation of transient voltage supply deprivation (the so-called power glitches). This fault injection mean is known and used since the beginning of FA [START_REF] Barel | The sorcerer's apprentice guide to fault attacks[END_REF]. However, there are few papers in the scientific bibliography ( [START_REF] Selmane | Security evaluation of application-specific integrated circuits and field programmable gate arrays against setup time violation attacks[END_REF], [START_REF] Barenghi | Low voltage fault attacks to aes[END_REF], [START_REF] Li | New fault-based side-channel attack using fault sensitivity[END_REF]), which report a deep investigation and understanding of the underlying fault injection mechanisms related to power glitches. Our contributions to that research field are:

• the experimental proof that power glitches create timing constraint violations (as clock glitches and underpowering do),

• a study of the properties and physical limitations of this injection means.

A programmable circuit (FPGA) was chosen as a test vehicle to conduct this study. It implements the advanced encryption standard (AES [START_REF]Announcing the advanced encryption standard (aes)[END_REF]), which is a secret key encryption algorithm. This article is organized as follows: a remainder on timing constraints and an explanation of how faults may be injected by their violation are given in section II. A state-of-the-art on clock and power glitches induced faults is given in section III. The experimental set-up and the experiments outline are described in section IV. Then, the experimental results and their analysis are reported in section V. Finally a conclusion is drawn.

II. TIMING CONSTRAINTS

In this section, the basics of timing constraints are firstly reminded. Secondly, the two means of inducing timing constraint violations for the purpose of fault injection are reviewed. Then, the experimental proof intended to demonstrate the equivalence of these two fault injection mechanisms is introduced.

A. Timing constraints

Almost all digital ICs use a common clock signal to synchronize their internal operations. Figure 1 Data are released from the first register bank on a clock rising edge and then processed through the logic before being latched into the next register on the next clock rising edge. Thus, in first approximation the clock period (T clk ) has to be longer than the maximum data propagation time through the logic (D pM ax ) to ensure correct operation. Besides, a precise writing of the timing constraint equation requires to take into account three other parameters: D clk2q the delay elapsed between the clock rising edge and the actual update of a register's output; T skew the skew or slight phase difference that may exist between the clock signals at the clock inputs of two different registers; T setup the setup time which is the amount of time for which a D flip-flop input must be stable before the clock's edge to ensure reliable operation. (It also exists an hold time (T hold ) which expresses the same constraint but after the clock edge.) Hence, the timing constraint equation (eq. 1) is obtained:

T clk >D clk2q + D pM ax + T setup -T skew (1)
An illustration, at bit level, of the signal flow is given in figure 2-a for which the timing constraint is fulfilled. Note that the input of the downstream DFF (D downstream ) undergoes many logic glitches related to the calculations of the combinatorial logic before stabilizing. It exists a time margin (called the slack) between the last signal transition at the input of the downstream register and the setup time.

The violation of this timing constraint is a straightforward means to inject faults into a circuit. Two stages of such violations are depicted in fig. 2-b-c. A shaded area around the clock rising edge delineates a time interval which corresponds to a non-deterministic behaviour of the DFF in case of any transition on its input. It extends before and after the clock edge from an amount of time equal to the setup and hold times respectively. A setup time violation arises if the last signal transition is too close to the clock rising edge (Fig. 2b). Then, the DFF's output undergoes a metastable behaviour [START_REF] Horstmann | Metastability behavior of cmos asic flip-flops in theory and test[END_REF]: it may stabilize either on a high or low state regardless of its input's value. An error may occur or not. Fig. 2-c introduces a second kind of faulty behaviour: an early latching. In this instance, an erroneous logic value is latched by the register: a fault is actually injected. The fault injection process is then purely assured and deterministic because there is no signal transition in the shaded area. Hereafter, we will refer to timing constraint violations for both cases.

The two next subsections reports the means to achieve such timing violations.

B. Overcloking

A straightforward approach to inject faults through timing constraint violations is overclocking. It consists in decreasing the clock's period until faults appear by setup time violation or early latching (Eq. 2).

T clk overclocking <D clk2q + D pM ax + T setup -T skew (2)
Overclocking does not provide any timing control: faults may be induced at any clock cycle of the targeted IC. An enhancement of that technique consists in inducing a timing violation by modifying only one chosen clock period (see III).

C. Increasing propagation time

The second means of violating the timing constraint equation (cf. eq. 1) is by increasing its right handside part. It may be achieved by increasing the data propagation time through the logic (D pM ax ). As shown by equation 3:

T clk <D clk2q + D pM ax increased + T setup -T skew (3)
For the sake of simplicity, the data propagation time through a simple CMOS inverter as a function of the power supply is recalled.The physical equations are obviously more elaborated for more complicated logic. However, the observable trends are alike. The inverter's architecture and waveforms are depicted in figure 3 where t pLH and t pHL are its propagation delays for an output's transition from low to high and high to low logic levels respectively. The propagation time, t pLH (eq. 4), is obtained from a first order analysis [START_REF] Razavi | Fundamentals of Microelectronics[END_REF] of the inverter's dynamic behaviour:

t pLH = C L  2|V th,p | V DD -|V th,p | +ln ✓ 3 -4 |V th,p | V DD ◆ µ p C ox W p L p (V DD -|V th,p |) (4)
where V DD is the power supply voltage, C L the load capacitance, V th,p the PMOS threshold voltage, µ p the holes mobility, C ox the gate oxyde capacitance and (W p /L p ) the aspect ratio of the PMOS. A similar equation for t pHL may be derived from eq. 4 by substituting the parameters related to the inverter's NMOS (e.g. µ n , (W n /L n ), V th,n ) for those related to the PMOS.

Underpowering: as stated by eq. 4 any decrease of V DD will induce an increase of the propagation delay of the inverter. By extension, the data propagation time through any logic block is increased as long as the IC is underpowered. Hence, underpowering is a common means to achieve fault injection by violation of the timing constraints.

D. Several fault injection means, a common mechanism

Therefore, overclocking and underpowering (and also overheating, however not studied in this paper for the sake of brevity) are two suitable means to inject faults into a circuit by violation of its timing constraints [START_REF] Barenghi | Low voltage fault attacks to aes[END_REF], [START_REF] Selmane | Security evaluation of application-specific integrated circuits and field programmable gate arrays against setup time violation attacks[END_REF]. Intuitively, these two means are usually considered to originate in a same mechanism. Underpowering is characterized by a static behaviour (i.e. the chip's supply voltage is set to a constant value outside its nominal range), which make it relatively easy to investigate and understand the corresponding injection mechanism.

Whereas power supply glitches consist in a transient perturbation of the power supply voltage. The assumption that power glitches induce faults by violation of the target's timing constraints is often made [START_REF] Tummeltshammer | On the role of the power supply as an entry for common cause faults[END_REF], [START_REF] Barel | The sorcerer's apprentice guide to fault attacks[END_REF]. However, no evidence of that assumption is given in the scientific bibliography. Indeed, the fact that power glitch induced faults are due to (and only to) timing constraint violations is questionable because it may involve some dynamic behaviour related to the fast modification of the power supply. Hence, the novelty of our approach lies in the proposal of an experimental validation of this assumption. This proof is based on the analysis of the injected faults by means of both clock and power supply glitches on a test chip handling the same data (the latter condition is due to the data-dependence of the propagation times, and consequently of the induced faults). The equivalence of the injected faults for these two means is the core of that proof as reported in the next sections.

III. STATE-OF-THE-ART OF CLOCK AND POWER GLITCHES

A. Clock glitch induced faults

The use of clock glitches to induce faults into the computations of an IC is well known. It consists in decreasing one clock period until a fault is injected due to timing constraint violations. Recent papers have introduced dedicated platforms on FPGAs [START_REF] Fukunaga | Practical fault attack on a cryptographic lsi with iso/iec 18033-3 block ciphers[END_REF], [START_REF] Agoyan | When clocks fail: On critical paths and clock faults[END_REF], [START_REF] Endo | An on-chip glitchy-clock generator for testing fault injection attacks[END_REF]. This technique provides the ability to choose precisely the stress applied to the target (i.e. the time decrement of the targeted clock period), and thus the number of the injected faults. It also, by nature, makes it possible to select a given calculation cycle, which is a useful property to meet the requirements of DFA's schemes.

We have designed our own clock glitch fault injection platform based on these previous researches. This design allows us to set the modified clock period with an accuracy of 35ps.

As reported in [START_REF] Agoyan | When clocks fail: On critical paths and clock faults[END_REF], [START_REF] Endo | An on-chip glitchy-clock generator for testing fault injection attacks[END_REF], [START_REF] Li | New fault-based side-channel attack using fault sensitivity[END_REF], clock glitch induced faults are characterized by two main properties:

• faults are data-dependent (i.e. if the processed data change so does the injected faults and the associated critical times),

• the fault injection process may undergo a metastable behaviour (as exemplified in fig. 2-b) when the stress applied to the target is still low. As the stress increases the injection process may become deterministic (see fig.

2-c as an illustration). These two properties are related to any fault injection means based on timing constraint violation.

B. Power glitch induced faults

Power supply glitches are often used to induce faults into secure ICs. Its use (mainly on micro-controllers) has been extensively reported [START_REF] Barel | The sorcerer's apprentice guide to fault attacks[END_REF], [START_REF] Choukri | Round reduction using faults. Fault Diagnosis an Tolerance in Cryptography -FDTC[END_REF], [START_REF] Tummeltshammer | On the role of the power supply as an entry for common cause faults[END_REF], [START_REF] Barenghi | Fault injection attacks on cryptographic devices: Theory, practice, and countermeasures[END_REF] for glitches consisting in a sudden negative change of the power supply voltage.

However, very few papers have been dedicated to a deep investigation of the underlying fault injection mechanism. The most significant paper [START_REF] Djellid-Ouar | Supply voltage glitches effects on cmos circuits[END_REF] studied accurately the effects of a voltage glitch on the DFFs of a CMOS circuit. It showed, on a simulation basis, that power supply glitches cannot induce faults into DFFs. It also confirmed, according electrical simulations, that the faults injected by negative voltage glitches are due to timing constraint violations. The latter are caused by an increase of the combinatorial logic propagation delays.

Other explanations of the fault injection mechanism related to power glitches may be found. The authors of [START_REF] Asier | Characterization of a voltage glitch attack detector for secure devices[END_REF] stated that due to voltage glitches "different sub-circuits might be powered at different voltages, hence, enabling fault injections". However, they did not provide any evidence of this phenomenon.

At the time being, no experimental proof of the assumption that power glitch induced faults are injected by timing constraint violations has been provided. The main intent of this paper is to provide such an experimental proof.

IV. EXPERIMENTAL SET-UP

A. AES test chip, board and voltage pulse generators

AES is a standard established by the NIST [START_REF]Announcing the advanced encryption standard (aes)[END_REF] for symmetric key cryptography. It is a substitution and permutation network, based on four transformations (i.e. SubBytes, ShiftRows, MixColumns, AddRoundKey), used iteratively in rounds as depicted in fig. 4. The test chip (Xilinx Spartan 3A FPGA) embeds a hardware 128-bit version of this algorithm (AES-128). It processes data blocks of 128 bits (usually represented as a 4x4 bytes matrix, called the AES state), in ten rounds (after round 0).The round keys (K1 to K10) used during every round are calculated on-the-fly, by a key expansion module. In fig. 4, the 4x4 bytes matrices also point out where the registers storing the AES' state are located in our design: just before the SubBytes transformation. The design is shaped in a loop encompassing the four AES transformations and the registers bank used to store the AES' state. Hence, a full encryption is completed in eleven clock periods. The test chip nominal clock period is 100 MHz. In this work, AES is mainly used as a test element. Thus, we will not go deeper into its properties. However, because this algorithm is likely to be subject to DFA, the obtained results are still of interest.

The component is mounted on a board with voltage regulators that provide the voltage supplies of its I/O ports and of its internal core logic : 3.3V and 1.2V respectively. Communication interfaces with this device are also provided. Many capacitances are connected between the board's ground and the supply rails of the chip. We have opened the supply rail of the FPGA's voltage core to make it possible to inject a voltage glitch into its logic. We have also de-soldered the capacitance of the voltage core supply rail to improve the efficiency of the fault injection process. An SMA connector has been soldered in place of a capacitance which was close to the core voltage input of the FPGA, in order to diminish the reflection phenomena that will affect the injected voltage pulse. For the purpose of injecting power supply glitches we used two pulse generators (Agilent 814A and Picosecond 10,300B).

B. Outline of experiments 1) Methods:

For a given set of data (plaintext and key) processed by the AES test chip, we used both clock and power supply glitches to gather and study the injected faults. For the sake of simplicity, we focused on the first injected fault obtained for every round of the AES, while increasing the stress applied to the FPGA (i.e. a step by step decrease of the faulted period duration or increase of the amplitude of the negative voltage glitch).

The clock glitch generator allowed to target independently the ten rounds of the AES. We did not succeed in inducing fault during the AES initial round because it has a very short data propagation time. Any clock glitch short enough to violate the corresponding critical time also faults the controlling FSM of the device driving it into a non-recovering fail state. While the data propagation times of the subsequent ten rounds are the longest of the design, we were always able to induce faults in these rounds by means of clock glitches. Besides, the first injected fault reveals the corresponding critical time (as detailed in [START_REF] Li | New fault-based side-channel attack using fault sensitivity[END_REF]). Then, for each data-set, we gathered the injected faults while targeting each AES round (except the initial one) and their critical times. Figure 5 reports the critical times obtained for a given data-set at nominal supply voltage (1.2V). They are obviously shorter than the clock period (10ns). As expected, the paths measured for each round were found different (because the data processed during each round were also different).

The utilized pulse generators are able to provide a DC voltage in addition to pulses. We used this feature to power the test chip internal core. Moreover, it allowed us to carry out underpowering attacks as illustrated in fig. 6. As the core voltage is decreased, the critical times of each round are increased (the grey shaded parts in fig. 6). A measure of these critical times was made by using simultaneously clock glitches. In the instance of fig. 6, the critical time of the 9 th round goes beyond the clock period. Then, a fault is injected.

Our main intent was to compare faults induced by power supply glitches with those induced by clock glitches. To do so, we used negative power supply glitches as depicted in figures 7 and 8. 2) Library of clock glitch induced faults: A data-set library of 1,000 random {Plaintext, Key} couples was built. For each couple a first fault-free encryption was run, and the obtained correct ciphetext was added to the library. Then, for each AES round of each encryption, a fault injection experiment by means of clock glitches was carried out. The corresponding clock faulted period was reduced progressively by steps of 35ps until a first fault was induced. Next, the faulted ciphertext was processed by reversing the AES encryption (the key and plaintext being known), in order to find out the injected fault and to check its instant of appearance. It allowed us to study the fault nature (i.e. the number of faulted bits and their location). Finally, the injected faults were added to the library.

3) Library of power supply glitch induced faults: The same data-set library of 1,000 random {Plaintext, Key} couples was used to conduct fault injection experiments by means of power supply glitches. These experiments were carried out in a similar way: a progressive increase of the applied stress until a first fault appears. The injection time was varied according to the principle illustrated in fig. 7 and8, in order to target all the AES rounds. Finally, the injected faults were added to the library.

4) Experimental proof: Then, clock and power glitches induced faults were compared in order to check whether they were identical or not. If identical, it would be an experimental proof that faults induced by clock and power glitches are due to timing constraint violations, i.e. that they originate in the same injection mechanism. The experimental results we have obtained are reported in the next section.

V. E XPERIMENTAL RESULTS

A. Clock glitch results

We observed, as expected, that this injection process is data-dependent and also that the metastability phenomenon exemplified in fig. 2-b is observable. Faults were injected successfully at each round of the AES. The obtained faults were single-bit with a rate slightly greater than 90%.

B. Power supply glitch results

1) Experimental issues:

The settings and methods reported in this work were found experimentally after many trials and errors. We finally found out that we need to inject a pulse in the 20ns range similar to those depicted in figs. 7 and 8 at a negative amplitude beyond 30V to go through the internal low filtering effect originated in the core voltage supply port: the pulse amplitude inside the component was highly attenuated. However, we were still unable to match the timing accuracy we had with clock glitches. After reversing the encryption of the faulty ciphertexts, we found that faults were often injected in two or three subsequent rounds. We drew the hypothesis that the injected pulse was distorted and its effect was extended over a larger period of time as illustrated on figure 9.

The remedy to this lack of accuracy was to use the second pulse generator (Picosecond 10,300B) to boost the rising part of the actually injected glitch as shown in figure 10 (As a result, the core power supply is also increased during the following rounds. However, it had no adverse effect on the computations of the IC). The correcting pulse was positive, with a 20V amplitude and a 100ns duration. Fig. 11 and 12 display the core supply rail voltage captured by an oscilloscope during pulsed injection performed with both techniques. Many oscillations appear. We also drew a low-filtered view of the voltage to figure how it may be inside the component (after passing through the supply port). This confirms the assumptions of fig. 9 and10.

However, because critical times are data-dependent, a different setting of the faulting pulse's amplitude was to be found for each round of each data-set. Consequently, a different setting of the correcting pulse was needed. This led to very long tuning steps. Thus, we simultaneously used a constant modification of the power supply and a voltage glitch to ease the process. The glitches settings were kept constant (for both faulting and correcting pulses). The core power supply value and the timing parameters were the only varying parameters of our experiments. This technique is illustrated in fig. 13 where the low grey shaded squares represent the critical time increase due to underpowering and the deep grey shaded squares represent the critical time increase due to the voltage pulse. In this instance, round 6 was faulted.

2) Results: Due to the long time needed to carry out power glitch experiments, we report here the injection results from 140 different rounds. The single-bit fault injection success rate was also slightly greater than 90%. As expected, the data-dependent nature of the injection process and also the metastability phenomenon, exemplified in fig. 2-b, were observed. The experimental results are :

• 70% of the injected faults were identical to those obtained by using clock glitch injection,

• 10% of the injected faults were induced by violating the timing constraints of the second most critical path of the round (as further clock glitches experiments revealed),

• 20% of the injected faults were injected in neighbouring rounds of the targeted one. The latter behaviour is exemplified in figure 14: a round with a critical path shorter than those of its neighbouring rounds may be unreachable.

C. Results analysis

For both studied fault injection means (clock and power glitches), we have observed the two main distinguishing features of timing constraint violations: data-dependency and the occurrence of a metastability phenomenon. Moreover, 70% of the injected faults were found to be identical. The remaining 10% and 20% were explained respectively by the violation of the 2 nd or 3 rd most critical path and by fault injection in neighbouring rounds. We believe that this is an effective experimental proof of the uniqueness of the injection mechanism. Even if the power glitch injection setup is far less accurate than the clock glitches one in some specific cases it could be easier to inject fault on the power supply line than on the clock line.

We did not report in this paper our experiments of fault injection with positive power supply glitches. The reason is that we were unable to induce faults on our FPGA board setup by using our pulse generators, despite their wide range of available settings in amplitude and time. Further experiments have to be carried out before being able to draw a conclusion. In this paper we have provided an experimental proof of the equivalence of the fault injection mechanism by means of clock and power supply glitches. The proof lies in the nature of the injected faults: they were the same or very similar for a given data-set irrespectively of the injection means used. Besides, we have conducted an in-depth study of the properties of these faults. It has revealed the ability to induce single-bit faults with a success rate beyond 90%. Power supply glitches also make it possible to fault almost every encryption round of our test chip (near 80% success rate). As, 10% of the injected faults were induced by violation of the 2 nd or 3 rd most critical path of the targeted ound, it suggests that there may also be a spatial effect associated with power glitches. This assumption would be studying in further researsh work.

  outlines a representation of their internal architecture: combinatorial logic (marked P ) surrounded upstream and downstream by register banks made of D flip-flops (DFF) sharing the same clock signal (clk).

Fig. 1 .

 1 Fig. 1. Internal architecture of digital ICs

Fig. 2 .

 2 Fig. 2. Timing constraint (a) fulfilled or violated: (b) setup violation, (c) early latching.

Fig. 3 .

 3 Fig. 3. Inverter: architecture and typical waveforms Note that t pLH and t pHL may have different values. Hence, the data propagation time through the inverter (and through any logic block) depends on the handled data: the propagation time is data-dependent.The propagation time, t pLH (eq. 4), is obtained from a first order analysis[START_REF] Razavi | Fundamentals of Microelectronics[END_REF] of the inverter's dynamic behaviour:

Fig. 4 .

 4 Fig. 4. AES-128 general outline.

Fig. 5 .Fig. 6 .

 56 Fig. 5. Most critical paths in every AES rounds in nominal conditions

Fig. 7 . 3 criticalFig. 8 .

 738 Fig. 7. Most critical paths in every AES round when subject to a power glitch centered on round 3

Fig. 9 .Fig. 10 .Fig. 11 .

 91011 Fig. 9. Expected and altered glitches with only one generator (hypothetical view)

Fig. 13 .Fig. 14 .

 1314 Fig. 13. Critical paths of every AES rounds affected by a transient pulse and underpowering


Cyril Roscian

Alexandre Sarafianos

Jean-Max Dutertre

Assia Tria

Fault Model Analysis of Laser-Induced Faults in SRAM Memory Cells

Keywords: Laser Fault injection, SRAM, Fault model, SPICE Simulation, Bit-flip, Bit-set, Bit-reset

The use of a laser to inject faults into SRAM memory cells is well known. However, the corresponding fault model is often unknown or misunderstood: the induced faults may be described as bit-flip or bit-set/reset faults. We have investigated in this paper whether the bit-set/reset fault model or bit-flip fault model may be encountered in SRAMs. First, the fault model of a standalone SRAM was considered. Experiments revealed that the relevant fault model was the bit-set/reset. This result was further investigated through electrical simulations based on the use of an electrical model of MOS transistors under laser illumination. Then, fault injections have been performed on the RAM memory of a micro-controller to check the validity of the previous results based on experiments and simulations.

I. INTRODUCTION

Secure circuits are prone to a wide range of physical attacks. Among them, fault attacks (FA) are based on the disturbance of the chip environmental conditions in order to induce faults into its computations. Fault injection may be achieved by using laser exposure [START_REF] Skorobogatov | Optical Fault Induction Attacks[END_REF], voltage [START_REF] Blömer | Fault Based Cryptanalysis of the Advanced Encryption Standard (AES)[END_REF] or clock glitches [START_REF] Agoyan | When clocks fail: On critical paths and clock faults[END_REF], electromagnetic perturbation [START_REF] Dehbaoui | Electromagnetic Transient Faults Injection on a Hardware and Software Implementation of AES[END_REF], etc. It exists a very efficient method called Differential Fault Attack (DFA) applied to encryption algorithms that takes advantage of a comparison between correct and faulted ciphertexts to retrieve the secret key used during the ciphering process [START_REF] Boneh | On the importance of checking cryptographic protocols for faults[END_REF], [START_REF] Biham | Differential fault analysis of secret key cryptosystems[END_REF], [START_REF] Giraud | DFA on AES[END_REF], [START_REF] Piret | A Differential Fault Attack Technique against SPN Structures, with Application to the AES and Khazad[END_REF]. In these attacks, the fault model [START_REF] Otto | Fault Attacks and Countermeasures[END_REF] can be very restrictive and is often the base of the attack efficiency. Thus, it is important to know what fault model is relevant or feasible with the targeted chip.

This work reports the study of the fault model of SRAM memory cells when exposed to laser pulses. Transient fault injection in memory elements is often modelled according two fault models: (1) the bit-set/reset model and (2) the bit-flip model. A data bit suffers from a bit-set (resp. a bit-reset) fault, if it is changed from 0 to 1 (resp. from 1 to 0), thus creating a calculation error. On the contrary, it remains unfaulted if its logical value was yet a 1 (resp. a 0). This data-dependent fault type is very worrying as it makes it possible to mount safe error attacks against cryptosystems [START_REF] Blömer | Fault Based Cryptanalysis of the Advanced Encryption Standard (AES)[END_REF], [START_REF] Yen | Checking before output may not be enough against fault-based cryptanalysis[END_REF], [START_REF] Loubet-Moundi | Static Fault Attacks on Hardware DES Registers[END_REF]. A data bit suffers from a bit-flip fault if it is inverted regardless of its value. This latter fault model is data-independent. The injected faults in SRAMs are often described in research papers according these two fault models [START_REF] Pouget | Dynamic Testing of an SRAMbased FPGA by Time-Resolved Laser Fault Injection[END_REF]. However, to the best of our knowledge, their relevance has never been precisely investigated. Moreover, the bit-flip fault model is questionable according a first order analysis of the laser-sensitive zones of an SRAM cell.

Our main contributions to that research field are:

• the identification on experimental basis of the actual fault model of laser-induced faults into SRAM cells,

• the use of electrical simulations that consider the induced photo-currents and the topology of the targeted SRAM cell to assess and further analyse the fault model. This paper is organized as follows. The first part reminds the effects of laser on silicon and emphasizes the notion of laser-sensitive zones on CMOS circuits. Then, a set of assumptions, derived from this notion, is made and its consequences on the fault model of an SRAM cell are reviewed. The second part reports the experiments we have carried out to find out the right fault model. In the third part, simulations results based on a proper model of laser-induced effects are displayed and commented for deeper analysis purposes. The forth part reports further experiments conducted on a microcontroller's RAM memory. Finally, a conclusion summarizes the different results and some perspectives are given for future works.

II. SEU ON SRAM CELL

A. From SEE to SEU A photoelectric effect is generated by a laser beam passing through silicon provided that its photons energy is greater than the silicon bandgap [START_REF] Habing | The Use of Lasers to Simulate Radiation-Induced Transients in Semiconductor Devices and Circuits[END_REF]. This effect creates electronhole pairs along the laser path. Generally these pairs recombine and there is no noticeable effect on the IC's behaviour. However, under specific conditions, some undesired effects may appear: the so-called Single Event Effects (SEE). A SEE happens when the charge carriers (i.e. electrons and holes) created by the laser beam are drifted in opposite directions by the electrical field found in the PN-junctions of CMOS transistors instead of recombining. As a consequence a transient current (i.e. moving charge carriers) is generated through the struck junction. This phenomenon is depicted in the left part of Figure 1, where the PN-junction of an NMOS transistor in its turned "OFF " state is drawn. This phenomenon can be decomposed in two parts described in [START_REF] Wang | Single Event Upset: An Embedded Tutorial[END_REF]. In a first time, the depletion region (hence the electric field) is stretched along the laser beam, the charges nearby are collected in a few picoseconds and gives a current peak, called funneling. In a second time, the remaining charges are collected in a longer phenomenon, called diffusion. The current decreases slowly until all charges are collected. The outline of the corresponding photo-current is displayed on the right part of Figure 1.

It exists a strong electric field, sufficient to create a transient current as explained above, in any PN-junction of the transistors used in CMOS logic regardless of their state (i.e. turned "ON " or "OFF "). However, such a transient current may, or may not, have an effect on the target's logic signals depending on both its location and the data handled by the logic. These dependencies are usually explained by considering the inverter case (see Figure 2).

Vdd

Gnd Gnd

Cload "0" "1"

Vdd Gnd Gnd

Cload "1" "0" Consider the left part of Figure 2 where the inverter's input is at a low logical level: its PMOS transistor is turned "ON " and its NMOS transistor is turned "OFF ". Hence the inverter's output is at a high logical level and its output's capacitive load (dotted in Figure 2) is charged. The inverter has four PN-junctions which are likely to give rise to a transient current if struck by a laser: the drains and sources of both PMOS and NMOS transistors. Nevertheless only a transient current originated in the NMOS' drain will result in a disturbance of the inverter's output (pointed out by a filled grey ellipse). In that case, the transient current is flowing from the drain to the substrate which is grounded (as drawn in the left part of Figure 1). Hence the capacitive load is discharged provided that the transient current is big enough to overcome a charging current flowing through the "ON " PMOS transistor. As a result the output of the inverter passes temporarily to a low logical level. When the transient current vanishes, the capacitive load is charged again via the turned "ON " PMOS transistor. Thus, due to the transient current generated in the NMOS' drain, the output voltage of the inverter undergoes a transient voltage inversion. This transient voltage may then propagate through the downstream logic: a so-called Single Event Transient (SET). Any transient current created in the NMOS' source has no effect on the output since it is isolated from the output by the turned "OFF " NMOS. Regarding the transient currents created in the PMOS' diffusions, they create a leakage path to the N-well which is biased at the core supply voltage (i.e. Vdd). Hence they have no discharging effect on the output's capacitive load. To sum up, the only laser-sensitive area of an inverter, when its input is in a low logical state, is the drain of the "OFF " NMOS transistor.

Likewise, when considering an inverter with its input at high level (right part of Figure 2), a similar reasoning may be conducted. It results that the only laser-sensitive area of an inverter when its input is in a high logical state is the drain of the "OFF " PMOS (underlined in grey).

As a conclusion, the laser-sensitive area of a CMOS inverter is the drain of the "OFF " transistor, whose location is changing with the logical level of the inverter's input. In a more general way the laser-sensitive areas of CMOS ICs are data-dependent. The occurrence of a laser-induced fault depends on the handled data.

B. The SRAM circuit

The SRAM cell used in this study is a configuration SRAM (CSRAM), principally used to store the configuration bitstream in configurable logic (FPGA). It is part of a test chip designed in 0.25 µm CMOS technology with a 2.5 V power supply that embeds several patterns for laser testing. This CSRAM is constituted by five transistors, more precisely, two CMOS inverters and one access transistor. The schematic of the CSRAM is depicted in Figure 3. This CSRAM is used to store a configuration bit, which is used through the output DATA_OUT. In the following we will refer to the CSRAM's state being state "1" as node DATA_OUT has a high logical level (i.e. Q =1 ); respectively, we will refer to state "0" as DATA_OUT is low (i.e. Q =0 ). The configuration bit is stored by the logical effect of the two cross-coupled inverters (built from the NMOS and PMOS transistors MN1/MP1 and MN2/MP2 respectively). It may be updated (from the value of the DATA_IN input) through the access NMOS transistor MN3, as long as it is in "ON " state (for SEL =1 ). As SEL =0 , the access transistor is "OFF ", thus the CSRAM is in its static mode: it memorizes its configuration bit.

A picture of the whole test chip is given in Figure 4, a zoom highlights the part where the CSRAM is located. The size of the CSRAM memory cell is 9 µm by 4 µm. Hereafter, we will rather use the term SRAM as the following results apply equally to standard six transistors SRAM cells.

C. Theoretical analysis of the SRAM's laser-sensitive zones

As presented in II-A, the laser-sensitive zones of a CMOS circuit are data-dependent. The laser-sensitive zones are highlighted on the SRAM's layout in Figure 5. Two zones, drawn in blue for laser-sensitivity in state "1", correspond to the drains of MP2 and MN1 (these transistors are turned "OFF " in state "1"). The laser-sensitive zones in state "0" are drawn in red. They correspond to the drains of the "OFF " transistors MP1 and MN2/MN3 (as seen on the layout MN2 and MN3 share a common drain diffusion). Thus, the analysis of the layout leads theoretically to the existence of four data-dependent laser-sensitive zones: two in state "1" and two in state "0". Figure 5. CSRAM layout with theoretical laser-sensitivite zones: blue for state "1", red for state "0". Such a laser-sensitive zones cartography is consistent with the bit-set/reset fault model. For a laser beam directed on a blue zone, a fault may appear provided that the SRAM is in state "1": this would be a bit-reset fault. Respectively, for a laser beam directed on a red zone, a fault may appear provided that the SRAM is in state "0": this would be a bit-set fault. This cartography excludes the feasibility of a bit-flip, for there is no location where a fault may be induced irrespectively of the SRAM's state (there is no overlap between blue and red zones).

However, this behaviour is questionable. Indeed, the previous analysis was made under the assumption that one laser shot will affect only one sensitive zone. Two parameters put this assumption at stake: (1) the SRAM size, which is 4 µm ×9 µm; (2) the minimum feasible diameter of a laser spot which is 1 µm given the laws of optic, moreover its effect area may extend far beyond it (depending on the pulse energy) [START_REF] Darracq | Backside SEU Laser Testing for Commercial Off-The-Shelf SRAMs[END_REF]. Thus the laser-sensitive zones shall extend beyond the drains: they may overlap as depicted in Figure 6.

The overlapping of laser-sensitive zones corresponding to bit-set and bit-reset gives rise to the feasibility of a bit-flip: if a laser shot arises on an overlapping area as depicted in Figure 6, the SRAM's configuration bit will be inverted irrespectively of its state. This correspond to a bit-flip fault model.

The next section presents the laser injection experiments carried out on this SRAM cell for the purpose of identifying the actual fault model.

III. EXPERIMENTS

A. Laser Set-up

The experiments reported in this section were performed in front side with a laser source at 1064 nm wavelength. The duration of the laser pulses was set to 50 ns. The laser power range extends from 0 to 3 Watts. The size of the laser spot could be chosen among three values, depending of the optical lenses, let 1 µm, 5 µm and 20 µm. The test chip was mounted on a motorized XYZ stage. It permitted us to draw an experimental cartography of the laser-sensitivity of the SRAM as reported in the following subsection.

B. Laser-sensitivity maps for small and large laser spots

An area of 10x10 µm 2 , around the SRAM, was scanned with a resolution step of 0.2 µm. For each scanning point, the SRAM was written either in state "1" or in state "0". Then, the laser was fired. After a few µs the SRAM's state was read back and compared to the state value initially written. In case of fault, the corresponding scanned point was added to the laser-sensitivity cartography. We used the term bit-set fault (resp. bit-reset fault) for a fault injected as the SRAM was in state "0" (resp. in state "1"). Figure 7 depicts the lasersensitivity map of the SRAM at 1.6W and 1 µm laser spot diameter. Coordinates corresponding to bit-set faults (resp. bit-reset faults) are given in red (resp. blue).

In Figure 7, there are two zones corresponding to bitset faults (the drains of MP1 and MN2/MN3) and one zone corresponding to bit-reset fault (MN1's drain). The bit-reset laser-sensitive zone corresponding to the drain of MP2 is missing. The hypothesis that this missing sensitivity zones is due to the metal coverage is not relevant here. As it can be observed on the Figure 5, the drain of MP2 is not covered by metal layer. A similar effect is also reported in section V. However, despite being promising, the analysis of this phenomenon is out of the scope of this paper.

The main point with this cartography is that bit-set and bit-reset sensitive zones do no overlap. Consequently, there is no laser shot location where a fault may be induced whatever is the SRAM's state: the bit-flip fault model proved irrelevant.

Identical results were obtained for other experiment series conducted with laser spot diameters set to 1 µm, 5 µm and 20 µm, and laser power in the 1 W to 2 W range (the SRAM cell is destroyed for a laser power above 2W , probably because of a latchup and the SRAM's value cannot be read or write). As a conclusion, based on these experimental results we concluded that the fault model of laser-induced faults on this SRAM is the bit-set/reset model.

The obtained cartographies showed no overlap between bit-set and bit-reset zones. However, these zones can almost touch each others (see the bottom part of Figure 7) suggesting that an overlap is not absolutely impossible. In order to confirm the lack of bit-flip we have further investigated the injection of faults in this location on a simulation basis as reported in the next section. Moreover, additional tests were carried out on the RAM memory of a micro-controller for validation purposes (see section V).

IV. SPICE SIMULATION

A. Spice model

The simulations presented in this section were based on the SPICE model of MOS transistors under laser illumination introduced in [START_REF] Sarafianos | Electrical modeling of the photoelectric effect induced by a pulsed laser applied to an NMOS transistor[END_REF]. According to this model, the photocurrent induced by the laser beam in any PN junction of the SRAM was simulated by a voltage controlled current source with a current amplitude expressed by:

I laser =(a * V + b) * Ω laser * S ( 1
)
where S is the surface of the sensitive zone in µm 2 , a and b fitting parameters depending on the laser power (P laser in Watts) and technology parameters, V is the reversed bias voltage of the PN junction under the laser illumination. a and b are expressed as follows (p, q, and s are fitting parameters defined in [START_REF] Sarafianos | Electrical modeling of the photoelectric effect induced by a pulsed laser applied to an NMOS transistor[END_REF]):

a = p * P 2 laser + q * P laser (2) b = s * P laser (3)
Ω laser is a parameter used to take into account the distance between the PN junction of interest and the laser spot (i.e. this model considers the topology of the target). The equation of Ω laser is :

Ω laser = β * exp(- d 2 c 1 )+γ * exp(- d 2 c 2 ) ( 4
)
where d is the distance between the sensitive zone and the center of the laser spot, c 1 and c 2 represents the influence of the optical lens uses to focus the laser beam, β and γ are fitting parameters.

To simulate a laser shoot on the SRAM circuit, each PN junction of the SRAM cell was connected to a current source modelling the laser-induced photo-current. Indeed, as demonstrated in [START_REF] Sarafianos | Electrical modeling of the photoelectric effect induced by a pulsed laser applied to an NMOS transistor[END_REF], even if the sources and the drains of the "ON " transistors were not considered sensitive, a photocurrent could be injected by a laser shoot. To simulate this effect, current sources had to be connected to all transistors sources and drains, not only to sensitivity zones. Finally, according to the layout of the memory cell presented in Figure 5 and the different shared diffusions, seven current sources were connected to the different drains and sources of the SRAM cell. The schematic of the final circuit used for simulation is depicted in Figure 8.

The surface of the SRAM was divided into squares of 0.5 µm ×0.5 µm. For each simulated point, the distance between the laser beam and the different sensitive zones of the memory cell were calculated and injected in the I laser expressions of their corresponding current sources. The other parameters have a fixed value.

B. Simulation of laser-sensitivity map

A first set of simulations was performed in order to draw the laser-sensitivity map of the SRAM cell: Figure 9 also depicts the corresponding fault-models (on simulation basis). This map was used for comparison purposes with the experimental results of section III-B. It validates the relevance of the model. This simulated laser-sensitivity map is very similar to the experimental laser-sensitivity cartography shown in Figure 7. it can explain the slight differences of the sensitivity zones between simulation and experiments performed with a test chip in 0.25 µm. However, the behaviour of the test chip and the simulation model were similar, that's allowed us to use this model to confirm the infeasibility of bit-flip fault (see next section). The two possible initial states of the SRAM ("0" or "1") have been simulated.

C. Analysis of laser fault simulation results

In Figure 9, there is only one contact point (with no overlap however) between bit-set and bit-reset zones: it is highlighted by a rectangle. We report in this subsection simulation results corresponding to laser injection in this area in order to illustrate the lack of bit-flip faults.

The first simulation was run for a laser shooting at the left inside part of this rectangle: a bit-reset sensitive zone. The SRAM was initialized in state "1", the laser pulse (50 ns duration) was simulated at 200 ns. As expected, a bit-reset fault occurred as illustrated in Figure 10 where the voltages at nodes Q and DATA_OUT are drawn. The shooting zone is close to the drain of MN1 which is laser-sensitive in state "1". As a result, a laser-induced photo-current, I laser (MN1), flows from MN1's drain to the substrate which is grounded (see the corresponding current source model in Figure 8). This current has a discharging effect on node DATA_OUT. Note that a balancing current, I SD (MP1), flows from Vdd to node DATA_OUT through MP1 (which is in "ON " state): it has a charging effect on node DATA_OUT. Both currents are depicted in Figure 11.

An SEU actually occurred because MN1's photo-current overcame MP1's balancing current. It is more noticeable by drawing the electrical charge injected by both currents on node DATA_OUT as displayed in Figure 12 (its absolute value is drawn).

From 200 ns to 220 ns, DATA_OUT's charge decreases slowly because I laser (MN1) prevails on I SD (MP1) by only 10 µA. It drives progressively DATA_OUT's voltage from 2.5 V to the SRAM's inversion threshold. Then, due to the inversion of the SRAM's state, this phenomenon accelerates as shown by the charge waveform. Finally, the SRAM stabilizes in state "0". A bit-reset fault injection has been simulated. There is a second balancing effect which comes from the photo-current induced in MN2's drain: I laser (MN2) displayed in Figure 13. It flows from node Q (connected to MN2's drain) to the ground.

Indeed, I laser (MN2) contributes to maintain node Q at a low logical level. However, its strength is too weak to avoid the bit-reset.

The second simulation was run with the same settings but the SRAM initialized in state "0". As expected for this location, no fault was injected. Figure 14 depicts the simulated voltages of nodes Q and DATA_OUT.

The laser beam closest laser-sensitive zone likely to induce a bit-set is the drain of MN2. Indeed the voltage of node Q undergoes a transient decrease during the laser shoot (from 200 ns to 250 ns in Figure 14). However, it is insufficient to change the SRAM's state. The photo-current induced in MN2, I laser (MN2), which has a discharging effect on node Q is balanced by the current I SD (MP2), flowing through MP2 (in "ON " state). They are both depicted in Figure 15. This balancing effect is clearly seen in Figure 16 where the electrical charge injected at node Q is drawn.

Node Q undergoes a discharge of about 0.03 pC, far below the 3.15 pC charge that was necessary to induce a bit-reset as illustrated in Figure 12. Note that, I laser (MN2) only grew to a maximum amplitude of 120 µA, whereas I laser (MN1) reached a current amplitude of 400 µA when the SRAM was in state "1" (see upper part of Figure 11). It explains why no bit-set fault is induced at this laser location in state "0".

As the simulated laser beam is displaced to the right inside part of the rectangle in Figure 9, it reaches a bit-set sensitive zone. The third simulation we report was carried out at this location with an SRAM in state "0". Figure 17 reports the voltage simulations of nodes Q and DATA_OUT at this position. As expected, a bit-set fault occured. The photo-current induced in MN2's drain overcome the MP2's balancing current in the same way as with bit-reset fault simulation.

The electrical charge injected by both currents, drawn in Figure 18, has the same behaviour that one displayed in Figure 12. MN2's induced photo-current drives progressively Q's voltage from 2.5V to the SRAM's inversion threshold, then the electrical charge injected increases quickly until the SRAM stabilizes in state "1". A bit-set fault injection has been simulated. A photo-current is also injected on MN1's drain that contribute to maintain DATA_ OUT at a low logical level but its maximum value is too low to avoid the bit-set.

The last simulation was carried out at the bit-set lasersensitive zone with the SRAM in state "1". Figure 19 reports the simulation of nodes Q and DATA_ OUT voltages during laser exposure: no fault was injected. The electrical charge injected at DATA_ OUT's node, depicted in Figure 20, is 0.03 pC which is far below the 0.7 pC charge necessary to change the SRAM state. Thus, a bit-reset fault is infeasible at this location.

Considering the two position highlighted on Figure 9 as the most likely position to have bit-flip fault, this type of fault is then infeasible on the memory cell.

To confirm the lack of bit-flip faults on SRAM cells, laser fault injection experiments have also been made on a microcontroller RAM memory as reported in the next section.

V. E XPERIMENTS ON MICRO-CONTROLLER RAM CELLS A. Chip description

The test chip is an 8-bit micro-controller (0.35 µm CMOS process). The RAM of the chip is depicted in Figure 21. Its capacity is 4 kB divided in eight parts, each part contains two blocks of 256 kB. It can be assumed that each SRAM memory cell is constructed with six transistors (two cross coupled inverters and two access transistors). According the hypothesis made in part II-C, each cell should have four data-dependent laser-sensitive zones (two in state "1", two in state "0").

The fault injection experiments have been focused on few bytes of the memory, i.e. a zone of 40 µm × 40 µm with displacement steps of 0.5 µm. Laser injection was performed through the backside of the chip, with spot sizes of 1 µm and 5 µm. For each fault injection, the protocol was the same as described in section III-B. After the laser shoot, a block size of 256 kB, containing the targeted bytes, was read back and compared with the initially stored values.

B. Sensitivity of the RAM memory

Figure 22 shows the sensitivity map of the RAM memory with a spot size of 1 µm and a power of 1.1 W.

Twelve SRAM cells are clearly distinguishable in this Figure : for each of them a bit-set zone (in red) and a bit- reset zone (in blue) were revealed. No bit-flip was obtained.

As with the experiments reported in part III-B, the bit-set zone and bit-reset zone do not overlap. For each SRAM cell, among the four theoretical sensitivity zones, two were not sensitive (this result is consistent with the experimental results of Figure 7, however, the analysis of this phenomenon is out of scope of this work). We were able to conclude on the absence of two laser-sensitive zones because we knew what bit of what byte was faulted. In addition, this methodology allowed us to draw a map of the memory (i.e. the location of every bit). In Figure 22, the size of an SRAM cell is highlighted by a square: it is about 5 µm × 5 µm.

Note that we have induced single-bit faults (i.e. faults restricted to only one bit of the entire RAM memory) with a success rate close to 99 % during these experiments. Some additional experiments have been conducted on this test chip at higher laser power and with a larger spot size. Figure 23 displays the result of the experiment at 1.2 W. More SRAM cells were sensitive but similarly to the previous experiments, bit-set zones and bit-reset zones do not overlap. Thus, increasing the power of laser has no effect on the feasibility of bit-flip fault injection.

The last experiment has been done at 1.1 W with a spot size of 5 µm. This time, the different memory cells were Despite the use of different spot size or power for the laser, these fault injections on several SRAM cells confirm the lack of bit-flip faults on SRAM cells.

VI. CONCLUSION

In this paper, we have first reported laser fault injection experiments on a configuration SRAM cell (CSRAM) similar to those used to store the configuration bitstream of FPGAs. Different laser powers and spot sizes were used in order to investigate the corresponding fault model. The results of the experiments showed that the bit-flip fault model is not relevant for laser-induced fault in this memory cell. Only bitset (or bit-reset) faults are feasible, contrarily to assumptions that may be drawn based on the fact that a laser spot may cover several sensitive zones. Additional SPICE simulations demonstrated and confirmed the infeasibility of bit-flip fault on the memory cell under laser illumination. It also provides a detailed understanding of the transition between bit-set and bi-reset zones as the laser beam location is changed.

Because these results were obtained with a particular SRAM, laser fault injection have been conducted on the RAM memory of a micro-controller for validation purposes. The results are in accordance with those obtained previously: no bit-flip has been injected on an area of 40 × 40 µm 2 gathering several SRAMs cell. Moreover, during these experiment series, almost all the injected faults were single-bit faults.

The bit-set/reset fault model related to laser-induced faults in SRAMs is very worrying. It makes it possible to mount relatively easily safe error attacks ( [START_REF] Blömer | Fault Based Cryptanalysis of the Advanced Encryption Standard (AES)[END_REF], [START_REF] Yen | Checking before output may not be enough against fault-based cryptanalysis[END_REF]) against cryptosystems. Moreover, even if some bit-flips are obtained on a given device, the occurrence rate of bit-set/reset faults will be much higher than that of bit-flip. Such a bias in the fault statistics will still permit to perform attacks like a differential behavioural analysis [START_REF] Robisson | Differential Behavioral Analysis[END_REF].

Nevertheless, the analysis of the missing sensitivity zones as reported in sections III and V could bring some interesting elements to improve the security of SRAM memory elements against laser fault injection.

Figure 1 .

 1 Figure 1. Photoelectric effect of a laser beam through a PN-junction (left) -Transient current resulting from charge collection after a laser shot [14] (right).

Figure 2 .

 2 Figure 2. Inverter's schematic with its data-dependent sensitive areas.

Figure 3 .

 3 Figure 3. CSRAM's schematic.

Figure 4 .

 4 Figure 4. Test chip view, and close-up to the CSRAM cell.

-

Figure 6 .

 6 Figure 6. CSRAM layout with bit-flip zones.

Figure 7 .

 7 Figure 7. Experimental laser-sensitivity map of the SRAM at 1.6W

Figure 8 .

 8 Figure 8. CSRAM schematic with current sources modelling laser-induced photo-currents.

Figure 9 .

 9 Figure 9. Laser-sensitivity map of the SRAM cell obtained from simulation.

Figure 10 .

 10 Figure 10. Bit-reset simulation: voltages at nodes Q and DATA_OUT.

Figure 11 .Figure 12 .

 1112 Figure 11. Bit-reset simulation: photo-current induced in MN1's drain (upper part) and current flowing through MP1 (bottom part).

Figure 13 .Figure 14 .

 1314 Figure 13. Simulation of the photo-current induced in the drain of MN2.

Figure 15 .Figure 16 .

 1516 Figure 15. Simulation of MN2's photo-current (upper part) and MP2's current (bottom part) in state "0".

Figure 17 .Figure 18 .

 1718 Figure 17. Bit-set simulation: voltages at nodes Q and DATA_OUT.

Figure 20 .

 20 Figure19.Aborted bit-reset simulation: voltages at nodes Q and DATA_OUT.

Figure 21 .

 21 Figure 21. View of the micro-controller with its RAM memory area

Figure 23 .

 23 Figure 23. Laser-sensitivity map of the RAM memory at 1.2 W and with a spot size of 1 µm.

Figure 24 .

 24 Figure 24. Laser-sensitivity map of the RAM memory at 1.1 W and with a spot size of 5 µm.

ACKNOWLEDGMENT

The research work of Cyril Roscian was partly funded by the "Conseil Regional PACA". The authors also would like to thank Ronan Lashermes for his help and his support.