Alexandre Sarafianos
email: alexandre.sarafianos@st.com

Mathieu Lisart

Olivier Gagliano

Valérie Serradeil

Cyril Roscian

Jean-Max Dutertre

Assia Tria

Robustness improvement of an SRAM cell against laser-induced fault injection

Keywords: component, SEU, SRAM cell, pulsed PLS, 1064nm wavelength, electrical simulation, robusteness I

INTRODUCTION

SRAM memory cells are prone to Single Event Upset (SEU) when exposed to ionizing particle hits (in harsh a radioactive environment). An SEU consists in an inversion of the data bit stored by the struck SRAM. SEU were strongly take into account when further problems were observed in space electronics devices during the 1960s due to the high exposition of chips embedded in space vehicles to radioactive particles emitted mainly by the sun. Nowadays, SEU is yet a major threat for semiconductor manufacturers. The robustness of chips against SEU could be tested by a cyclotron or pulsed laser equipment using the Photoelectrical Laser Stimulation (PLS) effect induced in silicon. However this kind of experiments could be very expensive and time consuming. Physical (i.e. TCAD) simulation [START_REF] Minixhofer | TCAD as an integral part of the semiconductor manufacturing environment[END_REF][START_REF] Dodd | Physics-Based Simulation of Single-Event Effects[END_REF] may be used, but a Spice simulation is faster [START_REF]ELDO user's Manual -Software Version 6.6_1 Release[END_REF]. In this context, it is interesting to use a simulation tool at gate level in order to simulate with good accuracy the effect of PLS on a chip in order to analyze its sensitivity to SEU in a very small amount of calculation time. In this paper, we present an electrical model of the backside PLS of an SRAM cell in 0.25 µm CMOS technology. We used a pulsed laser at 1064 nm wavelength to conduct the PLS experiments. The obtained measurements were used to build an electrical model of the cell under PLS and to analyze its behavior. This electrical model makes it possible to simulate the response of the SRAM cell to laser pulses in a very small amount of calculation time.

Moreover, comparisons between simulations and measurements will rather be qualitative than quantitative due to the fact that the electrical model of PN junctions under PLS was tuned thanks to measurements on a STMicroelectronics 90 nm technology.

Electrical models of PN junctions under pulsed laser stimulation (N+ on Psubstrate, P+ on Nwell and Nwell on Psubstrate) were previously introduced [START_REF] Sarafianos | Electrical modeling of the photoelectric effect induced by a pulsed laser applied to an NMOS transistor[END_REF][START_REF] Sarafianos | Electrical modeling of the photoelectric effect induced by a pulsed laser applied to a PMOS transistor[END_REF]. We have also already introduced electrical models, based on preliminary studies made from measurements and TCAD simulations [START_REF] Llido | Characterization and TCAD Simulation of 90nm Technology NMOS Transistor Under Continuous Photoelectric Laser Stimulation for Failure Analysis Improvement[END_REF][START_REF] Llido | Characterization and TCAD Simulation of 90nm Technology NMOS Transistor Under Continuous Photoelectric Laser Stimulation for Failure Analysis Improvement[END_REF] for continuous PLS at low laser power (under ~100 mW), which create only photoelectrical effects [START_REF] Llido | Characterization and TCAD Simulation of 90nm Technology NMOS Transistor Under Continuous Photoelectric Laser Stimulation for Failure Analysis Improvement[END_REF][START_REF] Sarafianos | Building the electrical model of the Photoelectric Laser Stimulation of an NMOS transistor in 90nm technology[END_REF]. This model consists in a simple current source controlled by voltage to model the laser induced photocurrent. The novelty of the model presented in this paper is that it is the first model of a relatively complex CMOS cell made from NMOS and PMOS transistors under pulsed PLS which takes into account the topology of the target (i.e. the layout of the cell) relatively to the effect area of the laser beam which have a Gaussian-like intensity profile.

This paper is organized as follows. Section II presents, from a theoretical point of view, the SEU sensitivity of an SRAM cell exposed to PLS. In theory four sensitive areas are expected. Section III reports measurements on an actual SRAM cell. It turns out that only three sensitive areas were revealed: a masking effect of the forth sensitive area appeared. The Gaussian intensity profile of the laser beam and the topology of the cell could explain this unexpected result. Moreover, electrical modeling and related simulations confirm this particular result. Sensitivity maps obtained from simulations and measurements showed a very good correlation. This validates the relevance of our simulation tool. In section IV, a new solution to increase the SEU robustness of a standard six transistors (6T) SRAM cell is introduced. This new design involved the use a triple well (deep Nwell) implant under the NMOS transistors of the SRAM cell and a careful positioning of the cell's transistors. The latter technique takes advantage of the SEU sensitive area masking effect analyzed in section 3. The new 6T SRAM cell was then tested with our electrical model. Finally, our findings are summarized in the concluding section V with some perspectives.

II. EFECT OF SINGLE EVENT UPSET ON AN SRAM CELL

The photoelectric effect is generated by a laser beam passing through silicon provided that its photons energy is greater than the silicon band gap [START_REF] Sarafianos | Building the electrical model of the Photoelectric Laser Stimulation of a PMOS transistor in 90nm technology[END_REF]. This effect creates electron-hole pairs along the laser path. Generally these pairs recombine and there is no noticeable effect on the IC's behavior. However, under specific conditions, some undesired effects may appear: the so-called Single Event Effects (SEE).

A SEE happens when the charge carriers (i.e. electrons and holes) created by the laser beam are drifted in opposite directions by the electrical field found in the PN-junctions of CMOS transistors instead of recombining. As a consequence a transient current (i.e. moving charge carriers) is generated through the struck junction. After the creation of the electronhole pairs along the laser beam, two phenomena lead to the creation of the transient current: the prompt charge collection, or funneling, and the diffusion. The first phenomenon stretches the depletion region (where it exists a strong electric field) along the laser beam, within a few picoseconds the charges nearby are collected giving a current peak. Then, in a second time, the remaining charges are collected in a longer diffusing scheme: the diffusion [START_REF] Habing | The use of lasers to simulate radiation-induced transients in semiconductor devices and circuits[END_REF]. When such a transient current is induced in the logic of a memory cell it may cause the flipping of its logical state: a so-called SEU.

A. Description of the studied SRAM cell

The cell studied in this section of the paper is a configuration SRAM (CSRAM) made of five transistors (see fig. 1) similar to those used to store the configuration bitstream in programmable devices (FPGA). The SRAM is embedded in a test chip designed in a CMOS 0.25 µm process. However, we will rather use the term SRAM in this paper, since its main results may be generalized to 6 transistors SRAM cells. When the selection signal (SEL) is at a high state (SEL="1") the SRAM cell is in write mode: DATA_IN is applied to node Q through transistor MN3. This value is then latched by the two coupled inverters made from MP1, MN1, MP2 and MN2. In the following the sensitivity of the cell to PLS is studied according the SRAM cell schematic and its bias conditions. A sensitive node of a CMOS gate is defined as a node in a circuit whose electrical potential can be modified by internal injection or collection of electrical charges.

B. Study of the SEU sensitivity of the SRAM cell

In this subsection, the SRAM SEU sensitivity is studied from a theoretical point of view (considering its schematic and its state) in its hold state (i.e. its access transistor MN3 is OFF).We refer to state one (respectively state zero) when the node DATA_OUT is in high state (resp. low state). The sensitivity of the cell can be investigated by considering which PN junctions are the most reverse biased in function of the SRAM state. Indeed, these reverse biased PN junctions are the place where the electrical field is strong enough to generate a transient current likely to induce an SEU. Two cases are considered: states "1" and "0". The red arrows in figures 2 and 3 also give the directions of the induced photocurrents between the transistors drain and bulk or source and bulk. The thick arrows represent strong photocurrents, the thin arrows smaller ones. In state "1", depicted in fig. 2, the two most sensitive areas to laser illumination are the drain junctions of MN1 and MP2. In state "0", depicted in fig. 3, the intensities of the induced photocurrents are inverted in comparison with the state "1": the two most sensitive areas are the drains of MP1 and MN2/MN3 (note that MN2 and MN3 share a common drain diffusion, see the SRAM's layout in fig. 5). Therefore four sensitive areas are expected: two in state "0" and two others in state "1".

III. MEASUREMENT AND ELECTRICAL MODDELING OF THE SEU SENSITIVITY OF AN SRAM CELL

A. Measurement

The SRAM test series were performed with a pulsed laser equipment (at 1064 nm wavelength, 0.16 µJ energy, and 50 ns pulse duration). The laser beam's spot diameter was set to 1 µm. Injection experiments were performed by exposing the front side of the SRAM cell. This cell was designed with a minimum of metallization, in order to be able to perform front side and backside laser injection. The absorption of the silicon at 1064 nm wavelength is weak. The carriers are also deeply created and can drift quite for approximately 10 or more µm. These two phenomena have probably as effect to increase the surface of the sensitive areas in comparison with cosmic rays, which are more point sources in comparison with the diameter of our laser spot. However, the SEU sensitivity mapping we have obtained in these conditions is drawn in figure 4. Dark red color is used to depict SEU sensitivity in state "0", and blue color to depict SEU sensitivity in state "1". As the laser spot is targeting a red case on this map and provided the SRAM is in state "0" an SEU occurs: the cell flips to state "1". Respectively, as the laser spot is targeting a blue case on this map and provided the SRAM is in state "1" an SEU occurs too: the cell flips to state "0". Only three sensitive areas were experimentally revealed (see fig. 4), despite four were theoritically expected. An explanation of the discrepancy between theory and experiment lies in the fact that the previous theoritical analysis was made according the assumption that a laser shot only affect one sensitive area. However, this assumption does not hold experimentally because PLS may induce photocurrents in several PN junctions depending on the target's topology and on the location and size of the laser spot. Indeed, the laser beam's effect area has a Gaussian like profile and its effect may extend beyond the spot size.

Moreover, the trend in continuously reducing the technology size makes it very difficult to illuminate only one junction without creating effects on the others. This is the reason why it is needed to take into account the topology and size of the cell and the effect of the laser on several junctions at the same time. The layout of the studied SRAM cell is depicted on figure 5. Its size is 4x9 µm. Note that transistors MN2 and MN3 have a shared drain diffusion (which is close to the drain of MP2). We made the hypothesis that this layout has the effect to mask the sensitivity of MP2's drain (which is the missing sensitivity area in fig. 4). Figure 6 illustrates this masking effect which originates from the photocurrent generated by the drain shared between MN2 and MN3 (blue arrows) that counterbalances the effect of the photocurrent induced in the Drain/Nwell junction of MP2 (crossed arrow). This effect lies in the proximity between the drains of MP2 and MN2/MN3, and also in their sizing.

Therefore with a topological approach there is only one sensitive area in state "1" which is the drain/Psubstrate junction of MN1. There is no such similar counterbalancing effect in state "0". It is then proposed to illustrate thanks to electrical modeling the effect of the cell's topology which gives only three sensitive areas, while four are expected in theory.

B. Electrical modeling

In this section we present an electrical model of the SRAM cell under Photoelectrical Laser Stimulation. In this model we consider that the laser power used in measurement and electrical simulations are not capable to trig the different parasitical bipolar transistors present in this cell [START_REF] Wang | Single event upset: An embedded tutorial[END_REF].

For every PN junction, a sub circuit which contains a specific controlled voltage current source is added to the netlist of the SRAM cell (See Fig. 7) to model the laserinduced photocurrents. These models were built and validated from actual measurements on transistors. This research work is reported in [START_REF] Sarafianos | Electrical modeling of the photoelectric effect induced by a pulsed laser applied to a PMOS transistor[END_REF][START_REF] Llido | Characterization and TCAD Simulation of 90nm Technology NMOS Transistor Under Continuous Photoelectric Laser Stimulation for Failure Analysis Improvement[END_REF]. The current amplitude of the current source of each PN junction is defined thanks to equations presented on Table I. I ph is the photocurrent generated during the laser pulse expressed in Ampere. P laser is the laser power expressed in Watt. The function α gauss expressed in % is a function which defines the spatial dependency of the photocurrent (d is the distance, expressed in µm, between the laser spot and the PN junction of interest).

In this layout there are some junctions which are shared (sources of MP1 and MP2, sources of MN1 and MN2, and drains of MN2 and MN3). It is the reason why only eight sub circuits are connected to the SRAM netlist. Results obtained in electrical simulations are more qualitative than quantitative. Indeed, our electrical modeling could reveal the number of sensitive areas ant a trend of their surfaces.

C. Measurement versus electrical simulation

In this section, cartographies made from our electrical model are presented. We used a 0.5 µm step to draw the SEU sensitivity map depicted in figure 8. The simulator was used in order to take into account the topology of the target relatively to the location of the laser beam. SEU sensitivity in state "0" is drawn in red, whereas SEU sensitivity in state "1" is drawn in blue. These simulation results are well correlated to the measurement results (cf. figure 4): the sensitivity of MP2's drain in state "1" is masked. This provides a high confidence in the validity of our modeling of PLS at transistor level and of its use to perform SEU sensitivity studies. The next section reports the use of this methodology to analyze and improve the SEU sensitivity of a 6T SRAM cell.

IV. SRAM ROBUSTNESS IMPROVEMENT

The first part of this section describes attempts to decrease the number of sensitive areas by using the previously described masking effect. The second part reports the use of triple well (deep Nwell) implant [START_REF] Puchner | Advanced SEU engineering using a triple well architecture [CMOS SRAM[END_REF] to obtain a further decrease of SEU sensitivity. The study was done now on a standard 6T SRAM cell designed in CMOS 90 nm technology.

A. Decreasing the number of SEU sensitive areas

The schematic of the 6T SRAM cell is presented in fig. 9. In state "0" (defined for Q in low state), a masking effect of MP2's SEU sensitivity (similar to that described in the previous section) may be obtained by placing the shared drain of the NMOS transistors MN2 and MN3 in its closeness. Likewise, in state "1" (defined for Q in high state), the SEU sensitivity of MP1's drain may be masked by placing the shared drain of MN1 and MN4 close to it. The previous placing constraints were used to draw the layout of the 6T SRAM cell as depicted in figure 10 (we have also followed the guidelines given in [START_REF] Ishida | A novel 6T-SRAM cell technology designed with rectangular patterns scalable beyound 0.18µm generation and desirable for ultra high speed operation[END_REF] for the drawing of SRAM layout). The corresponding SEU sensitivity map drawn from electrical modeling of PLS and simulation is given in figure 11. This layout solution of the 6T SRAM cell has removed the two sensitive areas of MP1 and MP2 (one more than for the 5T SRAM cell thank to the additional access transistor MN4). However there are always two remaining sensitive areas which are the shared drains of NMOS transistors MN1/MN4 and MN2/MN3. In the following a solution is proposed to decrease the threshold of these sensitive areas.

B. SRAM cell using triple well implant 1) Triple well effect on NMOS transistor a) Measurement

Another approach in order to increase the robustness of the SRAM cell under PLS is to use triple well implant (i.e. a deep Nwell implant) under NMOS transistors. This implant modifies strongly the collection charge mechanism which occurs on an NMOS transistor. In these conditions the most important photocurrents are generated by the deep Nwell/Psubstrate and the deep Nwell/Pwell junctions, which have for effect to decrease the photocurrent generated by the two N+/Pwell junctions. Moreover, but in small proportion, this implant creates an optical interface between the deep Nwell and the Psubstrate: a reflection phenomenon takes place. As a result, due to these two effects, the induced photocurrents at the NMOS transistors' N+/Pwell junctions should be reduced. In order to study the influence of the deep Nwell implant on an NMOS transistor we have compared the photocurrents generated on an NMOS transistor, in OFF state, with and without deep Nwell. The biasing conditions of the NMOS deep Nwell transistors are the followings: the source, the gate and the triple well are biased at 1.2V, and the Psubstrate, the Pwell and the drain are grounded.

Figure 12 presents the photocurrent measured on NMOS transistors with and without a deep Nwell implant. Results of the photocurrent generation between an N+/Psubstrate junction and an N+/Pwell junction are presented in table II. As seen in measurement, the deep Nwell implant decreases the photocurrent generation on the drain of the NMOS transistor. 2) New layout proposal of the 6T SRAM cell using triple well implant A triple well (deep Nwell) was added to the layout depicted in figure 10. The same kind of electrical simulation for the purpose of drawing its SEU sensitivity cartography was then ran. The model we used took into account the effect of the triple well on PLS (the model was tuned thanks to the actual measurements reported previously).

At the same simulated laser power which was used in order to draw the electrical cartography presented in figure 11, all the sensitive areas of the cell have disappeared. An increase by a factor of 4 of the simulated laser power is needed to make it reappear.

V. CONCLUSION

An analysis of the laser induced sensitive nodes of an SRAM cell was firstly reported in this paper. The preliminary conclusion of this theoretical analyze was that there are two sensitive areas of the SRAM cell which modify the output from "0" to "1" and two others for an output state modification from "1" to "0". However this conclusion was not verified in practice. The topology of the cell has a strong impact on the sensitivity of a CMOS gate. A masking effect occurred: only one area which modifies the output node from "1" to "0" was revealed. This phenomenon revealed by measurement cartographies was also confirmed by proper electrical simulations that take into account the topology of the target and the induction of photocurrents in several sensitive nodes. The validity of the approach was assessed by the very good correlation obtained between electrical simulations (based on SPICE language) and measurements. This model permits us to propose and to validate (on simulation basis) a new layout of a standard 6T SRAM cell more robust against SEU. The SEU robustness of PMOS transistors is obtained thanks to the masking effect provided by the photocurrents induced in the NMOS' sensitive junctions. We also used a deep Nwell implant to increase the SEU robustness of the SRAM's NMOS. As a result the SEU sensitivity threshold of the SRAM was significantly raised. The main interest in increasing the robustness of CMOS gates is that it will be necessary to increase the laser power in order to obtain the same effects. This laser power increase could be more easily detected by SEU sensors which could be embedded on a chip [START_REF] Puchner | Advanced SEU engineering using a triple well architecture [CMOS SRAM[END_REF]. Moreover, this sensitivity improvement of the cell could permit to decrease the number of these sensors on the die too. As a conclusion we can say that the electrical model presented in this paper could be an interesting tool for designer who wants to build more robust CMOS gates against SEU effects or against fault injection in the security field.

Figure 1 .

 1 Figure 1. Schematic of the CSRAM cell.

Figure 2 .

 2 Figure 2. Schematic of the SRAM cell laser sensitivity in state "1".

Figure 3 .

 3 Figure 3. Schematic of the SRAM cell laser sensitivity in state "0".

Figure 4 .

 4 Figure 4. Experimental SEU sensitivity map of the SRAM cell at a laser energy equal to 0.16 µJ.

Figure 5 .

 5 Figure 5. Layout of the SRAM cell.

Figure 6 .

 6 Figure 6. Schematic of the SRAM cell laser sensitivity in state "1", with a layout approach.

Figure 7 .

 7 Figure 7. Electrical model of the SRAM cell under PLS.

Figure 8 .

 8 Figure 8. Simulation-based SEU cartography of the SRAM cell.

Figure 9 .

 9 Figure 9. Schematic of the standard 6T SRAM cell.

Figure 10 .

 10 Figure 10. New layout of the more robust SRAM cell.

Figure 11 .

 11 Figure 11. SEU sensitivity map of the 6T SRAM cell.

Figure 12 .

 12 Figure 12. Photocurrent generated on an NMOS transistor with (left) and without deep Nwell (right). The photocurrents measured on the drain (ID) and the source (IS) of the NMOS transistor with deep Nwell are negligeable in comparison with the photocurrents generated by the deep Nwell/Psubstrate junction (IPW and IDeep Nw). This result is confirmed by TCAD simulations. The triple well implant (which also creates a strong photocurent generation between the deep Nwell and the Psubstrate) leads to a decrease by a factor of 10 of the photocurrent induced in and pushed through the drain of the NMOS. The latter photocurrent is the one that may cause a SEU. b) TCAD simulation In order to confirm the trend seen in measurement, TCAD simulations were ran. Two TCAD structures were built: a standard NMOS transistor (fig. 13a), and a NMOS with deep Nwell transistor (fig 13b).

Figure 13 .

 13 Figure 13. TCAD cuts with (a) and without deep Nwell implant (b).

TABLE I .

 I EQUATIONS WITH COEFFICIENTS WHICH CONTROL THE PHOTOCURRENT GENERATED BY THE PN JUNCTIONS OF THE SRAM CELL DURING THE LASER PULSE.

						I	ph	(	a	V	b )	S	gaus s	las er V	_	tr ig
	a	p	P laser	2	q		P	laser	r	b	s	laser P
	Coefficient		N+/Psub		P+/Nwell	Nwell/Psub
	p				4E -9					9E -5	6E -11
	q				-5E -7				2E -4	9E -9
	r				9E -6					-5E -6	1E -7
	s				4E -6					1.2E -3	6E -8
					gaus s	(	d	)			exp	1 c 2 d	exp	c d	2 2	w

TABLE II .

 II COMPARISON OF THE PHOTOCURRENT GENERATION BETWEEN AN NMOS TRANSISTORI WITH AND WITHOUT DEEP NWELL.

		IDNMOS (A)	IPsub (A)
	STD	3.1E-12	1.08E-10
	deep Nwell	1.1E-12	3.33E-9


Amir-Pasha Mirbaha

Jean-Max Dutertre
email: dutertre@emse.frassia.tria@cea.fr

Assia Tria

Differential Analysis of Round-Reduced AES Faulty Ciphertexts

This paper describes new Round Reduction analysis attacks on an Advanced Encryption Standard (AES)i m p l e m e ntation by laser fault injection. The previous round reduction attacks require both of spatial and temporal accuracies in order to execute only one, two or nine rounds. We present new attacks by more flexible fault injection conditions. Our experimentsa r e carried out on an 8-bit microcontroller which embeds a software AES with pre-calculated round keys. Faults are injected either into the round counter itself or into the reference of its total round number. The attacks may result to the use of a faulty round key at the last one or two executed rounds. The cryptanalysis of the obtained round-reduced faulty ciphertexts resorts tot h e differentiation techniques used by Differential Fault Analysis.

I. INTRODUCTION

Fault attacks consist in using hardware malfunction to infer secrets from the target's faulty behavior or outputs. These active attacks can be performed in different physical manners as reported by [START_REF] Barenghi | Fault injection attacks on cryptographic devices: Theory, practice, and countermeasures[END_REF]. Modifying the behavior of a device's software refers to algorithm modification.T hi sc l a s sofa c t i v e attacks may consist in replacing instructions executed by a microcontroller [START_REF] Balasch | An in-depth and blackbox characterization of the effects of clock glitches on 8-bit MCUs[END_REF] to circumvent its security features, ori n weakening the strength of an encryption algorithm by reducing the number of its rounds [START_REF] Choukri | Round reduction using faults[END_REF], [START_REF] Park | Differentialf a u l t analysis for round-reduced AES by fault injection[END_REF], [START_REF] Bae | Differential fault analysis on AES by round reduction[END_REF] (i.e. Round Reduction Analysis or RRA). [START_REF] Dutertre | Fault round modification analysis of the Advanced encryption standard[END_REF] proposed an extension of the latter analysis to the Round Modification Analysis (RMA). The RMA is based on decreasing or increasing the number of iterative rounds or on altering them to retrieve information about the secret key.

In this paper, we focus on any feasible round reduction analysis of an AES implementation. Altering the roundcontrolling stored values by laser fault injection requiresaccuracy on spatial and on temporal positions. Suppose the previous round reduction attacks may not be achieved by an opponent, due to the difficulty of injecting the required fault value. Therefore, is there any other threat by round reduction attacks? We examine these issues in our study. Our experiments are done on an 8-bit microcontroller which embeds a software AES with pre-calculated round keys. Round-reduced ciphertexts are obtained by laser fault injection either into the round counter itself or into the reference of its total round number. In our experiments by faulting the round counter, the last 1 or 2 executed rounds (of the shortened encryptions) is/are xored with faulty round keys. We present a few instances (including two generalized attacks) with their corresponding cryptanalysis. Remarkably, the cryptanalysis of the obtained round-reduced faulty ciphertexts resorts to the differentiation techniques used by Differential Fault Analysis (DFA). This article is organized as follows: Some reminders on the AES and a review of the state-of-the-art of RRA attacks are given in section II. The theory of RRA by laser fault injection is described in section III. The practical basics of our attacks and the experimental setup are presented in section IV. Finally, our findings are summarized in the concluding section V with some perspectives.

II. ROUND REDUCTION ANALYSIS

Many symmetric cryptographic algorithms are based on the repetition of identical sequences of transformations, called rounds.Asignificantpartofthesealgorithms'strengthagainst cryptanalysis is based on their repeated rounds. Any decrease in the number of rounds is likely to reduce their security level [START_REF] Anderson | Low cost attacks on tamper resistant devices[END_REF]. For instance, suppose an attack that induces a jump to the end of the algorithm after the execution of only a few instructions (or after one or two rounds). As a result, much of the encryption process is skipped and the final ciphertext is the product of few algorithm operations that may easily reveal the key by light cryptanalysis operations and lower computational complexity. In the following, we first remind the AES'b a s i c sa n di n t r o d u c eo u rs o f t w a r ei m p l e m e n t a t i o n before going deeper into the state-of-the-art of round reduction analysis.

A. The Advanced Encryption Standard

1) The AES-128: AES is a Substitution-Permutation Network (SPN)blockcipher [START_REF]Announcing the Advanced Encryption Standard (AES)[END_REF].AES processes a 128-bit plaintext and a key of 128, 192 or 256 bits long to produce a 128-bit ciphertext, by executing 10, 12 or 14 rounds, respectively. For the sake of simplicity, we will consider hereafter only the 128bit AES version: denoted by AES or by AES-128. The algorithm has two separated processes: One for the KeyExpansion to derive round keys from the secret key and another one for the DataEncryption. AES-128 performs encryption in 10 rounds, after a short initial round. Each round has its own round key which is used in one of the transformation steps. Hereafter, we use the "K"p r e fi xp l u st h er o u n dn u m b e rt o refer to a round key (e.g. "K 9 "f o rt h e9 th round key). Solely use of "K"r e f e r st ot h es e c r e tk e y( K=K 0 ).

To encrypt a plaintext, denoted by M ,t h ee n c r y p t i o n process considers its 16 bytes as a matrix of 4 × 4 bytes.

Each round of the algorithm, except the initial and the final ones, includes 4 transformations: First, the value of each matrix element, i.e. one byte value, is exchanged with the corresponding value in a substitution table (SubBytes or SB). Second, a rotational operation on the matrix rows is executed (ShiftRows or SR). Third, a linear transformation is applied to each element (MixColumns or MC). MC operates columnby-column and may be written as a matrix multiplication (which coefficients are 01, 02, or 03) in GF (2 8 ).F o r t h ,a bitwise xor operation is performed between the value of each element and the corresponding byte of the round key (AddRoundKey or ARK). Before the 1 st round, an ARK is applied to M and K (i.e. Round 0 or initial round). The MC transformation is omitted in the final round. If the algorithmis implemented with iterative rounds, a round counter, hereafter RC,countstherounds.W eusealsoR max as the reference for total rounds. In a correct typical execution of AES-128, R max is equal 10 and RC is counted from 0 or 1, to 10.

Notation: In the following, we use the "R"p r e fi xp l u s the round number to refer to the transformations involved in an AES encryption. Hence,

R 0 -R 1 -R 2 -R 3 -R 4 -R 5 -R 6 -R 7 - R 8 -R 9 -R 10 ,
o rs h o r t l yR 0 ...R 10 ,r e p r e s e n t st h er o u n d so f ac o m p l e t e( i.e. unmodified) AES. R 1 , R 2 ,. . .a n dR 9 are used to represent unchanged middle rounds, including all the four transformations. R 0 and R 10 represent the unchanged initial and final rounds of an AES-128, including only ARK and ARK•SR•SB transformations, respectively. Besides, we use R m=i to express that, due to a fault, a round composed of the ARK•MC•SR•SB transformations (where " m "s t a n d sf o r middle round) is using an incorrect round key of index i. R f =j has the same meaning for a round without the MC transformation (" f "s t a n d sf o rfinal round). In addition, "M i " represents the AES intermediate state at the end of round i.

2) Software implementations of the AES-128: In this work we consider a software implementation of the AES-128, shown in algorithm 1. This implementation is embedded in an 8-bit microcontroller (see section IV). Algorithm 1 is similar to the proposed implementation in the official NIST publication for AES [START_REF]Announcing the Advanced Encryption Standard (AES)[END_REF]. The only difference lies in the last ARK transformation which uses RC value, as the final round key index, instead of the total round number reference (R max ).

Algorithm 1 Software implementation of the AES algorithm with precalculated round keys.

C ← M C ← C ⊕ K 0 RC =1 while (RC < Rmax) do C ← SB(C) C ← SR(C) C ← MC(C) C ← C ⊕ K RC RC ← RC +1 end while C ← SB(C) C ← SR(C) C ← C ⊕ K RC
Where C is an intermediate variable used to memorize the AES state throughout the encryption process. The round counter, RC,i su s e da sa ni n d e xt os e l e c tt h er o u n dk e y processed during every ARK transformation (except the initial one). Moreover, RC is compared to the total round number reference, R max ,t oe n dt h ei t e r a t i v el o o pp r e c e d i n gt h efi n a l round. R max is not a constant number to permit the use of different values [START_REF] Skorobogatov | Optical fault induction attacks[END_REF][START_REF] Darracq | Single-event sensitivity of a single SRAM cell[END_REF], or 14 rounds).

Note that the initial and final rounds (R 0 and R 10 )a r e implemented outside the iterative loop. Hence, even with complete removal of the middle rounds, the initial and the final rounds will still be executed. Moreover, if for any reason RC takes a value greater than 10, the algorithm will use the 16 bytes stored in the memory that correspond to an address calculated by the same formula for K RC .C o n s e q u e n t l y ,a block of unknown and invalid values will be mapped in the memory and processed by the next ARK transformation.

B. Round Reduction Analysis:S t a t e -o f -t h e -A r t 1) H. Choukri and M. Tunstall's attack:

The first practical round reduction analysis experiment was introduced by H. Choukri and M. Tunstall in 2005. [START_REF] Choukri | Round reduction using faults[END_REF] shows that a transient glitch on the power supply of a microcontroller may change the round counter (RC)v alueofaniterati v eAES cipher. They succeeded in changing the round counter of an AES program at the beginning of algorithm execution to its final value. Hence, the ciphertext was the product of a single round (plus the initial round): R 0 -R m (according to the notation introduced in II-A). They also introduced a cryptanalysis technique that makes it possible to retrieve the secret key: eq. 1 is obtained by xoring two faulty ciphertexts outputs: D a and D b (M a and M b ,being the corresponding plaintexts):

MC -1 (D a ⊕ D b )=SB(M a ⊕ K) ⊕ SB(M b ⊕ K) (1)
For every key byte, eq. 1 yields two different hypotheses. Finally, an exhaustive search over the 2 16 possible keys is made to retrieve the secret key. Note that this cryptanalysis does not require the knowledge of the correct encryptions of M a and M b .

2) Y. Monnet et al.'s attack:

Y. M o n n e t e t a l . r e p o r t e d in [START_REF] Monnet | Case study of a fault attack on asynchronous DES crypto-processors[END_REF] another round reduction attack on two asynchronous cryptoprocessors running the Data Encryption Standard (DES) algorithm. The attack was done by laser fault injection. A pool of over 50 reproducible round-corrupted results was obtained. Then, the key was retrieved by differential analysis of faulty encryptions pairs whose round execution sequences have a difference of one round.

3) J.H. Park et al.'s attack:

This attack, reported in [START_REF] Park | Differentialf a u l t analysis for round-reduced AES by fault injection[END_REF], is alaserfaultinjectionintoanATmega128 8-bit microcontroller with an embedded AES.T heAES implementation is compliant with the algorithm structure proposed in [START_REF]Announcing the Advanced Encryption Standard (AES)[END_REF]. They reported a successful attack that consists in jumping from R 1 to R 10 .The faulty execution path is R 0 -R 1 -R 10 .T h e r e f o r e ,a na d d i t i o n a l round is executed in comparison to [START_REF] Choukri | Round reduction using faults[END_REF] that included only R 0 -R m .T h ea s s o c i a t e dc r y p t a n a l y s i sr e q u i r e sd a t af r o mt e n different reduced encryptions. Calculations involved foursteps of exhaustive search of 2 40 , 2 32 , 2 24 ,and2 32 steps respectively. This has taken approximately ten hours on a PC. [START_REF] Bae | Differential fault analysis on AES by round reduction[END_REF] a successful attack by eliminating the AES penultimate round. The encryption included R 0 ...R 8 -R 10 .T h ea t t a c kw a s performed on the experimental setup introduced in [START_REF] Park | Differentialf a u l t analysis for round-reduced AES by fault injection[END_REF]. The key was revealed using two pairs of corresponding faulty and correct ciphertexts and an exhaustive search between the two candidates for each key byte. This technique is similar to the reported one by H. Choukri and M. Tunstall in [START_REF] Choukri | Round reduction using faults[END_REF]. The difference is in using ciphertexts instead of plaintexts. Thus, the cryptanalysis needs finding a key between 2 16 candidates.

4) K.S. Bae et al.'s attack: K.S. Bae et al. presented in

III. THEORY OF OUR ROUND REDUCTION ANALYSIS

Previous round reduction attacks on AES are based on the analysis of a round-reduced encryption in one, two or nine rounds. Their exploitation requires a differential analysis referring either to the plaintexts or to the correct ciphertexts. Round-reduced ciphertext in the previous attacks did not contain any faulty round key value in their sequences.

In this paper, we study all the feasible attacks by reducing the number of executed rounds. We examine if an AES implementation can be considered safe while the opponent cannot reduce the rounds to one, two or nine. Indeed, is there still a threat if the opponent may reduce the total rounds to between 3 and 8 rounds? Our aim is to identify all the round reduction threats via round controlling operations on an AES implementation.

A. RRA Scenarios

For reducing the number of total rounds in algorithm 1 by fault injection, two scenarios are conceivable: changingthe R max or altering the RC value. We assume in this paper a bit-flip fault model. We show the injected fault by "e". Consequently, e is always single-byte and xored either with R max or with RC.F e wm o r ep o t e n t i a ls c e n a r i o se x i s tb yfi n d i n gs o m e external targets; for instance, the chip's program counter. In this article, we cannot include all the potential targets for algorithm 1. Thus, we focus only on the fault attacks into R max and into RC values which are more common for an AES implementation similar to the NIST proposed version [START_REF]Announcing the Advanced Encryption Standard (AES)[END_REF].

1) Scenario I: Attacks on the round number reference:

Suppose a fault injection into R max during AES execution. R max is accessed only once per round, at the beginning of the while loop in algorithm 1. Depending on the resulting R max ⊕ e value and on the RC value during the attack, an increase or a decrease may be induced in the total round number:

Case a: If R max ⊕ e<R max and RC < R max -1 ⇒ Round reduction or suppression of one or several rounds to Max{R max ⊕ e, RC+1} rounds. For instance: if e =8 is injected, when RC =5,thenR max ⊕e =2 and the AES execution will be: R 0 ...R 5 -R f =6 .T h e r e f o r e ,a sR max ⊕ e< RC,t h e following round after the attack will be executed as the final round and any remaining round will be suppressed.

Case b: If R max ⊕ e> R max and RC < R max ⇒
Round addition or execution of additional rounds.Forinstance: if e =4 is injected, when RC < 10, then R max ⊕ e =14 and the AES execution will be: R 0

...R 9 -R m=10 -R m=11 -R m=12 - R m=13 -R f =14 .
T h e1 0 th round and the additional rounds 11 to 13 will be executed similar to middle rounds (i.e. including MC step). Then, the final round is executed as R 14 .W i t hp r ecalculated key option, and in absence of countermeasures, the rounds above R 10 will use invalid round key values K 11 ...K 14 in their ARK transformation. The total number of executed rounds will be incremented to 14.

Faulting R max when RC < R max -1 results always in round reduction or addition. A fault in R max cannot cause a redundant execution of any round.

2) Scenario II: Attacks on the round counter value:

The second scenario is like the attacks reported in [START_REF] Choukri | Round reduction using faults[END_REF], [START_REF] Park | Differentialf a u l t analysis for round-reduced AES by fault injection[END_REF] and [START_REF] Bae | Differential fault analysis on AES by round reduction[END_REF], by targeting the round counter, RC,duringtheAES execution. The attack alters the index of the current executing round. In an algorithm similar to algorithm 1, RC is accessed two times during each middle and final round execution. Thus, depending on the instant of fault injection, various changes can occur to the encryption process: An RC change before ARK alters the index of the executing round and thus, the index of the mapped round key. Besides, RC modification during ARK has not any immediate effect until the next RC incrementation in the while loop; i.e. beginning of the following round.

An RC variation often leads to a change in the number of total executing rounds, by adding, by suppressing or even by repetitively executing of several rounds: Case a: If RC ⊕ e<R C⇒Round addition or repetitive execution of several rounds.F orinstance:ifRC =7 and e =2then RC ⊕ e =5.I ft h ef a u l ti si n j e c t e db e f o r et h e ARK, AES execution will be: R 0 ...R 5 -R 6 -R 5 -R 6 -R 7 ...R 10 . Thus, R 5 and R 6 will be executed twice and the total number of executed rounds will be incremented to 12. An attack during the ARK affects the encryption on the following round. In this example, R 6 and R 7 (instead of R 5 and R 6 )w i l lb e repeated and AES execution will become: R 0

...R 5 -R 6 -R 7 - R 6 -R 7 ...R 10 .
Case b: If RC ⊕ e>R Cwhen RC < R max -1 ⇒Round reduction.F o re x a m p l e :i fRC =4and e =2 (before ARK)t he nRC ⊕ e =6and the faulty AES execution will be :R 0 ...R 3 -R 6 ...R 10 .Therefore,R 4 -R 5 will be skipped and the total number of executed rounds will be reduced to 8.

Case c:

If RC ⊕ e>R Cwhen RC = R max -1 ⇒Round alteration:t h et o t a ln u m b e ro fr o u n d sr e m a i n s unchanged, but the attack has effects on the following ARK transformations. For instance: if RC =9and e =2is injected before ARK,t h e nRC ⊕ e =1 1and AES execution will be: R 0 ...R 8 -R m=11 -R f =12 .C o n s e q u e n t l y ,t h et o t a ln u m b e ro f executed rounds will remain 10, but the penultimate round and the final round will use invalid round keys values (K ′ 11 and K ′ 12 )d u r i n gt h e i rARK transformations. When the round keys are pre-calculated, K ′ 11 and K ′ 12 are mapped to the memory contents which exclude any information about K.

As it is shown, contrary to the attacks on R max ,f a u l t i n g RC may cause redundant execution of one or several rounds. In this paper, we focus only on the round reduction attacks.

B. Round Reduction Experiments

Now, we examine all the round reduction attack possibilities by the two scenarios on our AES implementation, using the experimental setup described in section IV-B.

1) Round Reduction to the Initial Round:

Ar o u n dr eduction attack which reduces AES encryption to only the initial round transformation, is theoretically, the most optimal attack. Because, the round-reduced ciphertext (shown as D) is produced with the minimal transformation on the plaintext (shown as M )c o n t a i n i n ga l lt h ek e yi n f o r m a t i o n :

D = M ⊕ K (2)
Thus, the attack analysis requires the knowledge of only one pair of a round-reduced ciphertext and its corresponding plaintext. The key is revealed by an xor between them. This attack seems to be infeasible on an AES implementation similar to algorithm 1.

2) Round Reduction to One Round: Round reduction to only one round (after the initial round) is maybe the optimal realistic attack on several AES implementations. Because, the encryption involves only one round transformations. Thus, the results can be exploited very fast. The analysis requires two pairs of corresponding round-reduced ciphertext and plaintext.

The first realization of this attack is reported by H. Choukri and M. Tunstall in [START_REF] Choukri | Round reduction using faults[END_REF]. We refer the readers to their article for more details about their technique. This attack seems to be feasible, only by targeting R max on an AES implementation, similar to algorithm 1.

3) Round Reduction to Two Rounds (Experiment 1):

A round reduction to two rounds (after the initial round) is a realistic attack (and maybe the optimal one) on the NIST proposed implementation. This attack is exploitable in a feasible calculation time. J.H. Park et al. reported a successful realization of this attack in [START_REF] Park | Differentialf a u l t analysis for round-reduced AES by fault injection[END_REF]. Their technique requires 10 pairs of corresponding round-reduced ciphertext and plaintext. Their analysis takes 10 hours on a PC.H e r e ,w er e p o r to u r round reduction attacks to two rounds as our experiment 1. Our technique has more performance in comparison to [START_REF] Park | Differentialf a u l t analysis for round-reduced AES by fault injection[END_REF]. This experiment is done by faulting the RC during the first round in order to increment it to 9 or a higher value. This was achieved with a single-bit or single-byte fault equal to 0x08 or any other value between 0x0a and 0xff.T h u s ,RC ⊕ e became bigger than 8 and the next round was performed as the final round. Therefore, the encryption sequence of rounds was: R 0 -R m -R f with faulty key values for the second and the final rounds. The cryptanalysis of this attack scheme requires at least three pairs of plaintexts and corresponding faulty ciphertexts (M a ,D a ), (M b ,D b )a n d( M c ,D c ). Considering a plaintext M a ,t h ec o r r e s p o n d i n gf a u l t yc i p h e r t e x ti sg i v e nb y eq. 3:

D a = SR • SB[MC • SR • SB(M a ⊕ K) ⊕ K ′ x ] ⊕ K ′ y (3)
In eq. 3, K ′ x and K ′ y are unknown constant values corresponding to invalid round keys, for the rounds R m and R f , respectively. By xoring eq. 3 and the similar equation for D b , we discard K ′ y values and we obtain eq. 4. We repeat the xoring for eq. 3 and for D c equation.

D a ⊕ D b = SR • SB[MC • SR • SB(M a ⊕ K) ⊕ K ′ x ] ⊕SR • SB[MC • SR • SB(M b ⊕ K) ⊕ K ′ x ] (4)
Nevertheless, K ′ x remained in eq. 4 and in corresponding equation for D a ⊕D c .Thesolutionforresolvingthemconsists in creating hypotheses on both of K and K ′

x where M a , M b , M c , D a , D b ,a n dD c are known values. Therefore, a brute-force search of (2 8 ) 4 × 2 8 × 4 = 2 42 values is necessary for each column of SR(K). The search results to only 1, 2 or 3 hypotheses for each corresponding column of SR(K) and K ′

x .A tt h en e x ts t e p ,e a c hc o m b i n a t i o no fk e yc o l u m n hypotheses can be examined by using one of the pairs of corresponding plaintext and correct ciphertext; e.g. M a and C a .T h ee n t i r ek e yi sd i s c o v e r e da f t e rab r u t e -f o r c es e a r c ho f 2 42 × 4 = 2 44 values. With a PC running with an Intel Core i5-2410M microprocessor at 2.30GHz (hereafter our PC), the full attack exploitation takes about 3 hours and 50 minutes. In our experiment, except the initial round key (i.e. K), any round key (i.e. K m or K 1 and also K f or K 10 )m a ybei ne xi s t e ntor fully faulty. However, our method is about 2.5 times faster and needs only 3 encryptions, instead of 10 required encryptions in Park et al.'s technique.

4) Round Reduction to Three Rounds:

Reducing AES execution to three rounds (after the initial round) is realistic in both of our implementations. However, we could not find any differential technique in a relatively calculation time (<∼ 10 hours).

5) Differential One-Round Analysis of the Round-Reduced

Encryptions (Experiment 2): Suppose an attack that changes the number of executed rounds during two consecutive encryption of a unique plaintext. If the two obtained roundreduced encryptions differ in only one round, the corresponding plaintext or correct ciphertext are no longer required for the exploitation. A differential analysis between the two roundreduced encryptions may reveal the key.

We assume the first attack reduces the number of executed rounds from R max to i +1,asalesservalue.Then,thesecond attack reduces a new encryption of the same plaintext to i +2. The sequences of round-reduced encryptions are:

1 st encryption : R 0 ...R i -R f =i+1 2 nd encryption : R 0 ...R i -R i+1 -R f =i+2
Please note that i is the index of the last executed middle round in the first round-reduced encryption. A differential cryptanalysis over only the framed part of the round-reduced encryptions may reveal the key. We denote two consecutive round-reduced encryptions for a given plaintext M a by D a 1 and D a 2 .W es h o wt h e mb ye q .5 aa n de q .5 b :

D a 1 = SR • SB(M a i ) ⊕ K i+1 (5a) D a 2 = SR • SB(M a i+1 ) ⊕ K i+2 (5b)
K i+1 and K i+2 are unknown values corresponding to valid round keys for the rounds R i+1 and R i+2 ,r e s p e c t i v e l y .B y using two plaintexts, a xor operation between two D 1 and another xor operation between two D 2 equations lead to eq. 6 and eq. 7:

D a 1 ⊕ D b 1 = SR • SB(M a i ) ⊕ SR • SB(M b i ) (6) D a 2 ⊕ D b 2 = SR • SB(M a i+1 ) ⊕ SR • SB(M b i+1 ) (7)
Eq. 8 is obtained by applying a MC transformation to eq. 6 (given the MC distributivity property over ⊕):

M b i+1 = MC(D a 1 ⊕ D b 1 ) ⊕ M a i+1 (8)
By replacing M b i+1 from eq. 8 in eq. 7, we obtain eq. 9:

D a 2 ⊕ D b 2 = SR • SB(M a i+1 )⊕ SR • SB[MC(D a 1 ⊕ D b 1 ) ⊕ M a i+1 ] (9)
where D a 1 , D b 1 , D a 2 and D b 2 have known values. Hence, we perform an exhaustive search over 2 8 possible values for each M a i+1 byte. This search leads often to a unique value for each byte. Then, by using the obtained M a i+1 values and eq. 5b, we find K i+2 .T h e r e f o r e ,K is revealed using the inverse of KeyExpansion. a) Experiment 2.a Using Scenario I: By using the experimental setup reported in section IV-B, we performed successfully this attack. We reduced R max to several values and obtained K by using the technique explained above. b) Experiment 2.b Using Scenario II: This attack using scenario II results to two round-reduced encryptions without any valid key at the final rounds. In order to exploit the round-reduced encryptions with short cryptanalysis solutions, the fault must be injected during ARK transformation of the last middle round (of each round-reduced encryption). Otherwise (i.e. with an earlier fault, before ARK), the faulty RC alters key values during two rounds. Therefore, we obtain eq. 10a and eq. 10b, instead of eq. 5a and eq. 5b, respectively for a given plaintext M a :

D a 1 = SR • SB(M a i ) ⊕ K ′ y1 (10a) D a 2 = SR • SB(M a i+1 ) ⊕ K ′ y2 (10b)
Adi f ferent i alcrypt anal ys i sbet w eeneq.10aandeq.10bl eads to finding M a i+1 .H o w e v e r ,K ′ y2 is an invalid key, unrelated to K.T h u st h ea n a l y s i sc a n n o tr e l e a s ea n yi n f o r m a t i o nf o r finding K.As o l u t i o nf o re x p l o i t i n gs c e n a r i oI Ii st oe x p a n d this experiment with a third attack, and thus, obtaining a third round-reduced encryption to i +3 rounds, denoted by eq. 11:

D a 3 = SR • SB(M a i+2 ) ⊕ K ′ y3 (11)
Thus, M a i+2 is revealed by a differential cryptanalysis between eq. 10b and eq. 11. Consequently, K i+2 is obtained using M a i+1 and M a i+2 values in eq. 12:

K i+2 = M a i+2 ⊕ MC • SR • SB(M a i+1 ) (12)
Therefore, two separate differential cryptanalyses by using three round-reduced encryptions of D 1 , D 2 and D 3 for 3 plaintexts M a , M b and M c reveal the secret key. The calculation time is less than one second with our PC.

c) Experiment 2.c Using Scenario II: Another option exists for this experiment by using only 2 given plaintexts M a and M b ,i n s t e a do f3 .I nt h i sc a s e ,t h ec r y p t a n a l y s i s between D 1 and D 2 (for two corresponding pairs) reveals often two hypotheses for each pair of corresponding M a i+1 and K ′ y2 bytes at the first step. Then, the cryptanalysis between D 2 and D 3 (for two corresponding pairs) reveals often two hypotheses for each byte of M a i+2 .A tt h et h i r ds t e p ,e a c h2 hypotheses for one byte on M a i+1 creates 2 4 hypotheses for its corresponding column values. Thus, with 2 hypotheses for each of corresponding bytes on M a i+2 , 2 8 hypotheses are made for the corresponding bytes on K i+1 .T he re foreK is revealed after testing all the (2 8 ) 4 hypotheses for entire K i+1 .T h i s exploitation needs calculation and testing of other round keys for each of the hypotheses. It needs in average less than 3 hours and 30 minutes with our PC.

d) Experiment 2.d Using Both of the Scenarios I & II:

Another possibility for performing this attack, is using both of the scenarios I and II, in a manner that the first attack targets the RC and the second attack changes the R max .I nt hi sc a s e , eq. 13a and eq. 13b present the faulty encryptions for a given M a :

D a 1 = SR • SB(M a i ) ⊕ K ′ y (13a) D a 2 = SR • SB(M a i+1 ) ⊕ K i+2 (13b)
K ′ y is an invalid round key. However, this attack exploitation is similar to experiment 2.a using scenario I. Please refer to section III-B5 for this attack exploitation. This experiment with combined scenarios shows the threat of existing flexible targets for the opponent in order to obtain the required encryption sequences.

6) Differential Two-Round Analysis of the Round-Reduced Encryptions (Experiment 3):

Another attack possibility is a differential analysis between round-reduced encryptions which differ in two rounds. For brevity in this article, we report this attack only in table I. b) Experiment 4.b Using Scenario II: This is a round reduction experiment by targeting RC during ARK of R 7 with any fault value greater than 0x07,e x c e p t0x0f.D u et ot h e fault, RC was incremented to R max or a higher value at the beginning of following round. Therefore, the encryption sequence was: R 0 -R 1 ...R 7 -R f .Thisattackexploitationneeds at least three pairs of correct and round-reduced ciphertexts:

(C a ,D a ), (C b ,D b )a n d( C c ,D c ). C a = SR • SB[MC • SR • SB(M a 8 ) ⊕ K 9 ] ⊕ K 10 (14)
D a = SR • SB(M a 7 ) ⊕ K ′ y (15)
An xor between D a and D b ,f o l l o w e db yaMC gives eq. 16:

MC(D a ⊕ D b )=MC • SR • SB(M a 7 ) ⊕ MC • SR • SB(M b 7 ) (16)
Eq. 16 can be also expressed by M 8 values, as shown in eq. 17:

MC(D a ⊕ D b )=M a 8 ⊕ M b 8 (17)
By xoring eq. 14 with similar eq. for C b ,a n dr e v e r s i n g ShiftRows operations, we obtain eq. 18:

SR -1 (C a ⊕ C b )=SB(M a 9 ) ⊕ SB(M b 9 ) (18)
By replacing M a 9 and M b 9 from eq. 17 in eq. 18, we obtain eq. 19:

SR -1 (C a ⊕ C b )=SB[MC • SR • SB(M a 8 ) ⊕ K 9 ]⊕ SB{MC • SR • SB[MC(D a ⊕ D b ) ⊕ M a 8 ] ⊕ K 9 } (19)
In eq. 19, C a , C b , D a and D b have known values. We perform an exhaustive search among (2 8 ) 4 possible values for each SR(M a 8 ) column and its corresponding column of K 9 values. By using three corresponding pairs of round-reduced ciphertexts, in average, two column values for each column of K 9 can be found. Then, K 9 and consequently K can be found by testing all the 2 4 column hypotheses. This attack exploitation is similar to the experiment 3, reported in table I. The complete cryptanalysis takes about 4 hours and 10 minutes with our PC.

8) Round Reduction to Nine Rounds: Ar o u n dr e d u c t i o n

to nine rounds (after the initial round) can be considered as as i m i l a ra t t a c ko fr o u n dr e d u c t i o nt oo n er o u n d ,r e p o r t e di n [START_REF] Choukri | Round reduction using faults[END_REF].A successful experiment of this attack is reported by K.S. Bae et al. in [START_REF] Bae | Differential fault analysis on AES by round reduction[END_REF].

IV. LASER INDUCED RRA ON THE MICROCONTROLLER

A. Laser fault injection

The use of a laser to inject faults into the calculations of a secure circuit was introduced by S. Skorobogatov and R. Anderson in 2002 [START_REF] Skorobogatov | Optical fault induction attacks[END_REF]. Laser faults arise from the photoelectric effect caused by a laser beam passing through silicon provided that its photon energy is greater than the silicon bandgap [START_REF] Habing | The use of lasers to simulate radiation-induced transients in semiconductor devices and circuits[END_REF]. This effect generates electron-hole pairs in silicon.These charges may create a transient current when exposed to the strong electric fields found in the PN junctions of CMOS transistors. Then, this transient current turns into a voltage transient that may travel through the circuit's logic. It may affect the computations of the target circuit or some of its memory elements. Hence, SRAMsa r es u b j e c tt ob i t -fl i pw h e n exposed to a laser beam [START_REF] Skorobogatov | Optical fault induction attacks[END_REF], [START_REF] Darracq | Single-event sensitivity of a single SRAM cell[END_REF]. We have reported in [START_REF] Agoyan | On-Line Testing -Proceedings of IOLTS[END_REF] experiments showing our ability to inject single byte and even single bit faults in the SRAM of the same device. We took advantage of the knowledge acquired during this previous work to realize the experiments reported in this section.

B. Experimental Setup for laser induced RRA

Target: We used a device communicating with smart card standards as our target. It is an 8-bit 0.35µm RISC microcontroller with an integrated 128KB flash program memory, 4KB EEPROM and 4KB SRAM.I ts h o u l db en o t e dt h a tt h i s microcontroller does not embed any countermeasure against fault injection. The device runs the Simple Operating System for Smartcard Education [14] for simulating the smart card environment. The microcontroller operates at a frequency of 3.59 MHz. It runs the software AES described in algorithm 1 (in section II-A2) which uses pre-calculated round-keys. Inour implementation, the AES secret key is embedded in the code. After each circuit reset, the AES'r o u n dk e y sa r ed e r i v e da n d stored in the microcontroller's SRAM.

RC and R max are also stored in the circuit's SRAM.T h a t is the entry point we have used to modify the AES behaviour by laser fault injection. We have already reported ( [START_REF] Agoyan | On-Line Testing -Proceedings of IOLTS[END_REF], [START_REF] Agoyan | Single-bit DFA using multiple-byte laser faulti n j e c t i o n[END_REF]) bytewise and bitwise fault injection experiments in this SRAM. As a consequence, laser proved to be a suitable fault injection means in order to corrupt RC and R max for the purpose of carrying out RRA.F i g u r e1h i g h l i g h t st h ec h i p ' sSRAM area.

Bench: Our experiments were conducted with green (532nm) or infrared (1064nm) wavelengths, through the front and rear sides of the chip respectively (obviously after a proper decapsulation). The laser beam for injecting single-bit faults was about ∅4µmwith≃ 10pJ energy per shot (before passing through the lens). The laser pulse duration was set to 5ns. The target was mount on an XY motorized stage with a 0.1µm resolution. It makes it possible to scan the target's SRAM with high accuracy. Figure 1 shows the circuit installed on the laser bench. A synchronization card provides a jitter of 10ns at the instant of injection. Hence, given the clock period of the device, 280ns, a very precise timing is achieved.

C. Realizations

One key point in performing RRA is to find out the kind of round modification induced by the fault injection (i.e. the number of rounds actually processed). It was achieved by precisely measuring the time elapsed between the end of the encryption command (sent by our communication interface) and the beginning of the card status answered by the test chip. Each encryption command includes a plaintext. The card's chip receives the command and then encrypts the plaintext. As soon as the encryption finishes, the card's chip sends the status "61 10"t ot h er e a d e r .T h i ss t a t u sm e a n st h a tt h ee n c r y p t i o n was normally completed and that 0x10 bytes of extra data are available (this number of bytes refers to the ciphertext's length).

In our implementation and experiments, any change in the total number of rounds is related only to a decrease (or eventually an increase) of the middle rounds number. Therefore, the time elapsed between the end of the encryption command and the beginning of the status on the I/O signal is afunc t i onoft henumbe rofmi ddl eroundsa c t ua l l yproc e s s e d. Figure 2 shows the differences between the duration of the circuit's I/O and power consumption signals for a normal AES encryption, for one shortened encryption to only two rounds (after the initial round), and for a round-reduced encryption to 8 rounds. The I/O signal remains constantly high for about 2.20ms during the AES encryption. Before this interval, the last byte of plaintext has been sent to the circuit (from the reader). Then, just after the AES encryption, the first byte of the card status is sent to the reader (from the circuit). The observed time difference between the correct encryption and the reduced ones is denoted by ∆t.F orade c re a s eof8mi ddl erounds ,∆t is about 1.48ms. When the encryption skips two rounds, ∆t is about 0.37ms. Thus, we were always able to discover any decrease (or even increase) in the round number by comparison with an unmodified encryption. We also monitored the chip's power consumption for checkout purposes. Target points: Finding R max and RC on the circuit is a sensitive step for carrying out the experiments. We realized during our previous experiments that this SRAM is implemented by blocks of 512 bytes. In each block of bytes, the bits of same index are implemented together for all the bytes. Thus, for each byte, the corresponding bits are distributed in 8 blocks of bits on the Y-axis with a fixed distance between them. Besides, each line on the Y-axis contained the bits of several bytes. We refer our reader to [START_REF] Skorobogatov | Optical fault induction attacks[END_REF] for a detailed experiment reported by S. Skorobogatov on the SRAM of another microcontroller.

For finding the target points, we scanned the spatial coordinates for high value bits (i.e. bits 4, 5, 6 and 7 for the faults equal to 2 4 , 2 5 , 2 6 or 2 7 ,respectively)bylaserfaultinjectionin the middle of AES encryption (preferably R 4 ...R 6 ). As soon as a fault was injected either into the R max or into the RC, as i g n i fi c a n tr o u n dm o d i fi c a t i o nw a si n d u c e d .I ft h eRC was faulted, the encryption was stopped one round later. Otherwise, if the fault was injected into the R max ,t h ee n c r y p t i o nw a s increased to 26 rounds or more. Therefore, we found the spatial coordinates of both of the targets on the X-axis. For finding the other bits of RC and R max ,wedisplacedthelaserspoton the Y-axis and found their coordinates. Please refer to figure 3. We needed to enlarge the beam on the Y-axis to ∼ 45µm( o r respectively to ∼ 90µm) in order to inject faults on 2 (or 3 resp.) neighboring bits. No additional opening above the initial 4µmo nt h eX-axis was necessary. Another key point in performing RRA is the ability to induce several times the same fault (what we shall call fault repeatability). Indeed, the RRA schemes introduced in section III require to gather faulty ciphertexts obtained from an identically modified sequence of rounds but with a different plaintext. To ascertain the fault repeatability rate we were able to obtain, we have run several fault injections with the same experimental settings (including the data: plaintext and key). When the laser was positioned at correct coordinates of our target (either R max or RC)t h a n k st ot h ea c c u r a t eX-Ystage, faults are injected into the target itself and often a very limited set offew neighboring bytes without any effect on the encryption. In at least 30% of irradiations, a fault is injected into the target. By using the above-mentioned laser spot (and even larger spots up to 10 times greater), all the injected faults were only singlebit faults. Thus, they were identical, as required in our attacks. Therefore, in almost all the successful single-bit fault injection into the target at a fixed X-Y stage coordinates, the fault value was repeated. According to several SRAM architectures (e.g. in our microcontroller), the bits of a unique value are designed and built close together for a block of bytes in the memory array. In theses implementations, usually the distance of two bit cells of same index in a block of bytes (e.g. 256 or 512 bytes) is much closer than the distance of a bit with its neighbor bits of the same byte. This is a weakness for the security of SRAM contents against single-bit fault injection. Please refer to our results reported in [START_REF] Agoyan | Single-bit DFA using multiple-byte laser faulti n j e c t i o n[END_REF] for more details. Among various modifications of the AES algorithm obtained by laser fault injection, we have chosen to report the 4 most significant round reduction attacks (including two generalized analyses). All these experiments were realized by single-bit laser fault injection and accurate time-tuning of the laser irradiations. However, they can be extended to multiple-bit faults.

V. C ONCLUSION AND PERSPECTIVES

In this paper we introduced some new round reduction analysis attacks on an AES implementation, similar to the proposed one by NIST in [START_REF]Announcing the Advanced Encryption Standard (AES)[END_REF]. Our experiments were carried on

  a) Experiment 1.a Using Scenario I: By injection an adequate fault value into R max ,t h eo p p o n e n tm a yr e d u c et h e encryption sequence to 2 rounds, i.e.: R 0 -R 1 -R f =2 .[ 4 ]c a n successfully exploit this attack, even if the encryption sequence differs at the final round. We review a more complex case in experiment 1.b for scenario II and then present our technique. b) Experiment 1.b Using Scenario II: We performed this attack by faulting RC during the execution of R 1 .I f the fault is injected during ARK of R 1 ,t h ee n c r y p t i o ns equence becomes: R 0 -R 1 -R f .[ 4 ]m a ya g a i nb eu s e df o rt h e exploitation. Besides, if the fault is injected before ARK of R 1 , the encryption sequence becomes R 0 -R m -R f .T h i si sam o r e sophisticated case in comparison to J.H. Park et al.'s attack. We present here a technique exploiting our attack which can be also applied to J.H. Park et al.'s attack.

7 )

 7 Round Reduction to Eight Rounds (Experiment 4): Here, we review round reduction attack to 8 rounds. a) Experiment 4.a Using Scenarios I: It is possible to modify R max in order to execute 8 rounds. The encryption includes all the rounds until R 7 ,t h e ni tp e r f o r m sR 8 as the final round, i.e. without MC: R 0 ...R 7 -R f =8 .T h ea t t a c kc a n be exploited as a simple case by our technique for scenario II (experiment 4.b).

Fig. 1 .

 1 Fig. 1. On the left: View of the 8-bit microcontroller and of its SRAM area. Right: The target circuit, installed on the laser bench for front side injection.

Fig. 2 .

 2 Fig. 2. The I/O and power consumption signals for three encryptions of a same plaintext, given from top to bottom for a correct, a 2-rounds and an 8-rounds encryptions.

Fig. 3 .

 3 Fig.3. A SRAM block of 512 bytes on our circuit. The bits of each byte are implemented on distinct rows.

It should be noted that most of the results we have obtained depend on the AES implementation we used: KeyExpansion performed once prior to the encryptions (in order to save both computation time and power consumption). However, even if some of the scenarios we have presented may become impracticable, similar cryptanalysis may be derived for an AES implementation using on-the-fly key scheduling (to save memory consumption). Besides, if a fully unrolled AES (i.e. without any loop) is immune to RRA through RC or R max modification, RRA should still be performed by faulting the program counter of the microcontroller. Moreover, the KeyExpansion iterative process is also a potential target. Further work has to be done based on these findings in order to propose countermeasures against RRA.