Ihab Alshaer

Brice Colombier

Christophe Deleuze

Vincent Beroulle

Paolo Maistri

Microarchitectural Insights into Unexplained Behaviors under Clock Glitch Fault Injection

Keywords: Fault injection attacks, Clock glitch, Fault model

de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Given how frequently embedded systems are used in various spheres of life, securing them from malicious activities is fundamental. Sensitive data in embedded systems can be efficiently protected using cryptographic algorithms, which are frequently implemented in software on embedded microprocessors. However, such solutions can be vulnerable to attacks that seek to gain access to this private data. In particular, they might be vulnerable to physical attacks.

Fault injection is a major and powerful active physical attack. Since the well-known Boneh et al. attack [START_REF] Boneh | On the importance of eliminating errors in cryptographic computations[END_REF], where the authors were able to break an implementation of CRT-RSA by inducing faults into the computations, it has been an attractive research topic.

It is possible to perform the fault injection in a variety of ways: by exposing a digital device to radiations [START_REF] Baumann | Radiation-induced soft errors in advanced semiconductor technologies[END_REF], laser beams [START_REF] Khuat | Laser fault injection in a 32-bit microcontroller: from the flash interface to the execution pipeline[END_REF], or an electromagnetic pulse [START_REF] Moro | Electromagnetic fault injection: Towards a fault model on a 32-bit microcontroller[END_REF], by causing perturbations in the power supply [START_REF] Timmers | Controlling PC on ARM using fault injection[END_REF] or in the clock signal [START_REF] Alshaer | Variable-length instruction set: Feature or bug?[END_REF], by altering the environment's temperature [START_REF] Skorobogatov | Local heating attacks on flash memory devices[END_REF], etc.

Fault Injection Effects

Several works [START_REF] Khelil | Fault analysis attack on an FPGA AES implementation[END_REF][START_REF] Moro | Electromagnetic fault injection: Towards a fault model on a 32-bit microcontroller[END_REF][START_REF] Proy | A first isa-level characterization of EM pulse effects on superscalar microarchitectures: A secure software perspective[END_REF][START_REF] Trouchkine | EM fault model characterization on SoCs: From different architectures to the same fault model[END_REF][START_REF] Spensky | Glitching demystified: Analyzing control-flow-based glitching attacks and defenses[END_REF][START_REF] Buhren | One glitch to rule them all: Fault injection attacks against amd's secure encrypted virtualization[END_REF] claimed that the effect of a fault injection or the success of a fault injection attack is somehow random. In some cases [START_REF] Khelil | Fault analysis attack on an FPGA AES implementation[END_REF][START_REF] Spensky | Glitching demystified: Analyzing control-flow-based glitching attacks and defenses[END_REF][START_REF] Buhren | One glitch to rule them all: Fault injection attacks against amd's secure encrypted virtualization[END_REF], the corruption is expressed as random bit flips or random byte faults. On the other hand, other works [START_REF] Moro | Electromagnetic fault injection: Towards a fault model on a 32-bit microcontroller[END_REF][START_REF] Proy | A first isa-level characterization of EM pulse effects on superscalar microarchitectures: A secure software perspective[END_REF][START_REF] Trouchkine | EM fault model characterization on SoCs: From different architectures to the same fault model[END_REF], described it as random data corruptions that are applied at the instruction set architecture (ISA) level, either on the instruction data or on the contents of the registers.

Based on such variety, analyzing the vulnerabilities that fault injection can exploit is extremely challenging, and thus, developing countermeasures is significantly more complex. This will definitely result in either over-protections, which will affect the performance and the cost of the device, or conversely, in under-protections too, which will affect the security of the device.

Recent studies [START_REF] Laurent | Bridging the gap between RTL and software fault injection[END_REF][START_REF] Tollec | Exploration of fault effects on formal RISC-V microarchitecture models[END_REF][START_REF] Alshaer | Cross-layer inference methodology for microarchitecture-aware fault models[END_REF][START_REF] Khuat | Laser fault injection in a 32-bit microcontroller: from the flash interface to the execution pipeline[END_REF][START_REF] Alshaer | Variable-length instruction set: Feature or bug?[END_REF] tried to explain the effects of the fault injection by looking at the lower levels of abstraction of digital systems. In particular, they focus on the register transfer level (RTL), microarchitectural level and/or binary encoding level of the instructions. In some cases [START_REF] Laurent | Bridging the gap between RTL and software fault injection[END_REF][START_REF] Tollec | Exploration of fault effects on formal RISC-V microarchitecture models[END_REF], however, the authors only conducted simulations at ISA and RTL levels: they did not confirm the realism of their analysis with physical fault injections. In contrast, [START_REF] Alshaer | Cross-layer inference methodology for microarchitecture-aware fault models[END_REF][START_REF] Khuat | Laser fault injection in a 32-bit microcontroller: from the flash interface to the execution pipeline[END_REF] performed physical fault injections, but they only focused on two kinds of faulty behaviors: complete-instructions skip and complete-instructions replay faults. In [START_REF] Alshaer | Variable-length instruction set: Feature or bug?[END_REF], authors offered a thorough analysis and justification of the experimental findings that show how the alignment of the instructions in the flash memory can affect the obtained faulty behaviors. Based on that, they proposed two fault models at the binary encoding level: Skip a specific number of bits and Skip and Repeat a specific number of bits, whose value is strictly related to the flash memory access size. However, in their work, they explicitly said that these two fault models explain many of the obtained faulty behaviors, but not all of them.

Contributions

In this article, we propose a new inferred fault model, the partial update fault model, that is applied to the binary encoding of the instructions. This new fault model aims at explaining different faulty behaviors that are obtained when performing clock glitch fault injection campaigns on a 32-bit microcontroller. Therefore, it improves the vulnerability analysis process against fault injection, and hence, allows developers to design cost-effective countermeasures. We also show how a subcase of the new fault model is instruction-independent with high probability, and its manifestation is highly device-dependent. We show how we can execute new instructions even with a different length of encoding as a result of a clock glitch, by exploiting the variable-length capabilities of the target microcontroller. Finally, we make use of the presented fault model to modify the program counter to a chosen address, whose value is stored in a general-purpose register.

Outline

This article is organized as follows: Section 2 briefly describes the methodology we followed to explain the obtained results. Section 3 presents the inferred binary encoding fault models. Section 4 describes the experimental setup, then experimental results are reported and discussed in Section 5. Section 6 presents different practical scenarios to modify the program counter, based on the presented fault models. The article is concluded along with future perspectives in Section 7.

Fault model inference

The method we followed in this work to describe and characterize the fault injection results is comparable to the methods used in [START_REF] Dureuil | From code review to fault injection attacks: Filling the gap using fault model inference[END_REF][START_REF] Alshaer | Cross-layer inference methodology for microarchitecture-aware fault models[END_REF][START_REF] Laurent | Bridging the gap between RTL and software fault injection[END_REF][START_REF] Moro | Electromagnetic fault injection: Towards a fault model on a 32-bit microcontroller[END_REF]. The core of the analysis consists in comparing the outcomes of executions, both the simulations and the actual fault injections, at various levels of digital system abstraction. In this work, we focus our analysis on two abstraction levels: ISA level and binary encoding of the instructions. We also enrich these descriptions by providing insights at the microarchitectural level.

On one side, physical fault injections are performed, with appropriate injection parameters, on a target device that is executing a simple target program, which is formed of a sequence of assembly instructions (step 1 in Figure 1). Then, from the physical fault injection results, we infer fault models at the binary encoding level of the instructions (step 2 in Figure 1). Applying the inferred binary fault models to the simulated execution of the same target program, that was used in step 1 , is the next step (step 3 in Figure 1). The outcomes of the physical fault injection and the software execution are then compared in order to provide better characterization of the impact of the fault injection and validate the inferred fault models (step 4 in Figure 1). The comparison is carried out on the output values of the processor's general-purpose registers. Each of these registers has a known value at the beginning, and any change can be detected after performing step 4 in Figure 1.

Partial update fault model

This section presents the inferred binary encoding fault models that are applied to the target programs. These fault models seek to explain the faulty behaviors that have been observed after physical fault injection campaigns have been carried out on the target device that is running these target programs.

It has been observed through these physical fault injection experiments that not all of the observed faulty behaviors can be explained by the binary encoding fault models described in [START_REF] Alshaer | Variable-length instruction set: Feature or bug?[END_REF]. There are in fact other faulty behaviors, which can be explained with the new fault models described in this section.

Partial update from the precharge value

This fault model corresponds to a fault that happens while the fetched data or instruction is propagated between internal registers from the flash memory to the core, as shown in Figure 2.

The hypothesis behind this fault model is based on the fact that not all bits of the data are propagated at the same speed from an internal register to another through a bus or combinational logic. Consequently, not all flip-flops within the destination register will get the update at the same time at a rising edge of a new clock cycle.

In nominal conditions, the clock period is defined such that all signals can be correctly sampled (i.e., the critical path has a positive slack). In case of a clock glitch, however, this behavior is disrupted by the fact the clock edge occurs quite sooner than expected. Thus, with the suitable injection parameters, it may happen that some flip-flops will receive the correct update, while some will receive the precharge value of the bus. Assuming that the precharge value of a bus or a wire between two registers is zero, then the correct update of a flip-flop means receiving the correct logic one or zero, while not receiving the correct update means capturing the precharge value of the bus, i.e. zero. This model is observed as a reset on some bits while the instructions are transferred through the fetch data path in Figure 2, as shown experimentally in subsection 5.1.

It should be mentioned that in [START_REF] Moro | Electromagnetic fault injection: Towards a fault model on a 32-bit microcontroller[END_REF], the authors claimed that some of the observed faults, as a result of electromagnetic fault injection, might be related to the precharge value of the target microcontroller's bus. However, they didn't have a clear model that could explain their observed faults.

Partial update from the previous value

This fault model is somehow similar to the previous one. It occurs on the same path shown in Figure 2. However, instead of receiving the precharge value from the bus, some flip-flops within a destination register will keep their old values, either because the values have not been changed or because the corresponding wire still keeps the old values, and hence, the updated values are similar to the old ones. Conversely, and at the same time, other flip-flops in the destination register will receive the correct updated value. This model is formally described as a bitwise OR between the old value and the new value of an internal register. This merge might be a full merge or a partial merge, as shown experimentally in subsection 5.2. Thus, in each flip-flop, the resulting value can be either the previous value or the correct value i.e. the value that the flip-flop should receive under normal execution, without any fault injection.

When looking at the instructions execution in this case, we observe the following behavior. The instruction(s) fetched at clock cycle i is executed normally. However, the instruction(s) fetched at clock cycle i + 1 is not the one being executed. Instead, the observed instruction(s) is a full or partial merge between the fetched data at clock cycle i and the fetched data at clock cycle i + 1. More details about this behavior are provided in subsection 5.2.

Discussion

Exploiting the transition value of a wire or a bus from a precharge (or a previous) value to a new value is a well-established modelling approach in power analysis attacks [START_REF] Alioto | Differential power analysis attacks to precharged buses: A general analysis for symmetric-key cryptographic algorithms[END_REF][START_REF] Randolph | Power side-channel attack analysis: A review of 20 years of study for the layman[END_REF][START_REF] Shelton | Rosita: Towards automatic elimination of power-analysis leakage in ciphers[END_REF], which employ the so-called Hamming weight (or distance) leakage model. Likewise, our approach shows a similar pattern: depending on the type of register transition occurring (from previous or precharge value), the corresponding partial update fault model applies.

In section 5, we show that both cases can occur for the same device. This is not in contrast with our modeling, as depending on the actual element that is affected by the fault injection (in our case, the clock glitch) and the fine-tuning of the injection parameters, we may see different outcomes. Further details ahead.

Experimental setup

The target device and the fault injection method we employed are presented in this section. Section 5 includes the target programs, the corresponding experimental outcomes, and the discussion that follows.

Clock glitch fault injection

An effective method of fault injection is to introduce perturbations on the clock signal. Compared with other fault injection methods like laser or electromagnetic pulses, clock glitch is known to be effective and the least expensive method. Also, it can offer a respectable level of controllability thanks to its temporal accuracy and, consequently, the location of the injection within the target program. In clock glitch fault injection, the glitch interferes with the normal operation of the clock signal, possibly causing a timing violation that results in a variety of erroneous behaviors. Additionally, since the glitch is introduced into the global clock, it is uncertain which microarchitectural component might be affected by the fault injection.

The following settings, illustrated in Figure 3, are tuned when performing clock glitch fault injection:

-Delay: the time between the rising edge of a trigger signal and the rising edge of the target clock cycle. -Shift: the time between the rising edge of the glitch and the rising edge of the target clock cycle. -Width: the duration of the glitch. In this work, the clock glitch fault injection campaigns have been carried out using the ChipWhisperer environment [START_REF] O'flynn | Chipwhisperer: An open-source platform for hardware embedded security research[END_REF].

Target device

The target device is a 32-bit microcontroller that embeds an Arm Cortex-M4 processor. The Arm Cortex-M4 has a 3-stage pipeline: fetch, decode and execute. It has 13 general-purpose 32-bit registers, R0 to R12. Arm Cortex-M4 is based on ARMv7-M architecture [START_REF]ARM Limited: Armv7-m architecture reference manual[END_REF] and supports the Thumb-2 instruction set [START_REF] Limited | ARM architecture reference manual Thumb-2 supplement[END_REF].

Thumb-2 is a variable-length instruction set that offers two encoding lengths: 16 and 32 bits. The instruction has a 32-bit encoding if the most significant five bits of a 32-bit word have one of the following values [START_REF]ARM Limited: Armv7-m architecture reference manual[END_REF]: 0b11101, 0b11110 or 0b11111.

The flash memory access size in this microcontroller is 64 bits. Therefore, up to two 32-bit or four 16-bit instructions can be fetched simultaneously. Additionally, as the supported instruction set is a variable-length instruction set, misaligned instructions can be fetched in several configurations as described in [START_REF] Alshaer | Variable-length instruction set: Feature or bug?[END_REF]. For example, the first half of a 32-bit instruction may be fetched at a given clock cycle, while the second half is fetched at the next clock cycle.

In the experiments, the processor is put in a known state before each fault injection. This is done by initialization instructions, that are located before the target instructions. After each execution, the values of the general purpose registers are transferred to a control computer via a serial communication in order to analyze the results. The target programs are presented in the next section.

Experimental results

The result of any fault injection experiment is assigned to one of these classes:

-Crash: we obtain a crash, reset, or failure when attempting to read the target final state via the serial communication, -Silent: the final state of the target is the so-called golden state, i.e. as if no fault was injected, -Fault: the final state of the target is different from the golden state.

The results of the different clock glitch fault injection campaigns are discussed separately with respect to each fault model in the following subsections.

Partial update from the precharge value

This section demonstrates how the partial update from the precharge value fault model explains many of the faulty behaviors observed during the fault injection campaigns. Also, it demonstrates the relation between this fault model and both the target instruction and the target device. To put it another way, it determines whether some bits in the fetched data are more sensitive to this fault model than other bits and, if so, whether the target instruction or the target device is to blame. The following subsections provide detailed results when targeting different instructions, and also when targeting a new device, identical to the already used one.

High-Hamming weight instruction

Since the partial update from the precharge value fault model causes some bits of the target instruction to be reset, it makes sense to choose an instruction with a large Hamming Weight in order to maximize the occurrence of the considered fault model. Under this assumption, we chose the instruction SUBS R6, 0xff, whose encoding in Thumb-2 is 0x3eff. Our rationale is twofold: the instruction has a comparatively large Hamming Weight [START_REF] Moro | Electromagnetic fault injection: Towards a fault model on a 32-bit microcontroller[END_REF] given its size. Secondly, since the partial update from the precharge value fault model causes some bits of the instruction to be reset, applying it on 0x3eff results in an instruction that can be discriminated with high probability.

The objective behind these experiments is to show that several faulty behaviors can be explained using the partial update from the precharge value fault model. In addition, we want to see if some bits are more vulnerable than others to be reset within a target instruction. Finally, were it the case, we need to know if this is because of the target instruction or of the target device. Since the fetch size in the target device is 64 bits, a 16-bit instruction may reside in any of four different positions within these 64 bits. Therefore, four injection campaigns have been performed, where the position of 0x3eff is different from one campaign to another. The main reason of changing the position of the target instruction is to find out if the fault model depends on the target instruction, or it depends on its position within the fetched 64 bits, and hence, depends on the physical implementation of the target device. The remaining three positions are filled with three instructions with the encoding 0x0000, in order to minimize possible side effects from other instructions and make the analysis easier. This encoding corresponds to the MOVS R0, R0 instruction, which is equivalent to a NOP.

Table 1 gives the target part code of each fault injection campaign. It also shows the glitch parameters that are used. These parameters are chosen in order to maximize the number of faults that can be classified under the partial update from the precharge value fault model. Position refers to the location of 0x3eff within the fetched 64 bits. The values of shift and width are provided as a percentage of a single clock cycle: the glitch is introduced before the rising edge of the target clock cycle if shift is negative. ChipWhisperer provides an additional parameter, called fine-width, which is used to offer fine-tuning of the width parameter. It has been noticed that fine-width provides better reproducibility of the results when it is used. Repetitions is the number of executions for each combination of parameters. For each fault injection campaign, the total number of experiments corresponds therefore to more than 20 000 executions, as summarized in the last row of the table. The same value of delay is used in all the campaigns, and it depends on the number of initialization instructions that precede the target part.

The results of the four injection campaigns on 0x3eff with respect to the three classes (i.e., Crash, Silent and Fault) are presented in Table 2. All the resulting faulty behaviors can be classified under two fault models: Skip (all the general purpose registers keep their initial values), or partial update from the precharge value . Table 2 also provides the number of observed behaviors linked to each fault model among the faulty executions.

Figure 4 shows the encoding of the executed instructions for each injection campaign, along with the number of times each of them is observed. All of these faulty behaviors are classified under the partial update from the precharge value fault model. This is because all of them can be seen as a reset on some bits of the original instruction 0x3eff. It should be noticed that resetting all Target 0x3eff 0x0000 0x0000 0x0000 part 0x0000 0x3eff 0x0000 0x0000 code 0x0000 0x0000 0x3eff 0x0000 0x0000 0x0000 0x0000 0x3eff the bits of 0x3eff will result in executing 0x0000, which is an instruction with no effect as mentioned earlier, and thus classified under the skip fault model.

Shift

Additionally, Table 2 and Figure 4 show that the number of faulty behaviors and the observed executed instructions depend on the position of the instruction in the fetched 64 bits. Thus, the results depend on the position rather than the instruction. Furthermore, the results of each position show that some instructions are more probable to be executed than others as a result of the fault injection.

To better understand the effect of the fault at each position, and hence, on each bit in the position, we define a metric called bit sensitivity. It measures the probability for a bit to be reset as a result of the clock glitch fault injection over the faulty behaviors that are classified under the partial update from the precharge value fault model at a specific position. The bit sensitivity S p (f, b) of bit b to a given fault model f at position p is defined in Equation [START_REF] Alioto | Differential power analysis attacks to precharged buses: A general analysis for symmetric-key cryptographic algorithms[END_REF].

S p (f, b) = 1 - P (b = 1 | p) P (fault model = f | p) (1)
Figure 5 presents the bit sensitivity values for the results obtained during the fault injection campaigns on 0x3eff at all positions. Obviously, bits that are zero in 0x3eff (bits 8, 14, and 15) have no corresponding bit sensitivity value. We can see that the bit sensitivity is different from one position to another and from one bit to another at the same position. Thus, under the partial update from the precharge value fault model, some instructions are more probable than others. Subsection 5.1 presents the results of targeting a different instruction, to confirm that the partial update from the precharge value fault model depends on the physical implementation of the device, and not on the target instruction.

It is important to note that whenever there is a doubt about the execution of an instruction, results are confirmed using alternative initial register values. Nonetheless, in rare circumstances, more than one instruction may produce the same outcome, for instance, when the value of a register is zero. For example, this might happen because of moving zero to the register, or by shifting its value by 32 bits. In Figure 4, when the encoding is starred, it means that there is an alternative instruction that could lead to the same outcome, and we selected one based on other observed encoding at the same position. It is important to stress that this is happening only in a few cases (4 times), and does not affect the measurements or the general conclusion.

Confirming sensitive bits

We carried out extra experiments with the value 0x3b7d, which is the encoding of the SUBS R3, 0x7d instruction. Again, we chose this instruction since it has a relatively high Hamming weight, and allows recognizing the encoding of the executed instructions as a result of the partial update from the precharge value fault model with high probability. However, we specifically took care to have ones in the most sensitive positions from Figure 5 to see if these measurements are reproducible when targeting a different instruction.

The experimental parameters for the fault injection campaigns on 0x3b7d are identical to that of 0x3eff, given in Table 1. The only difference is that the target program has 0x3b7d instead of 0x3eff. The classification results are presented in Table 3, while the bit sensitivity values are plotted in Figure 6. It is clear that the classification results and the bit sensitivity values of 0x3b7d are very close to the corresponding results of 0x3eff. This leads us to the conclusion that the partial update from the precharge value fault model is instruction-independent with high probability. If it depended on the instruction, then changing the position should not have an observable distinct effect on the executed instructions and on the bit sensitivity of different positions. On the other hand, the next subsection shows that bit sensitivity greatly depends on the target device. 0x3eff experiments on a new microcontroller In this section, we present the results of targeting the 0x3eff instruction again while using a brand new device, which we did not use to perform any experiment previously. In any other means, it is identical to the one we used in the previous experiments. This is done to better understand the dependency of the partial update from the precharge value fault model on the target device. The experimental parameters of this campaign are identical to those in Table 1.

For our purposes, it is enough to present the results on the 2 nd and 4 th positions to see that they are very different between the two devices. The results are presented in Table 4 and Figure 7.

A very interesting observation is that the number of faults and the bit sensitivity were much higher when performing the fault injection campaigns on the old device. This is clear for the bit sensitivity of the 4 th position in Figure 7b, as we can see the distribution of the bit sensitivities is similar to that in Figures 5d and6d, however, on the old device, the sensitivity is much higher. This could be explained as an aging effect, since the old device has been used for fault injection experiments for a few months. We speculate that the bit sensitivity could increase over time (a common consequence of performance degradation due to aging), but further research is needed to confirm this observation.

Conclusion on bit sensitivity

To summarize, the bit sensitivity figures illustrate that, as a result of the partial update from the precharge value fault model, the probability distribution of the corrupted instruction is not random, and it depends on several features that are mostly device-dependent. The probability of executing a given instruction differs from the probability of executing another. This discrepancy is determined by both the instruction's position inside the target program and the target device itself. This is of prime importance if the instruction results in a security vulnerability, as will be highlighted in section 6.

Partial update from the previous value

In this section, we focus on the occurrence of faulty behaviors that can be classified under the partial update from the previous value fault model. In this case, there is no precharge value and the transition occurs from the value that was previously stored in the register. In the time while the register is updating its value, a transient situation may occur when some bits already have the new value, whereas others are still to be updated. This behavior can be seen a merge between the previous and the new instruction. The following subsections give examples of observed faulty behaviors that are classified as full or partial merge.

Full merge

The merge is considered full if and only if the observed executed instruction(s) can be expressed as a bitwise OR between the data fetched at clock cycle i and the data fetched at clock cycle i + 1. In the following, an example is provided, which illustrates how two new 32-bit instructions are executed as a result of a full merge between eight different 16-bit instructions.

Listing 1.1 shows the target program and the encoding of each instruction of this example. The observed execution as a result of the clock glitch fault injection is given in Listing 1.2. The bitwise OR of the first two hexadecimal digits at line 1 (0xa9) and the corresponding digits at line 5 (0x42) gives 0xeb. Since the most significant five bits are 0b11101, this word is decoded as a 32-bit instruction, as explained in subsection 4.2. The same holds for the merging of instructions at lines 3 and 7.

Listing 1.2 is obtained a full merge applied on Listing 1.1 as follows:

-Merging the 32 bits at lines 1 and 2 with the 32 bits at lines 5 and 6 respectively: 0xa9000000 | 0x42000305 = 0xeb000305. -Merging the 32 bits at lines 3 and 4 with the 32 bits at lines 7 and 8 respectively: 0xa9000000 | 0x42020405 = 0xeb020405. One of the observed executions that can be classified under Partial merge is as the following: We observed that not all the 32 bits at lines 1 (0xf1010104) are systematically merged with the corresponding 32 bits at line 4 (0xf102020a): only the destination and source registers are merged. In addition to this behavior, another partial merge occurred in the following instructions, only over the least significant digit, between the 16 bits at line 2 (0x4002) and the 16 bits at line 5 (0x0004). As a consequence, only the destination register at line 5 is affected. The observed execution of this example is shown in Listing 1.4. It should be mentioned that we cannot discriminate on the opcode values (0xf1), as it is the same in both ADD instructions. It is worth mentioning that a Full merge was also observed for the target program in Listing 1.3

Program counter modification

In this section, we exploit the proposed fault models to change the value of the program counter to an address stored in one of the general purpose registers. Being able to modify the program counter allows to break the control flow integrity of a program. This is leveraged in various attacks, such as privilege escalation or secure-boot violation [START_REF] Timmers | Controlling PC on ARM using fault injection[END_REF].

In the following subsections, we measure the probability of modifying the program counter under different scenarios for the target program in Listing 1.5. The results of the different scenarios, along with the fault models that led to the success of the attack, and the glitch parameters that allowed observing the results are summarized in Table 5. The success rate is computed over 10 000 executions for each clock glitch fault injection scenario. The glitch parameters are tuned to maximize the success rate.

Misaligned code

In [START_REF] Alshaer | Variable-length instruction set: Feature or bug?[END_REF], the authors were able to modify the program counter to an address stored in R8 as a result of the skip fault model in a misaligned code. This is done by executing the least significant 16 bits of a misaligned 32-bit instruction. The first half of the 32-bit instruction is fetched at clock cycle i and its second half is fetched at clock cycle i + 1. Therefore, skipping the fetched data at clock cycle i results in decoding the remaining half that is fetched at clock cycle i + 1, and executing when it is a valid encoding for a 16-bit instruction. The same thing can happen for the ADD R6, R1, 0x4c7 instruction shown in Listing 1.5. Its least significant 16 bits (0x46c7) are the encoding of MOV PC, R8, which stores the value of R8 into the program counter. Thus, executing MOV PC, R8 leads to a jump from line 3 to line 11, since R8 stores the address of line 11.

We reproduced their attack on Listing 1.5. Many useful and dummy instructions are used in Listing 1.5 to make sure of detecting the execution of MOV PC, R8. The success rate in this scenario was 100 %. We noticed that 9996 of the executions can be classified under the skip fault model. However, four executions can be classified under the partial update from the precharge value fault model. This is because resetting some bits of the most significant 16 bits of ADD R6, R1, 0x4c7, will lead to execute two 16-bit instructions, as the most significant five bits do not identify a valid encoding for a 32-bit instruction (as detailed in 4.2). For these four executions, we confirmed this is happening by observing the values of the registers that the MOVS R1, R0 instruction, of encoding 0x0001, had been executed. Thus, the instructions MOVS R1, R0 and MOV PC, R8 are executed in sequence.

Aligned code

The aforementioned attack relies on the misalignment of the code in memory, as explained in [START_REF] Alshaer | Variable-length instruction set: Feature or bug?[END_REF]. We add a single MOVS R0, R0 (0x0000) to the target program, just before ADD R6, R1, 0x4c7 instruction, to realign it. The code is now aligned, all bits of 0xf20146c7 are fetched in a single clock cycle. In this case, the fault model that we can rely on to create new instructions (and thus modify the program counter) is the partial update from the precharge value fault model. The aim is to reset bits over the most significant 16 bits while not touching the least significant 16 bits, in order to keep the encoding of MOV PC, R8, i.e., 0x46c7. The success rate of the clock glitch fault injection campaign in this case was 0.71 %. However, no side effect is observed along with executing MOV PC, R8, but this is normal as resetting some bits of the most significant 16 bits of 0xf20146c7 could lead to execute many 16-bit instructions with no observable effect like MOVS R0, R0 (0x0000), or TST R0, R0 (0x4200) for example.

This result is an improvement over the state of the art, since one could imagine that making the code aligned will protect from the misaligned faulty behaviors that are described in [START_REF] Alshaer | Variable-length instruction set: Feature or bug?[END_REF]. Thus, aligning the code cannot be considered a sufficient countermeasure against clock glitch attacks, that might focus on misaligned codes. However, aligning the sensitive instructions can effectively decrease the success rate, as demonstrated experimentally.

Countermeasure: register substitution

In this scenario the code is misaligned, but we changed the destination register in ADD R6, R1, 0x4c7 from R6 to R2. Other occurrences of R6 are replaced with R2 in the rest of the program. Now, the least significant 16-bit word for ADD R2, R1, 0x4c7 is 0x42c7. The success rate in this scenario was zero: no fault led to modify the program counter to the value in R8, even when we used the same experimental parameters that previously led to a success rate of 100 %. The R2 register was chosen because 2 in the encoding can not be turned into a 6 by resetting bits. Thus, we avoid obtaining the encoding of MOV PC, R8.

This scenario shows that a clear understanding of the fault effect led to the design of a very simple and cost-effective countermeasure. This proposal clearly has no overhead and is easily implemented by the compiler, except in rare cases where registers might be under a lot of pressure.

Trojan

In this case, dummy code with no effect on the target program is added just before ADD R2, R1, 0x4c7, where the code is protected against executing MOV PC, R8. This dummy code is shown in Listing 1.6. It implements a Trojan that can be activated by clock glitch fault injection in order to controllably execute the MOV PC, R8 instruction. It is clear that the partial update from the previous value fault model in the full merge setting will lead to execute MOV PC, In terms of future works, proper formalization of protections against the presented fault models will be very necessary. At software level, an automated framework made of vulnerability assessment followed by automatic code protection would greatly improve the security of the targeted application. At a lower level, several approaches might be envisioned at different abstraction levels, from ISA down to transistor-level. Also, targeting other architectures will be important to see if the proposed models can be generalized to various Finally, although clock glitch has been used in this article to perform the fault injection, the presented results may be generalized to other fault injection techniques that rely on timing violations. This includes, for example, voltage glitch and electromagnetic fault injection.

Fig. 1 :

 1 Fig. 1: Fault model inference methodology.

Fig. 2 :

 2 Fig. 2: Fetch data path in a microcontroller.

Fig. 3 :

 3 Fig. 3: Clock glitch parameters

- 13 Width

 13 {6, 10} {6, 10} {3, 4} {3,

(d) 4 th positionFig. 4 :

 4 Fig. 4: Encoding of the observed executed instructions when targeting 0x3eff at four different positions within the target programs.

Fig. 5 :

 5 Fig. 5: Bit sensitivity values obtained when targeting 0x3eff.

Fig. 6 :

 6 Fig. 6: Bit sensitivity values obtained when targeting 0x3b7d.

Fig. 7 :

 7 Fig. 7: Bit sensitivity values obtained when targeting 0x3eff on the new device at the 2nd and the 4th positions.

Table 1 : Experimental parameters

 1

	Position	1 st	2 nd	3 rd	4 th

Table 2 : Fault obtained when targetting the 0x3eff instruction at four different positions

 2

	Class	1 st	Position 2 nd 3 rd	4 th
	Crash	0	0	23	1
	Silent	33	1574 2273 158
	Fault	20 407 18 866 18 144 20 281
	Skip	11 523 8295 11 107 7901
	Partial update from the precharge value 8884 10 571 7037 12 380

1 st position

	Binary encoding	0x0800* 0x3a1f 0x3e9f 0x3a1b 0x0801* 0x3e1f 0x3edf 0x381b 0x3813	1	Number of occurences 1106 968 922 777 (a) Number of occurences 2226 2116 408 360 0x0040 0x3eee 0x08c0 0x00c0 0x3efe 0x0cc0 0x0ec2 0x2200* 0x3eea 0x0ec0 0x0cc2 0x0ee2 Binary encoding 1813 1618 1228 983 694 509 425 163 125 51 6 (b)	2956

2 nd position

	Binary encoding	0x3ef7 0x0200 0x0600 0x3ef6 0x0e82 0x0680 0x0681 0x3686 0x3eb6 0x3682 0x0e86 0x3696 0x36b6 0x36a6 0x3e96 0x3e86 0x3ea6 0x3ed6 0x0e80 0x3ee6 0x36c6 0x36f6 0x36e6 0x36d6 0x2679 0x3ec6 0x36a2 0x0601 0x3e82	96 95 71 43 42 32 25 23 19 15 15 7 6 5 4 3 2 1 1 1 1	272 223	592 489 443	1323 1114	2074
					Number of occurences
				(c)

3 rd position

	Binary encoding	0x3490 0x34fa 0x3cfe 0x3cfa 0x0400 0x2410 0x34c0 0x2490 0x0410 0x34da 0x34d2 0x2400* 0x3410 0x3cff 0x34f2 0x34d8 0x34f0 0x34f8	149 116 105 90 83 71 55 41 39 21 8	474	1450 1419 1295	2452 2357 2155
					Number of occurences

4 th position

	Bit index	0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15	0.0 0.000	0.2	0.4 0.354 0.504 0.6 Bit sensitivity 0.251 0.354 0.354 0.395 0.354 0.354	0.8 0.742 0.830	1.0 1.000 0.950	Bit index	0 1 2 3 4 5 6 7 8 9 10 11 12 13 15 14	0.0	0.040	0.2	0.4 0.320 Bit sensitivity 0.6 0.667 0.8 0.736 0.720 0.907 1.0 1.000 0.720 0.619 0.589 0.436 0.720 0.680
	Bit index	0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15	(a) 1 st position 0.666 0.450 0.534 0.586 0.592 0.615 0.347 0.000 0.190 0.513 0.530 0.530	1.000	Bit index	0 1 2 3 4 5 6 7 8 9 10 11 12 13 15 14	0.000	(b) 2 nd position 0.495 0.502 0.160 0.508 0.451 0.241 0.704 0.247 0.124	0.821	0.996 1.000
			0.0	0.2	0.4	0.6 Bit sensitivity	0.8	1.0			0.0			0.2	0.4	0.6 Bit sensitivity	0.8	1.0
				(c) 3 rd position							(d)

Table 3 : Fault obtained when targeting the 0x37bd instruction at four different positions

 3

	Class	1 st	Position 2 nd 3 rd	4 th
	Crash	0	0	0	0
	Silent	39	2304 2589 197
	Fault	20 401 18 136 17 851 20 243
	Skip	11 694 8386 10 528 7606
	Partial update from the precharge value 8707 9750 7323 12 637

4 th position

	Bit index	0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15	0.0 0.000	0.2	0.4 0.266 0.335 Bit sensitivity 0.6 0.509 0.335 0.228 0.422 0.333 0.333	0.8	1.0 1.000 0.941	Bit index	0 1 2 3 4 5 6 7 8 9 10 11 12 13 15 14	0.0	0.025	0.2	0.4 0.325 Bit sensitivity 0.6 0.677 0.8 0.713 0.677 0.605 0.677 0.652	0.838	1.0 1.000 0.950
	Bit index	0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15	0.000		(a) 1 st position 0.742 0.459 0.499 0.560 0.591 0.311 0.541 0.458 0.453	1.000	Bit index	0 1 2 3 4 5 6 7 8 9 10 11 12 13 15 14	(b) 2 nd position 0.466 0.421 0.458 0.481 0.639 0.130 0.060 0.000	0.763	0.992 1.000
			0.0	0.2	0.4	0.6 Bit sensitivity	0.8	1.0			0.0		0.2	0.4	0.6 Bit sensitivity	0.8	1.0
				(c) 3 rd position							(d)

Table 4 : Fault obtained when targeting the 0x3eff instruction using the new device

 4

						Class						Position 2 nd 4 th
						Crash						0	2
						Silent						18 058 16 995
						Fault						2382 3443
						Skip						345	0
						Partial update from the precharge value 2037 3443
	Bit index	0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15	0.000 0.000 0.000 0.058	0.421 0.548 0.189 0.351 0.281 0.500	0.775 0.688	1.000	Bit index	0 1 2 3 4 5 6 7 8 9 10 11 12 13 15 14	0.005 0.162 0.001 0.000 0.001 0.009 0.009 0.008 0.001 0.016 0.019	0.281	1.000
			0.0	0.2	0.4	0.6 Bit sensitivity	0.8	1.0			0.0	0.2	0.4	0.6 Bit sensitivity	0.8	1.0
					(a) 2 nd position					(b)

4 th position

1: Target program to execute two new 32-bit instructions as a result of full merge.

	1 ADD R1, SP, 0x0	// 0xa900
	2 MOVS R0, R0	// 0x0000
	3 ADD R1, SP, 0x0	// 0xa900
	4 MOVS R0, R0	// 0x0000
	5 TST R0, R0	// 0x4200
	6 LSLS R5, R0, 0xc	// 0x0305
	7 TST R2, R0	// 0x4202
	8 LSLS R5, R0, 0x10	// 0x0405
	Listing 1.1 ADD R1, SP, 0x0	// 0xa900
	2 MOVS R0, R0	// 0x0000
	3 ADD R1, SP, 0x0	// 0xa900
	4 MOVS R0, R0	// 0x0000
	5 ADD R3, R0, R5	// 0xeb000305
	6 ADD R4, R2, R5	// 0xeb020405
	Listing 1.2:

Observed execution as a result of full merge on Listing 1.1. Partial merge

  In this case, only part of the fetched data at clock cycle i and the data fetched at clock cycle i + 1 is merged. The target code that is used for this example is shown in Listing 1.3.

	1 ADD R1, R1, 0x4	// 0xf1010104
	2 ANDS R2, R0	// 0x4002
	3 MOVS R0, R0	// 0x0000
	4 ADD R2, R2, 0xa	// 0xf102020a
	5 MOVS R4, R0	// 0x0004
	6 MOVS R0, R0	// 0x0000
	Listing 1.3: Target program for partial merge experiment.

Listing 1.4: Observed execution as a result of partial merge after targeting Listing 1.3.

	1 ADD R1, R1, 0x4	// 0xf1010104
	2 ANDS R2, R0	// 0x4002
	3 MOVS R0, R0	// 0x0000
	4 ADD R3, R3, 0xa	// 0xf103030a
	5 MOVS R6, R0	// 0x0006
	6 MOVS R0, R0	// 0x0000

5: Target program for PC modification experiments.

	1 R8 = address of line 11
	2 // series of 0x0000
	3 ADD R6, R1, 0x4c7	// 0xf20146c7
	4 ADD R3, R3, 0xa
	5 ADD R4, R4, 0xb
	6 ADD R5, R6, R3
	7 ADD R3, R3, 0xf
	8 // series of 0x0000
	9 ADD R5, R5, 0x5
	10 // series of 0x0000
	11 ADD R1, R1, 0x3
	12 ADD R9, R0, R6
	Listing 1.

ACKNOWLEDGMENTS

This work has been supported by the LabEx PERSYVAL-Lab (ANR-11-LABX-0025-01) and the French National Research Agency in the framework of the "Investissements d'avenir" program (ANR-15-IDEX-02).

R8, since we have that 0x4281 | 0x0446 = 0x46c7 (MOV PC, R8). The experimental success rate of this scenario was 95.11 %. This scenario is possible if we assume that the attacker is the software developer himself. Alternatively, the compiler used to compile the code may be untrusted and thus represent the attacker. As a countermeasure, a code review, based on the presented fault models, should be able to detect such Trojans.

Conclusion and future works

A new binary encoding fault model has been presented and defined: the partial update fault model, which comes in two variations: the partial update from the precharge value and the partial update from the previous value fault models. These fault models allow explaining a wide range of the faulty behaviors that are obtained when performing clock glitch fault injection campaigns. Therefore, they can be used to perform vulnerability analysis of software codes against these fault attacks, and help in better designing efficient and low-cost countermeasures.

We have also given an exploitation example: modifying the program counter can be achieved and explained through these fault models. Following that, we proposed a simple yet effective countermeasure against such vulnerability. We also examined the dependency of partial update from the precharge value fault model with respect to the target device and program.


Peizhao Liu

Yann Battie

Takaki Kimura

Yutaka Okazaki

Piyanan Pranee

Hao Wang

Emilie Pouget

Sylvain Nlate

Takashi Sagawa

Reiko Oda

Jumpei Kuno

Takuya Nakashima

Tingting Zhu

Junhua Luo

Chiral Perovskite Nanocrystal Growth inside Helical Hollow Silica Nanoribbons

Keywords: Silica nanohelices, perovskite nanocrystals, chiral shape, circular dichroism, circularly polarized luminescence

Helical perovskite nanocrystals (H-PNCs) were prepared using nanometric silica helical ribbons as platforms for the in situ growth of the crystals using the supersaturated recrystallization method. The H-PNCs grow inside nanometric helical porous silica, and their handedness is determined by the handedness of porous silica templates. They show both strong induced circular dichroism (CD) and strong induced circularly polarized luminescence (CPL) signals, with high dissymmetry gfactors. Right-handed and left-handed PNCs show respectively positive and negative CD and CPL signals, with a dissymmetry gfactor (abs and lum) of ∼±2 × 10 -2 . Simulations based on the boundary element method demonstrate that the circular dichroism originates from the chiral shape of H-PNCs.

P erovskite materials attract a lot of attention due to their outstanding optoelectronic properties and promising applications, such as solar cells and light-emitting diodes (LEDs). The lower trap densities [START_REF] Shi | Solar cells. Low trap-state density and long carrier diffusion in organolead trihalide perovskite single crystals[END_REF] and long carrier-diffusion length [START_REF] Dong | Solar cells. Electron-hole diffusion lengths > 175 mum in solution-grown CH3NH3PbI3 single crystals[END_REF] have led to the solar cells with efficiency up to 20%; 3 the higher photoluminescence quantum yields and tunable emission have enabled high-performance LEDs. [START_REF] Du | Focus on performance of perovskite light-emitting diodes[END_REF] Among various semiconductor nanocrystals, optically active (OA) ones are of particular interest, which can show strong circular dichroism (CD) and circularly polarized luminescence (CPL) signals, [START_REF] Chen | Two-Photon Absorption-Based Upconverted Circularly Polarized Luminescence Generated in Chiral Perovskite Nanocrystals[END_REF] second-harmonic generation (SHG), [START_REF] Yuan | Chiral Lead Halide Perovskite Nanowires for Second-Order Nonlinear Optics[END_REF] piezoelectricity, pyroelectricity, [START_REF] Naciri | Synthesis and Pyroelectric Properties of Novel Ferroelectric Organosiloxane Liquid Crystalline Materials[END_REF] ferroelectricity, [START_REF] Zhang | Toward the Targeted Design of Molecular Ferroelectrics: Modifying Molecular Symmetries and Homochirality[END_REF] and topological quantum properties. [START_REF] Sanchez | Topological chiral crystals with helicoid-arc quantum states[END_REF] The distinctive properties result in many potential and promising applications in chirophotoeletronics, such as CPL detector, [START_REF] Chen | Circularly polarized light detection using chiral hybrid perovskite[END_REF] circularly polarized LEDs, [START_REF] Kim | Chiralinduced spin selectivity enables a room-temperature spin lightemitting diode[END_REF] 3D display, [START_REF] Bisoyi | Light-Directing Chiral Liquid Crystal Nanostructures: From 1D to 3D[END_REF] quantum computing, [START_REF] Service | Ultrafast Lasers. Lighting the Way to a Quantum Computer[END_REF] quantum communication, [START_REF] Humphreys | Deterministic delivery of remote entanglement on a quantum network[END_REF] and spintronics. [START_REF] Michaeli | The electron's spin and molecular chirality -how are they related and how do they affect life processes?[END_REF][START_REF] Long | Chiral-perovskite optoelectronics[END_REF][START_REF] Naaman | Chiral Induced Spin Selectivity Gives a New Twist on Spin-Control in Chemistry[END_REF][START_REF] Naaman | Chiral-Induced Spin Selectivity Effect[END_REF][START_REF] Abendroth | Spin Selectivity in Photoinduced Charge-Transfer Mediated by Chiral Molecules[END_REF] The preparation of chiral perovskite materials therefore represents a particularly hot topic. Several review papers have described the ways to endow chirality to perovskite materials and their potential and promising applications. [START_REF] Long | Chiral-perovskite optoelectronics[END_REF][START_REF] Dang | Chiral halide perovskite crystals for optoelectronic applications[END_REF][START_REF] Ma | Recent Progress of Chiral Perovskites: Materials, Synthesis, and Properties[END_REF][START_REF] Dong | Chiral Perovskites: Promising Materials toward Next-Generation Optoelectronics[END_REF] The chirality generation in nanocrystals (NCs) can be roughly classified into four approaches: a) coordination of chiral ligands around NCs; [START_REF] Kuznetsova | Effect of Chiral Ligand Concentration and Binding Mode on Chiroptical Activity of CdSe/CdS Quantum Dots[END_REF][START_REF] Gao | Excitonic Circular Dichroism of Chiral Quantum Rods[END_REF][START_REF] Gao | Distinct Excitonic Circular Dichroism between Wurtzite and Zincblende CdSe Nanoplatelets[END_REF] b) chiral selforganization of NCs; 26-28 c) chiral lattice; [START_REF] Ben-Moshe | Enantioselective synthesis of intrinsically chiral mercury sulfide nanocrystals[END_REF][START_REF] Flack | Chiral and Achiral Crystal Structures[END_REF] and d) chiral shape. [START_REF] Wang | Assembled Suprastructures of Inorganic Chiral Nanocrystals and Hierarchical Chirality[END_REF][START_REF] Ben-Moshe | Enantioselective control of lattice and shape chirality in inorganic nanostructures using chiral biomolecules[END_REF][START_REF] Wang | Cooperative expression of atomic chirality in inorganic nanostructures[END_REF] The chiral ligands coordinated to the perovskite NCs can induce chiral distortion of the inorganic surface or chiral patterning of the surface ligands, and the electronic coupling between the chiral organic molecules and the inorganic structure results in optically active properties with a dissymmetric g-factor of ∼10 -3 . [START_REF] Long | Chiral-perovskite optoelectronics[END_REF] The chirality endowed to perovskite NCs by inorganic [START_REF] Liu | Chirality Induction to CdSe Nanocrystals Self-Organized on Silica Nanohelices: Tuning Chiroptical Properties[END_REF][START_REF] Liu | Optically Active Perovskite CsPbBr3 Nanocrystals Helically Arranged on Inorganic Silica Nanohelices[END_REF] or organic [START_REF] Shi | Endowing Perovskite Nanocrystals with Circularly Polarized Luminescence[END_REF] templates has also been reported giving the similar order of g-factor. Chiral organic ammonium cations could be incorporated into the perovskite lattice which results in a chiral lattice of an organic inorganic hybrid perovskite structure forming 1D and 2D structures with a higher g-factor up to 10 -2 . [START_REF] Ma | Recent Progress of Chiral Perovskites: Materials, Synthesis, and Properties[END_REF] In order to obtain chiral perovskite NCs with higher g-factors, perovskite NCs having a chiral shape would be an alternative approach. Indeed, recently there have been some reports of chiral shaped NCs, and the mechanism of the formation is attributed to the differential growth rates of chiral facets possibly mediated by the presence of chiral ligands [START_REF] Wang | Cooperative expression of atomic chirality in inorganic nanostructures[END_REF][START_REF] Orme | Formation of chiral morphologies through selective binding of amino acids to calcite surface steps[END_REF][START_REF] Lee | Amino-acid-and peptide-directed synthesis of chiral plasmonic gold nanoparticles[END_REF][START_REF] Duan | Optically active chiral CuO ″nanoflowers″[END_REF] or the intrinsic chiral crystal structure. [START_REF] Hazen | Chiral selection on inorganic crystalline surfaces[END_REF][START_REF] Ernst | Molecular chirality in surface science[END_REF] Another proposed mechanism is that the nuclei of the crystals contain screw dislocations which create a more reactive crystal growth front. [START_REF] Meng | Screw dislocation driven growth of nanomaterials[END_REF][START_REF] Shtukenberg | Growth actuated bending and twisting of single crystals[END_REF][START_REF] Liu | Helical van der Waals crystals with discretized Eshelby twist[END_REF][START_REF] Ben-Moshe | The chain of chirality transfer in tellurium nanocrystals[END_REF][START_REF] Bierman | Dislocation-driven nanowire growth and Eshelby twist[END_REF] Such screw-dislocationmediated growth yields a helical or twisted shape. The growth of nanomaterials such as CdSe, [START_REF] Parala | Confinement of CdSe Nanoparticles Inside MCM-41[END_REF] CdS, [START_REF] Li | Preparation of Cadmium Sulfide Nanowire Arrays in Anodic Aluminum Oxide Templates[END_REF][START_REF] Hirai | Size-Selective Incorporation of CdS Nanoparticles into Mesoporous Silica[END_REF] and InP 47 inside hollow structure materials [START_REF] Lu | Nanocasting: A Versatile Strategy for Creating Nanostructured Porous Materials[END_REF][START_REF] Martin | Nanomaterials: a membrane-based synthetic approach[END_REF][START_REF] Zhang | Templated Growth of Crystalline Mesoporous Materials: From Soft/Hard Templates to Colloidal Templates[END_REF] was also reported. PNCs such as hybrid CH 3 NH 3 PbBr 3 [START_REF] Longo | Highly luminescent perovskite-aluminum oxide composites[END_REF] and inorganic CsPbX 3 (X = Cl, Br, I or their mixture) [START_REF] Zhang | Ceramic-like stable CsPbBr3 nanocrystals encapsulated in silica derived from molecular sieve templates[END_REF][START_REF] Dirin | Harnessing Defect-Tolerance at the Nanoscale: Highly Luminescent Lead Halide Perovskite Nanocrystals in Mesoporous Silica Matrixes[END_REF][START_REF] Zong | Spatial and chemical confined ultra-small CsPbBr3 perovskites in dendritic mesoporous silica nanospheres with enhanced stability[END_REF] were shown to grow inside the hollow materials with high luminescence due to their halide self-passivation [START_REF] Liu | Halide-Rich Synthesized Cesium Lead Bromide Perovskite Nanocrystals for Light-Emitting Diodes with Improved Performance[END_REF] and defect tolerance. [START_REF] Dirin | Harnessing Defect-Tolerance at the Nanoscale: Highly Luminescent Lead Halide Perovskite Nanocrystals in Mesoporous Silica Matrixes[END_REF] Meanwhile, so far, there is no report on clearly morphologically helical/twisted shaped perovskite NCs and the resulting chirality induction.

Inspired by these observations, we prepared helical PNCs. Their growth is assisted by the hollow silica ribbons via supersaturated recrystallization methods. The solution of ion precursors of perovskite was drop-casted on a surface on which the left-/right-handed hollow helical silica ribbons have first been deposited. During the solvent evaporation, the perovskite NCs grow in the hollow inner space of left-or right-handed chiral shape. These H-PNCs obtained with this very simple method show strong CD and CPL mirror images with a dissymmetry g-factor up to 2 × 10 -2 which is much higher than the previously reported values from the chiral perovskite NCs (in the range of 10 -3 ). It should be noted that in the whole process of crystallization, no chiral ligands are used. The formation of chiral shaped H-PNCs originates solely from the confined crystallization of the ions in the hollow silica ribbons.

As previously reported, right-or left-handed silica nanohelices were synthesized using cationic bis-quaternary ammonium gemini surfactants of chemical formula C 2 H 4 -1,2-((CH 3 ) 2 N + C 16 H 33 ) 2 , noted hereafter 16-2-16, which selfassemble in water to form nanometric helical structures in the presence of tartrate counterions. With L tartrate, 16-2-16 formed right-handed helices, and with D tartrate, left-handed helices are formed. [START_REF] Oda | Tuning bilayer twist using chiral counterions[END_REF][START_REF] Brizard | temperature, and time modulation of nanometric chiral ribbons from gemini-tartrate amphiphiles[END_REF] The resulting nanohelices were used as templates for the sol-gel condensation of tetra-alkoxysilane to obtain silica nanohelices. [START_REF] Sugiyasu | Double helical silica fibrils by sol-gel transcription of chiral aggregates of gemini surfactants[END_REF][START_REF] Delclos | Individualized silica nanohelices and nanotubes: tuning inorganic nanostructures using lipidic self-assemblies[END_REF] The organic template Gemini-L/ D-tartrate was washed away leaving helical pores inside the silica helices. Tip-sonication was used to cut the helices and to obtain a homogeneous suspension in ethanol. Using these porous silica nanohelices as templates, two methods were developed to obtain the H-PNCs as shown in Figure 1. The two-step method is to first drop-cast the suspension of porous silica helices. When a film of dried deposition of helices is obtained, a DMF solution of a stoichiometric mixture of ion precursors (SI) is drop-casted on the film. For the one step method, the various amounts of hollow silica helical ribbons were mixed with the solution of ion precursors in DMF, the suspension was drop-casted on a quartz substrate, and DMF was dried to obtain a film. With both methods, upon solvent evaporation, and the increased concentration of the ion mixture with much higher electron density (higher contrast), domains are observed inside the silica helical ribbons forming helical structures due to the supersaturated recrystallization.

We then investigated the optimal conditions to obtain the highest chiroptical signals by varying the parameters such as the relative concentration of ions/silica helices and temperature during the drying. For 1 mg of silica helical ribbons, the volume of hollow helical space is estimated as 2.84 × 10 -4 cm 3 , as shown in Scheme (SI) and Table S1. If this volume is filled with CsPbBr 3 PNCs (4.42 g/mL), this would correspond to 1.25 mg of PNCs of 54 μL of ion precursors.

For the H-PNCs obtained by the two-step method, different quantities of silica helical ribbon suspension in ethanol (10 μg, 20 μg, 50 μg, 100 μg, and 200 μg) were first drop-casted and dried on the surface of the quartz slide at room temperature. Then, 10 μL of the above-mentioned ion precursor solution (230 μg) in DMF was drop-casted and allowed to dry at room temperature. This corresponds to the weight ratios of Cs + Pb 2+ Br -/silica helices of 23, 11.5, 4.6, 2.3, and 1.15. Considering our calculation on the weight ratio of ion precursors to inner helical space of silica ribbons of 1.25 for the fully filled helices, for most of these samples, the ions are in large excess. Such helical crystalline structures show UV-vis (first absorption peak at 508 nm) and fluorescence (ex @365 nm) spectra which correspond to the typical signals obtained from perovskite nanocrystals. [START_REF] Protesescu | Nanocrystals of Cesium Lead Halide Perovskites (CsPbX(3), X = Cl, Br, and I): Novel Optoelectronic Materials Showing Bright Emission with Wide Color Gamut[END_REF] These helices also show remarkably strong induced CD and CPL signals, the signs of which depend on the handedness of the helices (Figure 2): the PNC with left-handed (right-handed) silica helical ribbons shows negative (positive) CD and CPL signals, respectively. The CD and CPL were measured with two azimuth angles at 0°and 90°, respectively, and accumulated to minimize the LD effect. Both CD-Abs and CPL-PL increases with lower Cs + Pb 2+ Br -/silica helices ratios, indicating the increase in the quantity of chiral PNCs inside silica helices with respect to the achiral ones outside the helices.

Detailed observation of these dark domains with high resolution TEM (HRTEM) shows that they are inside the pore of the silica helices replacing washed away gemini surfactants (Figure 2(e)). The average dimension of these helices is around 23 nm wide and 60 nm pitch, in good agreement with the size of the inner pore of the silica helices. [START_REF] Liu | Chiral optical scattering from helical and twisted silica nanoribbons[END_REF][START_REF] Oda | Molecular Structure of Self-Assembled Chiral Nanoribbons and Nanotubules Revealed in the Hydrated State[END_REF] To further investigate the nature of these helical dark domains specifically, the electron diffraction method was carried out. Although the helical dark domains are very small (Figure 2f), the selected area electron diffraction (SAED) technique allows us to target the helical and crystal dark domains inside the silica helices while avoiding the contamination from the crystal information on the materials produced outside of silica helices. The selected area electron diffraction (SAED) pattern was clearly observed (Figure 2f) from the red circle area in Figure S2(a). Since silica nanohelices are amorphous structures, the observed SAED pattern indicates that the helical dark domain is composed of crystalline structures. The observed spots, 113), (202), and/or (022) planes of the orthorhombic phase of the CsPbBr 3 perovskite nanocrystal, respectively. These results support the existence of the CsPbBr 3 perovskite structure in the helical dark domains. As shown in Figures 5 andS6, even in the saturation conditions (Cs + Pb 2+ Br -/silica helices > 1.25), the PNCs grew only in part of the silica helices.

The importance of the nanospace of silica helices for perovskite crystallization was clearly demonstrated by the strong increase of the fluorescence in the presence of silica helices compared to the substrates on which the CsPbBr 3 ion mixture is deposited alone in the absence of silica helices (Figure 2c, Figures S3 andS4). The solution of the CsPbBr 3 ion mixture was drop-casted on bare quartz substrates in the presence of various quantities of helical hollow silica nanoribbons (Cs + Pb 2+ Br -/silica helices: 11.5, 4.6, 2.3, and 1.15, and no silica helices) and irradiated by UV light (@365 nm). In the absence of silica helices, extremely weak fluorescence was observed, whereas a clear increase of the fluorescence was observed in the presence of the helices. The fluorescence property of H-PNCs was quantitatively evaluated by studying the photoluminescence quantum yield (PLQY). The internal and external PLQY were 3.9% and 0.8%, respectively. Such low values of PLQY compared with other CsPbBr 3 PNCs 52-54 might be due to the weak emission of PNCs outside silica on the film. The emission intensity from the H-PNC film under UV light is bright enough to be observed by the naked eye (Figure S3). We have also observed that silica helices play an important role for the stability of the PL intensity. PL intensity of the H-PNC film was stable at least during 3 months even when the sample was kept under room light, humidity, and temperature (Figure S5).

The PNC helices show g abs (∝ normalized CD signals by absorbance) ∼4 × 10 -3 for Cs + Pb 2+ Br -/silica helices = 1.15 and show an exponential decrease with the increasing Cs + Pb 2+ Br -/silica helices ratio. Interestingly g lum (∝ normalized CPL signals by fluorescence) is globally much higher, ∼2 × 10 -2 for the Cs + Pb 2+ Br -/silica helices ratio around 2.3, and decreased more slowly with the increasing Cs + Pb 2+ Br -/silica helices ratio. This is probably because the proportion of achiral and larger NCs which forms outside the helices (Figure S3, S6) with respect to the chiral PNCs inside the helices increases with the decreasing quantity of silica ribbons. While both achiral and chiral NCs show similar absorbance but only chiral NCs show the CD signal, the achiral NCs show weaker fluorescence (FL) and no CPL signal. Only the PNCs inside the silica helical ribbons show both CPL and FL signals due to the confined size and surface passivation of the latter. Therefore, g lum ∝ CPL chiral PNCs /(FL chiral PNCs + FL achrial PNCs ) ≈ CPL chiral PNCs /FL chiral PNCs (outside achiral PNCs show weak luminescence) and g abs ∝ CD chiral PNCs /(Abs chiral PNCs + Abs achrial PNCs ). With a decreasing relative quantity of hollow silica helical ribbons, more NCs (absorbing but nonfluorescent) grow outside the hollow silica. This may explain why globally g lum > g abs and also why g abs decreases more drastically than g lum with increasing the Cs + Pb 2+ Br -/silica helices ratio.

The extinction cross-section and the CD signals of helical PNCs were simulated using the boundary element method. [START_REF] Hohenester | Simulating electron energy loss spectroscopy with the MNPBEM toolbox[END_REF] This method solves the Maxwell's equations for a complex interface which separates homogeneous isotropic medium. In our case, we consider two interfaces. The first one separates the air and the silica shell, while the second one separates the silica shell and the PNC cores. The dimensions of the structure are given in the scheme (SI). The height, thickness, width, diameter, and the pitch of the helical structure are 300 nm, 6 nm, 17 nm, 27, and 60 nm, respectively, as observed from the TEM images. The dielectric function of the silica shell is taken from the Palik handbook, [START_REF] Palik | Handbook of Optical Constants of Solids[END_REF] while the dielectric function of PNC comes from ref 65. The incident wave vector is perpendicular to the helix axis. Figure 3b shows the simulated extinction, scattering, and absorption cross section. For unpolarized incident light, left-handed H-PNC exhibits the same optical response as right-handed H-PNC. The absorption cross section is equal to 0 for a wavelength higher than 550 nm i.e. the band gap of PNC. However, due to the scattering effect, the extinction cross section does not vanish. A band centered at 517 nm is clearly observed in the absorption and extinction cross section spectra of H-PNC. This band is assigned to the resonant transition between the valence and conduction bands of PNC. The multiple peaks seen in the absorbance between 470 and 495 nm are the noise due to the light source of the CD apparatus. Corresponding (b) g abs at 504 nm and (d) g lum at 514 nm (ex @ 365 nm) variation for the different ratios of Cs + Pb 2+ Br -/silica helices. Both CD-Abs and CPL-PL increase with lower Cs + Pb 2+ Br -/silica helices ratios. (e) HRTEM image and (f) SAED pattern of CsPbBr 3 -R-silica helices (inset shows the domain of the sample observed with SAED).

The simulated CD signals, evaluated from the difference between the extinction cross sections simulated for left-and right-handed circular polarizations, are depicted on Figure 3b. They are in agreement with the measured ones in terms of their shapes and their signs depending on the handedness of the helices, confirming that this signal is related to the chiral shape of H-PNC. The CD intensity decreases with the increasing wavelength. It exhibits a band centered at 517 nm, i.e. the same wavelength as the resonant transition of electrons in PNC. According to Figure 3b, the small CD value observed above the band gap of PNC is related to the scattering effect. Such scattering (and chiral scattering) contribution was again confirmed experimentally using diffusion reflection CD (DRCD) measurements (Figure S10). However, both experimental signals and simulation unambiguously show that the absorbance and the absorbance based circular dichroism are the major contribution of the signals.

The crystallization of the PNCs inside the hollow silica helical ribbons is also affected by the solvent evaporation speed. As shown in Figure 4, the PNCs grown at lower temperatures (6.8 and 20 °C) show higher values of g abs than those grown at higher temperatures (35 and 50 °C). TEM images (Figure 5) show that at high temperatures, larger and achiral crystals grow outside the silica helical ribbons. This is in good agreement with the red shift observed with emission spectra, i.e. the broadening of the emission spectra originates from the emission of a larger size of achiral PNC growth outside the hollow silica ribbons.

In sum, the lower the evaporation temperature and the slower the evaporation speed, the higher the ratio of helical and chiral PNC with respect to the achiral crystal growth outside the silica helical ribbons showing higher G values.

We also verified that the observed CD and CPL signals are not due to the chiral scattering from silica helices. [START_REF] Liu | Chiral optical scattering from helical and twisted silica nanoribbons[END_REF] Silica helices and achiral quantum dots (QDs) were drop-casted on the same side (in contact) or opposite side (not in contact) of the quartz: no detectable CD and CPL were observed (Figure S8) confirming that the observed CD and CPL by the PNC inside the silica nanohelices do not originate from the chiral scattering of the silica helices.

The chiroptical properties were also observed from PNCs grown with the one-step method. 0.5 mL ion precursor solutions in DMF with a concentration (0.04 M, 23 mg/mL, corresponding to 11.5 mg) were mixed with different amounts of silica helical ribbons: 0.5, 1.0, 1.5, 2.0 mg. This corresponds to Cs + Pb 2+ Br -/silica helices = 23, 11.5, 7.7, and 5.8. Then, 50 μL of each suspension was drop-casted on the surface of quartz slides (1 × 1 cm) and dried at room temperature. Similar helical domains with higher electron densities were observed as the ones obtained with the two-step method. CD and CPL signals with slightly lower g-factors (g abs ∼ 2 × 10 -3 , g lum ∼ 1 × 10 -2 ) were observed (Figure S9).

The effect of the replacement of Br -by I -was investigated. Here, the ion precursors were prepared by dispersing CsBr, CsI, PbBr 2 , and PbI 2 in DMF with different ratios of Br and I, keeping the stoichiometric ratio between Cs:Pb:Br:I = 1:1:x:3x. The solution of mixed halide ion precursor (10 μL, 0.04 M), x = 0, 0.75, 1.5, was drop-casted on the surface of the 100 μg silica helices quartz substrate. Although the TEM images show a similar contrast increase of some of the silica helices (Figures S11(a-c)), while the dried sample showed strong CD signals (Figure S12, right-(left)-handed samples show positive (negative) signals), these samples were not emissive, and the absorption spectra show a blue shift to 420 nm which results from the yellow nonperovskite polymorph. [START_REF] Sutton | Cubic or Orthorhombic? Revealing the Crystal Structure of Metastable Black-Phase CsPbI3 by Theory and Experiment[END_REF][START_REF] Eperon | Inorganic caesium lead iodide perovskite solar cells[END_REF] The H-PNCs (CsPbBr 3 ) have been successfully prepared by two supersaturated recrystallization methods assisted by the hollow silica ribbons. Both one-step and two-step methods show strong optical activities both for CD and CPL. The twostep method shows a larger g-factor and easier control of the ratio of silica and ion precursor with a dissymmetric g-factor up to 2 × 10 -2 . Both the ratios of the silica ribbons and ion precursors and the solvent evaporation temperature show a significant effect on the PNC growth inside and outside the hollow silica ribbons which has a strong effect on the g lum and g abs . For the mixed halide ions (Br -and I -), a yellow nonperovskite type nanocrystal grows inside the hollow silica helical ribbons, which showed strong CD, while no emission was observed. The versatile and simple method to prepare the chiral shaped PNCs with high g-factors prepared inside the hollow silica ribbons would enrich the chiral group of PNCs for their further applications.

■ ASSOCIATED CONTENT

* sı Supporting Information Detailed experimental conditions as well as characterization; additional figures describing the models of silica helical/twisted ribbons and their hollow volume calculations, SEM, SAED pattern of helical PNCs, photographs of PNCs@silica helical ribbons under room light and UV light at 365 nm, Photoluminescence and photoluminescence quantum yield of PNCs@silica helical ribbons, TCD, DRCD, CPL, g-factor of CsPbBr x I (1-x) @silica helical/twisted ribbons (PDF)

■ AUTHOR INFORMATION

Figure 1 .

 1 Figure 1. Scheme of the H-PNC growth inside the hollow silica helical ribbons through one-step or two-step drop casting methods and the TEM images of empty and PNC filled silica helices.

Figure 2 .

 2 Figure 2. (a) CD, absorption and (c) CPL, DC (ex@365 nm) spectra of CsPbBr 3 -R/L-silica helices grown at different ratios of Cs + Pb 2+ Br -/ silica helices for a given quantity of ions (230 μg, 10 μL of 0.04 M).The multiple peaks seen in the absorbance between 470 and 495 nm are the noise due to the light source of the CD apparatus. Corresponding (b) g abs at 504 nm and (d) g lum at 514 nm (ex @ 365 nm) variation for the different ratios of Cs + Pb 2+ Br -/silica helices. Both CD-Abs and CPL-PL increase with lower Cs + Pb 2+ Br -/silica helices ratios. (e) HRTEM image and (f) SAED pattern of CsPbBr 3 -R-silica helices (inset shows the domain of the sample observed with SAED).

Figure 3 .

 3 Figure 3. (a) Dimension of the PNC helix used for the simulation. (b) Simulated circular dichroism of H-PNCs. (c) Extinction, absorption, and scattering cross sections of H-PNC simulated by the boundary element method for unpolarized incident light.

Figure 4 .

 4 Figure 4. CD, absorption (a) and CPL, DC (b) spectra of CsPbBr 3 -R/L-silica helices growth at different evaporation temperatures.Relative ratio of inside and outside PNCs (c) and g abs , g lum (d) of CsPbBr 3 -R-silica helices growth at different evaporation temperatures and evaporation speeds. The relative ratio of inside and outside PNCs was calculated by the DC curves fitting (FigureS7). All CPL and DC spectra were measured under the irradiation of 365 nm excitation light.

Figure 5 .

 5 Figure 5. Lower magnification of TEM images of PNC growth at 6.8 °C (a), 20 °C (b), 35 °C (c), and 50 °C (d), respectively.

Corresponding Author

Reiko Oda -Univ. Bordeaux, CNRS, Bordeaux INP, CBMN, UMR 5248, 33600 Pessac, France; WPI-Advanced Institute for Materials Research, Tohoku University, 980-8577 Sendai, Japan; orcid.org/0000-0003-3273-8635; Email: reiko.oda@u-bordeaux.fr Authors Peizhao Liu -Univ. Bordeaux, CNRS, Bordeaux INP, CBMN, UMR 5248, 33600 Pessac, France; Graduate School of Energy Science, Kyoto University, 606-8501 Kyoto, Japan Yann Battie -Université de Lorraine, Laboratoire de Chimie et Physique -Approche Multi-échelles des milieux Complexes, (LCP-A2MC), 57078 Metz, France; orcid.org/0000-0003-2421-2684 Takaki Kimura -Graduate School of Energy Science, Kyoto University, 606-8501 Kyoto, Japan; orcid.org/0000-0003-1989-0149 Yutaka Okazaki -Graduate School of Energy Science, Kyoto University, 606-8501 Kyoto, Japan; orcid.org/0000-0003-2261-5914 Piyanan Pranee -Univ. Bordeaux, CNRS, Bordeaux INP, CBMN, UMR 5248, 33600 Pessac, France Hao Wang -Univ. Bordeaux, CNRS, Bordeaux INP, CBMN, UMR 5248, 33600 Pessac, France Emilie Pouget -Univ. Bordeaux, CNRS, Bordeaux INP, CBMN, UMR 5248, 33600 Pessac, France; orcid.org/ 0000-0002-3175-6201 Sylvain Nlate -Univ. Bordeaux, CNRS, Bordeaux INP, CBMN, UMR 5248, 33600 Pessac, France Takashi Sagawa -Graduate School of Energy Science, Kyoto University, 606-8501 Kyoto, Japan; orcid.org/0000-0002-0908-0487 Complete contact information is available at:

Author Contributions

T he manuscript was written through contributions of all authors. All authors have given approval to the final version of the manuscript.

Notes

T he authors declare no competing financial interest.

■ ACKNOWLEDGMENTS

This work was supported by the France-Japan International Associated Laboratory, Chiral Nanostructures for Photonic Applications (LIA_CNPA_RO_R175_UBx-DRI DAJ DIRVED) as well as the Centre National de la Recherche Scientifique and Université de Bordeaux. Y.O. acknowledges the JSPS Overseas Research Fellowship. P.L. and H.W. are grateful for financial support from the Chinese Scholarship Council (CSC). P.L. thanks CNRS for the fellowship.