SCA and Fault Attacks Against RFID Tags

Introduction

Side-channel attacks are one of the most powerful attacks against cryptographic devices. By measuring physical values (side channels) such as the power consumption or the electromagnetic emanation, information can be exploited that allows the extraction of the secret key stored in the device. In contrast, fault attacks attempt to cause failures during the processing of cryptographic operations. As erroneous messages are returned or unintended program flows are observed, mathematical cryptanalysis can be applied to compromize its secret.

IAIK attacks RFID systems using methods from side-channel analysis and from fault analysis. The goal of this research activity is to find countermeasures against these types of attacks. Countermeasures are necessary as soon as cryptography is implemented on passive RFID tags.

Our objectives are:

• Develop countermeasures against side-channel analysis and fault attacks
• Evaluate and analyze existing side-channels and countermeasures
• Provide high level of protection in relation to their implementation cost
• Find new attacking methodologies to be able to design good and effective countermeasures against it

SCA on HF RFID Tags

Side-channel analysis on RFID tags is typically done by exploiting the electromagnetic emanation of the tag. Especially for HF RFID systems, the strong RF field, which is generated by the reader, disturbs the measurement of the very weak side-channel information. To improve this low signal-to-noise ratio (SNR), several techniques can be applied that are listed in the following.

Frequency-selective filters Band-pass and Band-stop filters may be applied to perform frequency selective measurements. They are used to filter out the carrier frequency of the reader and to amplify specific sideband signals of the harmonic-rich clock frequency of RFID tags.
Helmholtz arrangement A measurement bridge is used to cancel out the interfering reader field. The special arrangement of a reader antenna and two sense coils in parallel allows power consumption measurements of passively powered devices. This setup is normally used for compliance testing of proximity and vicinity cards.
Special EM probes and amplifiers We use small magnetic near-field antennas to measure the electromagnetic emanation of the tag. For HF measurements, we use probes which are less receptive to the carrier frequency of the reader (i.e. 13.56 MHz).
Contact-based communication (direct contact between tag and the reader) By directly contacting the antenna pads with the antenna output of an RFID reader, a field-less communication between reader and tag can be obtained. This setup allows the exploitation of electromagnetic emissions of the tag without interferences of a strong RF field.

SCA on UHF-RFID Tags

For UHF RFID tags, side-channel analysis can be conducted in the near-field and in the far field. Whereas measurements in the near-field allow analyzing the direct EM emissions of the tag IC, far-field measurements can be used to evaluate the signal that is backscattered by the tag antenna.

Direct Emissions in the Near Field With magnetic near-field antennas (the same as used for HF RFID tags), the direct emissions of the tag IC can be measured. Especially for higher class UHF RFID tags that are supplied by a battery and contain a microcontroller, this measurement technique achieves good results. The RF field which is of high frequency can be easily suppressed by applying a low-pass filter.

Parasitic backscatter in the Far Field For reader-to-tag communication, UHF RFID tags use backscatter modulation by varying the amount of power that is reflected by the tag antenna. Besides the intended backscatter modulation, the varying power consumption of the tag IC modulates the tag’s backscatter as well. This parasitic backscatter can be measured with a simple dipole antenna. Although the power consumption of UHF RFID tags is innately low, the parasitic backscatter effected can be detected even meters away from the tag.

Fault Attacks on RFID

In the following, the most promising fault-injection techniques are described which are applied to RFID devices.

Temperature variations RFID tags include analog circuits which are susceptible to temperature variations. Tags in high temperature conditions will not be able to communicate with the reader anymore. After a certain temperature limit, tags are unable to write data into the memory. Exceeding higher temperature limits will lead to a complete black out of the tags. In order to avoid the deformation of the tag antenna and the destruction of the label, the chip has to be preferably separated from its antenna before it is stressed with heating.
Power and clock variations (antenna tearing) In RFID, both the power supply and the clock signal are extracted out of the reader field. The RFID tag only possesses two input pads that are normally connected to the tag antenna. By temporarily conducting these input pads, the antenna is bypassed for a certain amount of time. Tearing attacks like on smart cards focus on such supply interruptions and have to be considered especially in contact-less powered devices.
Electromagnetic interferences A fast-changing electromagnetic field induces current into conductors. Such a field is generated by a fast-changing current that is flowing through a coil. RFID devices that operate in higher frequencies like UHF tags, are considered to be more sensitive to electromagnetic interferences. Their antenna is largely receptive to high frequency signals, which are around 900MHz.
Optical inductions A light beam that is focused on the surface of a chip can induce current. This current is often referred to as Optical Beam Induced Current (OBIC). This optical injection leads transistors to switch and causes faults during the processing of the chip. In order to induce faults, the light beam has to be focused on a n-p junction of the semiconductor. Thus, it is essential to have intervisibility to regions that are intended to be attacked. Many RFID tags are only covered by a transparent PET inlay. Parts of the chip are also hidden by the antenna circuit. Remaining PET layers, adhesive, and dirt can be either removed by carefully scratching off or by using chemicals. Optical faults can be induced very precisely in time and can be applied globally and locally. Moreover, they are semi-invasive and need the decapsulation of the chip. For tags that use transparent inlays, optical inductions are performed innately without further de-packaging. In this context, they are therefore considered to be non-invasive.

For more information please contact: Michael Hutter, Thomas Plos, Jörn-Marc Schmidt