High-precision self-characterization for the LUT burn-in information leakage threat

Information security in FPGAs is at risk; during system operation, data and usage patterns can potentially get imprinted into a chip´s physical characteristics, allowing an attacker to later recover intellectual property or cryptographic secrets. Can “data burn-in” vulnerabilities in FPGAs be characterized at low cost? Specifically, can slight shifts in path delays due to burn-in be measured with enough precision? This paper contributes methods for self-characterization of delay changes using novel isolation of key FPGA transistors, improved clock sweeping, and enhanced estimation from launch-andcapture data. Hardware experiments on 2048 Xilinx Kintex-7 paths demonstrate measurement precision of 30-60 femtoseconds, which is more than 10× finer than previous self-characterization results. Further, results show that unintentional burn-in of FPGA LUT contents does indeed occur and can in some cases be detected within a single week, highlighting the need to deploy countermeasures.