Extraction of Secrets from 40nm CMOS Gate Dielectric Breakdown Antifuses by FIB...
summary
Extraction of keys from a 40nm microcontroller using FIB passive voltage contrast recovers the bitwise OR of adjacent rows, allowing antifuse OTP arrays to be imaged after 1 day sample prep + a few hours FIB. The team reverse-engineers floorplan and cell layout, deprocesses to contacts, maps 24-bit planes and mirroring, and produces readable bit-plane dumps and usable secret keys. Recommended mitigations: encrypt data at rest or program complementary paired bits.
AI-written summary · about
chapters (10)
- 0:00Secure boot flow intro
- 1:59Locating fuse array
- 4:27Deprocessing bit cell
- 7:38Antifuse bit cell cross-section
- 9:26Reading antifuse cells
- 12:17FIB voltage contrast
- 15:05FIB bit cell imaging
- 18:56Reverse engineering address map
- 20:21Extracting fuse data
- 21:45Mitigations and conclusions
related talks
33mBreaking Into Chips By Reading The Datasheet
01h 03mHack To Discover Weaknesses In A Series Of Smartcards
57mHardware security evaluation of Intel MAX 10 FPGAs
45mBits From The Matrix: Optical ROM Extraction
45mIntegrated Circuit Offensive Security
36mOpen Sesame - Or How Secure Is Your Stuff In Electronic Lockers
48mReverse-Engineering the Supra iBox: Exploitation of a Hardened MSP430-Based Device
48mFatal Fury on ESP32: Time to Release Hardware Exploits