Escaping The Sandbox: Side Channel Shenanigans On Our DIY Chip
summary
Project moves from simulation to a DIY tapeout on Efabless Caravel after funding cuts, hitting a 10K tapeout 6‑week deadline. Open RV32 and AES cores undergo brute‑force single‑bit fault injection across every gate and cycle, revealing ~48 sensitive signals; 656 gates receive triple modular redundancy and gate count rises ~50%. The 150 nm chip proves functionally leaky: decap + a 100 µm probe show EM leakage dominated by bond‑wire power rails, and a failing management core prevents one RISCV block from running.
AI-written summary · about
chapters (13)
- 0:00Project motivation
- 2:02Designing the custom chip
- 4:07Chip architecture
- 6:22Fault injection testing
- 8:59Hardware hardening
- 11:47Post-manufacturing reality
- 14:20Side channel analysis
- 17:37Physical die examination
- 20:38Tracing power leakage
- 25:24Simulating power patterns
- 28:16Chip art tradition
- 30:45Research conclusions
- 33:43Q&A session
related talks
44mSilicon Under Attack Physical Exploitation Of Modern Chips
26mTiny Tapeout: custom silicon open to all
21mOpen Source IC Design and Hardware Reverse Engineering Or: How I Learned to Stop...
24mSystem Level Security Verification of RISC V Based SoCs
41mFault Attacks & Side Channels
32mSecSi Product Development
24mSecurity through Transparency: Tales from the RP2350 Hacking Challenge
27mReverse Engineering Custom ASICs By Exploiting Supply-Chain Leaks