Clock glitch fault injection attack on an FPGA-based non-autonomous chaotic oscillator

  • Talal BonnyEmail author
  • Qassim Nasir
Original Paper


Chaos-based true random bit generators have been demonstrated in many studies to be feasible and secure for crypto-system applications. In this work, we demonstrate that an FPGA-based non-autonomous chaotic oscillator, used as a true random number generator, can be compromised via cryptanalysis attacks. First, we realize non-autonomous chaotic oscillator (previously implemented only in analog form) on a modular FPGA platform. The oscillator architecture is simplified to eliminate the Sin function and is described in details in VHDL. Then, we propose chaotic oscillator attacking system including clock glitch generator to compromise the oscillator by injecting glitches on function clock. The parameters and positions of those glitches are carefully determined to achieve a successful attack. The experimental results show that the system is attacked, and the generated glitched bit-streams are distorted, unlike the bit-streams generated without glitching. The randomness of the generated bit-streams is checked using the NIST test tool.


Non-autonomous chaotic oscillators Clock glitch NIST FPGA 


Compliance with ethical standards

Conflict of interest

The authors declare that they have no conflict of interest.


  1. 1.
    Saleh, S.: A secure data communication system using cryptography and steganography. Int. J. Comput. Netw. Commun. (IJCNC) 5(3), 125–137 (2013)CrossRefGoogle Scholar
  2. 2.
    Sunar, B.: True random number generators for cryptography. In: Koç, Ç.K. (ed.) Cryptographic Engineering. Springer, Boston, MA (2009)Google Scholar
  3. 3.
    Filali, R.L., Benrejeb, M., Borne, P.: Observer-based secure communication design using discrete-time hyperchaotic systems. Commun. Nonlinear Sci. Numer. Simul. 19(5), 1424–1432 (2014)MathSciNetCrossRefGoogle Scholar
  4. 4.
    Ergun, S., O zoguz, S.: Truly random number generators based on a non-autonomous chaotic oscillator. Int. J. Electron. Commun. 61, 235–242 (2007)CrossRefGoogle Scholar
  5. 5.
    Ren, G., Zhou, P., Ma, J., Cai, N., Alsaedi, A., Ahmad, B.: Dynamical response of electrical activities in digital neuron circuit driven by autapse. Int. J. Bifurc. Chaos 27(12), 1750187 (2017)MathSciNetCrossRefGoogle Scholar
  6. 6.
    Bonny, T., Aldebsi, R., Majzoub, S., Elwakil, A.S.: Hardware optimized FPGA implementations of high speed true random bit generators based on switching-type chaotic oscillators. J. Circuits Syst. Signal Process. 38, 1342 (2019)CrossRefGoogle Scholar
  7. 7.
    Ma, J., Zhou, P., Ahmad, B., Ren, G., Wang, C.: Chaos and multi-scroll attractors in RCL-shunted junction coupled Jerk circuit connected by memristor. PLoS ONE 13(1), e0191120 (2018)CrossRefGoogle Scholar
  8. 8.
    Dong, E.Z., Yuan, M.F., Zhang, C., Tong, J.G., Chen, Z.Q., Du, S.Z.: Topological horseshoe analysis, ultimate boundary estimations of a new 4D hyperchaotic system and its FPGA implementation. Int. J. Bifurc. Chaos 28(07), 1850081 (2018)MathSciNetCrossRefzbMATHGoogle Scholar
  9. 9.
    Bonny, T., Henkel, J.: LICT: left-uncompressed instructions compression technique to improve the decoding performance of VLIW processors. In: Design Automation Conference (DAC09), pp. 903–906, USA (2009)Google Scholar
  10. 10.
    Bonny, T., Affan Zidan, M., Salama, K.N.: An adaptive hybrid multiprocessor technique for bioinformatics sequence alignment. In: International Conference on Biomedical Engineering Conference (2010)Google Scholar
  11. 11.
    Bonny, T., Henno, S.: Image edge detectors under different noise levels with FPGA implementations. J. Circuits Syst. Comput. 27(13), 1850209 (2018)CrossRefGoogle Scholar
  12. 12.
    Bonny, T., Rabie, T., Abdul Hafez, A.H.: Multiple histogram-based face recognition with high-speed FPGA implementation. J. Multimed. Tools Appl. 77(18), 24269–24288 (2018)CrossRefGoogle Scholar
  13. 13.
    Trejo-Guerra, R., Tlelo-Cuautle, E., Carbajal-Gomez, V.H., Rodriguez-Gomez, G.: A survey on the integrated design of chaotic oscillators. Appl. Math. Comput. 219(10), 5113–5122 (2013)MathSciNetzbMATHGoogle Scholar
  14. 14.
    Koyuncu, I., Ozcerit, A.T., Pehlivan, I.: Implementation of FPGA-based real time novel chaotic oscillator. Nonlinear Dyn. 77(1–2), 49–59 (2014)MathSciNetCrossRefGoogle Scholar
  15. 15.
    Chen, C., Chen, H., Ma, H., Meng, Y., Ding, Q.: FPGA implementation of a UPT chaotic signal generator for image encryption. Pac. Sci. Rev. A Nat. Sci. Eng. 17(3), 97–102 (2015)Google Scholar
  16. 16.
    De Micco, L., Larrondo, H.A.: Methodology for FPGA implementation of a chaos-based AWGN generator. In: Gazzano, J.D.D. (ed.) Field-Programmable Gate Array (FPGA) Technologies for High Performance Instrumentation. IGI Global, Hershey (2016)Google Scholar
  17. 17.
    Qiu, M., Yu, S., Wen, Y., et al.: Design and FPGA implementation of a universal chaotic signal generator based on the Verilog HDL fixed-point algorithm and state machine control. Int. J. Bifurc. Chaos 27(3), 1750040–1750055 (2017)CrossRefzbMATHGoogle Scholar
  18. 18.
    Bonny, T., Elwakil, A.S.: FPGA realizations of high speed switching-type chaotic oscillators using compact VHDL codes. J. Nonlinear Dyn. 93(2), 819–833 (2018)CrossRefGoogle Scholar
  19. 19.
    Tlelo-Cuautle, E., Quintas-Valles, A., de la Fraga, L., et al.: VHDL descriptions for the FPGA implementation of PWL-function-based multi-scroll chaotic oscillators. PLoS ONE 11(12), e0168300 (2016)CrossRefGoogle Scholar
  20. 20.
    SPROTT, J.C.: Chaos and Time–Series Analysis, p. 507. Oxford University Press, Oxford (2003). ISBN 01-985-0840-9zbMATHGoogle Scholar
  21. 21.
    Kowalski, J.M., Albert, G.L., Gross, G.W.: Asymptotically synchronous chaotic orbits in systems of excitable elements. Phys. Rev. A 15 42(10), 6260–6263 (1990)CrossRefGoogle Scholar
  22. 22.
    Kennedy, M.P.: Robust OP AMP realization of Chua’s circuit. Frequenz 46, 66–80 (1992)CrossRefGoogle Scholar
  23. 23.
    Kennedy, M.P.: Chaos in the Colpitts oscillator. IEEE Trans. Circuits Syst. I Fundam. Theory Appl. 41, 771–774 (1994)CrossRefGoogle Scholar
  24. 24.
    Sivaganesh, G.: Analytical study of an MLC circuit with quasiperiodic forcing. Chin. J. Phys. 52(6), 1760–1769 (2014)MathSciNetGoogle Scholar
  25. 25.
    Dong, E.Z., Liang, Z.H., Du, S.Z., Chen, Z.Q.: Topological horseshoe analysis on a four-wing chaotic attractor and its FPGA implementation. Nonlinear Dyn. 83(1–2), 623–630 (2016)CrossRefGoogle Scholar
  26. 26.
    Giancane, L.: Side-channel attacks and countermeasures. In: The Design Of Secure Ic’s Devices For Cryptographic Applications. University of Roma (2011)Google Scholar
  27. 27.
    Endo, S., Sugawara, T., Homma, N., Aoki, T., Satoh, A.: An on-chip glitchy-clock generator for testing fault injection attacks. J. Cryptogr. Eng. 1, 265 (2011)CrossRefGoogle Scholar
  28. 28.
    Ma, Jun, Fuqiang, Wu, Alsaedi, Ahmed, Tang, Jun: Crack synchronization of chaotic circuits under field coupling. Nonlinear Dyn. 93(4), 2057–2069 (2018)CrossRefGoogle Scholar
  29. 29.
    Masoumeh, D.: Analysis and design of clock-glitch fault injection within an FPGA. Master’s thesis, University of Waterloo, Canada (2013)Google Scholar
  30. 30.
    Balasch, J., Gierlichs, B., Verbauwhede, I.: An in-depth and black-box characterization of the effects of clock glitches on 8-bit MCUs. In: 2011 Workshop on Fault Diagnosis and Tolerance in Cryptography (2011)Google Scholar
  31. 31.
    Luo, P., Fei, Y.: Faulty clock detection for crypto circuits against differential fault analysis attack. IACR Cryptol ePrint Arch. 967, 1–8 (2014)Google Scholar
  32. 32.
    Qiao, Y., Lu, Z., Liu, H., Liu, Z.: Clock glitch fault injection attacks on an fpga AES implementation. J. Electrotechnol. Electr. Eng. Manag. 1(1), 23–27 (2017)Google Scholar
  33. 33.
    Canivet, G., Maistri, P., Leveugle, R., et al.: Glitch and laser fault attacks onto a secure AES implementation on a SRAM—based FPGA. J. Cryptol. 24, 247 (2011)CrossRefzbMATHGoogle Scholar
  34. 34.
    Santosh, D.: High speed clock glitching. Master’s thesis, Cleveland State University (2015)Google Scholar
  35. 35.
    Allagui, A., Rojas, A.E., Bonny, T., Elwakil, A.S., Abdelkareem, M.A.: Nonlinear time-series analysis of current signal in cathodic contact glow discharge electrolysis. J. Appl. Phys. 119, 203303 (2016)CrossRefGoogle Scholar
  36. 36.
    Elwakil, A.S., Ozoguz, S.: Chaos in a pulse-excited resonator with self feedback. Electron. Lett. 39, 831–833 (2003)CrossRefGoogle Scholar
  37. 37.
    Butcher, J.C.: Numerical Methods for Ordinary Differential Equations, 2nd edn. Wiley, New York (2008)CrossRefzbMATHGoogle Scholar
  38. 38.
    Dieci, L.: Jacobian free computation of Lyapunov exponents. J. Dyn. Differ. Equ. 14(3), 697–717 (2002)MathSciNetCrossRefzbMATHGoogle Scholar
  39. 39.
    Digilent Inc. (2016)
  40. 40.
    Inc, X.: 7 Series FPGAs Overview, vol. 1. Xilinx, San Jose (2014)Google Scholar
  41. 41.
    Xilinx, Vivado design suite—hlx editions (2016)Google Scholar
  42. 42.

Copyright information

© Springer Nature B.V. 2019

Authors and Affiliations

  1. 1.Department of Electrical and Computer EngineeringUniversity of SharjahSharjahUnited Arab Emirates

Personalised recommendations