Design Considerations for EM Pulse Fault Injection

  • Arthur BeckersEmail author
  • Masahiro Kinugawa
  • Yuichi Hayashi
  • Daisuke Fujimoto
  • Josep Balasch
  • Benedikt Gierlichs
  • Ingrid Verbauwhede
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 11833)


Electromagnetic-fault injection (EM-FI) setups are appealing since they can be made at a low cost, achieve relatively high spatial resolutions, and avoid the need of tampering with the PCB or packaging of the target. In this paper we first sketch the importance of understanding the pulse characteristics of a pulse injection setup in order to successfully mount an attack. We then look into the different components that make up an EM-pulse setup and demonstrate their impact on the pulse shape. The different components are then assembled to form an EM-pulse injection setup. The effectiveness of the setup and how different design decisions impact the outcome of a fault injection campaign are demonstrated on a 32-bit ARM microcontroller.


EM fault attack Probe design EM-FI setup 



This work was supported in part by the Research Council KU Leuven C1 on Security and Privacy for Cyber-Physical Systems and the Internet of Things with contract number C16/15/058 and through the Horizon 2020 research and innovation programme under Cathedral ERC Advanced Grant 695305. Additionally this work has been partially supported by FWO project VS06717N in collaboration with JSPS.

Supplementary material


  1. 1.
    Balasch, J., Arumi, D., Manich, S.: Design and validation of a platform for electromagnetic fault injection. In: DCIS 2017, pp. 1–6. IEEE (2017)Google Scholar
  2. 2.
    Bar-El, H., Choukri, H., Naccache, D., Tunstall, M., Whelan, C.: The sorcerer’s apprentice guide to fault attacks. Proc. IEEE 94(2), 370–382 (2006)CrossRefGoogle Scholar
  3. 3.
    Boneh, D., DeMillo, R.A., Lipton, R.J.: On the importance of checking cryptographic protocols for faults. In: Fumy, W. (ed.) EUROCRYPT 1997. LNCS, vol. 1233, pp. 37–51. Springer, Heidelberg (1997). Scholar
  4. 4.
    Cui, A., Housley, R.: BADFET: defeating modern secure boot using second-order pulsed electromagnetic fault injection. In: 11th USENIX Workshop on Offensive Technologies (WOOT 2017). USENIX Association, Vancouver (2017)Google Scholar
  5. 5.
    Dumont, M., Lisart, M., Maurine, P.: Electromagnetic fault injection: how faults occur. In: FDTC 2019, pp. 9–16. IEEE (2019)Google Scholar
  6. 6.
    Giancoli, D.C.: Physics: Principles with Applications. Pearson, Boston (2014)Google Scholar
  7. 7.
    Maurine, P.: Techniques for EM fault injection: equipments and experimental results. In: FDTC 2012, pp. 3–4 (2012)Google Scholar
  8. 8.
    Moro, N., Dehbaoui, A., Heydemann, K., Robisson, B., Encrenaz, E.: Electromagnetic fault injection: towards a fault model on a 32-bit microcontroller. In: Fischer, W., Schmidt, J. (eds.) FDTC 2013, pp. 77–88. IEEE (2013)Google Scholar
  9. 9.
    Omarouayache, R., Raoult, J., Jarrix, S., Chusseau, L., Maurine, P.: Magnetic microprobe design for EM fault attack. In: Catrysse, J., Pissoort, D. (eds.) EMC 2013, pp. 949–954. IEEE Computer Society, Brugge (2013)Google Scholar
  10. 10.
    Ordas, S., Guillaume-Sage, L., Tobich, K., Dutertre, J.-M., Maurine, P.: Evidence of a larger EM-induced fault model. In: Joye, M., Moradi, A. (eds.) CARDIS 2014. LNCS, vol. 8968, pp. 245–259. Springer, Cham (2015). Scholar
  11. 11.
    Quisquater, J.J., Samyde, D.: Eddy current for magnetic analysis with active sensor. In: Esmart 2002 (2002)Google Scholar
  12. 12.
    Skorobogatov, S.P., Anderson, R.J.: Optical fault induction attacks. In: Kaliski, B.S., Koç, K., Paar, C. (eds.) CHES 2002. LNCS, vol. 2523, pp. 2–12. Springer, Heidelberg (2003). Scholar

Copyright information

© Springer Nature Switzerland AG 2020

Authors and Affiliations

  • Arthur Beckers
    • 1
    Email author
  • Masahiro Kinugawa
    • 2
  • Yuichi Hayashi
    • 3
  • Daisuke Fujimoto
    • 3
  • Josep Balasch
    • 1
  • Benedikt Gierlichs
    • 1
  • Ingrid Verbauwhede
    • 1
  1. 1.imec-COSIC KU LeuvenLeuvenBelgium
  2. 2.National Institute of Technology (KOSEN), Sendai CollegeSendaiJapan
  3. 3.Nara Institute of Science and TechnologyIkomaJapan

Personalised recommendations