Fault Attack on AES via Hardware Trojan Insertion by Dynamic Partial Reconfiguration of FPGA over Ethernet

Anju P. Johnson, Sayandeep Saha, Rajat Subhra Chakraborty, Debdeep Mukhopadhyay, Sezer Gören

Research output: Chapter in Book/Report/Conference proceedingConference contribution


We describe a novel methodology to exploit the widely used Dynamic Partial Reconfiguration (DPR) support in Field Programmable Gate Arrays (FPGAs) to implant a hardware Trojan in an Advanced Encryption Standard (AES) encryption
circuit implemented on a FPGA. The DPR is performed by transferring the required partial configuration bitstream file over an Ethernet connection to the FPGA board, from an attacker’s computer which can communicate with the FPGA
over a network. The inserted Trojan launches a “fault attack” on the AES encryption circuit, which enables recovery of the secret key by standard mathematical analysis of the faulty ciphertext produced. To the best of our knowledge, this is the first reported attack which exploits DPR to break
an AES hardware implementation on FPGA. Our implementation results establish this to be an extremely potent attack on AES at low hardware and computational overhead, while using the standard unlicensed FPGA design tools.
Original languageEnglish
Title of host publicationWorkshop on Embedded Systems Security (WESS, part of ACM ESWEEK) 2014, New Delhi, India
ISBN (Print)9781450329323
Publication statusPublished - Oct 2014


  • Hardware Trojan
  • FPGA
  • Dynamic Partial Reconfiguration
  • AES
  • Fault Attack

Cite this