Fatemeh Khojasteh Dana
Mehmet Ali Cetin
Xinrui Wang
Worcester Polytechnic Institute
Worcester Polytechnic Institute
Ruhr University Bochum
Andrew Butler
Yuval Yarom
Shahin Tajik
Worcester Polytechnic Institute
Ruhr University Bochum
Worcester Polytechnic Institute
Scenario 2: Chypothermia + Chypnosis
1
Clock Sensor Deactivation
2
Cooling to -196°C by Liquid Nitrogen
Cooling to -36°C by Thermal Chamber
Scenario 1: Chypothermia
Abstract—Static side-channel attacks, which exploit haltedclock conditions to extract sensitive information, pose an increasing threat to chip security. To counter these attacks, various defenses have been proposed that monitor for abnormal clock behavior and trigger the clearing of sensitive data when clock anomalies are detected. In this work, we demonstrate that exposing a chip to cryogenic temperatures interferes with on-chip mixed-signal components, responsible for signal sensing and generation. Based on this observation, we develop Chypothermia, an attack that, without any electrical tampering with the system, disables the target clock sensor, the clock generation circuit, and the voltage sensors, while preserving the secret data. While effective at halting the clock, cooling is a slow process and, on its own, is often insufficient against systems equipped with temperature sensors designed to detect thermal anomalies. To bypass these protections, we combine Chypothermia with Chypnosis (Mitard et al., IEEE SP 2026) and show that, even within a moderately low-temperature operating range, this combination can halt the clock while evading detection. We implement Chypothermia on multiple FPGA/SoC platforms and demonstrate successful disabling of both soft-IP and hardIP sensor implementations. Finally, we apply Chypothermia to the alert handler of the OpenTitan root of trust, which incorporates a state-of-the-art clock sensor, and show that the attack evades detection and prevents key zeroization. Finally, we introduce and implement an FPGA-compatible self-heating sensor as a countermeasure and demonstrate its robustness against Chypothermia.
Voltage Sensor Deactivation
Undervolting to ~VDD/2
arXiv:2609.11442v1 [cs.CR] 10 Sep 2026
Chypothermia: Clock Freezing for Static Side-channel Attacks
Clock Freezing
Clock Freezing
Slowing Down Clock Sensor
Clock Sensor Deactivation
Voltage Sensor Deactivation
Figure 1: High-level overview of Chypothermia attack scenarios
multiple clock cycles. However, there has been a rise in a class of attacks called static side-channel attacks, in which attackers halt the chip’s clock and recover static data stored in memory components, such as Flip-Flops (FFs). In this case, randomness becomes ineffective if the adversary halts the circuit to probe it between two clock cycles using attacks such as static power analysis [44], Laser Logic State Imaging (LLSI) [33], Impedance Analysis (IA) [43], and Thermal Laser Stimulation (TLS) [34]. Because recovering static data stored in registers takes significantly longer than a clock cycle, stopping the circuit clock is the main requirement for static attacks [33, 43]. Consequently, countermeasures that detect clock tampering [14, 16] and respond by clearing sensitive state are generally effective against such attacks. Furthermore, direct manipulation of the system clock is often impractical in realworld settings because many secure integrated circuits rely on internal clock sources for cryptographic operations [37]. As a result, attacks that can halt the system without requiring direct access to the clock are particularly relevant. Recently, Chypnosis [42] demonstrated that rapidly dropping the supply voltage to nearly half of its nominal value can place a chip into a hibernation state, in which clock propagation ceases while sensitive data remains intact and can subsequently be recovered using static attacks. The work showed that although the analog sensing component
1. Introduction Over the last three decades, various physical sidechannels have been discovered, showing that the security of cryptographic implementations on chips can be undermined. The primary assumption for most physical side-channels is that information leakage occurs during data transitions. Deploying data randomization or shuffling in countermeasures, such as masking and hiding [32], is a conventional technique to mitigate dynamic side-channel attacks, as it prevents repetition and integration of measurements over
1
of existing clock sensors detects a clock stoppage, the digital response logic cannot clear sensitive data quickly enough before the clock halts. To address this limitation, follow-up countermeasures based on asynchronous clearing were proposed to respond more rapidly to undervolting attacks [2, 38, 42]. However, it remains an open question whether an adversary can non-invasively manipulate the analog sensing component itself without using invasive techniques [23, 59]. On-chip analog components, such as sensors and oscillators, are usually designed to operate robustly in various environmental conditions. However, if the adversary operates the chip in extremely cold or hot temperatures, these analog components might start operating erratically or completely fail to function. Operating the chip in a hot environment might not be feasible, as it could cause a meltdown and irreversible damage. However, operating the chip in extremely cold temperatures has been shown to be safe. The digital fabrics of devices, such as Field Programmable Gate Arrays (FPGAs), have been reported to operate reliably at cryogenic temperatures (below -150◦ C) across various applications, including deep-space missions [10, 51], quantum computing [11, 26, 45], and superconducting magnets for particle acceleration [57]. However, it has also been reported that both on-chip mixed-signal modules (e.g., internal clock generation circuits and sensors) and off-chip components (e.g., decoupling capacitors and voltage regulators) could become unreliable [28, 51]. Although most anti-tamper mechanisms monitor voltage and clock anomalies, they are typically not configured to respond to temperature fluctuations [37], particularly lowtemperature conditions. One reason is that the same device may be deployed across a wide range of operating environments, e.g., an FPGA embedded in a drone operating at different altitudes and in different geographic locations, making it difficult to distinguish legitimate environmental variations from deliberate temperature manipulation. Furthermore, even when temperature sensors are configured to detect excessively low temperatures, the threshold is constrained by the intended deployment environment. For example, for applications operating in cold regions, such as the Arctic [31], the threshold cannot be set above certain temperatures (e.g., -40◦ C) without risking false alarms and zeroization during normal operation. Driven by these observations, we ask the following questions: (1) Is it possible to halt the system’s clock at cryogenic temperatures without electrically tampering with its source? (2) Can we halt the clock at moderate cold temperatures without triggering state-of-the-art clock sensors? Our Contribution. In this work, we answer both questions affirmatively. We introduce Chypothermia attacks, in which an adversary puts the chip in a cryogenic condition, bypasses the clock sensors, and deactivates the on-chip clock sources while the digital fabric of the chip retains the data. The adversary can then warm the chip while keeping the clock halted to perform a static side-channel attack (e.g., LLSI) and recover the retained data. Our attack exploits the observation that at a cryogenic temperature (i.e., -196◦ C)
the on-chip mixed-signal components, such as Phase-Locked Loops (PLLs) and analog-to-digital converters (ADCs), fail, while on-chip digital circuits continue to function and retain data. Figure 1 presents an abstract overview of our attack. Although cryogenic temperatures can stop the clock, cooling the chip is a slow process; hence, systems equipped with temperature sensors, intended to detect temperature anomalies, can detect the attack. To evade detection, we also present a combined attack, in which we mount Chypothermia at a moderately cold temperature within the temperature sensor’s allowed thresholds (above -40◦ C) to reduce the sensor’s sensitivity and then mount Chypnosis [42] to put the chip in hibernation without triggering the clock sensor. We perform Chypothermia on various SRAM- and Flash-based FPGAs/SoCs fabricated in 28 nm and 16 nm processes. First, we conduct extensive experiments using liquid nitrogen (LN2 ) to determine the time required to induce failure in PLLs and ADCs at cryogenic temperatures. Next, we demonstrate that staying in cryogenic conditions effectively halts the clock without requiring direct control of the clock source or triggering the clock sensor. To demonstrate the effectiveness of Chypothermia in practical scenarios, we integrate the state-of-the-art sensor proposed in [42] into the FPGA implementation of OpenTitan English Breakfast [49] and successfully stop the clock of its sidechannel-protected cryptographic engine without triggering zeroization. Finally, we propose and implement a circuitbased, FPGA-compatible self-heating countermeasure that maintains the sensor’s temperature within the nominal range and mitigates the attack.
2. System Operation in Cryogenic Conditions 2.1. Digital Circuits Chip vendors specify operating ranges for temperature and voltage in their public datasheets. However, these specified ranges are usually very conservative, and most digital circuits still function beyond them. While there is a limit to how hot a chip can get, digital chips have been shown to function reliably at extremely low temperatures, such as -267◦ C (4K) [10, 11, 26, 51, 57]. Two temperature-dependent competing factors in CMOS logic offset each other, enabling digital circuits to remain stable and function under cryogenic conditions. Reducing temperature increases electron mobility, thereby increasing the electrical current [51]. Conversely, cold temperatures increase the threshold voltage for both PMOS and NMOS transistors, reducing gate overdrive and current and making it harder to turn on a transistor [51, 57]. However, depending on the transistor technology, one of these two factors is slightly more dominant than the other. In older, larger transistor technologies, cooling the circuit makes electron mobility the dominant factor; hence, transistors draw more current and switch faster. In this case, voltage regulator modules (VRMs) might not be able to keep up with the chip’s current surge, leading to significant voltage drops in
2
Off- Chip
On- Chip
1
ESL
ESL
C
4 …
ESL
N
VCO
LP Divider
3
3
ADC
Analog Conditioning
Analog Sensing Front-End 2
2
2
…
ESR
CP
Sensor
Physical Signal
…
ADC PDN
4
Core PDN
ESR
PFD
Phase-locked Loop
C
3
3
CLK
Buffer Chain
Digital Sensing
RO
TDC
Synthesized CLK
…
Lock
Lock Monitor
…
Voltage Regulator Module (VRM)
ESR
Mixed-Signal Circuits AUX PDN
4
C
Digital Response RST 0 k CLK Synchronous Zeroization RST k CLK Asynchronous Zeroization
Figure 2: On modern FPGAs, PLLs, sensors, and digital cores have their own PDNs. Possible failures at extremely cold temperatures, indicated by blue warning signs, include: 1. VRM Malfunction, 2. Digital Malfunction, 3. Analog Malfunction, and 4. Capacitor Malfunction.
2.3. Printed Circuit Boards (PCBs)
the core voltage domain. We refer failures caused by such voltage drops as 1 VRM Malfunctions, see Figure 2.
The Power Distribution Network (PDN) on a PCB is responsible for reliably delivering voltage to the chip. Commercial components on the PDN include discrete components (e.g., decoupling capacitors) and integrated circuits (e.g., DC-DC voltage regulators), all of which are designed for specific temperature ranges. Their failure at cryogenic temperatures could cause voltage and current fluctuations, leading to destabilized chip behavior. Commercial Surface Mount Device (SMD) capacitors can experience a significant 90% drop in capacitance at cryogenic temperatures, and their parasitic resistance (ESR) can increase up to 1000× [27, 56]. In this case, mixed-signal modules on chips suffer more as their PDN is usually separate from the core voltage PDN, and, therefore, the available capacitance of the PDN under normal conditions is much lower and, thus, more sensitive to capacitance loss [24]. We call failures caused by such capacitance loss as 4 Capacitor Malfunctions, see Figure 2. Certain voltage regulators have also been shown to misfunction below -196◦ C (77K) [28]. These are, again, 1 VRM Malfunctions.
However, in modern technology nodes (e.g., sub 28 nm), we observe inverse temperature dependence (ITD) [17, 47], in which the circuit slows at lower temperatures. ITD could have security implications for FPGAs, as some soft IP FPGA sensors exploit the propagation delay of digital logic to detect anomalies. Buffer chain-based [1], ring oscillators (ROs), and Time-to-digital converters (TDCs) are examples of such delay-based sensors. As a result, longer delays in these sensors at cold temperatures relative to their calibrated values could reduce their reaction time. We refer these failures as 2 Digital Malfunctions, see Figure 2.
2.2. Mixed-Signal Circuits
Mixed-signal circuits, such as PLLs and ADCs, combine analog and digital components to process or synthesize realworld signals. In contrast to digital blocks on a chip, mixedsignal circuits are more customized; therefore, their response to extremely cold temperatures varies. However, generally, cryogenic conditions reshape the analog circuit’s operating point due to changes in threshold voltage, mobility, transconductance, leakage current, and parasitic impedances. The result is that bias, reference, startup, and timing margins move first, and eventually the macro-block fails as the supporting circuits drift out of range. We refer these failures as 3 Analog Malfunctions, see Figure 2.
3. Clock Sources and Sensors 3.1. Clock Synthesis The system clock can be generated from various onchip or off-chip sources. The most common sources are offchip crystal, as well as internal RC and ring oscillators [16]. Regardless of the clock source, these sources can usually generate only a limited number of fixed frequencies, which
3
is insufficient for the clock requirements of various IPs on the chip. Moreover, some of these sources are suffering from jitter and are sensitive to environmental conditions. To synthesize multiple stable clock frequencies and reduce clock skew, on-chip PLLs are deployed. The main building blocks of PLLs are the phase frequency detector (PFD), charge pump, loop filter, and voltage-controlled oscillator (VCO), see Figure 2. While PFDs are digital, Charge Pumps and VCOs are analog, and the loop filter is composed of passive components. VCOs are tuned to operate in the device operating temperature range. They may fail to operate outside their specified range or continue to oscillate, but there is no guarantee of frequency accuracy.
during a clock-stop attack, the system clock may already be stopped or unreliable. By using asynchronous paths, the countermeasure can react immediately after the delay-based detector is triggered, without relying on the system clock, which might already have stopped.
4. Threat Model We assume that the attacker has physical access to the target device. Moreover, the attacker can obtain snapshots of the hardware state using techniques such as LLSI [33], and then reconstruct the values stored in the registers. In the case of LLSI, failure-analysis tools are often available for rental at a few hundred dollars per hour, avoiding the need for a full purchase. For secret extraction, we assume a templateattack threat model, in which the attacker must identify the locations of the target registers, either through reverse engineering or by leveraging prior knowledge of the design. During the attack phase, we assume that all detectionand response-based countermeasures are active. We also assume that the internal workings of the security sensors may be unknown to the attacker. With these assumptions, we consider two attack scenarios. Scenario 1: In the first scenario, we assume the chip is equipped with a clock sensor and that the clock is generated internally. However, the chip either lacks a temperature sensor or its temperature sensor is not configured by the user. This is a realistic scenario for mission-critical systems, such as FPGAs deployed on military drones, since they must operate in various conditions. In this case, the temperature sensor is not usually deployed as an anti-tamper sensor, as its potential triggering by environmental changes can lead to system unavailability during the mission. Such a system could fall into the adversary’s hands and be exposed to cryogenic temperatures, leading to stopping the clock without triggering the clock sensor. Liquid gases or cryocoolers can be employed to reach such cryogenic temperatures. Scenario 2: In the second scenario, we assume that the clock is still generated internally, but the chip’s temperature sensor has been configured as an anti-tamper sensor. While most temperature sensors are configured for hot temperatures to prevent fault injection or meltdown, they might not be configured for cold temperatures. Even if they are configured for cold temperatures, the threshold cannot be set too high. For example, the temperature in the northern regions can reach -40◦ C; hence, for an operational system operating at such temperatures, the threshold should be set much lower than -40◦ C to prevent false alarms. If such a system falls into the adversary’s hands, she can cool down the chip to a modest subzero temperature within the allowed ranges to slow down the clock sensor, and then undervolt (Chypnosis attack [42]) the chip to hibernate it, and consequently, stop the clock without triggering the clock sensor. In this scenario, the adversary can cool the chip using a thermal chamber to achieve a controlled temperature decrease. However, a rapid drop in temperature could also be achieved using inexpensive freeze sprays or Peltier-based thermoelectric coolers (TECs) with less control over the magnitude of the temperature drop. We
3.2. Clock Sensors To detect whether a clock has stopped or become unstable, different monitoring techniques can be used. A clock sensor consists of two main modules, namely, an analog sensing module and a digital response module. 3.2.1. PLL-based Sensing. One common approach is to use PLL-based sensors [14]. A PLL has an output signal called Lock, which indicates whether the PLL is synchronized with its reference clock, see Figure 2. The PLL continuously compares the reference clock and the generated output clock. When the input clock stops or changes significantly, the PLL loses synchronization, and the Lock signal is deasserted. Therefore, the locked signal can be used as a simple indicator of clock failure. 3.2.2. Delay-based Sensing. Another way to detect clockstop attacks is to use a delay-based detection circuit within the chip’s digital fabric, such as a buffer-chain sensor [14], as shown in Figures 2 and 8. In this approach, a chain of LUTs forms a delay path for monitoring the clock’s behavior. Under normal operation, the clock signal propagates through this delay path, and the outputs of different buffers in the chain will be ”1” or ”0” alternatively, depending on whether the rising or falling edge of the clock signal has passed through them. However, when the clock is stopped, all buffers’ outputs will eventually be equal. Such a condition can indicate that the clock has been halted and can be detected by an XNOR gate connected to the outputs of buffers. In this case, the output of the XNOR gate is connected to the response logic and is used to trigger the protection mechanism.
3.3. Clock Tamper Response After detecting that the clock is halted, synchronous or asynchronous responses can be generated. The main issue with the synchronous response is that it requires the response to wait for the next active clock edge, see Figure 2. Such requirements cannot be met if the chip is undervolted rapidly, as in Chypnosis attack [42]. To speed up the response time, asynchronous preset/clear signals have been proposed to wipe the secret [42]. This is important because,
4
Nitrogen vapours
Aluminum Channel
Liquid Nitrogen
Adhesive
FPGA FPGA PCB
(a) Cross-sectional schematic
(b) Fixtures on DUTs
(c) DUT exposure to LN2
Figure 3: Cryogenic test environment. (a) The FPGA-bearing PCB sits in an aluminum channel filled with liquid nitrogen, cooling the die to cryogenic temperatures. (b) All evaluated platforms under test, each fitted with a funnel-based LN2 delivery setup. (c) LN2 was poured from a dewar through a funnel onto the target board during an experiment. The target board was not wired up for an orderly demonstration. further assume that the attacker can access and modify the chip’s core voltage supply rails and remove the decoupling capacitors on the printed circuit board (PCB). Carrying out this type of tampering requires some understanding of the PCB schematic, which can be obtained from documentation, visual inspection, or multimeter measurements. Real-world Implications: To see how an adversary could gain from this type of attack in practice, we can look at the following cases. One case involves the decryption core on FPGAs or microcontrollers/microprocessors, which is configured with a cryptographic key. These decryption cores can be employed, for instance, to decrypt the device’s bitstream, firmware, or any other confidential data. By extracting the secret key, the adversary can clone, reverse-engineer, spoof, or tamper with the design contained in the bitstream or firmware. Moreover, if the same key is used across multiple chips in the field, the attacker can compromise the security of other chips that use it.
We also used Digilent Arty S7 boards [12], which contain AMD Spartan-7 FPGAs in a BGA package. The FPGA part number is XC7S50-CSGA324, and it is fabricated using a 28 nm technology [4]. These boards were used for both liquid nitrogen and thermal chamber experiments. Since the latter experiment was designed to test the combined attack, which involved rapid undervolting, we prepared additional samples from the same families and removed several capacitors from them to make them suitable for the attack. Specifically, the C30, C63, C29, C28, C27, C25, C36, and C37 capacitors were removed, which means approximately 99% of the capacitance on the core voltage rail was removed. To supply the core voltage externally, the R221 shunt resistor, which connects the voltage rail between the buck regulator and the silicon, was removed. Next, a BNC female-toDuPont male test lead connector was soldered to the target PCB’s JP3 test pin, allowing a function generator to supply the desired core voltage externally. For AMD Spartan-7 and Zynq UltraScale+ boards, we used the Vivado Design Suite [6] to implement and program the FPGA designs.
5. Experimental Setup
5.1.2. Microchip Devices. We used a Microchip PolarFire Discovery Kit board, which includes a Flash-based Microchip PolarFire FPGA SoC with part number MPFS095T1FCSG325E [39] in a BGA package. This board is suitable for embedded development, digital signal processing (DSP), and edge-computing applications. The FPGA fabric can be configured using Microchip’s Libero SoC software [40].
5.1. Devices under Test (DUT) To test the effects of extremely cold temperatures on mixed-signal and digital circuits of chips, we used three devices from two vendors as follows. 5.1.1. AMD Devices. We used AMD Kria KV260 Vision AI Starter Kits (part number SK-KV260-G) [3], which contain SRAM-based AMD Zynq UltraScale+ MPSoC chips. The kit includes a K26 System-on-Module (SOM) connected to a vision carrier card and uses a fan and heatsink as its thermal solution. The AMD Zynq UltraScale+ MPSoC is packaged in a flip-chip package and soldered to the SOM, which combines an ARM processing system (PS) with programmable logic (PL) as an FPGA fabric. The device is fabricated with a 16 nm technology [8]. For our experiments, we removed the chip’s fan and heatsink to expose the silicon backside directly to liquid nitrogen.
5.2. Cooling Setups 5.2.1. Cryogenic Setup. For the cryogenic experiments, we used LN2 , which has a boiling temperature of approximately -196◦ C. To cool down each chip while preventing the surrounding components from being exposed to LN2 , we built a small open-topped channel directly on each board; see Figure 3a. The channel is a strip of aluminum, 0.2 mm thick, bent by hand to enclose the device and wall off the rest of the PCB. We chose aluminum because, in our trials, plastic and
5
External Clock Generator TX/RX
o o o o o o o o o
PCB
AMD Zynq UltraScale+ Counter Lock
PS Counter
Counter
SYSMON
RO
PCB
Counter UART
CCC Lock Counter TVS
Counter RO
AMD Spartan-7 Counter
Clock Generator
UART
MMCM
Microchip PolarFire Clock Generator
Clock
PCB
Host PC USB to UART Bridge
UART
MMCM Lock Counter
Counter
XADC
RO
Figure 4: Experimental setup for the cryogenic evaluation. The host PC communicates with the DUT through a USBto-UART interface (ESP-Prog) using the UART TX/RX pins, shown by the orange paths. An external clock source, a Tektronix AFG3021B function generator, provides a 12.5 MHz clock (shown by the blue paths) for communication and delay-monitoring measurements using the RO. The other clock sources are also shown in purple, including the on-board clock for AMD Spartan-7, the on-chip clock for Microchip PolarFire, and the PS-generated clock for AMD Zynq UltraScale+. The DUT is placed inside the cryogenic test environment and is equipped with monitoring sensors. both supply the clock and communicate via UART TX/RX. For the Microchip PolarFire board, we used the Raspberry Pi header pins to both supply the clock and communicate via UART TX/RX. In addition, we used the same Tektronix AFG3021 function generator model [53] to generate the fast voltagedrop signal for our combined attack. The function generator allowed us to create the rapid voltage drop required to perform the Chypnosis attack.
similar materials became brittle and cracked at cryogenic temperatures, whereas the aluminum retained its mechanical properties. A 14 cm (5.5 in) stainless-steel kitchen funnel glued to the top directs the LN2 onto the die. To seal the channel to the board and keep it leak-proof through repeated cooling cycles, we combined two adhesives, Loctite Power Grab Express construction adhesive and J-B Weld 8281 steel-reinforced epoxy, with heavy-duty duct tape applied in several overlapping layers, see Figure 3b. To induce freezing, LN2 is poured from a dewar onto the target device (see Figure 3c) for varying durations, allowing us to investigate the impact of cooling on chips. In addition, because contact with LN2 or the chilled surfaces can cause frostbite, special gloves should be used.
5.4. On-Chip Telemetry To understand the behavior of various components on our DUTs, we configured the chips to monitor the available telemetry data during the experiments. The available data includes the on-die temperature, voltage levels on different rails, clock behavior, and digital logic delay variations. To monitor the temperature and voltage rails, we used the available on-chip sensing blocks. These include System Monitor (SYSMON) for the AMD UltraScale+ device, Temperature and Voltage Sensor (TVS) for the Microchip PolarFire device, and Analog-to-Digital Converter (XADC) for the AMD Spartan-7 device. To monitor clock behavior, we implemented a 28-bit counter to count clock edges within the chip. By tracking the counter values, we were able to observe whether the clock was running normally, slowing down, or stopping under cryogenic conditions. To monitor delay changes during our experiments, we implemented an 11-stage RO. The RO was built by connecting 11 Look-up tables (LUTs) configured as inverter gates in series, with the output of the last inverter gate connected back to the input of the first, forming a feedback loop. We also added a 32-bit counter to measure the RO output frequency. The counter counted the number of edges from the RO output during a fixed observation window of 100000 clock cycles. The reference clock for this measurement was the external clock generated by the
5.2.2. Thermal Chamber Setup. For conducting temperature-controlled experiments, we used a TestEquity Model 107 temperature chamber [54]. TE-107 is a benchtop environmental chamber that provides controlled thermal conditions over a wide temperature range, from -40◦ C to 130◦ C. It includes digital controls for programming and monitoring the chamber temperature, which enabled us to conduct stable, repeatable experiments.
5.3. Electrical Setup To ensure reliable telemetry data communication for the chip under cryogenic conditions and to avoid potential failures in the on-board USB-to-serial UART interface, we used an external clock signal and FPGA I/Os as UART pins. For our experiments, we generated an external clock from a Tektronix AFG3021B function generator [53]. In our setup, we configured the output clock frequency to 12.5 MHz. The UART pins were connected to an ESP-Prog board [15], which was used to communicate with the chip from the host PC (see Figure 4). For the AMD Spartan-7 and Zynq UltraScale+ boards, we configured PMOD pins to
6
0.0 −2.5
VCCINT
1.02
1.00
VCCAUX
PLL Input Clock Counter (4 MSBs) 14 12 10 8 6 4 2 0
PLL Output Clock Counter (4 MSBs)
55s
75s
(a) AMD Zynq UltraScale+ SoC
Voltage (V)
0.0 −2.5
PLL Input Clock Counter (4 MSBs) 14 12 10 8 6 4 2 0
PLL Output Clock Counter (4 MSBs) 14 12 10 8 6 4 2 0 0s
100s
200s
300s Time (s)
400s
500s
(b) Microchip PolarFire SoC
2.25 2.00 1.75
Counter Value Counter Value
Voltage (V)
0
2.5
Counter Value Counter Value
Voltage (V) Counter Value Counter Value
1
35s Time (s)
−100
VDDAUX
VCCAUX
15s
VDD
Temperature 0
Voltage (V)
0.0
Temperature (C)
Voltage (V) Temperature (C)
VCCINT 0.5
14 12 10 8 6 4 2 0
Temperature
103 102 101 0 −101 −102
−200
Voltage (V)
Temperature (C)
Temperature 0
PLL Input Clock Counter (4 MSBs) 14 12 10 8 6 4 2 0
PLL Output Clock Counter (4 MSBs) 14 12 10 8 6 4 2 0 0s
100s
200s Time (s)
300s
400s
(c) AMD Spartan-7 FPGA
Normal operation
SYSMON / TVS / XADC failure
Clock slowdown
TVS unreliable
Clock Stopped / Lock failure
Hibernation mode
I/O failure
Figure 5: Monitoring behavior of the DUTs under cryogenic conditions. From top to bottom, the rows show the reported temperature, monitored voltage rails, and clock counters over time for the (a) AMD Zynq UltraScale+ MPSoC, (b) Microchip PolarFire SoC, and (c) AMD Spartan-7 FPGA. The 4 most significant bits of the 28-bit counters were monitored for the MMCM/CCC clock signals to verify that the clocks remained running during the experiment. interface, an I2C interface, the Power Management Bus (PMBus), and the Advanced Peripheral Bus (APB) in AMD Zynq UltraScale+ MPSoC devices. In our design, we instantiated the System Management module in our Verilog design to monitor the die temperature, PL VCCINT, which supplies the FPGA core, and PL VCCAUX, which supplies the PLLs/MMCMs. SYSMON has an input clock that drives its internal operation and interface logic.
function generator. The RO helped us monitor timing-delay changes in the FPGA fabric during the experiments. It also provided a simple way to verify that the digital fabric and I/Os were still operating correctly at cryogenic temperatures. If the RO continued to oscillate and the counter produced the expected values, it indicated that the chip remained functional and healthy under those conditions.
6. Chypothermia Attack Results 6.1.2. Clock Configurations. For the AMD Zynq UltraScale+ board, we used the internal clock generated by the Zynq UltraScale+ MPSoC IP. This clock was routed from the Processing System (PS) side to the Programmable Logic side, and its output frequency was configured to 33.33 MHz. For the SYSMON and Mixed-Mode Clock Managers (MMCM) input clock, we used an internal clock generated by the PS.
In this section, we evaluate telemetry data from the implemented sensors across three chips under cryogenic conditions. The goal is to monitor the behavior of mixedsignal and digital circuits under cryogenic attacks.
6.1. AMD Zynq UltraScale+ Results 6.1.1. AMD System Monitor Configuration. The System Monitor (SYSMON) includes an ADC for monitoring internal device conditions, such as die temperature and various voltage rails [5]. The sampled ADC data is stored in status registers and can be accessed through different interfaces, including the Dynamic Reconfiguration Port (DRP), a JTAG
6.1.3. Clock Stability Monitoring. To monitor the PLL behavior on the AMD Zynq UltraScale+ board, we used the MMCM IP and observed its lock signal. In this design, the MMCM input clock was generated from the PS clock and
7
275 270 265
RO Frequency
405 400 395 390 385
−150
−100 −50 0 Temperature (C)
(a) AMD Zynq UltraScale+
50
−150
−100 −50 Temperature (C)
(b) Microchip PolarFire
0
RO Frequency (MHz)
RO Frequency
RO Frequency (MHz)
RO Frequency (MHz)
280
192 190 188 186 184 RO Frequency
182 −150
−100 −50 Temperature (C)
0
(c) AMD Spartan-7
Figure 6: RO frequency vs. temperature for the tested platforms under cryogenic conditions. For the AMD Spartan-7 FPGA and Zynq UltraScale+ MPSoC, the RO frequency decreases with temperature, indicating that the RO operates more slowly at lower temperatures. For the Microchip PolarFire FPGA, the RO frequency initially increases as the temperature decreases, reaches a maximum around -125◦ C, and then decreases again at lower temperatures. to reliably communicate with the chip to read back the RO counter and record the temperature. This allowed us to measure the RO frequency as a function of temperature.
had a frequency of 33.33 MHz. The MMCM was configured to generate a 100 MHz output clock. To determine how the input and output clocks behaved under cryogenic conditions, we implemented two 28-bit counters: one for the MMCM input clock and one for the MMCM output clock (See Figure 4). We used those counters to count the positive edges of the PLL input and output clocks. Comparing the four most significant bits (MSBs) of the counters enabled us to monitor and verify the PLL clock behavior at cryogenic temperatures. By tracking the counter values, we monitored whether each clock continued running, slowed down, or stopped during the cryogenic experiment.
6.2. Microchip PolarFire Results 6.2.1. Temperature and Voltage Sensor (TVS) Configuration. Each PolarFire device includes a built-in temperature and voltage sensor (TVS), which can be used to monitor the internal die temperature and the main device supply rails [41]. The TVS provides this information to the FPGA fabric in digital form. It is implemented with a 4channel ADC, with each channel corresponding to a specific measurement. Channel 0 monitors the VDD (1 V) supply, Channel 1 monitors the VDDAUX (1.8 V) supply, Channel 2 monitors the VDDI (2.5 V) supply, and Channel 3 monitors the die temperature. The TVS outputs a 16-bit value. These raw digital values are then converted to standard voltage and temperature values for analysis. In our design, we monitored the temperature and the VDD and VDDAUX voltage rails.
6.1.4. Results. For the AMD Zynq UltraScale+ device, we tested the chip in a cryogenic environment. Our observation was that at around -100◦ C, the internal clock coming from the PS stopped working. As shown in Figure 5a, the counter that was counting the clock coming from the PS, which was also used as the MMCM input clock, stopped counting. Similarly, the counter that counted the MMCM output clock edges also stopped. The 4 MSB bits of both counters show that they remained stuck at the last reported value. Also, the lock signal failed. These failures occur due to 3 Analog Malfunction and perhaps 4 Capacitor Malfunctions for the VCCAUX power rail for PS. When the internal clock stopped, the entire design, including the MMCM output clock, froze, and the SYSMON temperature and voltage readings remained at their last reported values. Therefore, even though the chip temperature was further reduced, the reported temperature and voltage values could not reflect that change. Also, although the I/O stopped working at a cryogenic temperature, it started working again after we warmed the chip back up. However, the internal clock generated by the PS remained stopped. We also implemented an RO to observe the delay behavior in the 16 nm technology. As shown in Figure 6a, the RO frequency decreases as the temperature drops. This indicates that at lower temperatures, the RO becomes slower due to the ITD effect. Because the XADC stopped working at around -100◦ C when using the internal clock, we performed the RO experiments using a stable external clock source
6.2.2. Clock Resources. For the Microchip PolarFire board, we used the 2 MHz clock generated by the internal PolarFire RC oscillator. This internal clock served as the clock source for both the TVS module and the Clock Conditioning Circuitry (CCC) input. 6.2.3. Clock Stability Monitor. To monitor the clock behavior on the PolarFire device, we used the CCC and tracked its lock signal. In this design, the CCC input was driven by the 2 MHz clock generated from the internal RC oscillator, and the CCC was configured to generate a 2 MHz output clock. To evaluate the behavior of both the CCC input and output clocks under cryogenic conditions, we implemented two 28-bit counters: one for the CCC input clock, generated by the RC oscillator, and one for the CCC output clock, as shown in Figure 4. These counters counted the positive edges of the corresponding clocks. By comparing the four most significant bits (MSBs) of the counters, we monitored the CCC clock behavior and verified whether the clocks continued running, slowed down, or stopped during the cryogenic experiment.
8
TABLE 1: Comparison of tested platforms under cryogenic conditions. Platform
Clock failure temperature
Technology / package
AMD UltraScale+ 16 nm, SRAM, flip-chip −100 °C Microchip PolarFire 28 nm, Flash, BGA −150 °C AMD Spartan-7 28 nm, SRAM, BGA −176 °C ∗ TVS did not recover on warm-up; reported invalid values (0xFFFF).
6.2.4. Results. For the Microchip PolarFire, we tested the chip in a cryogenic environment. Our observation was that at around -150◦ C, the chip started to behave differently. As shown in Figure 5b, when the device reached cryogenic temperature, the TVS module started reporting invalid values, between approximately 40 s and 70 s. During this period, other parts of the design, including the clocks, RO, and monitoring logic, were still operating. This is due to 1 VRM and 4 Capacitor Malfunctions for the VDDAUX power rail under cryogenic conditions. Shortly after this interval, the device stopped responding. At this point, communication between the host PC and the chip was lost. Our external VDD measurement reported a voltage below 0.9 V, which, according to [42], indicates that the PolarFire device will enter a brownout condition and hibernate. In this condition, the transistors on the digital fabric fail to switch, and hence the clock propagation halts. The instability of VDD indicates that this Microchip PolarFire family, unlike the AMD Ultrascale+ family, does not exhibit ITD; therefore, cold temperatures cause faster transistor switching and current surges, leading to a significant voltage drop on the VDD power rail. Based on our observation, the VRM was unable to keep up with the higher current draw, and thus, the voltage could not be compensated. As a result, we can attribute this failure to 1 VRM and 2 Digital Malfunctions. The device could be awakened when it was warmed back up at around 410 s (see Figure 5b), after which the chip started operating again, and communication was restored. Also, the counters for both the oscillator clock and the CCC output clock resumed operation. Since we monitored the 4 MSBs of the counters, we observed that both counters continued from the same values they had before the device stopped responding. This suggests that the chip was indeed in hibernation mode from around 70 s to 410 s, rather than being fully reset or reprogrammed. It is noteworthy that when the device was warmed up again, the TVS sensor reported invalid values for both temperature and voltage rails. The TVS voltage output was 0xFFFF. Based on our decoding function, this raw value is interpreted as −4.095875V. However, this value is not physically meaningful for voltage rails, since the supply voltage cannot be negative. Therefore, we treat this as an invalid TVS reading. This indicates that the TVS sensor did not recover properly after being exposed to cryogenic temperatures. Also, it is notable that the TVS high-temperature alarm was not triggered, even when the TVS sensor reported invalid high-temperature values. This suggests that the invalid TVS readings did not necessarily activate the
Inferred failure modes
Sensors disabled?
ITD?
3, 4 1, 2, 4 1, 3, 4
Yes Yes∗ Yes
Yes No Yes
corresponding tamper alarm flags. Finally, the RO monitoring results on the Microchip PolarFire device show a non-monotonic behavior under cryogenic conditions (see Figure 6b). As the temperature decreased, the RO frequency initially increased, indicating that the RO became faster, confirming that this device is not exhibiting ITD at moderately cold temperatures. This trend continued until approximately -125◦ C. Below this temperature, the RO frequency began to decrease, indicating that the RO slowed again at lower temperatures, indicating the appearance of the ITD effect at extremely cold temperatures. Note that we report RO values only for time periods when the chip was not in hibernation mode. During hibernation, both the clock and the RO stopped operating, so the RO counter also stopped counting.
6.3. AMD Spartan-7 Results 6.3.1. XADC Configuration. The XADC includes a dual 12-bit, 1 Mega-sample-per-second (MSPS) analog-to-digital converter (ADC) and on-chip sensors [7]. The ADCs provide a high-precision analog interface for various analog inputs. In addition to external analog inputs, the XADC can measure internal FPGA parameters, such as the device supply voltages and die temperature. The XADC data can also be accessed through the JTAG TAP interface, either before or after FPGA configuration [7]. In our design, we instantiated the XADC module in Verilog and used it to read three internal measurements: die temperature, VCCINT, and VCCAUX. VCCINT is the FPGA core supply voltage, which is nominally 1.0 V, while VCCAUX is the auxiliary supply voltage, which is nominally 1.8 V. The XADC has an input clock that drives its internal operation. 6.3.2. Clock Configurations. For the AMD Spartan-7 board, we used the on-board clock generated by the board oscillator. This clock provides a 12 MHz input to the FPGA and serves as the main clock source in our cryogenic experiments. Thus, we used this on-board clock as the input clock for both the XADC and the MMCM. (See Figure 4) 6.3.3. Clock Stability Monitoring. For the AMD Spartan-7 board, we used the MMCM IP as the clock-monitoring block and tracked its lock signal during the cryogenic experiment. The MMCM was driven by the on-board 12 MHz clock and configured to generate a 6 MHz output clock. To study the behavior of both sides of the MMCM, we added two 28-bit counters, as shown in Figure 4. One
9
6.4. Peripheral Interface Reliability Under Cryogenic Conditions
Slow rate (%)
100% 80% 60%
Based on our observations, the peripheral interfaces were affected when the devices were cooled to cryogenic temperatures. For the AMD Spartan-7 and Zynq UltraScale+ devices, the JTAG interface failed at very low temperatures, making it impossible to reprogram the chips. Specifically, we could not reprogram the AMD Spartan-7 at around 176◦ C or the AMD Zynq UltraScale+ at around -168◦ C. For the Microchip PolarFire device, the chip entered hibernation mode at cryogenic temperatures, disabling the device and rendering the interfaces unreachable. The I/O pins on the AMD devices continued to operate during the cryogenic experiments. However, for the AMD Zynq UltraScale+ device, the interface became disabled after approximately 30 seconds of operation at cryogenic temperature. For the Microchip PolarFire device, once the chip entered hibernation mode, the I/O pins and other interfaces were inaccessible at that temperature. After warming the devices back up, the JTAG and I/O interfaces started working again for all tested chips. This shows that the failures were temperature-dependent and reversible after returning the devices to a normal operating temperature.
40% 20% 0% 100s
200s Time (s)
300s
400s
Figure 7: AMD Spartan-7 PLL input clock slow rate over time, calculated from changes in the input clock counter cycle period relative to the initial cycle period.
counter was driven by the MMCM input clock, while the other was driven by the MMCM output clock. These counters counted the positive clock edges, allowing us to monitor whether each clock continued operating, slowed down, or stopped as the device temperature decreased. Instead of reading the full counter values, we recorded the four most significant bits (MSBs) of each counter. This provided a compact way to track clock activity and verify MMCM behavior under cryogenic conditions.
6.5. Results Conclusion
6.3.4. Results. After placing the chip in a cryogenic environment, we observed that the PLL output clock stopped working when the chip temperature decreased to around 176◦ C. As shown in Figure 5c, the PLL output clock counter stopped at a specific value, so its 4 MSB bits remained constant. Also, the lock signal failed to detect this abnormality. In this case, our external monitoring VCCAUX starts showing first unreliable fluctuations and then a significant increase in the voltage level. This observation is consistent with the VCCAUX surge reported in [24]. Such a voltage surge is due to possible failures in the analog biasing of PLLs [24], as well as unreliability in VRMs and capacitors under cryogenic conditions. Hence, the PLL failure is caused by 1 VRM, 3 Analog and 4 Capacitor Malfunctions. After pouring liquid nitrogen onto the chip’s package, we observed that the PLL input clock started to slow down. Figure 7 shows the slowdown rate of the PLL input clock over time, which was calculated from the change in the input-clock counter period relative to its initial period. Also, in Figure 5c, we show only the regions where the clock slowdown exceeded 10%. We also observed that this slowdown was temporary. The input clock slowed for a short period, then returned to its previous behavior. In this experiment, the clock source was the on-board oscillator, which was not directly exposed to liquid nitrogen. For the XADC sensors, we observed that after briefly cooling the chip, the sensors became deactivated and reactivated while the chip remained in the cryogenic environment. Figure 5c shows the sensor results for the AMD Spartan7 device. We also tracked the RO behavior in the AMD Spartan-7 device. As shown in Figure 6c, the RO starts to slow down as the temperature decreases.
Based on the results presented, we observe that both the clock source/synthesis circuits and the PLL-based clock sensors on all three chips are disabled at cryogenic temperatures, albeit for different reasons (see Table 1). Meanwhile, the continuous operation of the RO and the error-free states of the counters indicate that the FPGA’s digital fabric remains operational or, if hibernated, retains its data intact for a later recovery using a static side-channel attack. This shows that the configuration of the FPGAs also remained intact. Note that for chips, where the clock continues to operate upon warm-up, the adversary can manually place or keep the chip in hibernation at cryogenic temperatures by undervolting it [42], preventing the clock signal from being reactivated at warmer temperatures. While we exposed only the chip’s package and its surroundings to LN2 , heat from other parts of the PCB is also being extracted through the PCB’s ground plane; therefore, the temperatures of the capacitors and VRMs are also lowered to cryogenic levels. This is why we also observe capacitor and VRM malfunctions. Finally, we observe that the temperature drop in flipchip BGA packages was slower than that of traditional BGA packages. This could be because the front-side cooling of the chip can more quickly extract heat from the transistors via the metal layers than the backside silicon.
7. Combined Attack Results Reducing the temperature is a slow process, making the attack detectable if temperature sensors have been configured. One can still disable the clock using Chypnosis [42]
10
RNG
CLK
Voltage
Tdelay VCCINT
RND
Tdelay+ ΔT
V_HIB
-36oC
⋮
Time Clock
c0
c1
Time
c2
cn-2
Combinatorial Logic: HIGH if all inputs equal
cn-1
original reg inputs stop_detect
CLK Q D
reg outputs
CLR
Complementary FDPE & FDCE
OpenTitan English Breakfast
Figure 8: Combined attack scenario against the state-of-the-art clock sensor proposed in [1, 14, 42]: The attacker first lowers the device temperature to -36◦ C using Chypothermia, and then applies a fast voltage drop using Chypnosis [42] to stop the clock. Lowering the temperature increases the delay chain due to Digital Malfunction caused by ITD, as shown in yellow. The additional delay introduced by cooling the system is represented by ∆T . This extra delay extends the detection window and gives the attacker more time to stop the clock before the sensor asserts the stop_detect signal, shown in green.
Ibex Core RV32 IMC Interrupt Rx
AES DOM FDCE <= 1 FDPE <= 0
async reset
AES module, to implement OpenTitan on our experimental FPGA boards due to limited hardware resources. The alert handler is responsible for detecting abnormal temperature conditions through the connection to the XADC module. We configure the alert handler in fast-track response mode, so that when the measured temperature drops below -40◦ C, the response is triggered in only four clock cycles. Since temperature reduction is a relatively slow process, this configuration allows the alert handler to erase sensitive registers synchronously before the attack can take effect. In our design, the buffer chain-based sensor detects rapid voltage reductions and can erase sensitive data by incorporating an asynchronous reset mechanism.
Buffer Chain Sensor LUT LUT ...
sync wipe Interrupt Tx
Escalate Tx
Alert Handler
Alert Rx
fast track
XADC Temperature Sensor <-40°C
Figure 9: Architecture of trimmed OpenTitan English Breakfast platform, equipped with an alert handler for synchronously wiping and a buffer chain sensor for asynchronously resetting registers.
attacks. But such attacks can also be mitigated by asynchronous sensors, as proposed in [2, 38, 42]. In this section, we show that, to bypass the clock sensor, one can first cool the chip to moderate temperatures within the allowed thresholds, thereby slowing the sensor’s sensing module (see Figure 8) due to 2 Digital Malfunctions caused by the ITD effect, and then mount Chypnosis to bypass the countermeasure.
7.2. Attack Results During the cooling experiments, we observed that as the temperature decreased, the RO frequency in the AMD Spartan-7 device also decreased. This means that the design becomes slower at lower temperatures. This behavior can help an attacker bypass delay-based security countermeasures. When the circuit slows down, the sensor’s timing margin changes, which can make the countermeasure less sensitive to fast voltage drops (Chypnosis attack). To evaluate this effect, we performed the combined Chypothermia and Chypnosis attack on the OpenTitan implementation on the AMD Spartan-7 board. We set the XADC temperature threshold to -40◦ C. So, if the temperature goes below -40◦ C, the XADC temperature sensor should also detect it. In addition, we used the delay-based sensor from [42] to detect clock halts caused by voltage drop. At room temperature, we observed that when we rapidly dropped the voltage, the sensor detected the attack and wiped the AES key. However, by placing the chip inside the thermal chamber and setting the chamber temperature to -36◦ C, we then repeated the same voltage-drop attack. In this case, the detection did not occur, and the AES key remained intact in the key registers, which were read out after the chip was awakened and the clock was re-enabled. This shows that reducing the temperature can slow down the countermeasure, making it vulnerable.
7.1. OpenTitan Implementation To demonstrate the effectiveness of our combined attack, we target the OpenTitan English Breakfast version [49], a root-of-trust platform that integrates a 2-share DomainOriented Masking (DOM) [18] AES implementation designed to defend against side-channel attacks. The objective is to mount a combined attack to bypass detection and recover the secret key stored in the registers of the secure AES module. For the experimental platform, we equipped OpenTitan with an alert handler [48] and a buffer chain sensor from [1, 42] with a complementary register design, as shown in Figure 8, to erase critical register values upon detecting the Chypnosis attack. The architecture of the platform is shown in Figure 9. For our experiment, we trimmed modules without degrading any security aspect, such as removing the 192-bit encryption mode within the
11
only about 21% of the slices on FPGAs [21]. Their selfheating remains substantial even at deep-cryogenic conditions, where a CMOS ring oscillator has been measured to self-heat by more than 150 K (i.e., a rise exceeding 150◦ C) at a 4.2 K (-268.95◦ C) bath depending on its power dissipation [20]. More broadly, the principle of pairing such logic-based heaters with an on-chip temperature sensor and a controller to hold a temperature-sensitive circuit at a predefined operating point is well established [22]. We therefore surround the temperature-sensitive clock-stop sensor with a farm of ROs that, once activated, generate sufficient localized heat to keep the sensor responsive, thereby mitigating cooling-based attacks. Following the approach of [22], the RO farm is not permanently enabled; instead, it is activated automatically once the on-die temperature reported by the XADC sensor falls below a predefined threshold. In this condition, it heats the surrounding logic to pull the sensor back into its safe operating temperature range. We set the threshold to -29◦ C, corresponding to the die temperature reported by the XADC when the thermal chamber is set to -36◦ C. At this operating point, the die remains approximately 7◦ C warmer than the ambient, staying above the -40◦ C anti-tamper threshold and avoiding a temperature alarm, while still being cold enough to slow the delay chain and disable the clock-stop sensor. Figure 10 shows our implementation on a modified AMD Spartan-7 board, where a distributed farm of three-stage ring oscillators is placed across the fabric around the delay-based clock-stop sensor that produces stop_detect, so that the generated heat flows to the sensor placement on the chip. To size the heater, we held the chamber ambient at the same -36◦ C used in the attack and swept the number of active ROs from 0 to 2500 while recording the resulting steady-state die temperature with the XADC. Table 2 reports these measurements, which rise with the number of active oscillators, from -29◦ C with no ROs active to -18◦ C at 2500 ROs. We found that activating 1500 three-stage ROs, which raises the die temperature to about -22.5◦ C, is sufficient to keep the delay chain in its nominal regime; we therefore deploy 1500 ROs in the final implementation of Figure 10. With the heater active, the sensor again asserts stop_detect within its expected timing window, triggering the zeroization response and mitigating the combined Chypothermia-Chypnosis attack. Deploying ROs as a countermeasure introduces both area and power overhead. In our implementation, each RO had three stages, so implementing 1500 ROs required approximately 4500 LUTs. Naturally, increasing the number of ROs requires increasing LUT utilization. We also measured the power overhead of the RO farm on the AMD Spartan-7 FPGA core supply rail. With the deployed 1500 ROs active, the core consumes approximately 323 mW, compared to roughly 30 mW when the farm is disabled, i.e., roughly 0.2 mW per oscillator. Since the ROs are enabled only below a certain temperature threshold, the countermeasure imposes no power overhead on the main design under nominal temperature ranges.
AMD Spartan-7 FPGA Floorplanning
Clock Sensor
A distributed placement of the ROs inside the FPGA
Figure 10: Implementation of the self-heating countermeasure on an AMD Spartan-7 FPGA. The delay-based clockstop sensor (yellow) is surrounded by a distributed deployment of 1500 three-stage ROs (red), keeping the sensor within its nominal operating-temperature range.
7.3. Results Conclusion We showed that reducing the temperature can increase the delay of delay-based sensors, enabling an attacker to stop the clock without triggering the detection mechanism and preserving the secret data on the chip. Note that this applies to devices that exhibit ITD behavior, which includes most modern chips with technologies smaller than 28 nm. Otherwise, the temperature-delay behavior can be inverted, and cold temperatures make the sensor faster, as is the case for Microchip devices, see Figure 6. In such devices, an adversary may need to actually heat the chip rather than cool it to increase the delay and execute a similar attack. Also, it is important to note that, according to the literature [17, 36], AMD 7-Series devices exhibit both ITD and non-ITD behaviors, depending on how the sensor is placed and routed on the chip. In this work, our sensor location on the FPGA followed the ITD pattern, and therefore, we could attack it.
8. Countermeasures 8.1. Self-heating Chip Our combined attack succeeds because low temperatures affect the signal propagation delay of the sensor’s sensing module, i.e., the buffer chain. A natural countermeasure would be to actively heat the sensor from within to keep it within its nominal delay regime. Ring oscillators (ROs) are well-suited to this task, as they are built entirely from standard CMOS logic, are compatible with FPGAs, and can be placed almost anywhere on the die. They are among the most efficient on-chip heat generators reported, raising the die temperature by more than 130◦ C while occupying
12
TABLE 2: Measured steady-state on-die temperature (reported by the XADC sensor) of the AMD Spartan-7 versus the number of active three-stage ROs. The thermal chamber maintains the ambient at -36◦ C throughout; with no ROs active, the die self-heats to -29◦ C, which is above the operating point of the combined attack. Active ROs 0 1000 1500 2000 2500
Chamber / ambient (◦ C)
Die temperature (◦ C)
−36 −36 −36 −36 −36
−29.0 −25.1 −22.5 −20.0 −18.0
is detected, they can erase sensitive data before an attacker can carry out a static SCA attack.
9. Discussion 9.1. Comparison with Data Remanence Attacks It may seem that our proposed attack resembles data remanence [9, 50], Cold Boot [19], or Pentimento [13] attacks, where the adversary leverages charge retention or bias temperature instability in transistors to reconstruct data that used to reside in memory. Nevertheless, our attack is distinct in an important aspect. In those prior attacks, it is typically assumed that the adversary can execute their own firmware or bitstream on the device after the sensitive data has been erased, and then exploit the analog properties of the memory (e.g., SRAM metastability, SRAM powerup patterns, or flip-flop propagation delays) to retrieve the original contents. In contrast, our approach directly targets memory content that is retained under extremely cold conditions and assumes that the data can be extracted using static side-channel attacks, such as LLSI [33, 42] or IA [42, 43], without requiring the adversary to take control of the chip by executing code and reading back data.
8.2. Other Potential Countermeasures A complementary direction is to harden the off-chip components for cryogenic operation rather than only heating the sensor. Established cryogenic-electronics design shows the feasibility of reliable operation with carefully chosen custom parts, allowing an FPGA system to remain functional down to 4 K [24, 28]. High-permittivity ceramic decoupling is a poor choice in cryogenic temperatures, since it loses most of its capacitance and gains series resistance. Therefore, the design should instead use NP0/COG (low-dielectric constant materials), PPS (polyphenylene sulfide film dielectric), or tantalum capacitors [24, 28, 55]. On the other hand, since commercial voltage regulators stop working below roughly 90 K, the supply could be regulated by deploying improved voltage regulators [35], using internal ROs, or feeding it from a room-temperature power source [24, 28]. Similarly, the clock can be generated by a cryogenic crystal oscillator or routed in from a source at room temperature. Off-the-shelf military- and defense-grade chips could also be more reliable, as they are screened and qualified for much wider operating temperature ranges than commercial parts [58]. The advantage of these board-level and device-level choices is that they reuse mature, commercially available components and keep the platform’s operation predictable across a wide range of temperatures. However, their main drawback is the cost associated with cryo-grade and ruggedized parts. Note that while these choices could prevent failure of mixed-signal components on specific chips, they cannot be generalized to all chip families. For instance, it has been shown in [25] that even with cryo-grade components, the mixed-signal behavior of some FPGA families remains unreliable under cryogenic conditions. Moreover, the effect of cooling on the digital circuits could still threaten the system’s security, as discussed in our combined attack scenario. Hence, the board-level solutions are most effective when combined with the active self-heating approach presented in the previous section. Another way to counter Chypothermia and Chypnosis attacks is to block or detect unauthorized access to the chip’s package and its supply voltage using PCB-level secure enclosures [29, 30, 52] or tamper sensors [46]. Once tampering
9.2. Applicability to ASICs Since we performed our attacks on FPGA SoC platforms, questions may arise regarding their applicability to ASICs. First, it is important to note that our cryogenic attack mainly targets mixed-signal components on chips, which are separate IPs from the digital FPGA fabric and are similar to those implemented on ASICs. Second, for the combined attack, we exploited the ITD effect, which is common to modern chips and not specific to FPGAs. Hence, although an in-depth comparison of FPGAs and ASICs lies outside the scope of this work, our results provide strong evidence that the fundamental mechanisms exploited in our attack are not unique to FPGAs.
10. Conclusion In this paper, we presented Chypothermia, a cryogenic attack that exploits failures in on-chip mixed-signal components at cryogenic temperatures to disable clock sensors, voltage sensors, and clock-generation circuitry without requiring any electrical tampering of the target system. Moreover, we demonstrated that by combining Chypothermia with Chypnosis, clock halting can be achieved even at moderately low operating temperatures while evading thermal anomaly detection mechanisms. Our evaluation across multiple FPGA/SoC platforms showed that both soft-IP and hard-IP sensing implementations can be disabled while preserving the secret on the chip. We further demonstrated the practical impact of the attack on the OpenTitan root of trust, in which our combined attack successfully bypassed a state-of-the-art clock-monitoring architecture and prevented
13
key zeroization. Our results again show that the security of chips’ anti-tamper sensors remains underexplored; we cannot simply assume that conventional reliability sensors on the chip can withstand adversarial manipulation of environmental conditions. Our results highlight the need for more resilient sensor designs and protection strategies that remain trustworthy under extreme environmental conditions.
User Guide, AMD, Jun. 2022, uG480, v1.11. [Online]. Available: https://docs.amd.com/r/en-US/ ug480 7Series XADC [8] ——, “Zynq UltraScale+ MPSoC,” https: //www.amd.com/en/products/adaptive-socs-and-fpgas/ soc/zynq-ultrascale-plus-mpsoc.html, accessed: 2026-05-31. [9] N. A. Anagnostopoulos, T. Arul, M. Rosenstihl, A. Schaller, S. Gabmeyer, and S. Katzenbeisser, “Lowtemperature Data Remanence Attacks Against Intrinsic SRAM PUFs,” in Euromicro Conference on Digital System Design, DSD, 2018, pp. 581–585. [10] A. Bakhsi, “Fpga-based instrumentation withstands the chill of deep space,” Xcell Journal, 2012. [11] I. Conway Lamb, J. Colless, J. Hornibrook, S. Pauka, S. Waddy, M. Frechtling, and D. Reilly, “An fpgabased instrumentation platform for use at deep cryogenic temperatures,” Review of Scientific Instruments, vol. 87, no. 1, 2016. [12] Digilent Inc., Arty S7 FPGA Board Reference Manual, Digilent Inc., Oct. 2019, revised October 25, 2019. [Online]. Available: https://digilent.com/reference/ programmable-logic/arty-s7/reference-manual [13] C. Drewes, O. Weng, A. Meza, A. Althoff, D. Kohlbrenner, R. Kastner, and D. Richmond, “Pentimento: Data Remanence in Cloud FPGAs,” in ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 2, ASPLOS, 2024, pp. 862–878. [14] R. Dumitru, T. Moos, A. Wabnitz, and Y. Yarom, “On Borrowed Time - Preventing Static Side-channel Analysis,” in Network and Distributed System Security Symposium, NDSS, 2025. [Online]. Available: https://www.ndss-symposium.org/ndss-paper/ on-borrowed-time-preventing-static-side-channel-analysis/ [15] Espressif Systems, “Introduction to the ESPProg Board,” https://docs.espressif.com/projects/ esp-iot-solution/en/latest/hw-reference/ESP-Prog guide.html, accessed: 2026-06-02. [16] T. Farheen, S. Roy, S. Tajik, and D. Forte, “A Twofold Clock and Voltage-based Detection Method for Laser Logic State Imaging Attack,” IEEE Trans. Very Large Scale Integr. Syst., vol. 31, no. 1, pp. 65–78, 2023. [17] O. Glamočanin, H. Bazaz, M. Payer, and M. Stojilović, “Temperature impact on remote power side-channel attacks on shared fpgas,” in 2023 Design, Automation & Test in Europe Conference & Exhibition (DATE). IEEE, 2023, pp. 1–6. [18] H. Groß, S. Mangard, and T. Korak, “Domain-oriented masking: Compact masked hardware implementations with arbitrary protection order,” in ACM Workshop on Theory of Implementation Security, 2016. [19] J. A. Halderman, S. D. Schoen, N. Heninger, W. Clarkson, W. Paul, J. A. Calandrino, A. J. Feldman, J. Appelbaum, and E. W. Felten, “Lest we remember: coldboot attacks on encryption keys,” Commun. ACM, vol. 52, no. 5, pp. 91–98, 2009. [20] J. Hamlet, K. Eng, T. Gurrieri, J. Levy, and M. Car-
11. Responsible Disclosure Following the discovery of the vulnerability, we responsibly disclosed it to AMD and Microchip on June 15, 2026, upon completing the initial version of the manuscript. We informed AMD and Microchip on the same date that we planned to keep the paper under embargo for 45 days. Microchip acknowledged the report on June 15, 2026. AMD acknowledged the report on June 18, 2026. All parties have remained in contact since the paper report was sent out. No further embargo was requested by either Microchip or AMD in follow-up communications.
Acknowledgments This effort was sponsored in part by NSF Grants CNS-2150123 and CNS-2338069 and in part by an ARC Discovery Project number DP210102670, the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) under Germany’s Excellence Strategy - EXC 2092 CASA - 390781972 and DFG project number 560392681.
References [1]
[2]
[3]
[4] [5]
[6] [7]
0xADE1A1DE, “Borrowed Time: An in-chip countermeasure against static side-channel analysis attacks,” https://github.com/0xADE1A1DE/Borrowed-Time, 2025, accessed: 2025-04-03. AMD, “Undervoltage-based Static Side-channel Attacks (“Chypnosis”) on FPGAs,” Security Brief AMD-SB-8018, 2025. [Online]. Available: https://www.amd.com/en/resources/ product-security/bulletin/amd-sb-8018.html ——, “Kria KV260 Vision AI Starter Kit,” https: //www.amd.com/en/products/system-on-modules/ kria/k26/kv260-vision-starter-kit.html, accessed: 2026-05-31. ——, “Spartan 7 FPGAs,” https://www.amd.com/en/ products/adaptive-socs-and-fpgas/fpga/spartan-7.html, accessed: 2026-05-31. ——, UltraScale Architecture System Monitor User Guide, AMD, Apr. 2023, uG580, v1.11. [Online]. Available: https://docs.amd.com/v/u/en-US/ ug580-ultrascale-sysmon ——, “Vivado Design Suite,” https://www.amd.com/ en/products/software/adaptive-socs-and-fpgas/vivado. html, accessed: 2026-05-31. ——, 7 Series FPGAs and Zynq-7000 SoC XADC Dual 12-Bit 1 MSPS Analog-to-Digital Converter
14
roll, “Modeling of circuits with strongly temperature dependent thermal conductivities for cryogenic cmos,” Microelectronics journal, vol. 42, no. 7, pp. 936–941, 2011. [21] M. Happe, H. Hangmann, A. Agne, and C. Plessl, “Eight ways to put your fpga on fire—a systematic study of heat generators,” in 2012 International Conference on Reconfigurable Computing and FPGAs. IEEE, 2012, pp. 1–6. [22] L. Hars, “Systems and methods for on-chip temperature stabilization for temperature-sensitive components of integrated circuits,” U.S. Patent 10,680,618, Jun. 9, 2020. [23] C. Helfmeier, D. Nedospasov, C. Tarnovsky, J. S. Krissler, C. Boit, and J.-P. Seifert, “Breaking and entering through the silicon,” in Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security, 2013, pp. 733–744. [24] H. Homulle, “Cryogenic electronics for the read-out of quantum processors,” 2019. [25] H. Homulle and E. Charbon, “Performance characterization of altera and xilinx 28 nm fpgas at cryogenic temperatures,” in 2017 International Conference on Field Programmable Technology (ICFPT). IEEE, 2017, pp. 25–31. [26] H. Homulle, S. Visser, and E. Charbon, “A cryogenic 1 gsa/s, soft-core fpga adc for quantum computing applications,” IEEE Transactions on Circuits and Systems I: Regular Papers, vol. 63, no. 11, pp. 1854–1865, 2016. [27] H. Homulle, S. Visser, B. Patra, G. Ferrari, E. Prati, F. Sebastiano, and E. Charbon, “A reconfigurable cryogenic platform for the classical control of quantum processors,” Review of Scientific Instruments, vol. 88, no. 4, 2017. [28] H. Homulle, S. Visser, B. Patra, and E. Charbon, “Design techniques for a stable operation of cryogenic field-programmable gate arrays,” Review of Scientific Instruments, vol. 89, no. 1, 2018. [29] V. Immler, J. Obermaier, M. König, M. Hiller, and G. Sigl, “B-TREPID: Batteryless tamper-resistant envelope with a PUF and integrity detection,” in 2018 IEEE International Symposium on Hardware Oriented Security and Trust, HOST, 2018, pp. 49–56. [30] V. Immler, J. Obermaier, K. K. Ng, F. X. Ke, J. Lee, Y. P. Lim, W. K. Oh, K. H. Wee, and G. Sigl, “Secure physical enclosures from covers with tamperresistance,” IACR transactions on cryptographic hardware and embedded systems, pp. 51–96, 2019. [31] G. Jaffe and K. Holston, “The u.s. army’s “big experiment” in the arctic cold,” The New York Times, May 2026, accessed: 2026-06-07. [Online]. Available: https://www.nytimes.com/2026/ 05/04/us/politics/us-army-arctic-cold.html [32] D. S. Koblah, F. Ganji, D. Forte, and S. Tajik, “Hardware Moving Target Defenses against Physical Attacks: Design Challenges and Opportunities,” in ACM Workshop on Moving Target Defense, MTD, 2022, pp. 25–36.
[33] T. Krachenfels, F. Ganji, A. Moradi, S. Tajik, and J. Seifert, “Real-world Snapshots vs. Theory: Questioning the t-Probing Security Model,” in IEEE Symposium on Security and Privacy, SP, 2021, pp. 1955– 1971. [34] T. Krachenfels, T. Kiyan, S. Tajik, and J. Seifert, “Automatic Extraction of Secrets from the Transistor Jungle using Laser-assisted Side-channel Attacks,” in USENIX Security, 2021, pp. 627– 644. [Online]. Available: https://www.usenix.org/ conference/usenixsecurity21/presentation/krachenfels [35] C. Lewis, D. Sellers, and M. Hamilton, “Implementation of field programmable gate arrays (fpgas) in extremely cold environments for space and cryogenic computing applications,” arXiv preprint arXiv:2504.13305, 2025. [36] D. M. Mehta, M. Hashemi, D. S. Koblah, D. Forte, and F. Ganji, “Bake it till you make it: Heat-induced power leakage from masked neural networks,” IACR Transactions on Cryptographic Hardware and Embedded Systems, vol. 2024, no. 4, pp. 569–609, 2024. [37] Microchip, “PolarFire Family FPGA Security User Guide,” 2025. [38] Microchip Product Security Incident Response Team (PSIRT), “PSIRT-118: Chypnosis: Undervoltage Static Side-Channel Attack,” Microchip, Tech. Rep. PSIRT118, 2025. [Online]. Available: https://www.microchip. com/en-us/solutions/technologies/embedded-security/ how-to-report-potential-product-security-vulnerabilities/ chypnosis-undervoltage-static-side-channel-attack [39] Microchip Technology Inc., “PolarFire SoC FPGA MPFS095T-1FCSG325E,” https://www.microchipdirect.com/product/ MPFS095T-1FCSG325E, accessed: 2025-06-05. [40] ——, “Libero SoC Design Suite,” https://www.microchip.com/en-us/products/ fpgas-and-plds/fpga-and-soc-design-tools/fpga/ libero-software-later-versions, accessed: 2026-05-31. [41] ——, PolarFire FPGA Temperature and Voltage Sensor, Microchip Technology Inc., 2022, application Note AN4682, DS00004682A. [Online]. Available: https://ww1.microchip.com/downloads/ aemDocuments/documents/FPGA/ProductDocuments/ UserGuides/microsemi polarfire fpga temperature and voltage sensor demo guide dg0852 v3.pdf [42] K. Mitard, S. K. Monfared, F. K. Dana, R. Dumitru, Y. Yarom, and S. Tajik, “Chypnosis: Undervoltingbased static side-channel attacks,” in 2026 IEEE symposium on security and privacy (SP). IEEE, 2026. [43] S. K. Monfared, T. Mosavirik, and S. Tajik, “LeakyOhm: Secret Bits Extraction using Impedance Analysis,” in ACM SIGSAC Conference on Computer and Communications Security, CCS, 2023, pp. 1675–1689. [44] A. Moradi, “Side-channel Leakage through Static Power - Should We Care about in Practice?” in Cryptographic Hardware and Embedded Systems - CHES, vol. 8731. Springer, 2014, pp. 562–579. [45] J. Morris, A. Abedin, C. Xu, and J. Szefer, “Finger-
15
[59] K. Yamashita, B. Cyr, K. Fu, W. Burleson, and T. Sugawara, “Redshift: Manipulating signal propagation delay via continuous-wave lasers,” IACR Transactions on Cryptographic Hardware and Embedded Systems, pp. 463–489, 2022.
printing quantum computer equipment,” in Proceedings of the Great Lakes Symposium on VLSI 2023, 2023, pp. 117–123. [46] T. Mosavirik, P. Schaumont, and S. Tajik, “ImpedanceVerif: On-chip Impedance Sensing for System-level Tampering Detection,” IACR Trans. Cryptogr. Hardw. Embed. Syst., vol. 2023, no. 1, pp. 301–325, 2023. [47] K. Neshatpour, W. Burleson, A. Khajeh, and H. Homayoun, “Enhancing power, performance, and energy efficiency in chip multiprocessors exploiting inverse thermal dependence,” IEEE Transactions on Very Large Scale Integration (VLSI) Systems, vol. 26, no. 4, pp. 778–791, 2018. [48] OpenTitan Project, “OpenTitan Documentation,” https://opentitan.org/book/hw/top earlgrey/ip autogen/alert handler/index.html# alert-handler-technical-specification, 2025. [49] OpenTitan project, “OpenTitan Top English Breakfast,” https://github.com/lowRISC/opentitan/ tree/master/hw/top englishbreakfast, 2025. [50] Y. Oren, A. Sadeghi, and C. Wachsmann, “On the Effectiveness of the Remanence Decay Side-channel to Clone Memory-based PUFs,” in Cryptographic Hardware and Embedded Systems - CHES, vol. 8086, 2013, pp. 107–125. [51] D. Sheldon, G. Burke, A. Argueta, A. Bakshi, N. Aranki, and M. Sadigursky, “Cryogenic operation of field programmable gate arrays,” 2011. [52] P. Staat, J. Tobisch, C. T. Zenger, and C. Paar, “Antitamper Radio: System-level Tamper Detection for Computing Systems,” in IEEE Symposium on Security and Privacy, SP, 2022, pp. 1722–1736. [53] Tektronix, AFG3000 Series Arbitrary/Function Generators Quick Start User Manual, https://download. tek.com/manual/071163106web 0.pdf, Tektronix, Inc., accessed: 2026-06-02. [54] TestEquity LLC, Model 107 Temperature Chamber Operation and Service Manual, rev. 2.4 ed., https: //assets.testequity.com/te1/Documents/pdf/testequity/ TE-107 Operation Service Manual Current.pdf, TestEquity LLC, Apr. 2019, accessed: 2026-06-04. [55] A. Teverovsky, “Performance and reliability of solid tantalum capacitors at cryogenic conditions,” in NASA Goddard Space Flight Center, 2006. [56] F. Teyssandier and D. Prêle, “Commercially available capacitors at cryogenic temperatures,” in Ninth International Workshop on Low Temperature ElectronicsWOLTE9, 2010. [57] M. Turqueti, “Cryogenic daqs and fpgas for magnet diagnostics,” 2020. [58] Xilinx, Inc., “7-series defense-grade FPGAs: Ruggedized all programmable devices,” Product Brief, Xilinx (AMD), 2016, military temperature grade −55 to +125 ◦ C; extended 0 to +100 ◦ C; industrial −40 to +100 ◦ C. [Online]. Available: https: //www.xilinx.com/support/documents/product-briefs/ 7-series-defense-grade-fpgas-product-brief.pdf
16