PaperlayerView exact revision on arXiv

Source-linked AI summary

Chypothermia: Clock Freezing for Static Side-channel Attacks

Fatemeh Khojasteh Dana, Mehmet Ali Cetin, Xinrui Wang, Andrew Butler, Yuval Yarom, Shahin Tajik

arXiv:2609.11442v1cs.CR

TL;DR

Static side-channel attacks require halted clocks to recover sensitive retained data, motivating defenses that detect clock anomalies and erase state. This paper introduces Chypothermia, which exploits cryogenic failures in mixed-signal components, and combines it with Chypnosis to evade thermal and clock-sensor defenses. Across FPGA/SoC platforms and an OpenTitan root of trust, the attacks disable sensing and clock generation while preserving data, evading detection and preventing key zeroization.

  • Problem

    Static side-channel attacks exploit halted clocks to recover sensitive data, while defenses depend on clock and temperature sensing to trigger state clearing.

  • Method

    Chypothermia uses cryogenic conditions to disable mixed-signal clock, voltage, and clock-generation components without electrical tampering, combined with Chypnosis for moderate-temperature attacks.

  • Results

    Across multiple FPGA/SoC platforms, Chypothermia disabled soft-IP and hard-IP sensing, and on OpenTitan the combined attack evaded clock monitoring and prevented key zeroization.

  • Takeaways & Limitations

    On-chip anti-tamper sensors cannot be assumed trustworthy under adversarial environmental conditions, motivating more resilient sensor designs and protection strategies.

  • Takeaways & Limitations

    Cryogenic cooling is slow and can be detected by configured temperature sensors, while ruggedized or cryo-grade components may be costly and are not reliable across all chip families.

Abstract

from arXiv · show

Static side-channel attacks, which exploit halted-clock conditions to extract sensitive information, pose an increasing threat to chip security. To counter these attacks, various defenses have been proposed that monitor for abnormal clock behavior and trigger the clearing of sensitive data when clock anomalies are detected. In this work, we demonstrate that exposing a chip to cryogenic temperatures interferes with on-chip mixed-signal components, responsible for signal sensing and generation. Based on this observation, we develop Chypothermia, an attack that, without any electrical tampering with the system, disables the target clock sensor, the clock generation circuit, and the voltage sensors, while preserving the secret data. While effective at halting the clock, cooling is a slow process and, on its own, is often insufficient against systems equipped with temperature sensors designed to detect thermal anomalies. To bypass these protections, we combine Chypothermia with Chypnosis (Mitard et al., IEEE SP 2026) and show that, even within a moderately low-temperature operating range, this combination can halt the clock while evading detection. We implement Chypothermia on multiple FPGA/SoC platforms and demonstrate successful disabling of both soft-IP and hard-IP sensor implementations. Finally, we apply Chypothermia to the alert handler of the OpenTitan root of trust, which incorporates a state-of-the-art clock sensor, and show that the attack evades detection and prevents key zeroization. Finally, we introduce and implement an FPGA-compatible self-heating sensor as a countermeasure and demonstrate its robustness against Chypothermia.

1. Introduction

Static side-channel attacks halt clocks to recover retained register data, while Chypothermia exploits cryogenic failure of mixed-signal components to disable sensing and clock generation without electrical tampering.

  • Motivation: Halting the clock is essential because static attacks need time to recover register data between clock cycles.Clock-tamper countermeasures typically clear sensitive state, but internally generated clocks make direct manipulation difficult.
  • Contribution: Chypothermia exploits cryogenic conditions to disable on-chip clock sensors, voltage sensors, and clock-generation circuitry while digital data remains retained.The attack targets mixed-signal components while preserving the digital fabric for later static side-channel recovery.
  • Limitations of direct cooling: Cryogenic temperatures can halt the clock, but slow cooling may trigger temperature sensors configured to detect thermal anomalies.Low-temperature defenses are difficult to configure across varied deployment environments and legitimate cold conditions.
  • Contribution: Combining Chypothermia with Chypnosis enables clock halting at moderately cold temperatures within temperature-sensor thresholds, avoiding clock-sensor triggering.Chypothermia first reduces sensor sensitivity, after which Chypnosis places the chip into hibernation.
  • Evaluation: Experiments span SRAM- and Flash-based FPGA/SoC platforms fabricated in 28 nm and 16 nm processes, testing cryogenic failure and clock halting.The evaluation examines PLLs and ADCs and integrates a state-of-the-art sensor into an FPGA implementation.

2. System Operation in Cryogenic Conditions

Cryogenic operation can preserve digital functionality while disrupting mixed-signal and power-delivery components, whose temperature-dependent behavior produces several failure modes relevant to Chypothermia.

  • 2.1. Digital Circuits: Digital circuits can remain functional at extremely low temperatures, including reported operation at -267◦C (4K).Conservative vendor operating ranges do not necessarily mark the practical limit of digital operation.
  • Failure modes: The attack categorizes cryogenic failures as VRM, digital, analog, and capacitor malfunctions across separate power-distribution networks.The figure identifies these four failure classes for PLLs, sensors, and digital cores.
  • 2.1. Digital Circuits: Inverse temperature dependence can slow sub-28 nm digital logic at low temperatures, reducing the reaction time of delay-based FPGA sensors.Affected sensor types include buffer chains, ring oscillators, and time-to-digital converters.
  • 2.2. Mixed-Signal Circuits: Cryogenic conditions shift mixed-signal operating points through changes in threshold voltage, mobility, transconductance, leakage, and parasitic impedances.Bias, reference, startup, and timing margins move before mixed-signal macro-blocks fail.
  • 2.3. Printed Circuit Boards (PCBs): Cryogenic capacitor degradation can reduce capacitance by 90% and increase equivalent series resistance by up to 1000×, destabilizing sensitive mixed-signal power domains.Separate mixed-signal power-distribution networks have less capacitance under normal conditions and are therefore more sensitive to loss.

3. Clock Sources and Sensors

On-chip PLLs synthesize stable clock frequencies, while clock sensors combine analog sensing with digital response logic to identify stopped or unstable clocks and trigger protective actions.

  • Clock Sources: Clock sources include off-chip crystals and internal RC or ring oscillators, but these sources provide limited fixed frequencies and may be environmentally sensitive.PLLs address frequency and skew requirements for multiple on-chip IP blocks.
  • Clock Sources: On-chip PLLs synthesize multiple stable clock frequencies and reduce clock skew using digital, analog, and passive building blocks.Their main blocks are the phase-frequency detector, charge pump, loop filter, and voltage-controlled oscillator.
  • Clock Sensors: Clock sensors contain an analog sensing module and a digital response module for detecting stopped or unstable clocks.The architecture separates signal detection from the logic that initiates a response.
  • PLL-Based Sensors: PLL-based sensors use the Lock signal to indicate loss of synchronization when the input clock stops or changes significantly.The PLL continuously compares the reference clock with the generated output clock.
  • Delay-Based Sensors: Buffer-chain sensors monitor clock propagation through alternating logic states, but synchronous responses must wait for a subsequent active clock edge.Asynchronous preset or clear paths can respond without relying on a clock that may already be stopped.

4. Threat Model

The threat model assumes physical access to a device and static-state imaging capabilities, with two attack scenarios covering absent or configured cold-temperature sensors.

  • Attacker Capabilities: The attacker has physical access, can obtain hardware-state snapshots using techniques such as LLSI, and uses template attacks to locate target registers.Register locations may come from reverse engineering or prior design knowledge.
  • Scenario 1: Scenario 1 targets chips with internally generated clocks and clock sensors but no user-configured temperature anti-tamper sensor.Cryogenic exposure can stop the clock without triggering the clock sensor in such systems.
  • Scenario 2: Scenario 2 considers internally generated clocks with temperature sensors configured as anti-tamper mechanisms, including cold thresholds constrained by legitimate environments.A northern-region temperature of -40◦C illustrates why thresholds cannot be set arbitrarily high.
  • Experimental Setting: Cryogenic testing uses liquid nitrogen delivered onto FPGA-bearing boards inside aluminum channels that isolate the target device from surrounding components.The setup pours LN2 from a dewar through a funnel for controlled cooling experiments.

5. Experimental Setup

The evaluation used three FPGA/SoC platforms, cryogenic and temperature-controlled environments, external clocking, and on-chip telemetry to track sensor, clock, voltage, and delay behavior.

  • Devices: Three devices from two vendors were evaluated: AMD Zynq UltraScale+ MPSoC, AMD Spartan-7 FPGA, and Microchip PolarFire FPGA SoC.The devices use 16 nm and 28 nm fabrication processes and SRAM- or Flash-based FPGA technologies.
  • Cryogenic and thermal environments: Liquid nitrogen was directed onto each target device through an aluminum channel and funnel, while a thermal chamber provided controlled conditions from -40◦C to 130◦C.LN2 has an approximate boiling temperature of -196◦C.
  • Clocking and communication: A 12.5 MHz external function-generator clock supported UART communication and delay monitoring while the boards used platform-specific clock sources.The setup used ESP-Prog over UART TX/RX and platform-specific clock inputs for the tested boards.
  • Telemetry instrumentation: Telemetry measured on-die temperature, voltage rails, clock behavior, and digital-logic delay using on-chip sensors, counters, and an 11-stage ring oscillator.The 28-bit counters tracked clock edges, while the ring oscillator monitored timing-delay changes and digital-fabric operation.
  • Telemetry instrumentation: Figure 5 organizes telemetry by device and plots temperature, voltage rails, and clock counters over time to assess cryogenic behavior.The monitored counter values were used to determine whether clocks continued running, slowed, or stopped.

6. Chypothermia Attack Results

Cryogenic conditions disabled or disrupted mixed-signal clocking and sensing across the tested platforms while digital logic or retained state persisted, with device-specific failure mechanisms and recovery behavior.

  • Clock stability monitoring: The PolarFire ring oscillator frequency initially increased as temperature decreased, peaked near -125◦C, and then decreased at lower temperatures.The non-monotonic trend indicates faster operation at moderately cold temperatures followed by slowing at more extreme temperatures.
  • AMD Zynq UltraScale+: At around -100◦C, the Zynq UltraScale+ internal and MMCM clocks stopped, the lock signal failed, and SYSMON readings froze at their last values.The PS clock and MMCM output counters remained stuck after the clock stopped, while the reported temperature and voltage could no longer reflect further cooling.
  • Cross-platform findings: Across all three chips, clock-source or synthesis circuits and PLL-based clock sensors were disabled at cryogenic temperatures while digital fabric operation or retained data remained available for later recovery.The study attributes platform differences to distinct mixed-signal failure mechanisms while using ring-oscillator and counter behavior to assess digital state.
  • Microchip PolarFire: At around -150◦C, PolarFire TVS readings became invalid before the device stopped responding, and both oscillator and CCC counters later resumed from prior values after warming.The device remained in an inferred hibernation state rather than being fully reset or reprogrammed.
  • Microchip PolarFire: After warming, PolarFire TVS outputs remained invalid and its high-temperature alarm did not trigger despite invalid sensor values.The voltage output was 0xFFFF, interpreted by the decoding function as −4.095875V, which was treated as physically invalid.

6.3. AMD Spartan-7 Results

On AMD Spartan-7, cryogenic cooling disrupted PLL operation, clock behavior, and XADC sensing while digital monitoring structures remained usable. The PLL output stopped near -176°C, input-clock slowdown was temporary, and several interfaces failed at low temperatures but recovered after warming.

  • PLL and clock behavior: At around -176°C, the PLL output clock stopped, its counter ceased changing, and the MMCM lock signal failed to detect the abnormality.External monitoring also observed unreliable VCCAUX behavior followed by a voltage increase, consistent with cryogenic analog, VRM, and capacitor malfunctions.
  • PLL and clock behavior: The PLL input clock temporarily slowed after liquid nitrogen cooling, despite the on-board oscillator not being directly exposed.The slowdown rate was computed from changes in input-clock counter period relative to its initial period, with Figure 7 showing the effect over time.
  • Sensor behavior: XADC sensors deactivated and reactivated during cryogenic exposure, while the Spartan-7 ring oscillator slowed as temperature decreased.These observations show that both sensing and delay-based timing behavior changed during cooling.
  • Peripheral interfaces: At very low temperatures, JTAG reprogramming failed on Spartan-7 near -176°C and Zynq UltraScale+ near -168°C, while interfaces recovered after warming.The tested devices exhibited temperature-dependent and reversible interface failures, although AMD-device I/O initially continued operating.
  • Overall result: Across the tested devices, cryogenic conditions disabled clock source or synthesis circuits and PLL-based sensors while the digital fabric remained operational or retained data.Continuous ring-oscillator operation and error-free counters supported preservation of configuration and data for later static recovery.

7. Combined Attack Results

The combined Chypothermia–Chypnosis attack cools the chip enough to slow a delay-based sensor, then uses voltage reduction to halt the clock without triggering detection. This approach targets OpenTitan-style protections and is limited by the temperature dependence of the sensor technology.

  • Attack mechanism: Moderate cooling slows the delay-based sensor through inverse temperature dependence, extending its timing margin before Chypnosis halts the clock.The combined sequence first reduces temperature within the sensor’s allowed range and then applies a fast voltage drop.
  • OpenTitan evaluation: The combined attack targets OpenTitan English Breakfast, whose alert handler monitors temperature through XADC and uses a delay-based sensor to detect voltage-induced clock halts.The implementation includes synchronous wiping and a buffer-chain sensor for asynchronous register reset.
  • OpenTitan evaluation: At the -40°C XADC threshold, the experiment evaluated whether combined cooling and voltage reduction could evade temperature and clock-halt detection.At room temperature, rapid voltage reduction caused the delay-based sensor to detect the attack and wipe sensitive state, providing the baseline for the combined evaluation.
  • Scope: The attack applies to devices exhibiting inverse temperature dependence, whereas devices with the opposite temperature behavior may require heating instead of cooling.The authors also note that AMD 7-Series behavior can depend on sensor placement and routing, and their attacked sensor followed the inverse-temperature pattern.

8. Countermeasures

The proposed countermeasure actively heats a delay-based sensor with distributed ring oscillators so it remains within its nominal operating regime during cryogenic attacks. This improves detection but adds FPGA area and power costs, while board-level hardening has broader cost and generalization limits.

  • 8.1. Self-heating Chip: A distributed ring-oscillator farm heats the delay-based sensor, counteracting the cooling-induced delay increase that enables the combined attack.The implementation surrounds the sensor with three-stage oscillators, and the farm is activated when the XADC-reported temperature falls below a threshold.
  • 8.1. Self-heating Chip: The 1500-oscillator implementation required approximately 4500 LUTs and increased core-supply power from roughly 30 mW to 323 mW when active.Because the oscillators activate only below a temperature threshold, the stated power overhead does not apply during nominal temperature operation.
  • 8.1. Self-heating Chip: At a -36°C chamber ambient, the die self-heated to -29°C with no oscillators active, above the combined attack’s operating point.Table 2 reports steady-state die temperature as a function of the number of active three-stage oscillators.
  • 8.2. Other Potential Countermeasures: Cryo-qualified board and device components may improve reliability, but their cost, chip-family dependence, and residual digital-security risks limit them as standalone defenses.The paper presents these choices as most effective when combined with active self-heating.

9. Discussion

The discussion distinguishes Chypothermia from prior memory-reconstruction attacks and assesses how its FPGA/SoC findings relate to ASICs.

  • 9.1. Distinction from Prior Attacks: Chypothermia differs from data remanence, Cold Boot, and Pentimento attacks in its attack setting.The cited passage introduces these prior attacks as resembling Chypothermia but states that an important distinction follows.
  • 9.2. Applicability to ASICs: The cryogenic attack primarily targets mixed-signal components that are separate from the FPGA’s digital fabric and resemble ASIC implementations.This comparison supports relevance beyond FPGA-specific digital logic.
  • 9.2. Applicability to ASICs: The combined attack exploits the ITD effect, which the authors describe as common to modern chips rather than specific to FPGAs.An in-depth FPGA–ASIC comparison remains outside the paper’s scope.

10. Conclusion

The conclusion presents Chypothermia as a non-invasive cryogenic attack that disables on-chip sensing and clock-generation circuitry, including in a practical OpenTitan scenario. It argues that anti-tamper sensors require greater resilience to adversarial environmental conditions.

  • 10. Conclusion: Chypothermia disables clock, voltage, and clock-generation circuitry by exploiting cryogenic failures in mixed-signal components without electrical tampering.The attack preserves secret data while disabling these on-chip components.
  • 10. Conclusion: The combined Chypothermia–Chypnosis attack halts clocks at moderately low temperatures while evading thermal anomaly detection.This extends the attack beyond relying solely on extreme cryogenic cooling.
  • 10. Conclusion: Across multiple FPGA/SoC platforms, both soft-IP and hard-IP sensing implementations were disabled while secrets remained on-chip.The evaluation covered multiple platform and sensor implementation types.
  • 10. Conclusion: On OpenTitan, the combined attack bypassed state-of-the-art clock monitoring and prevented key zeroization.This demonstrates practical impact on a root-of-trust alert handler.
  • 10. Conclusion: The results motivate sensor designs and protection strategies that remain trustworthy under extreme environmental conditions.The conclusion identifies conventional on-chip reliability sensors as underexplored against environmental manipulation.

11. Responsible Disclosure

The authors report responsible disclosure of the vulnerability to AMD and Microchip after completing the initial manuscript. They planned a 45-day embargo and recorded acknowledgments from both companies.

  • 11. Responsible Disclosure: The vulnerability was disclosed to AMD and Microchip on June 15, 2026, after the initial manuscript was completed.The authors simultaneously informed both companies that the paper would remain under embargo for 45 days.
  • 11. Responsible Disclosure: Microchip acknowledged the report on June 15, 2026, while AMD acknowledged it on June 18, 2026.The passage states that the parties remained in contact after the report was sent.
Loading 2609.11442v1…