MSc David Spielmann
david.spielmann@unisg.ch

School of Computer Science
Torstrasse 25
9000 St. Gallen, Switzerland

I joined the Programming Group as a PhD student in May 2023. I obtained my Bachelor’s degree in Computer Science from ETH Zurich and a joint Master’s degree from ETH Zurich and EPF Lausanne with a focus on security and distributed systems. As part of my Master’s thesis, I used to examine power side-channel attacks on remotely accessible FPGAs. In my PhD studies, I focus on my research interests which include software engineering and security.

Publications

1. TCHES
   

   RDS: FPGA Routing Delay Sensors for Effective Remote Power Analysis Attacks

   David Spielmann, Ognjen Glamočanin, Mirjana Stojilović

   IACR Transactions on Cryptographic Hardware Embedded Systems 198 (2), 2023

   Abstract PDF

   State-of-the-art sensors for measuring FPGA voltage fluctuations are time-to-digital converters (TDCs). They allow detecting voltage fluctuations in the order of a few nanoseconds. The key building component of a TDC is a delay line, typically implemented as a chain of fast carry propagation multiplexers. In FPGAs, the fast carry chains are constrained to dedicated logic and routing, and need to be routed strictly vertically. In this work, we present an alternative approach to designing on-chip voltage sensors, in which the FPGA routing resources replace the carry logic. We present three variants of what we name a routing delay sensor (RDS): one vertically constrained, one horizontally constrained, and one free of any constraints. We perform a thorough experimental evaluation on both the Sakura-X side-channel evaluation board and the Alveo U200 datacenter card, to evaluate the performance of RDS sensors in the context of a remote power side-channel analysis attack. The results show that our best RDS implementation in most cases outperforms the TDC. On average, for breaking the full 128-bit key of an AES-128 cryptographic core, an adversary requires 35% fewer side-channel traces when using the RDS than when using the TDC. Besides making the attack more effective, given the absence of the placement and routing constraint, the RDS sensor is also easier to deploy.