Glitch Attack Fault Injection
# Glitch Attack and Fault Injection
A side-channel attack passively listens to a chip's power or timing to extract a secret it's already computing correctly. A glitch attack does something more aggressive: it deliberately disturbs the chip's own operating conditions — a sudden voltage dip, an irregular clock edge, a laser pulse at a precise moment — to make a circuit compute incorrectly in a specific, exploitable way, then reads out what that induced error reveals. Fault injection is the general technique; a glitch attack is the specific, low-cost version an attacker can mount with nothing more exotic than a cheap voltage or clock manipulation circuit.
Voltage and clock glitching both work by pushing a specific flip-flop or logic path to momentarily violate its own timing requirements, at an instant the attacker chooses. A brief voltage droop slows down transistor switching for a few nanoseconds; an irregular, too-fast clock edge shortens the time a combinational path has to settle before the next clock tick captures it. Either disturbance, applied at precisely the right instant in a known instruction sequence, can cause one specific flip-flop to latch the wrong value — skip an instruction, corrupt a loop counter, or flip a single bit in a cryptographic computation — while the rest of the chip keeps running normally. The attacker doesn't need to understand the chip's internal design to find that instant; a successful glitch is found empirically, by sweeping glitch timing and depth across many attempts until one lands on a bit that matters.
The exploitable payoff is usually an instruction skip or a cryptographic fault, each useful to an attacker in a different way. Skipping a single instruction can bypass a security check entirely — a glitch timed to corrupt a conditional branch's own comparison result can turn an "access denied" path into an "access granted" one without ever defeating the check's logic, just by making the processor never properly evaluate it. Faulting a cryptographic computation is more subtle but often more powerful: differential fault analysis compares a correct ciphertext against a faulty one produced from the same plaintext and key, and for several widely used algorithms a single well-placed fault during encryption or signing leaks enough information to recover the secret key mathematically — turning one successful glitch into a complete key-extraction attack rather than just a bypassed check.
Countermeasures layer sensing, redundancy, and randomization together, because no single defense closes every fault-injection path. On-chip voltage and clock sensors detect out-of-spec supply or clock conditions and trigger a reset or lockout before a glitch can land cleanly, directly raising the bar on how precisely an attacker has to time an attack. Redundant computation — computing a security-critical result twice (or three times, with majority voting) and comparing — catches a fault that corrupts only one of the redundant copies, since a real glitch rarely corrupts two independent computations identically. And execution-timing randomization, deliberately varying when security-critical operations actually execute relative to external clock and power observation, denies an attacker the precise, repeatable timing reference a glitch attack depends on to land on the same vulnerable instant across repeated attempts. Secure-element and smartcard vendors like NXP and Infineon build all three layers into silicon specifically because any one alone still leaves an exploitable gap.
A PUF (id 12520) generates a device-specific secret from manufacturing randomness the chip itself can't be forced to reveal differently. Glitch attacks target something different entirely — not what secret the chip holds, but whether the chip can be forced to compute incorrectly at a chosen instant, which is why fault-injection countermeasures and a strong hardware root of trust are complementary defenses, not substitutes for each other.