Contactless probing methods through the chip backside have been demonstrated to be powerful attack techniques in the field of electronic security. However, these attacks typically require the adversary to run the circuit under specific conditions, such as enforcing the switching of gates or registers with certain frequencies or repeating measurements over multiple executions to achieve an acceptable signal-to-noise ratio (SNR). Fulfilling such requirements may not always be feasible due to challenges such as low-frequency switching or inaccessibility of the control signals. In this work, we assess these requirements for contactless electron- and photon-based probing attacks by performing extensive experiments. Our findings demonstrate that E-beam probing, in particular, has the potential to outperform optical methods in scenarios involving static or low-frequency circuit activities.

Programmable logics, such as complex programmable logic devices (CPLDs) and field programmable gate arrays (FPGAs), are widely used in security applications. In these applications cryptographic ciphers, physically unclonable functions (PUFs) and other security primitives are implemented on such platforms. These security primitives can be the target of fault injection attacks. One of the most powerful examples of fault injection techniques is laser fault injection (LFI), which can induce permanent or transient faults into the configuration memories of programmable logic. However, localization of fault sensitive locations on the chip requires reverse-engineering of the utilized building blocks, and therefore, is a tedious task. In this work, we propose an automated technique using readily available IC debug tools to map and profile the fault sensitive locations of programmable logic devices in a short period.