Chypothermia: Clock Freezing for Static Side-channel Attacks

• URL: http://arxiv.org/abs/2609.11442v1
• Date: Thu, 10 Sep 2026 12:12:12 GMT
• Title: Chypothermia: Clock Freezing for Static Side-channel Attacks
• Abstract summary: Static side-channel attacks, which exploit halted-clock conditions, pose an increasing threat to chip security.<n>In this work, we demonstrate that exposing a chip to cryogenic temperatures interferes with on-chip mixed-signal components.<n>We develop Chypothermia, an attack that disables the target clock sensor, the clock generation circuit, and the voltage sensors, while preserving the secret data.
• Score: 14.726177440082715
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Static side-channel attacks, which exploit halted-clock conditions to extract sensitive information, pose an increasing threat to chip security. To counter these attacks, various defenses have been proposed that monitor for abnormal clock behavior and trigger the clearing of sensitive data when clock anomalies are detected. In this work, we demonstrate that exposing a chip to cryogenic temperatures interferes with on-chip mixed-signal components, responsible for signal sensing and generation. Based on this observation, we develop Chypothermia, an attack that, without any electrical tampering with the system, disables the target clock sensor, the clock generation circuit, and the voltage sensors, while preserving the secret data. While effective at halting the clock, cooling is a slow process and, on its own, is often insufficient against systems equipped with temperature sensors designed to detect thermal anomalies. To bypass these protections, we combine Chypothermia with Chypnosis (Mitard et al., IEEE SP 2026) and show that, even within a moderately low-temperature operating range, this combination can halt the clock while evading detection. We implement Chypothermia on multiple FPGA/SoC platforms and demonstrate successful disabling of both soft-IP and hard-IP sensor implementations. Finally, we apply Chypothermia to the alert handler of the OpenTitan root of trust, which incorporates a state-of-the-art clock sensor, and show that the attack evades detection and prevents key zeroization. Finally, we introduce and implement an FPGA-compatible self-heating sensor as a countermeasure and demonstrate its robustness against Chypothermia.

Related papers

• QUACK! Making the (Rubber) Ducky Talk: A Systematic Study of Keystroke Dynamics for HID Injection Detection [60.105690843777666]
  We show that robust, privacy-preserving detection is achievable using lightweight models operating solely on timing features.<n>Our analysis reveals that attacker sophistication does not monotonically translate into improved evasion.
  arXiv  Detail & Related papers  (2026-04-17T08:53:24Z)
• From Passive Monitoring to Active Defence: Resilient Control of Manipulators Under Cyberattacks [42.72791770760975]
  False data injection attacks (FDIAs) can induce substantial end-effector deviations without triggering alarms.<n>This paper studies the resilience of redundant manipulators to stealthy FDIAs and advances the architecture from passive monitoring to active defence.
  arXiv  Detail & Related papers  (2026-03-13T14:08:41Z)
• A PUF-Based Security Framework for Fault and Intrusion Detection [0.0]
  This research presents a hardware-root-of-trust that embeds a Physically Unclonable Function (PUF) at the measurement layer to authenticate sensor readings.<n>The architecture combines voltage fingerprinting with a temporal authentication that integrates with standard industrial control system architecture.
  arXiv  Detail & Related papers  (2026-01-25T02:36:08Z)
• Online Reliable Anomaly Detection via Neuromorphic Sensing and Communications [58.796149594878585]
  This paper proposes a low-power online anomaly detection framework based on neuromorphic wireless sensor networks.<n>In the considered system, a central reader node actively queries a subset of neuromorphic sensor nodes (neuro-SNs) at each time frame.<n>The neuromorphic sensors are event-driven, producing spikes in correspondence to relevant changes in the monitored system.
  arXiv  Detail & Related papers  (2025-10-16T13:56:54Z)
• CyFence: Securing Cyber-Physical Controllers via Trusted Execution Environment [45.86654759872101]
  Cyber-physical systems (CPSs) have experienced a significant technological evolution and increased connectivity, at the cost of greater exposure to cyber-attacks.<n>We propose CyFence, a novel architecture that improves the resilience of closed-loop control systems against cyber-attacks by adding a semantic check.<n>We evaluate CyFence considering a real-world application, consisting of an active braking digital controller, demonstrating that it can mitigate different types of attacks with a negligible overhead.
  arXiv  Detail & Related papers  (2025-06-12T12:22:45Z)
• CANTXSec: A Deterministic Intrusion Detection and Prevention System for CAN Bus Monitoring ECU Activations [53.036288487863786]
  We propose CANTXSec, the first deterministic Intrusion Detection and Prevention system based on physical ECU activations.<n>It detects and prevents classical attacks in the CAN bus, while detecting advanced attacks that have been less investigated in the literature.<n>We prove the effectiveness of our solution on a physical testbed, where we achieve 100% detection accuracy in both classes of attacks while preventing 100% of FIAs.
  arXiv  Detail & Related papers  (2025-05-14T13:37:07Z)
• Chypnosis: Undervolting-based Static Side-channel Attacks [13.755322225156263]
  Static side-channel analysis attacks rely on a stopped clock to extract sensitive information.<n>We present emphChypnosis, an undervolting attack technique that indirectly stops the target circuit clock.<n>Chypnosis also blocks the state clearing stage of prior defenses, allowing recovery of secret information even in their presence.
  arXiv  Detail & Related papers  (2025-04-15T21:43:33Z)
• On Borrowed Time -- Preventing Static Side-Channel Analysis [13.896152066919036]
  adversaries exploit leakage or response behaviour of integrated circuits in a static state.<n>Members of this class include Static Power Side-Channel Analysis (SCA), Laser Logic State Imaging (LLSI) and Impedance Analysis (IA)
  arXiv  Detail & Related papers  (2023-07-18T06:36:04Z)
• No Need to Know Physics: Resilience of Process-based Model-free Anomaly Detection for Industrial Control Systems [95.54151664013011]
  We present a novel framework to generate adversarial spoofing signals that violate physical properties of the system. We analyze four anomaly detectors published at top security conferences.
  arXiv  Detail & Related papers  (2020-12-07T11:02:44Z)
• DATE: Defense Against TEmperature Side-Channel Attacks in DVFS Enabled MPSoCs [12.223734832899794]
  We propose a novel approach of reducing spatial and temporal thermal gradient, which makes the system more secure against temperature side-channel attacks. We introduce a new metric, Thermal-Security-in-Multi-Processors (TSMP), which is capable of quantifying the security against temperature side-channel attacks on computing systems.
  arXiv  Detail & Related papers  (2020-07-02T20:41:23Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.