ATECC608A Laser Fault Injection

In 2020, we evaluated the Microchip ATECC508A Secure Memory circuit. We identified a vulnerability allowing an attacker to read a secret data slot using single Laser Fault Injection. Subsequently, the product life cycle of this chip turned to be deprecated, and the circuit has been superseded by the ATECC608A, supposedly more secure. We present a new attack allowing retrieval of the same data slot secret for this new chip, using a double Laser Fault Injection to bypass two security tests during a single command execution. A particular hardware wallet is vulnerable to this attack, as it allows stealing the secret seed protected by the Secure Element. This work was conducted in a black box approach. We explain the attack path identification process, using help from power trace analysis and up to 4 faults in a single command, during an intermediate testing campaign. We construct a firmware implementation hypothesis based on our results to explain how the security and one double-check counter-measure are bypassed.

Hériveaux, Olivier. “Defeating a Secure Element with Multiple Laser Fault Injections”, n.d., 20.

The attack primarily affects BitBox02 and Foundation Passport and is related to usage of Microchip ATECC608A as an SE.

Links to this page
  • BitBox02

    The Microchip ATECC608A albeit cannot protect the data from physical attacks, an exploit ATECC608A Laser Fault Injection exists which allows the adversary to attack the device and possible extract the seeds from the secure data banks. Whether this attack had been addressed is yet unknown.