Experimental analysis of the electromagnetic instruction skip fault model and consequences for software countermeasures

Microcontrollers storing valuable data or using security functions are vulnerable to fault injection attacks. Among the various types of faults, instruction skips induced at runtime proved to be effective against identification routines or encryption algorithms. Until recently, most research works assessed a fault model that consists in a single instruction skip, i.e. the ability to prevent one chosen instruction in a program from being executed. We question this fault model for EM fault injection on experimental basis and report the possibility to induce several consecutive instructions skips. Such an extended fault model proved to be effective against a duplication-based software countermeasure as our experiments revealed.