Instead of trying to directly attack a security function (for example, breaking FPGA bitstream AES-256 decryption using a non-feasible brute-force key attack), an attacker will often look for an easier solution such as side-channel analysis. The side channel is an unintentional information leakage path that might exist in an electronic device. If observed for a long enough period, it might be possible to extract secret information from it (such as a cryptographic function’s red key data).
Differential power analysis (DPA) is a side-channel technique that observes and records samples of the power supply fluctuations due to digital switching (by monitoring voltage across a low resistance in series with the power line(s) or nearby electromagnetic probing) of a functioning electronic device. Signal processing and statistical methods are then applied to the recorded data to extract red key data. The number of data samples required has been consistently reduced over time as the capabilities of the attackers have improved.
AMD provides DPA resistance by limiting the amount of side channel data that an adversary can collect on any one key. This protocol-based data limiting technique is used on the UltraScale and UltraScale+ FPGAs to mitigate against DPA attacks of the on-chip bitstream decryptor. This technique offers the most long-term flexibility because the level of protection is programmable and can be increased as the capabilities of the attacker improve.
There are two types of data that must be limited in this regard: invalid/random bitstream data and valid bitstream data. To be effective, there must be countermeasures for both invalid/random and valid bitstream data attacks.