Theses and Internships

For local fault attacks, a suitable position on the chip needs to be identified before arming an attack on, e.g., some cipher. Currently, one needs to step over the entire chip and test possible fault parameters at each position. Later, the position with the best results in this positioning run will be used for the attack. Since there is a vast amount of possible fault injection parameters, the position search is very time-consuming. There are some approaches in state-of-the-art research publications to speed up this process. However, a detailed methodology is still missing, especially for fault injections.

A correlation between EM emanations and positions prone to faults can drastically speed up the process and provide a major time advantage to any attacker.

Within this work, the dependency of EM and fault positions should be explored in the example of different microcontroller or FPGA implementations. The most important part lies in the reproducibility of results across these different platforms.
Currently, the comparison is done manually. Further approaches should be found during the student work and evaluated in the recorded datasets.

• Knowledge in Side-Channels and Fault Injections are ideal
• Python and C are mandatory
• Linux skill are also mandatory

I am looking for students who are interested in HW implementations and have knowledge of a HDL language. If you are also interested in cryptography and its applications, you would be a suitable candidate.

Possible implementation tasks are the
  - Extension / implementation of symmetric ciphers
  - Extension / implementation of message authentication codes
  - Extension / implementation of error correction codes / functionality

The implementation will be analysed for its suitability for memory encryption and integrity verification of memory contents. For this assessment, typical performance metrics will be measured and evaluated on an FPGA.

If any of the topics interest you, please email me to discuss the details and your personal interests.

Do you have hardware experience? We are looking for you!

• You are looking for a thesis, research internship or student assistant position?
• You know how to draw an orderly schematic?
• You know a thing or two about electronic component selection?
• You know op-amps not just from textbooks?
• You have laid out your own PCBs before?
• You are no stranger to soldering?
• You know not just SMD, but lots of other three-letter acronyms, too: ESL, FR-4, C0G, NP0, UJT, QFN, DFN, BGA ... ?
• You prefer to talk to microcontrollers (at the register level)?
• You can tell components apart from the smell of their magic smoke?

If you can at least tick a few boxes here and want to help us improve our lab and measurement for various hardware attacks, please contact us! We will ?nd a hardware-oriented security-adjacent topic together.

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Servers Confidential Computing technologies are a promising tool for cloud computing. They aim to protect data while being processed in the cloud by preventing the cloud provider and platform owner from gaining access to it. AMD SEV-SNP and Intel TDX in particular do this by providing confidential virtual machines. Memory of these VMs remains confidential and integrity-protected at all times and the technologies provide remote attestation mechanisms for verification. Extensive work has analyzed, broken and improved upon these technologies. Especially for proof of concept implementations, however, creating, testing and verifying code requires specific server hardware that is not readily available to everyone.
This thesis aims to design and implement emulators for either AMD SEV-SNP or Intel TDX.

Task Description
In this thesis, the focus lies on providing AMD SEV-SNP or Intel TDX remote attestation mechanisms to a VM hosted on conventional hardware. For this, the student researches and evaluates required components needed to emulate these. The student then creates a design and proof of concept implementation that provides the corresponding remote attestation mechanism to the guest VM, e.g., by modifying and extending the virtual machine manager (VMM) QEMU. If possible, guest VM and host kernel shall remain unchanged.

* High motivation and ability to work independently
* Good understanding of virtualization concepts
* Experience with QEMU / KVM and Linux kernels

I am looking for students who are interested in HW implementations and have knowledge of a HDL language. If you are also interested in cryptography and its applications, you would be a suitable candidate.

Possible implementation tasks are the
  - Extension / implementation of symmetric ciphers
  - Extension / implementation of message authentication codes
  - Extension / implementation of error correction codes / functionality

The implementation will be analysed for its suitability for memory encryption and integrity verification of memory contents. For this assessment, typical performance metrics will be measured and evaluated on an FPGA.

If any of the topics interest you, please email me to discuss the details and your personal interests.

Do you have hardware experience? We are looking for you!

• You are looking for a thesis, research internship or student assistant position?
• You know how to draw an orderly schematic?
• You know a thing or two about electronic component selection?
• You know op-amps not just from textbooks?
• You have laid out your own PCBs before?
• You are no stranger to soldering?
• You know not just SMD, but lots of other three-letter acronyms, too: ESL, FR-4, C0G, NP0, UJT, QFN, DFN, BGA ... ?
• You prefer to talk to microcontrollers (at the register level)?
• You can tell components apart from the smell of their magic smoke?

If you can at least tick a few boxes here and want to help us improve our lab and measurement for various hardware attacks, please contact us! We will ?nd a hardware-oriented security-adjacent topic together.

Fuzzing is a powerful and versatile technique to hunt security vulnerabilities. Embedded devices, however, usually lack suitable interfaces to apply established fuzzing-concepts known from software. Tapping side-channel information such as power consumption or electromagnetic radiation, can yield these interfaces and enable conventional grey-box fuzzing of an embedded device.

Task Description

Our current test set-up is capable of extracting code-coverage information during a fuzzing campaign from the power consumption of a STM32F417IGT microcontroller and feeding it back into our tool, which is based on the popular AFL++ fuzzer. Your task will be to measure the performance of this tool on additional microcontrollers and to increase its effectiveness where applicable. In detail, this entails hooking up a microcontroller to the test set-up, train a machine-learning model to the microcontroller-specific behavior, and measure the performance and effectiveness while fuzzing proof-of-concept and real-world software running on the microcontroller.
As optional task, you can work towards tapping electromagnetic radiation as second side-channel next to power consumption.

• High motivation and ability to work independently
• Good coding skills in python and general understanding of software architecture
• Interest in offensive security and bug-hunting

Die Programmable Services Engine (PSE) der Elkhart Lake Plattform ist ein separater ARM Core zur Ausführung von Applikationen getrennt vom Hauptprozessor. Die Firmware der PSE ist eine Softwarekomponente, die zur Bereitstellung sicherheitskritischer Plattformfunktionalitäten eingesetzt wird. Durch den Einsatz der Programmiersprache C können in dieser Komponente angreifbare Schwachstellen mit weitreichenden Sicherheitsimplikationen vorhanden sein.

Aufgabenbeschreibung
Ziel der Arbeit ist die Erstellung eines funktionierenden Fuzzing-Setups für die PSE Firmware der Elkhart Lake Plattform. Im Rahmen der Arbeit sollen zunächst Aufbau und Schnittstellen der Firmware analysiert werden. Darauf aufbauend sollen für Fuzzing geeignet Schnittstellen identifiziert werden.
Basierend auf diesen Vorarbeiten soll dann ein geeigneter Fuzzer ausgewählt und damit ein lauffähiges Fuzzing-Setup aufgebaut werden. Auch die Identifikation und Umsetzung von ggf. notwendigen Änderungen am ausgewählten Fuzzer sind Teil der Arbeit. Abschließend soll eine Evaluation des implementierten Fuzzers im Hinblick auf Code Coverage, Performance und Reproduzierbarkeit erfolgen.

• Erweiterte Kenntnisse sowie praktische Erfahrung im Bereich Fuzzing
• Vorerfahrung mit Betriebssystemkonzepten und Linux-basierten Betriebssystemen
• Idealerweise Kenntnisse im Bereich Echtzeitbetriebssysteme, insbesondere Zephyr
• Idealerweise Grundkenntnisse im Bereich Rechnerarchitektur

Do you have hardware experience? We are looking for you!

• You are looking for a thesis, research internship or student assistant position?
• You know how to draw an orderly schematic?
• You know a thing or two about electronic component selection?
• You know op-amps not just from textbooks?
• You have laid out your own PCBs before?
• You are no stranger to soldering?
• You know not just SMD, but lots of other three-letter acronyms, too: ESL, FR-4, C0G, NP0, UJT, QFN, DFN, BGA ... ?
• You prefer to talk to microcontrollers (at the register level)?
• You can tell components apart from the smell of their magic smoke?

If you can at least tick a few boxes here and want to help us improve our lab and measurement for various hardware attacks, please contact us! We will ?nd a hardware-oriented security-adjacent topic together.

For local fault attacks, a suitable position on the chip needs to be identified before arming an attack on, e.g., some cipher. Currently, one needs to step over the entire chip and test possible fault parameters at each position. Later, the position with the best results in this positioning run will be used for the attack. Since there is a vast amount of possible fault injection parameters, the position search is very time-consuming. There are some approaches in state-of-the-art research publications to speed up this process. However, a detailed methodology is still missing, especially for fault injections.

A correlation between EM emanations and positions prone to faults can drastically speed up the process and provide a major time advantage to any attacker.

Within this work, the dependency of EM and fault positions should be explored in the example of different microcontroller or FPGA implementations. The most important part lies in the reproducibility of results across these different platforms.
Currently, the comparison is done manually. Further approaches should be found during the student work and evaluated in the recorded datasets.

• Knowledge in Side-Channels and Fault Injections are ideal
• Python and C are mandatory
• Linux skill are also mandatory

In scope of this work, you will
- Study and extend SGen for lattice-based cryptography
- Conduct design space exploration to evaluate different trade-offs
- Implement and evaluate a hardware accelerator on a Xilinx FPGA

- Experience in hardware design using VHDL or SystemVerilog
- Knowledge of basic DSP (Fixed-Point/Floating-Point Arithmetic, FFT, etc.)
- Knowledge and experience about FPGA design flow
- Motivation to learn more about lattice-based cryptography and hardware design

We are currently seeking students to join our research team for a practical experience in the field of
hardware security. This opportunity offers hands-on experience in conducting side-channel analysis
of System-on-Chips (SOCs).
Responsibilities

• Conduct literature research on hardware security and side-channel analysis techniques
• Build and use a measurement setup to collect side-channel data from SOCs
• Analyze the collected data and identify potential vulnerabilities
• Develop and implement potential attacks on the devices

• Currently enrolled as a student in a relevant field (e.g., computer science, electrical engineering)
• Strong interest in hardware security and side-channel analysis
• Basic knowledge of computer architecture and embedded systems
• Proficiency with programming languages, especially Python
• Ability to work independently and in a team

This research practicum provides an excellent opportunity to gain practical experience in the exciting
field of hardware security. If you are passionate about cybersecurity and eager to apply your
knowledge in a real-world context, we encourage you to apply for this position.
To apply, please submit your resume, your transcript of records and a brief statement of interest
highlighting your relevant experience and motivation for joining this research practicum.

I am looking for students who are interested in HW implementations and have knowledge of a HDL language. If you are also interested in cryptography and its applications, you would be a suitable candidate.

Possible implementation tasks are the
  - Extension / implementation of symmetric ciphers
  - Extension / implementation of message authentication codes
  - Extension / implementation of error correction codes / functionality

The implementation will be analysed for its suitability for memory encryption and integrity verification of memory contents. For this assessment, typical performance metrics will be measured and evaluated on an FPGA.

If any of the topics interest you, please email me to discuss the details and your personal interests.

RowHammer is a powerful fault injection technique, launched from software, to inject bitfaults into DRAM. Over the last decade, RowHammer was shown to threaten DRAMs. Vendors reacted and deployed countermeasures, which lead to the believe that the problem was solved. However, in the last years, research showed that RowHammer is still threatened by a more sophisticated technique, called Many-sided RowHammer.
In this work, we aim to create bitfaults inside the LPDDR4 of an embedded system by using the Many-Sided RowHammer technique. Therefore, we will port an existing RowHammer tool to our target embedded architecture. We will then evaluate, whether successful Many-sided RowHammer attack is possible on our targetted embedded platform, and which are the necessary parameters. Finally, we want evaluate how an attacker may use the particular achieved fault model.

The following skills are valuable for the execution of the project:
* Good knowledge of programming in C
* Basic experience with assembly programming
* Basic experience with embedded Linux (e.g., Buildroot, Yocto, Raspbian, etc.)
* Basic knowledge about memory hierarchies and DRAM structure

Do you have hardware experience? We are looking for you!

• You are looking for a thesis, research internship or student assistant position?
• You know how to draw an orderly schematic?
• You know a thing or two about electronic component selection?
• You know op-amps not just from textbooks?
• You have laid out your own PCBs before?
• You are no stranger to soldering?
• You know not just SMD, but lots of other three-letter acronyms, too: ESL, FR-4, C0G, NP0, UJT, QFN, DFN, BGA ... ?
• You prefer to talk to microcontrollers (at the register level)?
• You can tell components apart from the smell of their magic smoke?

If you can at least tick a few boxes here and want to help us improve our lab and measurement for various hardware attacks, please contact us! We will ?nd a hardware-oriented security-adjacent topic together.

Do you have hardware experience? We are looking for you!

• You are looking for a thesis, research internship or student assistant position?
• You know how to draw an orderly schematic?
• You know a thing or two about electronic component selection?
• You know op-amps not just from textbooks?
• You have laid out your own PCBs before?
• You are no stranger to soldering?
• You know not just SMD, but lots of other three-letter acronyms, too: ESL, FR-4, C0G, NP0, UJT, QFN, DFN, BGA ... ?
• You prefer to talk to microcontrollers (at the register level)?
• You can tell components apart from the smell of their magic smoke?

If you can at least tick a few boxes here and want to help us improve our lab and measurement for various hardware attacks, please contact us! We will ?nd a hardware-oriented security-adjacent topic together.

The smart card lab is a laboratory tailored for master students who want to expand their theoretical knowledge in side-channel analysis. Using the lessons learned in SIKA (Secure Implementation of Cryptographic Algorithms), students explore first-hand how to perform a correlation power analysis and break cryptographic implementations themselves. Howevel, the lab, is not only limited to just breaking implementations, but also covers a variety of approaches to secure implementations.

Given the broad scope of this lab, I am looking for a tutor (6-8 hours per week) to support my students, while working together with me to develop new ideas and refine existing exercises.

To give you a glimpse into potential tasks, on the hardware side you can

• assemble new smart cards, logic analyzers and debug adapter PCBs
• repair existing hardware if a malfunction can be seen
• drive the development of a new hardware revision

But you are not limited to the hardware aspects, we also strive to

• improve the existing smart card firmware to make it even more secure
• experiment with new ways to make the exercises more exciting. For example to give the students the opportunity to compete in a CTF-like scenario
• create a solution to automatically test and evaluate the code submitted by the students

If you are interested in embedded systems and hardware-software co-design, this could be the student job for you. I do not have the prerequesite of you having taken the course already.

The smart card lab draws expertise from several different areas, so your requirements will vary depending on which area you want to work in. From a hardware perspective, you should be able to read schematics and have some initial practice in soldering. If you strive to develop software, basic knowledge in embedded C and Python is required.

For local fault attacks, a suitable position on the chip needs to be identified before arming an attack on, e.g., some cipher. Currently, one needs to step over the entire chip and test possible fault parameters at each position. Later, the position with the best results in this positioning run will be used for the attack. Since there is a vast amount of possible fault injection parameters, the position search is very time-consuming. There are some approaches in state-of-the-art research publications to speed up this process. However, a detailed methodology is still missing, especially for fault injections.

A correlation between EM emanations and positions prone to faults can drastically speed up the process and provide a major time advantage to any attacker.

Within this work, the dependency of EM and fault positions should be explored in the example of different microcontroller or FPGA implementations. The most important part lies in the reproducibility of results across these different platforms.
Currently, the comparison is done manually. Further approaches should be found during the student work and evaluated in the recorded datasets.

• Knowledge in Side-Channels and Fault Injections are ideal
• Python and C are mandatory
• Linux skill are also mandatory

Fraunhofer AISEC and TU Munich are collaborating in designing security chip prototypes for various research projects. You have the opportunity to work with a team of researchers on realizing innovative security solutions on hardware circuits. During your work, you will use state-of-the-art EDA tools, learn valuable skills related to the different stages of chip design and have the opportunity to contribute to cutting edge research. This job is an ideal starting point for a future career in chip design and information security. We also offer Research Internships and Master Thesis positions.

Task Description
Within this work, you will
• Assist implementing and verifying hardware implementations
• Maintain and improve IP cores and tooling
• Document hardware designs
• Evaluate hardware implementations on AMD/Xilinx FPGAs

• First experience in hardware design using VHDL or SystemVerilog
• Basic knowledge about FPGA or ASIC design flow
• Good programming skills in Python
• High motivation to learn more about information security and hardware design

The project AUTOPSY aims to protect the privacy of the data collected and processed in cars and researches on the impact of deploying Privacy Enhancing Techniques (PETs) in an automotive scenario with a focus on platooning in the initial demonstration.
Goal of this work is to build upon an existing demonstrator and further improve it to showcase results in an interesting and interactive way. We are therefore looking for a motivated working student with strong background in embedded systems.
Task description

The tasks cover in particular:
• Developing and improving code for PET implementations, communication and system software
• Deployment of code on automotive embedded systems
• Improvement of visualization and user experience

• Strong background in programming and debugging embedded systems
• Interest in privacy enhancing techniques
• Strong motivation and independent working style
Date: June 2024
Start: any time

Fehlerangriffe auf kryptografische Verfahren sind eine Methode mittels derer ein geheimer Schlüssel aus einem Gerät extrahiert werden kann, indem während der Ausführung mit einer gezielten Störung des Geräts (z.B. durch einen starken elektromagnetischen Puls) eine fehlerhafte Berechnung des kryptografischen Algorithmus erzwungen wird. Abhängig vom kryptografischen Verfahren existieren eine Vielzahl von Angriffen, die auf Basis von fehlerhaften Ausgabewerten den verwendeten Schlüssel ermitteln können.
Aufgabe der hier ausgeschriebenen Stelle ist die Mitarbeit am Aufbau eines Tooling Frameworks für das Hardware Security Labor des Fraunhofer AISEC. Das Tooling soll verschiedene existierende Angriffe implementieren sodass diese für Analysen im Labor genutzt werden können. Folgende Tätigkeiten sind hierfür voraussichtlich durchzuführen:
• Literaturrecherche sowie Lesen und Verstehen von relevanten Publikationen
• Python-Implementierung von kryptografischen Verfahren mit der Möglichkeit Fehlerinjektionen zu simulieren
• Implementierung und Testen ausgewählter Angriffe

• Sehr gute Sprachkenntnisse in Deutsch und/oder Englisch
• Gute Programmierkenntnisse in Python
• Selbstständige Arbeitsweise

I am looking for students who are interested in HW implementations and have knowledge of a HDL language. If you are also interested in cryptography and its applications, you would be a suitable candidate.

Possible implementation tasks are the
  - Extension / implementation of symmetric ciphers
  - Extension / implementation of message authentication codes
  - Extension / implementation of error correction codes / functionality

The implementation will be analysed for its suitability for memory encryption and integrity verification of memory contents. For this assessment, typical performance metrics will be measured and evaluated on an FPGA.

If any of the topics interest you, please email me to discuss the details and your personal interests.

Do you have hardware experience? We are looking for you!

• You are looking for a thesis, research internship or student assistant position?
• You know how to draw an orderly schematic?
• You know a thing or two about electronic component selection?
• You know op-amps not just from textbooks?
• You have laid out your own PCBs before?
• You are no stranger to soldering?
• You know not just SMD, but lots of other three-letter acronyms, too: ESL, FR-4, C0G, NP0, UJT, QFN, DFN, BGA ... ?
• You prefer to talk to microcontrollers (at the register level)?
• You can tell components apart from the smell of their magic smoke?

If you can at least tick a few boxes here and want to help us improve our lab and measurement for various hardware attacks, please contact us! We will ?nd a hardware-oriented security-adjacent topic together.