Practical, Low-Cost Fault Injection Attacks on Personal Smart Devices

Round 1

Reviewer 1 Report

Overall, the paper is well-written and clearly presented. However, a few grammatical typos do appear throughout that should be fixed. For example,

- “glicthing” is misspelled in line 79

- “likely operate” should be “likely to operate” in line 170

- “%100” should be “100%” in line 189

- “faulty signature” should be “the faulty signature” in line 193

In addition, the acronym “DUT” is never defined. Lastly, the authors are not clear about how an adversary can use the information gained from a leaked faulty signature to construct the actual digital signature/key.

Author Response

“glicthing” is misspelled in line 79	Typo fixed
- “likely operate” should be “likely to operate” in line 170	Typo fixed
“%100” should be “100%” in line 189	changed to 100%
“faulty signature” should be “the faulty signature” in line 193	Added "the"
The acronym DUT is never defined	Defined DUT in line 51
Lastly, the authors are not clear about how an adversary can use the information gained from a leaked faulty signature to construct the actual digital signature/key.	Added clarification in line 127

Reviewer 2 Report

1. What is new in this approach? What is the main novelty? What is the input from this paper to the field?
2. How is the model working? What are steps in the model?
3. What are limitations of this idea? Not every attack is in the same way, so what are scenarios your model is not able to consider?
4. Model needs comparisons to other models and on other different scenarios to show advances.

Author Response

What is new in this approach? What is the main novelty? What is the input from this paper to the field?	Add a discussion about the novelty in the end of the Introduction section
How is the model working? What are steps in the model?	Described the working principle in the Attack Model section
What are limitations of this idea? Not every attack is in the same way, so what are scenarios your model is not able to consider?	discussed in Towards Malicious FRUs section
Model needs comparisons to other models and on other different scenarios to show advances.	Added a Comparison to other attack model section after the attack model section

Reviewer 3 Report

1. Which kinds of the oscillator and the voltage multiplier are used in the EM Fault Injector of Figure 1? The Authors should explain in details.
2. The mathematical models in the EM Fault Injector of Figure 1 should be listed in details.
3. The EM Fault Injector should be labeled in Figure 2.
4. Figure 1 is fuzzy due to too small. 
5.  The specifications of the ARMv7 should be listed.
6.  The specifications of the BCM2837 should be listed.
7. More experiments should be listed for more systems.

Author Response

Which kinds of the oscillator and the voltage multiplier are used in the EM Fault Injector of Figure 1? The Authors should explain in details.	Added voltage multiplier type and oscillator
The mathematical models in the EM Fault Injector of Figure 1 should be listed in details.	Added a reference to another work which thorougly cover the mathematical model behind EM fault injections
The EM Fault Injector should be labeled in Figure 2.	Labelled both parts of the circuit in the figure
Figure 1 is fuzzy due to too small.	Increased scale to of Figure 1 and improved the fonts
The specifications of the ARMv7 should be listed.	added the BCM2837 specification
The specifications of the BCM2837 should be listed.	added the BCM2837 specification
More experiments should be listed for more systems.	Added a section describing our ATMega experiement on an Arduino

Reviewer 4 Report

This paper intends to present a set of techniques that allow for simple and effective fault injection attacks on electronic devices with some actual experiments. However, the starting points of the paper are vague and some other experimental issues still own some room for further improvements, such as:

1. The general writing pattern seems like an experimental report, and the authors should point out specific research gaps between the current one and other ones.
2. Section 2 can be merged into Section 1 with a more concise way.
3. There are only 19 references in this paper, which lacks a convincing literature review in related areas, and a separate section need to be added.
4. The quality of Figure 1 should be updated.
5. How to show the validity of the presented experimentin terms of comparative analysis.
6. The limitations and future study trends need to be listed in a more detailed way.
7. The format of references need to be updated in a unified form.
8. Please also improve the language to avoid any typos and grammar mistakes.

Author Response

The general writing pattern seems like an experimental report, and the authors should point out specific research gaps between the current one and other ones.	Added a paragraph about the research gap at the end of the introduction
Section 2 can be merged into Section 1 with a more concise way.	Merged "Motivation" to Introduction while redacting the background paragraph
There are only 19 references in this paper, which lacks a convincing literature review in related areas, and a separate section need to be added.	Expanded the related work section to address more existing work and how they relate to this one
The quality of Figure 1 should be updated.	increased scale
How to show the validity of the presented experimentin terms of comparative analysis.	Added comparative analysis subsection
The limitations and future study trends need to be listed in a more detailed way.	Addressed in "Toward Malicious FRUs" section where at the end, the limitations of the proposed attack are discussed
The format of references need to be updated in a unified form.	Fixed reference 15 & 18 web references
Please also improve the language to avoid any typos and grammar mistakes.	Performed a grammer review, changed a few typos

Round 2

Reviewer 2 Report

ok

Reviewer 3 Report

This paper has been revised according to the reviewer's comments. This paper should be accepted. 

Reviewer 4 Report

Authors have revised the manuscript as per the comments of the reviewers.