Attacking Multi-Tenant FPGAs Without Manual Placement and Routing

Field Programmable Gate Arrays (FPGAs) allow to optimize computations at the speed of hardware whilst enjoying the flexibility of software. Sharing FPGAs between multiple users in clouds (so-called multi-tenant FPGAs) has reduced the implementation cost for each user; obviously, logical isolation ensures that each user can preserve his privacy. Nonetheless, it has been recently proven that multi-tenant FPGAs allow for a malevolent user to leverage physical leakage of another user to recover his private data, such as cryptographic keys. Such attacks mainly benefit from Time-to-Digital Converters (TDC) in sensing the FPGA's power consumption (modulated by the victim user's secret/private keys) and performing a side-channel analysis attack. However, the state-of-the-art attacks in this area require manual Placement and Routing (PnR) of the implemented TDC to be able to extract the victim's sensitive data. Such restriction makes the attack more difficult, if not impossible, as manual PnR is not straightforward when the access to the FPGA is limited and only the adversary (as a tenant) has access to a portion of the FPGA for the implementation. Accordingly, in this paper we lift such requirement and show how the victim can be affected even if the adversary has no control over the PnR to implement the TDC and in turn retrieve the secret information.