Sergei Skorobogatov

Background

Sergei Skorobogatov is a hardware security researcher who has worked for many years at the University of Cambridge Computer Laboratory. He holds an M.Sc. in Physics (1997) and a Ph.D. in Computer Science (2005), giving him a combined background in electronics, physics, and computer science that underpins his work analysing the physical behaviour of silicon chips rather than only their logical specifications. At Cambridge he has been part of the security research group associated with the university's long-running work on hardware tamper resistance, smart cards, and embedded device security.

Optical Fault Injection and Early Work

In the early 2000s, Skorobogatov became known for pioneering optical fault injection attacks, a technique in which precisely targeted light (for example from a laser) is used to induce faults in a chip's transistors at chosen moments, allowing an attacker to bypass security checks or extract secret data such as cryptographic keys. This class of attack, developed alongside colleagues at Cambridge, demonstrated that supposedly tamper-resistant secure microcontrollers used in smart cards and embedded devices could be manipulated at the silicon level, influencing how the semiconductor industry approached physical security countermeasures.

The ProASIC3 Backdoor Claim

In 2012, Skorobogatov and co-author Christopher Woods presented a paper titled "Breakthrough Silicon Scanning Discovers Backdoor in Military Chip" at the Cryptographic Hardware and Embedded Systems (CHES) workshop. The paper described the use of a proprietary technique called Pipeline Emission Analysis (PEA) to identify what the authors characterised as a backdoor inside the JTAG configuration controller of the Actel/Microsemi ProASIC3 A3P250 flash FPGA, a chip marketed by its manufacturer as highly resistant to invasive and non-invasive attacks and used in military and industrial systems. According to the paper, the technique allowed extraction of the chip's AES and Passkey security keys, which in turn could be used to read out or reprogram configuration data that the manufacturer's own documentation stated could not be read back by any method. The researchers noted that because the backdoor existed in the silicon itself rather than in loaded firmware, it could not be patched in devices already deployed. The claim drew wide attention, including speculation in some outlets about state-level involvement, which Skorobogatov and independent commentators noted was not established by the research itself; the manufacturer disputed some characterisations of the finding while acknowledging the underlying JTAG functionality.

Flash Memory and Card Cloning Research

Skorobogatov's subsequent research addressed vulnerabilities in flash memory devices, including "bumping" attacks that could extract data from flash memory chips lacking an explicit readback function, and work on data remanence in EEPROM and flash memory that required manufacturers to reconsider hardware designs. He also contributed to research on payment card security, including the "Chip and Skim" and "Be Prepared" papers analysing the EMV pre-play attack against chip-and-PIN cards, work that identified weaknesses in how some point-of-sale and ATM systems generated transaction authentication values.

iPhone 5c NAND Mirroring

In 2016, following public debate over whether the FBI could bypass the passcode limit on an iPhone 5c connected to the San Bernardino attack investigation without Apple's assistance, Skorobogatov published a paper titled "The Bumpy Road towards iPhone 5c NAND Mirroring." The paper described a practical hardware attack in which he desoldered the device's NAND flash chip, reverse-engineered its communication protocol with the processor, and used low-cost equipment to mirror the chip's contents, allowing repeated passcode guesses beyond the device's built-in retry limit. The work was presented as the first public demonstration of a technique that some in the security and law-enforcement communities had previously described as infeasible, and it fed directly into the ongoing debate about the practical limits of smartphone hardware security.

Later Work and Significance

Skorobogatov has continued to publish on hardware security topics including microprobing attacks on encrypted memory, teardown and security evaluation of secure USB flash drives, hardware security assessment of FPGA families, and forensic reconstruction of data from severely damaged semiconductor devices. He has served on the program committees of major hardware security venues such as CHES, HOST, FDTC, and CARDIS, and as an associate editor of the Journal of Cryptographic Engineering. Across two decades, his work has consistently demonstrated that physical, silicon-level analysis can reveal security weaknesses invisible to purely logical or software-based review, shaping how manufacturers, security researchers, and policymakers assess claims of hardware tamper resistance.

Timeline

• 1997Received M.Sc. in Physics.
• 2005Received Ph.D. in Computer Science.
• 2002Developed optical fault injection attack techniques against secure microcontrollers.
• 2010Published research on flash memory 'bumping' attacks for extracting data without a readback function.
• 2012-09Presented "Breakthrough Silicon Scanning Discovers Backdoor in Military Chip" (with Christopher Woods) at CHES 2012, disclosing a hidden backdoor in the Actel/Microsemi ProASIC3 FPGA.
• 2014Co-authored "Chip and Skim: Cloning EMV Cards with the Pre-play Attack."
• 2016-09Published "The Bumpy Road towards iPhone 5c NAND Mirroring," demonstrating a hardware bypass of the iPhone 5c passcode retry limit amid the Apple-FBI encryption dispute.
• 2020Published research on cloning an Infineon secure element (Optiga Trust B) chip.