{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,8,2]],"date-time":"2025-08-02T18:32:58Z","timestamp":1754159578022,"version":"3.41.2"},"reference-count":26,"publisher":"Association for Computing Machinery (ACM)","issue":"8","license":[{"start":{"date-parts":[[2025,7,25]],"date-time":"2025-07-25T00:00:00Z","timestamp":1753401600000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000185","name":"Defense Advanced Research Projects Agency","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100000185","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Commun. ACM"],"published-print":{"date-parts":[[2025,8]]},"abstract":"<jats:p>\n            The widespread use of embedded systems has increased the risk of physical memory disclosure attacks. A notable example is the\n            <jats:italic toggle=\"yes\">cold boot<\/jats:italic>\n            attack, where attackers exploit DRAM\u2019s temperature-dependent data retention property. At low temperatures, DRAM cells temporarily retain their state after power loss, allowing sensitive data to be recovered. Cold boot attacks can expose system secrets, bypassing defenses like disk encryption. To counter this threat, developers store sensitive data in on-chip SRAM. Unlike DRAM, on-chip SRAM is isolated from external access and, due to its low capacitance, loses data almost immediately when powered off, making it robust against such attacks.\n          <\/jats:p>\n          <jats:p>\n            While SRAM protects against traditional cold boot attacks, we show that there is another way to retain information in on-chip SRAM across power cycles. This paper presents\n            <jats:italic toggle=\"yes\">Volt Boot<\/jats:italic>\n            , an attack that demonstrates a vulnerability of on-chip SRAM due to the physical separation common in modern system-on-chip power distribution networks.\n            <jats:italic toggle=\"yes\">Volt Boot<\/jats:italic>\n            leverages asymmetrical power states (for example, on vs. off) to force SRAM state retention across power cycles, eliminating the need for traditional cold boot attack enablers, such as low-temperature or intrinsic data retention time. Using three modern ARM Cortex-A SOCs, we demonstrate the effectiveness of the attack in caches, registers, and iRAMs. Unlike other forms of SRAM data retention attacks,\n            <jats:italic toggle=\"yes\">Volt Boot<\/jats:italic>\n            retrieves data with\n            <jats:bold>100%<\/jats:bold>\n            accuracy\u2014without any complex post-processing.\n          <\/jats:p>","DOI":"10.1145\/3725845","type":"journal-article","created":{"date-parts":[[2025,7,24]],"date-time":"2025-07-24T15:56:35Z","timestamp":1753372595000},"page":"82-90","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["SRAM Has No Chill: Exploiting Power Domain Separation to Steal On-Chip Secrets"],"prefix":"10.1145","volume":"68","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6535-182X","authenticated-orcid":false,"given":"Jubayer","family":"Mahmod","sequence":"first","affiliation":[{"name":"Virginia Tech, Blacksburg, VA, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3639-4342","authenticated-orcid":false,"given":"Matthew","family":"Hicks","sequence":"additional","affiliation":[{"name":"Virginia Tech, Blacksburg, VA, USA"}]}],"member":"320","published-online":{"date-parts":[[2025,7,25]]},"reference":[{"key":"e_1_3_1_2_2","doi-asserted-by":"publisher","DOI":"10.1109\/DSD.2018.00102"},{"issue":"102864","key":"e_1_3_1_3_2","article-title":"Attacking sram pufs using very-low-temperature data remanence","volume":"71","author":"Anagnostopoulos N.A.","year":"2019","unstructured":"Anagnostopoulos, N.A. et al. Attacking sram pufs using very-low-temperature data remanence. Microprocessors and Microsystems\u00a071, 102864, 2019.","journal-title":"Microprocessors and Microsystems"},{"key":"e_1_3_1_4_2","unstructured":"ARM Limited. ARM Cortex-a72 MPCORE Processor Technical Reference Manual\u00a0(2016)."},{"key":"e_1_3_1_5_2","unstructured":"ARM Limited. ARM Cortex-A53 MPCore Processor Technical Reference Manual\u00a0(2021)."},{"key":"e_1_3_1_6_2","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455840"},{"key":"e_1_3_1_7_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-29962-0_20"},{"key":"e_1_3_1_8_2","doi-asserted-by":"crossref","unstructured":"Colp P. et al. Protecting data on smartphones and tablets from memory attacks. In Proceedings of the Intern. Conf. on Architectural Support for Programming Languages and Operating Systems\u00a0(2015) 177\u2013189.","DOI":"10.1145\/2694344.2694380"},{"key":"e_1_3_1_9_2","doi-asserted-by":"crossref","unstructured":"Garmany B. and M\u00fcller T. PRIME: Private RSA infrastructure for memory-less encryption. In Proceedings of the Annual Computer Security Applications Conf.\u00a0(2013) 149\u2013158.","DOI":"10.1145\/2523649.2523656"},{"key":"e_1_3_1_10_2","doi-asserted-by":"crossref","unstructured":"Guan L. Lin J. Luo B. and Jing J. Copker: Computing with private keys without RAM. In Proceedings of the Network and Distributed System Symp.\u00a0(2014) \u00a023\u201326.","DOI":"10.14722\/ndss.2014.23125"},{"key":"e_1_3_1_11_2","doi-asserted-by":"publisher","DOI":"10.1145\/1506409.1506429"},{"key":"e_1_3_1_12_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-38980-1_19"},{"key":"e_1_3_1_13_2","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2008.212"},{"key":"e_1_3_1_14_2","doi-asserted-by":"publisher","DOI":"10.1145\/3503222.3507710"},{"key":"e_1_3_1_15_2","unstructured":"Microchip Technology Inc. SAM L10\/L11 Family: Ultra Low-Power 32-bit Cortex-M23 MCUs with TrustZone Crypto and Enhanced PTC (2020)."},{"key":"e_1_3_1_16_2","doi-asserted-by":"crossref","unstructured":"Mosalikanti P. Mozak C. and Kurd N. High performance DDR architecture in Intel\u00ae Core\u2122 processors using 32nm CMOS high-k metal-gate process. In Proceedings of the VLSID Intern. Conf\u00a0(2011) 1\u20134.","DOI":"10.1109\/VDAT.2011.5783599"},{"key":"e_1_3_1_17_2","unstructured":"M\u00fcller T. Freiling F.C. and Dewald A. TRESOR runs encryption securely outside RAM. In Proceedings of the 20th USENIX Conf. on Security\u00a0(2011) 17."},{"key":"e_1_3_1_18_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-38980-1_23"},{"key":"e_1_3_1_19_2","unstructured":"NXP Semiconductors. i.MX535: Multimedia Applications Processors - HD Video High-Performance Low-Power ARM Cortex\u00ae-A8 Core\u00a0(2021)."},{"key":"e_1_3_1_20_2","first-page":"55","volume-title":"Proceedings of the Intern. Symp. on Signals, Circuits and Systems.","author":"Qin H.","year":"2004","unstructured":"Qin, H. et al. SRAM leakage suppression by minimizing standby supply voltage. In Proceedings of the Intern. Symp. on Signals, Circuits and Systems., IEEE\u00a0(2004), 55\u201360."},{"key":"e_1_3_1_21_2","unstructured":"Raspberry Pi 4.\u00a0Raspberry Pi Foundation (2021); https:\/\/tinyurl.com\/yyfmu4rm."},{"key":"e_1_3_1_22_2","doi-asserted-by":"publisher","DOI":"10.1109\/ISVLSI.2016.68"},{"key":"e_1_3_1_23_2","unstructured":"SiFive Inc. SiFive U54-MC manual\u00a0(2019); https:\/\/tinyurl.com\/24ee3z5l."},{"key":"e_1_3_1_24_2","doi-asserted-by":"crossref","unstructured":"Simmons P. Security through amnesia: a software-based solution to the cold boot attack on disk encryption. In Proceedings of the 27th Annual Computer Security Applications Conf. 2011 73\u201382.","DOI":"10.1145\/2076732.2076743"},{"key":"e_1_3_1_25_2","unstructured":"T. Instruments. SimpleLink ultra-low-power 32-bit ARM Cortex-M4F MCU With Precision ADC 256KB Flash and 64KB RAM (2019)."},{"key":"e_1_3_1_26_2","doi-asserted-by":"publisher","DOI":"10.1109\/HPCA.2017.10"},{"key":"e_1_3_1_27_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.13"}],"container-title":["Communications of the ACM"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3725845","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3725845","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,7,25]],"date-time":"2025-07-25T14:17:25Z","timestamp":1753453045000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3725845"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,7,25]]},"references-count":26,"journal-issue":{"issue":"8","published-print":{"date-parts":[[2025,8]]}},"alternative-id":["10.1145\/3725845"],"URL":"https:\/\/doi.org\/10.1145\/3725845","relation":{},"ISSN":["0001-0782","1557-7317"],"issn-type":[{"type":"print","value":"0001-0782"},{"type":"electronic","value":"1557-7317"}],"subject":[],"published":{"date-parts":[[2025,7,25]]},"assertion":[{"value":"2025-07-25","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}