  Field-Programmable Gate Arrays (FPGAs) are integrated circuits that implement
reconfigurable hardware. They are used in modern systems, creating specialized,
highly-optimized integrated circuits without the need to design and manufacture
dedicated chips. As the capacity of FPGAs grows, it is increasingly common for
designers to incorporate implementations of algorithms and protocols from a
range of third-party sources. The monolithic nature of FPGAs means that all
on-chip circuits, including third party black-box designs, must share common
on-chip infrastructure, such as routing resources. In this paper, we observe
that a "long" routing wire carrying a logical 1 reduces the propagation delay
of other adjacent but unconnected long wires in the FPGA interconnect, thereby
leaking information about its state. We exploit this effect and propose a
communication channel that can be used for both covert transmissions between
circuits, and for exfiltration of secrets from the chip. We show that the
effect is measurable for both static and dynamic signals, and that it can be
detected using very small on-board circuits. In our prototype, we are able to
correctly infer the logical state of an adjacent long wire over 99% of the
time, even without error correction, and for signals that are maintained for as
little as 82us. Using a Manchester encoding scheme, our channel bandwidth is as
high as 6kbps. We characterize the channel in detail and show that it is
measurable even when multiple competing circuits are present and can be
replicated on different generations and families of Xilinx devices (Virtex 5,
Virtex 6, and Artix 7). Finally, we propose countermeasures that can be
deployed by systems and tools designers to reduce the impact of this
information leakage.
