RP2350, security, and the hacking challenges
In August 2024, Raspberry Pi RP2350 was launched as a new secure microcontroller, together with two Hacking Challenges focused on breaking its protection features. The first round surfaced several weaknesses that were serious enough for Raspberry Pi to respin the silicon and ship the A4 die revision with a patched boot ROM.
A few months later, the Ledger Donjon hardware security team disclosed a new attack on RP2350. Their result would have been a prize‑winner in that first challenge: they showed how to bring back the debug interface on a locked RP2350‑A4 using a lab‑grade laser setup.
How the infrared laser attack works
Donjon’s method is a form of laser fault injection:
- The RP2350 package is removed and decapsulated, exposing the bare die.
- High‑resolution microscopy is used to map areas of interest on the silicon.
- A tightly focused infrared laser beam is aimed at specific regions while the chip runs.
- Carefully timed pulses cause faults in particular internal registers,
- which in turn re‑enable the debug port and allow OTP memory to be read out.
So instead of glitching supply voltage or clock, they inject faults directly into the die with photons.
Why Raspberry Pi won’t respin again
After reviewing the research, Raspberry Pi concluded that this attack does not justify another respin:
- It is destructive: the device must be physically removed and decapsulated.
- With per‑device keys, the impact is limited to a single chip.
- It demands a specialised lab, expert skills, and roughly $250k worth of equipment.
For most embedded and IoT use cases, this sits far beyond the realistic threat model.
There’s also an interesting callback: during the first Hacking Challenge, researcher Courk used a homebrew IR laser rig to glitch the earlier A2 stepping of RP2350. That issue was fixed by the boot ROM update that shipped in the current A4 revision.
Bottom line: RP2350 remains a solid choice for secure embedded designs, while Ledger Donjon’s work is an impressive demonstration of what’s possible at the high end of hardware security research.
Source: Raspberry Pi
