Practical operation extraction from electromagnetic leakage for side-channel analysis and reverse engineering

Robyns, Pieter; Martino, Mariano Di; Giese, Dennis; Lamotte, Wim; Quax, Peter; Noubir, Guevara

doi:10.1145/3395351.3399362

Cited by 9 publications

(8 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Our approach compares favourably to the one proposed in [8], in terms of computational efficiency of deriving the template (we only require averaging a set of collected values to derive the template) and in terms of data required to build the template itself (we achieve a classification accuracy above 99.9% with a single trace as a template, and an alignment jitter below 1 µs). We note, however, that our environment is less affected by strong disturbances, as the case study platform of [8] is endowed with a Wi-Fi radio front-end, which is enabled during side channel measurements. A recent work [9], tackles an attacker model with a further relaxation in the requirements, i.e., the attacker only knows some technical details of the target platform (such as the operating frequency) and the structure of the cryptographic primitive at hand (e.g., it is constituted by a countable loop, as it is a symmetric block cipher).…”

Section: Introductionmentioning

confidence: 99%

“…This comes at the cost of a timing overhead due to the context-change among threads, and the interleaved execution of computations which only act as a noisegeneration process. On the front of cryptographic primitive identification from side channel leakage, the authors of [8] proposed a method to select which cryptographic primitive, among a set of profiled ones, is being executed on an ESP32 embedded microcontroller platform. The approach adopted in [8] also performs trace realignment after classification; in particular, it compares three different classification strategies (mean-square error minimization in both time and frequency domain and neural network classification), achieving a 96.47 classification accuracy and a 34 µs timing jitter in realigning the primitive executions.…”

Section: Introductionmentioning

confidence: 99%

“…On the front of cryptographic primitive identification from side channel leakage, the authors of [8] proposed a method to select which cryptographic primitive, among a set of profiled ones, is being executed on an ESP32 embedded microcontroller platform. The approach adopted in [8] also performs trace realignment after classification; in particular, it compares three different classification strategies (mean-square error minimization in both time and frequency domain and neural network classification), achieving a 96.47 classification accuracy and a 34 µs timing jitter in realigning the primitive executions. Our approach compares favourably to the one proposed in [8], in terms of computational efficiency of deriving the template (we only require averaging a set of collected values to derive the template) and in terms of data required to build the template itself (we achieve a classification accuracy above 99.9% with a single trace as a template, and an alignment jitter below 1 µs).…”

Section: Introductionmentioning

confidence: 99%

“…The approach adopted in [8] also performs trace realignment after classification; in particular, it compares three different classification strategies (mean-square error minimization in both time and frequency domain and neural network classification), achieving a 96.47 classification accuracy and a 34 µs timing jitter in realigning the primitive executions. Our approach compares favourably to the one proposed in [8], in terms of computational efficiency of deriving the template (we only require averaging a set of collected values to derive the template) and in terms of data required to build the template itself (we achieve a classification accuracy above 99.9% with a single trace as a template, and an alignment jitter below 1 µs). We note, however, that our environment is less affected by strong disturbances, as the case study platform of [8] is endowed with a Wi-Fi radio front-end, which is enabled during side channel measurements.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Locating Side Channel Leakage in Time through Matched Filters

2022

View full text Add to dashboard Cite

Side channel attacks provide an effective way to extract secret information from the execution of cryptographic algorithms run on a variety of computing devices. One of the crucial steps for a side channel attack to succeed is the capability to locate the time instant in which the cryptographic primitive being attacked is effectively leaking information on the side channel itself, and synchronize the data obtained from the measurements on that instant. In this work, we propose an efficient and effective solution relying on the digital signal processing technique known as matched filters. We derive our matched filter with a small amount of profiling information which can be obtained from a device matching the one under attack. Our technique reliably identifies the cryptographic operation being computed, even when system interrupts or software multithreading are enabled on our target platform. We validate our approach through a successful attack against an unprotected AES implementation running on a Cortex-M4-based microcontroller.

show abstract

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Locating Side Channel Leakage in Time through Matched Filters

2022

View full text Add to dashboard Cite

show abstract

“…Electromagnetic side-channel analysis exploits unintentional electromagnetic leakages captured from integrated circuits to reveal secret information, especially in the area of crypto devices. Electromagnetic emission is used to identify the devices and operations in [12,13]. Screen contents are detected via electromagnetic side-channel information in [14].…”

Section: Introductionmentioning

confidence: 99%

Analysis of Electromagnetic Information Leakage Based on Cryptographic Integrated Circuits

Sun

Cui

et al. 2021

Entropy

View full text Add to dashboard Cite

Cryptographic algorithm is the most commonly used method of information security protection for many devices. The secret key of cryptographic algorithm is usually stored in these devices’ registers. In this paper, we propose an electromagnetic information leakage model to investigate the relationship between the electromagnetic leakage signal and the secret key. The registers are considered as electric dipole models to illustrate the source of the electromagnetic leakage. The equivalent circuit of the magnetic field probe is developed to bridge the output voltage and the electromagnetic leakage signal. Combining them, the electromagnetic information leakage model’s function relationship can be established. Besides, an electromagnetic leakage model based on multiple linear regression is proposed to recover the secret key and the model’s effectiveness is evaluated by guess entropy. Near field tests are conducted in an unshielded ordinary indoor environment to investigate the electromagnetic side-channel information leakage. The experiment result shows the correctness of the proposed electromagnetic leakage model and it can be used to recover the secret key of the cryptographic algorithm.

show abstract