An adaptive measurement protocol for fine-grained electromagnetic side-channel analysis of cryptographic modules
MetadataShow full item record
An adaptive measurement protocol is presented to increase effectiveness of fine-grained electromagnetic side-channel analysis (EM SCA) attacks that attempt to extract the information that is unintentionally leaked from physical implementations of cryptographic modules. Because measured fields vary with probe parameters as well as the data being encrypted, identifying the optimal configurations requires searching among a large number of possible configurations. The proposed protocol is a multi-step acquisition that corresponds to a greedy search in a 4-D configuration space consisting of probe’s on-chip coordinates, orientation, and number of signals acquired. This 4-D space can be extended to a 6-D space by repeating the protocol for different probe sizes and heights. This approach is presented as an alternative to current fine-grained EM SCA techniques that perform exhaustive full-chip scans to isolate information leaking locations. To demonstrate the feasibility of the approach, the protocol is tested by performing EM SCA attacks for different configurations and identifying the best attack configuration for two realizations of the advanced encryption standard (AES), subject to the precision of the measurement equipment. It is found that the protocol requires ~20× to ~25× less acquisition time compared to an exhaustive search for the optimal attack configuration.