Electromagnetic attack
These attacks are a more specific type of what is sometimes referred to as Van Eck phreaking, with the intention to capture encryption keys.
Any device that uses electricity will emit electromagnetic radiation due to the magnetic field created by charged particles moving along a medium.
The electronic device performing the computations is synced with a clock that is running at frequencies on the order of mega-hertz (MHz) to giga-hertz (GHz).
However, due to hardware pipelining, and complexity of some instructions, some operations take multiple clock cycles to complete.
[6] Android version 4.4's Bouncy Castle library implementation of ECDSA is vulnerable to key extraction side channel attacks around the 50 kHz range.
An implementation vulnerable to SEMA attacks will perform a different operation depending on whether the bit of the key is 0 or 1, which will use different amounts of power and/or different chip components.
An attacker with a clear trace can deduce the key simply by observing where the multiplication operations are performed.
While the fact that circuits that emit high-frequency signals may leak secret information was known since 1982 by the NSA, it was classified until 2000,[9] which was right around the time that the first electromagnetic attack against encryption was shown by researchers.
[11] They connect directly to a card reader which provides the power necessary to perform an encrypted financial transaction.
[12][13][14] A field-programmable gate arrays (FPGA) have been commonly used to implement cryptographic primitives in hardware to increase speed.
[15] The ARIA block cipher is a common primitive implemented with FPGAs that has been shown to leak keys.
[16] In contrast to smart cards, which are simple devices performing a single function, personal computers are doing many things at once.
Thus, it is much more difficult to perform electromagnetic side-channel attacks against them, due to high levels of noise and fast clock rates.
Likewise, the amount of research dedicated to mobile phone security side channel attacks has also increased.
By using an external USB sound card and an induction coil salvaged from a wireless charging pad, researchers were able to extract a user's signing key in Android's OpenSSL and Apple's CommonCrypto implementations of ECDSA.
[23] Therefore, a rough characterization of potential adversaries using this attack range from highly educated individuals to low to medium funded cartels.
The following demonstrates a few possible scenarios: Point of sale systems that accept payment from mobile phones or smart cards are vulnerable.
Induction coils can be hidden on these systems to record financial transactions from smart cards or mobile phone payments.
When coupled with packet sniffing capabilities of public Wi-Fi networks, the keys extracted could be used to perform man-in-the-middle attacks on users.
Recently, white-box modeling was utilized to develop a low-overhead generic circuit-level countermeasure[26] against both electromagnetic as well as power side-channel attacks.
To minimize the effects of the higher-level metal layers in an IC acting as more efficient antennas,[27] the idea is to embed the crypto core with a signature suppression circuit,[28][29] routed locally within the lower-level metal layers, leading towards both power and electromagnetic side-channel attack immunity.
