Electromagnetic Analysis: Concrete Results

Electromagnetic Analysis: Concrete Results

2001 | Karine Gandolfi, Christophe Mourtel, and Francis Olivier
This paper presents a series of electromagnetic (EM) analysis experiments conducted on three different CMOS chips, each featuring distinct hardware protections and executing cryptographic algorithms such as DES, an alleged COMP128, and RSA. The primary goal was to demonstrate the feasibility of EM attacks on smart cards, which have been previously discussed in research but rarely reported with conclusive experimental results. The authors describe the design and implementation of EM probes, which are small coils of copper wire used to measure the EM signals emitted by the chips. These probes are designed to be as small as possible to minimize their impact on the chip's operation. The EM signals are collected and processed using advanced acquisition chains to enhance sensitivity and reduce noise. The experiments reveal that EM signals, despite being more noisy than power consumption traces, provide clearer and more reliable information for key recovery. Specifically, the Differential ElectroMagnetic Analysis (DEMA) method outperforms the Differential Power Analysis (DPA) in terms of signal-to-noise ratio (SNR) and the ease of identifying the correct key. The DEMA method also reduces the number of false positives, making it easier to distinguish between correct and incorrect guesses. The paper also highlights the complementary nature of EM and power analysis (SEMA and SPA, respectively), showing that combining both methods can significantly enhance the effectiveness of attacks. The authors conclude that while EM attacks are feasible, they do not necessarily provide a more powerful attack than SPA. They suggest that a combination of hardware counter-measures and specific software coding techniques can provide an acceptable level of security for most commercial applications. The authors plan to further investigate the development of automatic cartography tools to automate the process of identifying potentially problematic spots on chips, which could help in evaluating the likelihood of data-correlated leakage and performing cross-platform comparisons.This paper presents a series of electromagnetic (EM) analysis experiments conducted on three different CMOS chips, each featuring distinct hardware protections and executing cryptographic algorithms such as DES, an alleged COMP128, and RSA. The primary goal was to demonstrate the feasibility of EM attacks on smart cards, which have been previously discussed in research but rarely reported with conclusive experimental results. The authors describe the design and implementation of EM probes, which are small coils of copper wire used to measure the EM signals emitted by the chips. These probes are designed to be as small as possible to minimize their impact on the chip's operation. The EM signals are collected and processed using advanced acquisition chains to enhance sensitivity and reduce noise. The experiments reveal that EM signals, despite being more noisy than power consumption traces, provide clearer and more reliable information for key recovery. Specifically, the Differential ElectroMagnetic Analysis (DEMA) method outperforms the Differential Power Analysis (DPA) in terms of signal-to-noise ratio (SNR) and the ease of identifying the correct key. The DEMA method also reduces the number of false positives, making it easier to distinguish between correct and incorrect guesses. The paper also highlights the complementary nature of EM and power analysis (SEMA and SPA, respectively), showing that combining both methods can significantly enhance the effectiveness of attacks. The authors conclude that while EM attacks are feasible, they do not necessarily provide a more powerful attack than SPA. They suggest that a combination of hardware counter-measures and specific software coding techniques can provide an acceptable level of security for most commercial applications. The authors plan to further investigate the development of automatic cartography tools to automate the process of identifying potentially problematic spots on chips, which could help in evaluating the likelihood of data-correlated leakage and performing cross-platform comparisons.
Reach us at info@study.space