Acoustic (and other Remote) Side Channels

Christian Walter
Seminarausarbeitung
July 10, 2014
Embedded Security Group - Prof. Dr.-Ing. Christof Paar
Abstract
In the modern world, cryptography has become omnipresent. Cryptographic al-
gorithms are usually mathematically secure, hence adversaries do not try break
the cryptographic scheme directly, they break the implementation of the cryp-
tographic algorithm exploiting side-channel leakage. Where most side-channel
attacks require direct access to the device in order to measure the power con-
sumption correctly. In this paper we present dierent remote side channels, like
Electromagnetic Emission (EM), Electric Potential or Sound, and dierent attack
strategies such that no direct access to the device is needed to extract the secret
key. The discussed attack strategies will be applied on various platforms such
as smart cards, Near Field Communication (NFC)-Tags, Field Programmable
Gate Arrays (FPGAs) and personal computers, running dierent cryptographic
algorithms, e.g., RSA, ECC, DESC and AES.
Contents
1. Introduction 2
2. Theoretical Background 3
2.1. Implementation Attacks . . . . . . . . . . . . . . . . . . . . . . . 3
2.2. Side Channel Analysis . . . . . . . . . . . . . . . . . . . . . . . . 4
3. Attacks 6
3.1. Electromagnetic Side Channel . . . . . . . . . . . . . . . . . . . . 6
3.1.1. Attack on an FPGA Implementation of ECC . . . . . . . . 6
3.1.2. Attack on a Security-Enabled NFC Tag . . . . . . . . . . . 7
3.2. Acoustic Side Channel . . . . . . . . . . . . . . . . . . . . . . . . 8
3.3. Electrical Potential Side Channel . . . . . . . . . . . . . . . . . . 10
4. Conclusion 12
A. Bibliography 16
Acronyms
ECC Elliptic Curve Cryptography
FPGA Field Programmable Gate Array
NFC Near Field Communication
RFID Radio Frequency Identication Device
SEMA Simple Electromagnetic Analysis
DEMA Dierential Electromagnetic Analysis
1. Introduction
In the modern world, cryptography has become omnipresent. Cryptographic
algorithms are usually mathematically secure, hence adversaries do not try to
break the cryptographic scheme directly. Instead they break the implementation
of the cryptographic algorithm by exploiting side-channel leakage, like power
consumption.
Most side-channel attacks require direct access to the device in order to measure
the power consumption correctly. In real world application an attacker would
like to perform remote side channel attacks which do not need direct physical
access to the device and are therefore much more dicult to detect. In addition,
wireless techniques like Near Field Communication (NFC) or Radio Frequency
Identication Device (RFID) come more and more into play in our everyday life,
such that it is important to evaluate possible remote side channel leakage, to
improve the known algorithms and to secure the technology used.
This paper is structured into three parts. First we give a short introduction
into implementation attacks, and explain side-channel analysis in more detail.
Second, we present various examples for attack strategies to gain information
about the secret key of dierent cryptosystems exploiting remote side-channel
leakage. Finally, Section 4 concludes this paper.
2. Theoretical Background
In this chapter, we give the necessary theoretical background for this paper.
First, we introduce implementation attacks. Afterwards, we describe side-channel
attacks in detail.
2.1. Implementation Attacks
Implementation attacks try to reveal secret information, e. g., a secret key, from
the physical implementation and the physical eects caused by the operation of
a cryptographic system. In contrast to implementation attacks, mathematical
attacks break the underlying mathematical structure of a crypto system. The
crucial advance of implementation attacks is that it is possible to extract the
secret key and break the cryptographic device, even if the algorithm is mathe-
matically completely secure, but its implementation is weak.
Implementation
Attacks
Side-Channel
Attacks
Timing Attacks
Power
Analysis
Attacks
Electromagnetic
Analysis
Attacks
P
a
s
s
i
v
e
Fault Injection Reverse Engineering
A
c
t
i
v
e
Figure 2.1.: Overview of Implementation Attacks
Implementation attacks can be divided into two main groups, active and passive
implementation attacks, see Figure 2.1. Active implementation attacks require an
interaction from the attacker side, for example forcing the device to produce false
calculations by exposing the device to UV light, excessive heat or manipulate the
clock frequency, which then can be used to reveal the secret key. This is called
fault injection. Another active implementation attack is reverse engineering.
4 Theoretical Background
While reverse engineering a device, an attacker analyzes the used chip on the
gate level. Reverse engineering does not only aim at recovering the secret key,
but also tries to retrieve secret program code or secret algorithms in order to
duplicate the program or to port it to another platform.
2.2. Side Channel Analysis
Passive implementation attacks, or so called side-channel attacks, monitor dier-
ent side-channel leakages of cryptographic devices. Examples are timing attacks,
power analysis attacks, and electromagnetic analysis attacks. Timing attacks
measure the time a device needs to calculate operations in order to obtain secret
values. The time dierent algorithms and dierent operations need for calcula-
tions often depends on the value of the key, which can be exploited by measuring
the time needed for those calculations.
Power analysis attacks record the power consumption of a device while it per-
forms a cryptographic functions. For most power analysis attacks the attacker
need direct physical access to the device in order to record the power consump-
tion successfully. The power consumption of a device is typically recorded by
measuring the voltage drop across a resistor that is inserted into the ground line
of the device as shown in Figure 2.2.
Figure 2.2.: General circuit for power measurement
Another passive side channel is abou the electromagnetic emission. Electro-
magnetic leakage is well known since 1950s by the US government. The rst
published papers are from Quisquater and Samyde [QS01] and the Gemplus team
[GMO01], both in 2001. Quisquater also introduced the terms Simple Electro-
magnetic Analysis (SEMA) and Dierential Electromagnetic Analysis (DEMA)
[DMOPV07]. In a SEMA attack, an attacker uses a single measurement to re-
veal parts or the whole secret key. In a DEMA attack, many measurements
are recorded with varying input data and statistical methods are used on the
recorded traces to gain information about the secret key. These attacks exploit
the information gathered from uctuations of the EM eld emitted by a device
while performing a cryptographic operation. Electromagnetic emanations can be
2.2 Side Channel Analysis 5
divided into to types of emanations: intentional and unintentional [AARR03].
Intentional emanations result from the intentional current ows. Many of these
consists of short bursts of current with sharp rising edges resulting in emanations
observabe over a wide frequency band. Side channel attacks aim for exploring the
unintentional emanations. Unintentional emanations are electrical and electro-
magnetic coupling between components in close proximity. The small couplings
are typically ignored by circuit designers, but provide a good source of emanations
which can be used for side-channel analysis. These consists of multiple channels,
therefore even DPA-resistant devices could be vulnerable. These information can
be acquired by means of near-eld probes which are positioned relatively close
to the chip, or the targeted device, leaving no traces behind. Based on this side
channel information, a DEMA can be performed [KOP09]. In practice, the analog
signal, i.e., the EM leakage, is digitized and recorded as a discrete and quantized
trace.
3. Attacks
In this chapter, we present various remote side-channel analysis strategies. We
also present attacks exploiting non-standard side-channels like the sound or the
electrical potential.
3.1. Electromagnetic Side Channel
Every electronic devices emits electromagnetic radiation. Hence, attacks exploit-
ing electromagnetic side-channels are getting more and more popular in the last
years, particularly because electromagnetic analysis attacks are non-invasive at-
tacks, meaning that no traces are left behind.
One interesting eld of side-channel analysis is the leakage of contactless smart-
cards using RFID technology. Kasper et al. introduced low-cost hardware for
non-invasive side-channel attacks on RFIDs. We present two examples where
remote side-channel analysis was used in order to gain information about the
secret key. One exploits an hardware implementation of Elliptic Curve Cryptog-
raphy (ECC), the other one targets the NFC system from a distance of up to one
meter.
3.1.1. Attack on an FPGA Implementation of ECC
Mulder et al. analyzed in 2007 how electromagnetic side channels can be used
break an Field Programmable Gate Array (FPGA) implementation of ECC. The
authors of [DMOPV07] set up a Xilinx Virtex 800 FPGA board and measured the
total power consumption and electromagnetic radiation while the FPGA executes
an ECC point multiplication [DMOPV07]. They formed a loop antenna around
the FPGA to measure the electromagnetic emission, because the current in an
FPGA ows from the power source to the ground in a circle on the FPGA, as
shown in Figure 3.1. The idea of the attack is to exploit the point multiplication
algorithm at line 5 (Figure 1). The rst step is to nd the correct point to mea-
sure. Next the autors recorded a le with the electromagnetic measurementsof
the operation Q
i
= [k]P
i
for i = 1, 2, ..., [Link] that, the autors of [DMOPV07]
calculated the ECC point multiplication with the same algorithm on a computer,
and predict the number of bits that change from 0 to 1 within a certain register.
3.1 Electromagnetic Side Channel 7
Figure 3.1.: FPGA measurement setup [DMOPV07].
Algorithm 1 EC point multiplication algorithm [DMOPV07].
After producing two prediction matrices for k
i2
= 1 or k
i2
= 0, where k
i2
is
the targeted bit, the dierence of means was used to nd the correct key bit.
For each measurement, it was checked if the predicted value is lower than the
average. In the end there are two sets S
2,1
and S
2,2
the measurements where put
into. The resulting bias signal, which is calculated as T
1
= E(S
1,2
) E(S
1,1
),
where E(

) is the mean of the set, shows a high peak on the chosen measurement
spot for the correct key bit.
With the described technique, it was possible to recover the targeted key bit
with 2000 measurements.
3.1.2. Attack on a Security-Enabled NFC Tag
The number of applications that use NFC technologies is signicantly growing.
Because of that, Korek et al. applied a remote side-channel analysis on a security-
enabled NFC Tag [KP13]. In their attack proposed in 2013, they used a prototype
of an NFC chip and mounted it on an antenna, so the chip behaves like a commer-
cial passive RFID tag. The main focus is to evaluate if it is possible to measure
useful side-channel information of NFC tags from distances up to one meter, even
if the communication range between reader and tag is limited to a few centime-
8 Attacks
Figure 3.2.: Measuring arrangement from [KP13]
ters according to the specication. For this, dierent distances between the NFC
system and the antenna which measured the electromagnetic information where
evaluated. At a distance of 25 cm, it was sucient to record 3000 traces to ex-
Table 3.1.: side-channel attack results at the analyzed distances. Taken from
[KP13]
tract the key with a maximum correlation of 0.204 . As shown in Figure 3.1,
even at a distance of one meter, around 30000 traces were enough to recover the
secret key.
3.2. Acoustic Side Channel
In the past few years, other remote side-channel attacks have been evaluated
and exploited. Eavesdropping on keyboards has already been well demonstrated
[ZZT09]. In 2013 Shamir et al. presented a side-channel attack which exploited
acoustic emanations. As a case study, a laptop was set up next to a highly
sensitive microphone (shown in Figure 3.3). The laptop computes the GnuPGs
RSA signing (or decryption) operations [gnu]. Shamir et al. rst started o
with distinguishing various CPU operations by recording the sound the laptop
produces while executing x86 instructions like HLT (CPU sleep), MUL (integer
3.2 Acoustic Side Channel 9
Figure 3.3.: Photograph of the setup
multiplication), FMUL (oating-point multiplication), REP NOP (short-term
idle) and accessing the main memory. The authors went one step further and
distinguished between dierent RSA secret keys. As shown in Figure 3.4, it
Figure 3.4.: Acoustic signature of two GnuPG RSA signatures. The transitions
between p and q are marked with yellow arrows.[aco]
can be observed that dierent RSA private keys cause dierent sounds. With
that knowledge, an adaptive chosen-ciphertext attack was performed on the RSA
signing algorithm (Figure 2) starting from the MSB to the LSB. The idea is to
attack the reduction c c mod q on line 3. Assume we have already recovered
the topmost i 1 bits of q. Then, we construct a 2048 bit ciphertext g
i,1
, where
the topmost i 1 bits are identical to the recovered i 1 bits of q. Now while
decrypting g
i,1
, there are two cases possible, depending on the bit q
i
:
q
i
= 1
If q
i=1
, then g
i,1
is less or equal than q, the ciphertext g
i,1
is not reduced,
and line 3 returns c = g
i,1
.
10 Attacks
Algorithm 2 GnuPGs modular exponentation. Taken from [aco]
q
i
= 0
If q
i
= 0, then q
i,1
is greater than q and will be reduced on line 3.
One problem of the proposed attack is that the numbers within GnuPG are
represented as an array of 32-bit limbs. Thus, the reduction decision is based
on the limb count of c. Therefore, g
i,1
is modied such that g
i,1
= g
i,1
+ n,
because by denition it holds that n = 0 mod q [aco]. Another approach would
be to allocate space for leading zeros, thus one may just ask for a decryption
of g
i,1
with additional limbs of leading zeros. But this could easily be xed by
changing the parsing algorithm to not allocate leading zero limbs. Unfortunately,
it is not possible to recover the whole 2048 bits of q, because the dierences in
acoustic leakage where the targeted bit is zero or one become less prominent as
the attack progresses [aco]. Therefore the templates, which where used to classify
the attacked key bits to be zero or one have to be adapted. The results from the
already recovered key bits can be used to update these templates and do adapt
the attack with each recovered key bit to work for the next targeted bit. With
this strategy Shamir et al. recovered the whole 2048-bit private key.
3.3. Electrical Potential Side Channel
Another side channel which was exploited in the Shamir et al. paper is the elec-
trical potential. When a laptop computer is connected by e.g., AC power supply
adapters or ethernet cables, the voltage between the rooms ground and the com-
puters chassis can be measured, resulting in similar signals to the ones observed
acoustically, often even with a better signal-to-noise ratio [aco]. The voltage of
3.3 Electrical Potential Side Channel 11
the laptops chassis can be measured by placing a probe directly in contact with
the laptop chassis or by simply touching the laptop with a nger and measuring
the voltage of the body.
Figure 3.5.: Chassis measurement from the far side of the Ethernet cable [aco].
Another way to measure the chassis potential, is to connect a probe at the far
side of a cable connected to an IO port such as USB, Ethernet, HDMI, etc., as
shown in Figure 3.5. The inserted plug typically makes contact with the plug
shields, which is connected to a conductive cable shield running along the length
of the cable [aco].
4. Conclusion
Remote side channels are a promising topic in modern cryptanalysis. Most power
analysis attacks have the precondition to have direct access to the device and
modify it in order to gain information about the power consumption. In constrast
remote side-channels give an attacker the opportunity to attack a device by being
around it, but not having direct access to it.
In this paper, we summed up novel attack strategies on NFC systems and
FPGA implementations. In addition we presented the recently proposed acoustic
cryptanalysis and explained how the electrical potential of a laptop chassis can
be used to gain information about the secret key.
A lot of research has already been done on that topic, but clearly, there is room
for further research. Shamir et al. already did a step towards remote side-channel
attacks with acoustic cryptanalysis and the attack on the electrical potential.
Another interesting topic for further research would be in which way counter-
measures against classical power analysis attacks can be overcome with remote
side-channels.
List of Figures
2.1. Overview of Implementation Attacks . . . . . . . . . . . . . . . . 3
2.2. General circuit for power measurement . . . . . . . . . . . . . . . 4
3.1. FPGA measurement setup [DMOPV07]. . . . . . . . . . . . . . . 7
3.2. Measuring arrangement from [KP13] . . . . . . . . . . . . . . . . 8
3.3. Photograph of the setup . . . . . . . . . . . . . . . . . . . . . . . 9
3.4. Acoustic signature of two GnuPG RSA signatures. The transitions
between p and q are marked with yellow arrows.[aco] . . . . . . . 9
3.5. Chassis measurement from the far side of the Ethernet cable [aco]. 11
List of Tables
3.1. side-channel attack results at the analyzed distances. Taken from
[KP13] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
List of Algorithms
1. EC point multiplication algorithm [DMOPV07]. . . . . . . . . . . 7
2. GnuPGs modular exponentation. Taken from [aco] . . . . . . . . 10
A. Bibliography
[AARR03] Dakshi Agrawal, Bruce Archambeault, Josyula R. Rao, and Pankaj
Rohatgi. The EM side-channel(s). In Revised Papers from the 4th
International Workshop on Cryptographic Hardware and Embedded
Systems, CHES 02, pages 2945, London, UK, UK, 2003. Springer-
Verlag.
[aco] Adi Shamir and Tromer Eran, Acoustic cryptanalysis On nosy
people and noisy machines, URL : [Link]
edu/tromer/acoustic/.
[DMOPV07] E. De Mulder, S. B.

Ors, B. Preneel, and I. Verbauwhede. Dieren-
tial power and electromagnetic attacks on a FPGA implementation
of elliptic curve cryptosystems. Comput. Electr. Eng., 33(5-6):367
382, 2007.
[GMO01] Karine Gandol, Christophe Mourtel, and Francis Olivier. Elec-
tromagnetic analysis: Concrete results. In C etin Kaya Koc, David
Naccache, and Christof Paar, editors, CHES, volume 2162 of Lec-
ture Notes in Computer Science, pages 251261. Springer, 2001.
[gnu] The GnuPG Project. the GNU privacy guard. url : [Link]
[Link].
[KOP09] Timo Kasper, David Oswald, and Christof Paar. EM side-channel
attacks on commercial contactless smartcards using low-cost equip-
ment. In Information Security Applications, pages 7993. 2009.
[KP13] Thomas Korak and Thomas Plos. Applying remote side-channel
analysis attacks on a security-enabled NFC tag. In CT-RSA, vol-
ume 7779 of Lecture Notes in Computer Science, pages 207222.
Springer, 2013.
[QS01] Jean-Jacques Quisquater and David Samyde. Electromagnetic anal-
ysis (ema): Measures and counter-measures for smart cards. In
Proceedings of the International Conference on Research in Smart
Cards: Smart Card Programming and Security, E-SMART 01,
pages 200210, London, UK, UK, 2001. Springer-Verlag.
[ZZT09] Li Zhuang, Feng Zhou, and J. D. Tygar. Keyboard acoustic em-
anations revisited. ACM Trans. Inf. Syst. Secur., 13(1):3:13:26,
November 2009.