Differential Electromagnetic Analysis Attacks Research Articles

Developing an Electromagnetic Noise Generator to Protect a Raspberry PI from Side Channel Analysis

This research investigates the Electromagnetic (EM) side channel leakage of a Raspberry Pi 2 B+. An evaluation is performed on the EM leakage as the device executes the AES-128 cryptographic algorithm contained in the libcrypto++ library in a threaded environment. Four multi-threaded implementations are evaluated. These implementations are Portable Operating System Interface Threads, C++11 threads, Threading Building Blocks, and OpenMP threads. It is demonstrated that the various thread techniques have distinct variations in frequency and shape as EM emanations are leaked from the Raspberry Pi. It is demonstrated that the AES-128 cryptographic implementation within the libcrypto++ library on a Raspberry Pi is vulnerable to Side Channel Analysis (SCA) attacks. The cryptographic process was seen visibly within the EM spectrum and the data for this process was extracted where digital filtering techniques was applied to the signal. The resultant data was utilised in the Differential Electromagnetic Analysis (DEMA) attack and the results revealed 16 sub-keys that are required to recover the full AES-128 secret key. Based on this discovery, this research introduced a multi-threading approach with the utilisation of Secure Hash Algorithm (SHA) to serve as a software based countermeasure to mitigate SCA attacks. The proposed countermeasure known as the FRIES noise generator executed as a Daemon and generated EM noise that was able to hide the cryptographic implementations and prevent the DEMA attack and other statistical analysis.

On measuring the parasitic backscatter of sensor-enabled UHF RFID tags

Radio-frequency identification (RFID) tags have found their way into many applications. When tags implement cryptographic algorithms, side-channel analysis (SCA) attacks become a concern. Especially tags in the ultra-high frequency (UHF) range are susceptible to so-called parasitic-backscatter attacks that can be applied from a distance. Whereas it is known that such attacks are a threat for passive low-cost tags, no results are so far available for sensor-enabled tags. In this work, we evaluate the parasitic backscatter of wireless identification and sensing platform (WISP) tags by conducting differential electromagnetic analysis (DEMA) attacks. We apply the attacks on a passively as well as a semi-passively operated WISP tag from a distance of 30 cm and compare the results with an attack on a commercial low-cost tag. The results show that the evaluated WISP tags are less susceptible to DEMA attacks based on the parasitic backscatter than the evaluated commercial low-cost tag. Moreover, we present a measurement approach that allows to detect the weak parasitic backscatter modulated on the strong reader field without the need for an expensive hardware receiver or a dedicated demodulation circuit.

A table masking countermeasure for low-energy secure embedded systems

Future wireless embedded devices will be increasingly powerful, supporting many more applications, including one of the most crucial, which is security. Although many embedded devices offer more resistance to bus probing attacks due to their compact size, susceptibility to power or electromagnetic analysis attacks must be analyzed. This paper presents a table masking countermeasure to resist differential power analysis (DPA) and differential electromagnetic analysis (DEMA). Real power and EM measurements are used to verify the countermeasure using second- and third-order DPA and DEMA attacks on a popular low-energy embedded ARM processor. Results show that the new table masking countermeasure provides increased security without large overheads of energy dissipation compared with previous countermeasures. With the emergence of security applications personal digital assistants, cellphones, and other embedded devices, low-energy countermeasures for resistance to DPA/DEMA are crucial for supporting future wireless embedded systems