Power analysis and EM

Timing is only a beginning. An electronic component consumes current, and this consumption tells, instant by instant, what it is computing.

Why consumption betrays

In a chip, each transistor that switches from 0 to 1 (or the reverse) draws a little current. Now the number of switches depends both on the operation performed and on the data being handled. Handling a byte full of 1s does not cost the same energy as a byte full of 0s.

An attacker who connects a small resistor and an oscilloscope to the power supply of a smart card records a power trace: the curve of the current over time.

courant
  |          _            _
  |    _    | |    _     | |          <- pics = opérations coûteuses
  |   | |  _| |   | |   _| |
  |  _| |_| | |__| |___| | |___
  +--------------------------------> temps
     ronde 1   ronde 2   ronde 3

SPA: reading the curve directly

SPA (Simple Power Analysis) consists in interpreting a single trace by eye or nearly so. On RSA, each bit of the secret exponent triggers "square" or "square + multiply": the two patterns do not have the same shape on the curve. In this way we read the key bit by bit, directly on the plot.

DPA: statistics do the rest

When the signal is too buried in noise to be read by eye, DPA (Differential Power Analysis) comes into play. It is formidable because it does not require finely understanding the circuit:

1. We record thousands of traces for different texts.
2. For a hypothesis about a small part of the key, we predict the consumption at a given instant.
3. We sort the traces according to this prediction and compute a difference of means.
4. The right hypothesis makes a peak appear; the wrong ones drown in the noise.

By repeating on each part of the key, we reconstruct the whole. DPA has broken bank cards and first-generation decoders.

The cousins: EM and acoustic

Current is not the only witness:

Channel	Physical medium
Electromagnetic	waves radiated by the chip, captured by a probe
Acoustic	very faint noise of the components (coils, capacitors)
Thermal	local heating

Electromagnetic analysis is particularly formidable: it is done at a distance, without contact, and can target a precise area of the chip.

The countermeasures

We cannot prevent a chip from consuming current, but we can break the link between consumption and secret:

• Masking: mixing the data with randomness before computing, so that the consumption no longer reflects the true value.
• Noise: adding dummy computations, random scheduling, to drown the signal.
• Balancing: designing the circuit so that a 0->1 switch costs as much as a 1->0.

None is perfect on its own; they are combined, and the chip is evaluated in a laboratory.

In summary

The power consumption of a chip depends on the operations and the data: SPA reads the secret on a single trace, DPA extracts it statistically from thousands of traces despite the noise. EM and acoustic emanations offer the same handholds, sometimes at a distance. We defend ourselves through masking, noise, and balancing, combined.