Side-Channel Attacks
& Countermeasures

Cryptographic algorithms are mathematically secure — AES-256 resists 2²⁵⁶ brute-force. But every implementation runs on physical hardware that leaks information through observable side effects.

First described by Paul Kocher (1996). If a cryptographic operation takes different amounts of time depending on the secret key, an attacker can statistically recover the key by measuring execution times.

Common Timing Leaks

• Conditional branches on secret bits (if key_bit → multiply, else skip)
• Early-exit comparisons (memcmp returns at first mismatch)
• Data-dependent table lookups (cache hits vs. misses)
• Variable-time multiplication (leading zeros skip)

Classic: RSA Square-and-Multiply

# VULNERABLE — timing leaks key bits
def modexp_vulnerable(base, exp, mod):
    result = 1
    for i in range(exp.bit_length()-1, -1, -1):
        result = (result * result) % mod   # always square
        if (exp >> i) & 1:                 # branch on secret!
            result = (result * base) % mod # multiply only if bit=1
    return result
# Multiply is ~2x slower than square-only
# → attacker times each iteration
# → recovers every bit of the exponent (secret key)

❌ Vulnerable (early-exit)

// Standard memcmp — LEAKS position of first difference
int memcmp(const void *a, const void *b, size_t n) {
    const uint8_t *p = a, *q = b;
    for (size_t i = 0; i < n; i++) {
        if (p[i] != q[i])
            return p[i] - q[i];  // exits early!
    }
    return 0;
}
// Timing reveals how many bytes match
// → attacker brute-forces one byte at a time
// → O(256 × n) instead of O(256^n)

✅ Constant-Time

// Crypto-safe comparison — always same time
int ct_memcmp(const void *a, const void *b, size_t n) {
    const volatile uint8_t *p = a, *q = b;
    uint8_t diff = 0;
    for (size_t i = 0; i < n; i++) {
        diff |= p[i] ^ q[i]; // accumulate diffs
    }
    // No early exit, no branch on secret data
    return diff; // 0 if equal, nonzero otherwise
}
// Runs in exactly the same time regardless
// of where (or whether) a mismatch occurs

❌ Branching on secret

// Branch predictor leaks which path taken
if (secret_bit) {
    result = value_a;
} else {
    result = value_b;
}

✅ Branchless select

// Constant-time conditional select
// mask = 0xFFFFFFFF if bit=1, 0x00000000 if bit=0
uint32_t mask = -(uint32_t)secret_bit;
result = (value_a & mask) | (value_b & ~mask);
// Both values computed, correct one selected
// No branch, no timing difference

In CMOS logic, dynamic power is consumed when transistors switch state. The power drawn by a gate depends on the Hamming weight and Hamming distance of the data it processes.

where α = switching activity (data-dependent!), C_L = load capacitance, V_dd = supply voltage, f = clock frequency.

Power Models

SPA extracts secrets by directly inspecting a single (or few) power traces. Different operations produce visually distinct power signatures.

RSA via SPA

Square-and-multiply RSA: a square operation has a shorter, lower-amplitude power pattern than a multiply. By reading the trace visually:

Each multiply reveals a 1 bit; square-only reveals 0. A single trace can recover a 2048-bit RSA private key.

Simulated SPA Trace

The most powerful form of profiled side-channel attack (Chari et al., 2002). Given access to an identical template device, an attacker can build a statistical model and then break a target device with as few as a single trace.

Two-Phase Process

Mathematical Model

Deep Learning Extensions

Modern attacks replace the Gaussian template with neural networks (CNNs, MLPs). Benefits:

• No need to manually select points of interest
• Handle misaligned traces (jitter) automatically
• Cross-device attacks: train on device A, attack device B — demonstrated to succeed in as few as a single trace
• Effective even against first-order masking

Current flow in IC wires produces electromagnetic radiation. A near-field EM probe (loop antenna, 50–500 μm) placed near the chip surface can capture signals that correlate with internal data processing.

Advantages Over Power Analysis

• Spatial resolution — probe individual circuit blocks, not just global power rail
• Non-contact — no need to modify power supply lines
• Bypass decoupling capacitors — EM radiates directly from die, unfiltered
• Works through packaging — even epoxy-encapsulated chips

Attack Setup

STELLAR Countermeasure

Route the crypto core exclusively within lower metal layers (M1–M4), then surround it with a Current-Domain Signature Attenuation (CDSA) shield in upper metals. The correlated EM signature is suppressed by 100–1000× before reaching the chip surface.

Cross-Device Deep Learning (X-DeepSCA)

Train a CNN on EM traces from Device A, attack Device B — same architecture, different manufacturing lot. Demonstrated to extract AES-256 keys with practical trace counts, proving device-specific noise is not a reliable defense.

Modern CPUs use multi-level caches (L1: ~1 ns, L2: ~5 ns, L3: ~15 ns, DRAM: ~60 ns). These timing differences are a side channel when crypto code performs secret-dependent memory accesses.

AES T-Table Attack (Bernstein 2005)

Standard AES implementations use lookup tables (T-tables, 4 × 1 KB). The index into each table depends on plaintext ⊕ key. An attacker on the same machine measures which cache lines were accessed, revealing which table entries were used, directly leaking key-dependent information.

Major Cache Attack Techniques

Spectre (2018)

Exploits speculative execution and branch prediction. The CPU speculatively executes instructions beyond a branch before the condition is resolved. Even though results are rolled back architecturally, cache state changes persist and are observable via timing.

Meltdown (2018)

Exploits out-of-order execution with delayed exception handling. CPU executes a kernel memory read before the privilege check completes. The data reaches the cache before the fault is raised.

Mitigations

KPTI (unmap kernel pages), retpoline (replace indirect branches), IBRS/IBPB (hardware predictor barriers), DAWG (cache partitioning), microcode patches. Performance cost: 5–30% on some workloads.

Introduced by Biham & Shamir (1997). Inject a fault during encryption, then compare the correct and faulty ciphertexts. The difference reveals information about the secret key.

DFA on AES — Piret & Quisquater (2003)

Inject a single-byte fault at the input of round 8 MixColumns. This fault propagates through rounds 9 and 10, affecting 4 bytes of ciphertext. By analyzing the difference between correct and faulty outputs:

• One faulty ciphertext yields ~2⁸ possible key hypotheses for 4 key bytes
• Two faults at different positions → unique 32-bit key fragment
• 2 fault pairs (4 total faults) → complete AES-128 round key → full key via key schedule inversion

DFA on RSA-CRT

Bellcore Attack (Boneh et al., 1997): If RSA uses CRT and a fault occurs in one of the two modular exponentiations:

A single faulty signature completely breaks RSA. This is why RSA-CRT implementations must verify signatures before output.

Countermeasures

Masking splits every sensitive intermediate value into d+1 random shares. Each share is statistically independent of the secret. An attacker must combine information from all shares simultaneously to learn anything — requiring (d+1)^th-order analysis.

Boolean Masking

Each share x_i (for i > 0) is uniformly random. x₀ = x ⊕ x₁ ⊕ ... ⊕ x_d. Any strict subset of shares is uniformly distributed — reveals zero information about x.

Arithmetic Masking

Used for ARX ciphers (SPECK, ChaCha20). Converting between Boolean and arithmetic masking requires dedicated secure algorithms.

Masking AES SubBytes

# First-order masked SubBytes (d=1)
def masked_subbytes(x0, x1):
    """x = x0 ⊕ x1 (true value)"""
    # Re-mask: generate fresh mask
    r = random_byte()
    # Pre-compute masked S-box table
    # S'[a] = S[a ⊕ x1] ⊕ r  (for all a)
    masked_sbox = [sbox[a ^ x1] ^ r
                   for a in range(256)]
    # Apply: lookup with share x0
    y0 = masked_sbox[x0]
    y1 = r  # new mask
    # Now y0 ⊕ y1 = S[x0 ⊕ x1] = S[x]
    return y0, y1

Masking in hardware must handle glitches — transient signal transitions that can combine shares within a single clock cycle, leaking information even if the steady-state design is secure.

TI Properties (Nikova, Rechberger, Rijmen 2006)

TI-Protected AND Gate (d=1, 3 shares)

// Inputs: a = (a0, a1, a2), b = (b0, b1, b2)
// where a = a0 ⊕ a1 ⊕ a2, b = b0 ⊕ b1 ⊕ b2
// Output shares of c = a AND b:

assign c0 = (a0 & b0) ^ (a0 & b1) ^ (a1 & b0);
assign c1 = (a1 & b1) ^ (a1 & b2) ^ (a2 & b1);
assign c2 = (a2 & b2) ^ (a2 & b0) ^ (a0 & b2);
// c0 ⊕ c1 ⊕ c2 = a & b  ✓
// Each c_i depends on only 2 of 3 input shares ✓
// Non-completeness: c0 has no a2,b2 etc.

Evolution

• TI → first-order glitch-resistant, limited to low algebraic degree
• DOM (Domain-Oriented Masking) → arbitrary order, less area/randomness than TI
• HPC2 / PINI → provably composable at arbitrary order, multivariate secure
• AGEMA → automated tool to convert unprotected HDL → masked implementation

The Compiler Problem

You write constant-time C. The compiler "optimizes" it back into branching code. This is a fundamental tension — compilers are designed to make code fast, not constant-time.

// You write:
uint32_t mask = -(uint32_t)(a == b);
result = old ^ (mask & (old ^ new_val));

// Compiler may emit:
//   CMP a, b
//   JNE skip      ← branch reintroduced!
//   MOV result, new_val
// skip:

Defenses

• Use volatile to prevent optimization
• Write in assembly for critical paths
• Use -O0 or specific compiler barriers
• Verify final binary with tools like ct-verif, Binsec/Rel

Libraries That Get It Right

Verification Tools

ct-verif dudect timecop Binsec/Rel CacheAudit ct-wasm

TVLA (Goodwill et al., 2011) is a standardized methodology to detect whether a device leaks side-channel information — without performing a full key-recovery attack.

The t-Test Approach

Collect two sets of power traces:

• Set A: encrypt a fixed plaintext repeatedly
• Set B: encrypt random plaintexts

At each time sample, compute Welch's t-statistic between Set A and Set B.

If |t| > 4.5 at any time point → statistically significant leakage detected (p < 10⁻⁵). The device fails TVLA.

Interpreting Results

Higher-Order TVLA

For masked implementations, apply preprocessing before the t-test: square the centered trace values (second-order), or compute products of pairs of samples. If the second-order t-test shows |t| > 4.5 on a first-order masked design, the masking is broken. Extend to n^th-order for n^th-order masking evaluation.

On-Chip Noise & Attenuation

Tamper Detection & Response

RSA Blinding

Randomize the input to the private-key operation so the attacker cannot correlate known inputs with power/timing traces.

# RSA signature with blinding
def rsa_sign_blinded(m, d, n):
    # Generate random blinding factor
    r = random_coprime(n)
    r_inv = modular_inverse(r, n)
    
    # Blind the message
    m_blind = (m * pow(r, e, n)) % n
    
    # Sign the blinded message
    s_blind = pow(m_blind, d, n)  # leaks info about r, not d!
    
    # Unblind the signature
    s = (s_blind * r_inv) % n
    return s  # correct signature, no leakage

Every invocation uses a fresh random r, so the intermediate values during exponentiation are completely randomized. Attacker's traces are decorrelated from the actual key bits.

ECC Scalar Blinding

For elliptic curve scalar multiplication k·G: