Electromagnetic attack
Known attacks
Known attacks
-------------

While the fact that circuits that emit high\-frequency signals may leak secret information was known since 1982 by the NSA, it was classified until 2000, which was right around the time that the first electromagnetic attack against encryption was shown by researchers. Since then, many more complex attacks have been introduced.

### Devices

#### Smart cards

[thumb\|Smart card pinout](/wiki/File:SmartCardPinout.svg "SmartCardPinout.svg")
[Smart cards](/wiki/Smart_card "Smart card"), often colloquially referred to as “chip cards", were designed to provide a more secure financial transaction than a traditional credit card. They contain simple embedded [integrated circuits](/wiki/Integrated_circuit "Integrated circuit") designed to perform cryptographic functions. They connect directly to a [card reader](/wiki/Card_reader "Card reader") which provides the power necessary to perform an encrypted [financial transaction](/wiki/Financial_transaction "Financial transaction"). Many side\-channel attacks have been shown to be effective against smart cards because they obtain their power supply and clock directly from the card reader. By tampering with a card reader, it is simple to collect traces and perform side\-channel attacks. Other works, however, have also shown that smart cards are vulnerable to electromagnetic attacks.

#### FPGAs

A field\-programmable gate arrays ([FPGA](/wiki/FPGA "FPGA")) have been commonly used to implement cryptographic primitives in hardware to increase speed. These hardware implementations are just as vulnerable as other software based primitives. In 2005, an implementation of elliptic curve encryption was shown vulnerable to both SEMA and DEMA attacks. The [ARIA](/wiki/ARIA_%28cipher%29 "ARIA (cipher)") block cipher is a common primitive implemented with FPGAs that has been shown to leak keys.

#### Personal computers

In contrast to smart cards, which are simple devices performing a single function, [personal computers](/wiki/Personal_computer "Personal computer") are doing many things at once. Thus, it is much more difficult to perform electromagnetic side\-channel attacks against them, due to high levels of noise and fast [clock rates](/wiki/Clock_rate "Clock rate"). Despite these issues, researchers in 2015 and 2016 showed attacks against a laptop using a [near\-field magnetic probe](/wiki/Near-field_scanner "Near-field scanner"). The resulting signal, observed for only a few seconds, was filtered, amplified, and digitized for offline key extraction. Most attacks require expensive, lab\-grade equipment, and require the attacker to be extremely close to the victim computer. However, some researchers were able to show attacks using cheaper hardware and from distances of up to half a meter. These attacks, however, required the collection of more traces than the more expensive attacks.

#### Smartphones

[Smartphones](/wiki/Smartphone "Smartphone") are of particular interest for electromagnetic side\-channel attacks. Since the advent of [mobile phone payment systems](/wiki/Mobile_payment "Mobile payment") such as [Apple Pay](/wiki/Apple_Pay "Apple Pay"), e\-commerce systems have become increasingly commonplace. Likewise, the amount of research dedicated to mobile phone security side channel attacks has also increased. Currently most attacks are proofs of concept that use expensive lab\-grade signal processing equipment. One of these attacks demonstrated that a commercial radio receiver could detect mobile phone leakage up to three meters away.

However, attacks using low\-end consumer grade equipment have also shown successful. By using an external USB sound card and an induction coil salvaged from a wireless charging pad, researchers were able to extract a user's signing key in Android's OpenSSL and Apple's CommonCrypto implementations of ECDSA.

### Examples of vulnerable encryption schemes

Widely used theoretical encryption schemes are [mathematically secure](/wiki/Provable_security "Provable security"), yet this type of security does not consider their physical implementations, and thus, do not necessarily protect against side\-channel attacks. Therefore, the vulnerability lies in the code itself, and it is the specific implementation that is shown to be insecure. Luckily, many of the vulnerabilities shown have since been [patched](/wiki/Patch_%28computing%29 "Patch (computing)"). Vulnerable implementations include, but are definitely not limited to, the following:
* [Libgcrypt](/wiki/Libgcrypt "Libgcrypt") – cryptographic library of [GnuPG](/wiki/GnuPG "GnuPG"), implementation of [ECDH](/wiki/ECDH "ECDH") public\-key encryption algorithm (since patched)
* GnuPG implementation of 4096\-bit RSA (since patched)
* GnuPG implementation of 3072\-bit [ElGamal](/wiki/ElGamal_encryption "ElGamal encryption") (since patched)
* [GMP](/wiki/GNU_Multiple_Precision_Arithmetic_Library "GNU Multiple Precision Arithmetic Library") implementation of 1024\-bit RSA
* [OpenSSL](/wiki/OpenSSL "OpenSSL") implementation of 1024\-bit RSA


How can attackers extract information from a device using cheaper hardware and more traces?