Electromagnetic Side-Channel Basics
Electromagnetic side-channel analysis is power analysis’s close cousin. Instead of measuring current on the power line, it measures the tiny electromagnetic field a chip radiates as it switches, which carries the same secret-dependent information. With a probe and patience, that radiated field can give up the keys the device was computing with.
The Leak Nobody Intends
A chip computing on secret data is not supposed to tell anyone what that data is, but the physics of switching transistors means it does, faintly, whether the designers want it to or not. Every transistor that flips state emits a small electromagnetic pulse, and a chip running code is millions of these flips per second, so the combined field above the package rises and falls with the activity inside. A near-field probe held over the die picks up that field as a voltage trace.
Crucially, the field varies with the data being processed, just as power consumption does: an operation on a byte with many set bits looks different from one on a byte with few, and a multiplication by a key-dependent value leaves a key-dependent signature. Side-channel analysis is the discipline of recovering secrets from those unintended physical signals rather than from the logical interface, and that data dependence is the door through which the secret leaks.
Why EM Can Beat Power Analysis
EM analysis listens to the radiated field instead of tapping the power line, and that changes the practicalities in the attacker’s favor:
| Power analysis | EM analysis | |
|---|---|---|
| What it measures | Current on the power line | The radiated field above the die |
| Board access | Needs a shunt resistor in the supply | Often none; a probe hovers over the package |
| Spatial selectivity | Sums the whole chip at the supply pin | Can isolate one region of the die |
| The maths | DPA and correlation analysis | The same, applied to EM traces |
The non-invasiveness and the spatial selectivity are the real advantages. A probe over the package needs no cut traces and betrays no measurement, and because it can be parked over the block doing the cryptography, it hears the relevant circuitry rather than the whole device, which sometimes recovers a key that defeats a power-analysis attempt on the same chip.
The Measurement Setup
The practical rig is a near-field EM probe, an amplifier, and a fast oscilloscope or capture board, with a trigger tied to the operation under study. The probe is small, the kind used for EMC debugging, and it is positioned over the die while the device repeats the cryptographic operation.
# capture EM traces aligned to each encryption, then analyze # probe over the die -> LNA -> scope, triggered on the AES start signal chipwhisperer: scope.adc.samples = 5000; scope.gain.db = 35 capture_traces(N=20000, trigger='aes_start') # collect many aligned traces
The setup mirrors a power-analysis rig with the shunt swapped for a field probe. You collect many traces of the same operation, aligned to a trigger, because the statistical attacks that follow need many measurements to pull a small data-dependent signal out of the noise.
From Traces to Keys
A single trace is mostly noise. The attacks that recover keys are statistical: differential and correlation power analysis, applied identically to EM traces, test hypotheses about key bytes against thousands of traces and let the correct guess emerge as a correlation peak. The same math that breaks an unprotected AES from power traces breaks it from EM traces.
# correlation analysis: the correct key byte shows a clear peak
cpa = correlation_analysis(traces, plaintexts, leakage_model='HW_sbox_out')
print("recovered key byte 0:", hex(cpa.best_guess[0]), "conf", cpa.confidence[0])recovered key byte 0: 0x2b conf 0.94 # repeated per byte, the full AES key falls out of ~15k traces
When the correct guess for each key byte produces a sharp correlation peak and the wrong guesses stay flat, the key falls out one byte at a time. An unprotected AES on a microcontroller commonly yields its key from tens of thousands of EM traces, which is minutes to hours of collection, not an academic abstraction.
The Defenses, Largely Shared
The good news is that the countermeasures are largely shared with power analysis, because the root cause is the same data-dependent switching:
- Masking. Split secret values into random shares so the intermediates an attacker measures decorrelate from the real secret. It is the strongest algorithmic defense, and it cuts both channels.
- Constant-time and constant-power code. Remove data-dependent branches and balance the work so the trace varies less with the secret.
- Shielding. Metal layers and added distance attenuate the radiated field. This one is EM-specific and rarely sufficient on its own, but it pairs well with the rest.
- Noise and randomization. Random delays, dummy operations, and shuffled order misalign the traces, raising the trace count needed from thousands toward millions.
None of the algorithmic measures are EM-specific, so an implementation hardened against power analysis is generally hardened against EM as well, one investment defending both channels. Combined, masking and randomization are how high-assurance smartcards and secure elements resist analysis that easily breaks an unprotected microcontroller.
When It Is the Real Threat
Not every device needs to resist this. EM and power analysis require physical access and many measurements, so they matter most for devices an attacker can hold and repeatedly exercise: smartcards, secure elements, payment hardware, and any product where extracting a key has high value and the device is in the attacker’s hands. For a low-value device an attacker would not bother to instrument, it may be out of scope, and the threat model is what tells you which case you are in.
For the devices that do need it, the defenses have to be designed in from the start, because they are hard to bolt on later. Treating EM as a distinct, sometimes easier, channel and choosing a side-channel-resistant crypto library or a certified secure element up front is what turns the radiated leak from an open door into a closed one.
Where This Fits
Evaluating a device’s side-channel leakage, electromagnetic and power alike, and advising on countermeasures is part of a hardware-focused product security assessment. If you want an evaluation of what your device radiates and how hard its keys are to extract, that is the kind of work we do at Berkner Tech.
