Electronics Guide

Sources of Timing Variation

Timing variations arise from several sources in typical embedded implementations. Conditional branches that depend on secret data cause different code paths with different execution times. Early-exit optimizations that terminate loops when certain conditions are met leak information about when those conditions occur. Cache behavior creates timing differences when some memory accesses hit the cache while others miss. Even multiplication and division operations on some processors take variable time depending on operand values.

The modular exponentiation operation used in RSA provides a classic example. Square-and-multiply algorithms process exponent bits sequentially, performing a squaring operation for every bit but only performing multiplication when the bit is one. This creates a direct timing correlation between the secret exponent bits and the operation duration.

Timing Attack Countermeasures

Constant-time algorithms: The fundamental defense against timing attacks is ensuring that all operations take the same amount of time regardless of input values or secret data. This requires eliminating all data-dependent branches, ensuring uniform memory access patterns, and avoiding variable-time instructions.

Branchless programming: Replace conditional branches with arithmetic operations that compute the same result without branching. For example, instead of conditionally selecting between two values based on a secret bit, compute both results and use bitwise operations to select the correct one.

Uniform table lookups: When table lookups are required, access the entire table rather than only the needed entry. This prevents cache timing attacks from revealing which entry was accessed.

Time padding: Add random delays to obscure the actual operation time. This is a weak substitute for constant-time code: random delays do not remove the leakage, they only bury it in noise that an attacker removes by averaging over more measurements. Use padding as a supplement when constant-time operation is genuinely infeasible, never as the primary defense.

Blinding: Transform input data with random values before processing, then remove the blinding after the operation completes. RSA implementations commonly blind both the message and the exponent, and elliptic-curve implementations randomize the scalar or the projective coordinates of the base point. Because the attacker no longer knows the values actually being processed, measurements cannot be correlated across operations, yet the final result remains correct.

Verifying constant-time behavior deserves as much attention as writing it. Compilers routinely undo hand-written branchless code: an optimizer is free to convert a conditional move back into a branch, and a library routine such as memcmp returns early by design. Tools that check binaries rather than source, including dynamic-analysis instrumentation and static verifiers, catch violations that code review misses. Constant-time comparison of authentication tags and PINs is a standard requirement, since an early-exit comparison leaks the position of the first mismatched byte.

Simple Power Analysis

Simple Power Analysis (SPA) directly interprets power traces to extract secrets. When examining the power consumption during RSA operations, for example, the square and multiply operations have distinctly different power signatures. An attacker can visually identify which operations occur and directly read the secret exponent bits from a single power trace.

SPA attacks are straightforward to execute when implementations lack protection, requiring only an oscilloscope connected to the power supply or through a small resistor in the ground path. The challenge for attackers is obtaining sufficient signal quality, but this is readily achievable with modern equipment.

Differential Power Analysis

Differential Power Analysis (DPA) uses statistical methods to extract secrets from many power traces, even when individual traces reveal little information. DPA correlates hypothetical power consumption models with actual measurements to identify which key hypotheses best explain the observed power patterns.

In a typical DPA attack against AES, the attacker captures power traces during many encryption operations. For each possible value of a key byte, the attacker predicts the power consumption at a specific intermediate point, such as the output of the first-round S-box, using a leakage model such as the Hamming weight or Hamming distance of the intermediate value. Because each key byte can be attacked independently, the search space collapses from the full key to a manageable set of byte hypotheses. The correct hypothesis produces the strongest statistical correlation between predicted and measured power. Correlation Power Analysis (CPA), which uses the Pearson correlation coefficient, is the modern refinement of this approach and typically recovers keys with fewer traces than the original difference-of-means method.

DPA can extract keys even from implementations that resist SPA, making it a more powerful and general attack technique. However, it requires many traces, accurate trace alignment, and more sophisticated statistical analysis.

Power Analysis Countermeasures

Masking: Split all sensitive intermediate values into multiple shares such that the actual secret is never directly processed. Each share is processed independently, and only their combination reveals the true value. A scheme of order d uses d + 1 shares and forces the attacker to combine leakage from at least d + 1 points in the trace; in the presence of measurement noise, the number of traces required grows exponentially with the order. The cost is steep, because secure multiplication of shared values scales roughly with the square of the order, so most products settle on first- or second-order masking of the algorithm's nonlinear steps.

Masking depends on a fresh, high-quality entropy source. Reusing mask values, deriving them from a weak generator, or letting a compiler reorder share operations so that two shares meet in one register collapses the protection. In hardware, combinational glitches can momentarily recombine shares even when the register-transfer description is correct; threshold implementations, which impose non-completeness and uniformity requirements on each share function, were developed specifically to remain sound in the presence of glitches.

Hiding: Reduce the signal-to-noise ratio by adding random noise to power consumption or by using circuit techniques that consume constant power regardless of data values. Dual-rail precharge logic, in which every signal is routed with its complement and the pair is precharged between evaluations, draws the same number of switching events for every data value. In practice the balance is imperfect: routing capacitance rarely matches exactly between the two rails, and the residual imbalance leaks. Such styles also cost roughly double the area and power of standard cells, so they are reserved for the cryptographic core rather than the whole design.

Shuffling: Randomize the order of independent operations. When multiple S-box lookups or similar operations occur, processing them in random order prevents attackers from knowing which operation corresponds to which portion of the key.

Amplitude and temporal randomization: Randomly vary operation timing and current consumption to decorrelate measurements from secrets. Random delays, dummy operations, and variable-frequency clocking all contribute to this protection.

Hardware countermeasures: Design custom logic cells that consume data-independent power. Implement on-chip voltage regulation that masks power consumption from external observation. Use noise generators that inject random current consumption.

EM Attack Advantages

EM attacks can target specific chip areas by positioning probes directly over regions of interest. This spatial selectivity allows attackers to isolate signals from cryptographic engines while filtering out noise from unrelated circuit activity. Power analysis measures aggregate chip consumption, but EM analysis can focus on individual components.

EM attacks can sometimes bypass power-side countermeasures. On-chip voltage regulation that masks external power consumption may not prevent local EM emissions. Shielding and filtering effective against power analysis may leave EM paths unprotected.

Attacks can be conducted without electrical contact. While power analysis requires connection to the power supply, EM probes need only proximity to the target. This enables attacks on devices with protected or inaccessible power connections.

EM Attack Countermeasures

Shielding: Enclose sensitive components in conductive shielding that attenuates EM emissions. Effective shielding requires careful attention to apertures, seams, and cable penetrations that could leak emissions.

On-chip countermeasures: Implement noise generators and randomization circuits that obscure EM signatures. Design balanced circuits that minimize differential emissions.

Active cancellation: Generate intentional EM emissions designed to mask or cancel signals from cryptographic operations. This technique requires careful calibration but can effectively obscure useful signals.

Layout techniques: Place cryptographic logic away from package surfaces where a probe can be positioned, keep the loop area of current paths small so that less energy is radiated, and interleave sensitive cells with unrelated active logic so that a probe cannot isolate them spatially. Metal fill and active shield meshes over the sensitive region serve the same purpose while also complicating probing and localized fault injection.

Attack Mechanisms

In prime and probe attacks, the attacker fills cache sets with their own data, allows the victim to execute, then measures access time to their data. Slow access indicates the victim evicted attacker data, revealing which cache sets the victim accessed.

Flush and reload attacks operate on shared memory. The attacker flushes a shared memory region from cache, waits for the victim to execute, then times access to that region. Fast access indicates the victim loaded the data, revealing that the victim accessed that memory location.

These attacks are particularly effective against table-driven cryptographic implementations. AES lookup tables indexed by secret-dependent values leak information about those secrets through cache access patterns.

Frequency and Prediction Channels

Caches are only the best-known microarchitectural channel. Branch predictors and branch target buffers retain state across context switches, so an attacker who trains and then probes the predictor can recover the direction of secret-dependent branches. Speculative-execution attacks in the Spectre family use the same measurement techniques to read data the program never architecturally exposes.

Dynamic voltage and frequency scaling adds a further route. The Hertzbleed attack, presented at the 31st USENIX Security Symposium in 2022 and tracked as CVE-2022-24436 for Intel processors and CVE-2022-23823 for AMD, showed that because a processor's boost frequency responds to the power drawn by the data it is processing, data-dependent power consumption becomes data-dependent wall-clock time. A remote attacker who can only time responses therefore observes a power side channel. The consequence is significant: code that is constant-time in the classic sense, with no secret-dependent branches or memory accesses, can still leak. Mitigations are unattractive, ranging from disabling turbo modes at a large performance cost to masking the sensitive primitive so that no exploitable power signature exists in the first place.

Cache and Microarchitectural Countermeasures

Constant-memory-access patterns: Access all possible memory locations regardless of actual need. For table lookups, read the entire table and use masking to select the desired entry without revealing which entry is needed.

Bit-sliced implementations: Implement algorithms using bitwise operations rather than table lookups. Bit-sliced AES, for example, processes multiple blocks in parallel using only logical operations, eliminating table access entirely.

Cache partitioning and core isolation: Isolate cryptographic operations in dedicated cache partitions that other processes cannot probe, using hardware partitioning where the processor supports it or page-coloring in software where it does not. On platforms with simultaneous multithreading, avoid co-scheduling untrusted work on a sibling thread, and flush shared microarchitectural state on context switches into and out of the sensitive task.

Disable cache for sensitive operations: Execute cryptographic code from non-cached memory. This eliminates cache-based side channels but significantly impacts performance.

Hardware AES instructions: Use processor instructions specifically designed for AES that operate entirely in registers without table access. AES-NI on x86 and the AES extensions in the Armv8 cryptographic extension execute a round in fixed time with no data-dependent memory access, which removes cache and timing leakage. They do not, however, make the device immune to power or electromagnetic analysis, since the underlying datapath still switches in a data-dependent way.

Fault Injection Methods

Voltage glitching: Briefly disrupt the power supply voltage to cause timing violations or computational errors. Voltage glitches can be precisely timed to affect specific operations while leaving others undisturbed.

Clock glitching: Inject extra clock edges or briefly shorten a clock period so that combinational logic cannot settle before the next capture. Registers then latch incorrect values, and instructions may be corrupted or skipped entirely. Clock glitching applies only to devices driven by an accessible external clock.

Electromagnetic fault injection: Apply localized electromagnetic pulses to induce currents in specific chip regions. EM fault injection can target particular circuits with high spatial precision.

Laser fault injection: Use focused laser beams to flip individual bits in memory or registers. Laser attacks provide extremely precise spatial and temporal control over induced faults.

Temperature manipulation: Operate devices outside specified temperature ranges to cause timing failures or memory errors. While less precise than other methods, temperature attacks require minimal equipment.

Differential Fault Analysis

Differential Fault Analysis (DFA) extracts keys by comparing correct and faulty cryptographic outputs. For block ciphers, a fault introduced in a late round produces a faulty ciphertext that, when compared with the correct ciphertext, reveals information about the round keys.

AES is a classic target. The attack of Piret and Quisquater, published at CHES 2003, recovers an AES-128 key from as few as two faulty ciphertexts when a random single-byte fault is injected between the antepenultimate and the penultimate MixColumns operations. Later work reduced the requirement to a single fault: Tunstall, Mukhopadhyay, and Ali showed in 2011 that one random byte fault at the input of the eighth round narrows the key to about 2³² candidates in the first stage of their analysis and to roughly 2⁸ in the second, a space that is trivially exhausted. DFA is therefore remarkably efficient, often requiring only one or two faulty computations to recover a key, which is why fault resistance cannot be treated as a lesser concern than passive-leakage resistance.

Fault attacks are equally damaging outside of key extraction. A glitch that skips a single comparison instruction can turn a failed signature check into a successful one, defeat a PIN retry counter, or leave a debug interface enabled. Attacks of this kind against secure boot chains and read-out protection fuses have been demonstrated repeatedly on commercial microcontrollers, generally with inexpensive glitching hardware rather than laboratory equipment.

Fault Injection Countermeasures

Redundant computation: Perform critical operations multiple times and compare results. Faults affecting one computation are unlikely to identically affect redundant copies. Operations proceed only when all copies agree.

Error detection codes: Protect intermediate values with checksums or error-detecting codes. Verify these codes before using values or producing outputs. This detects both natural errors and injected faults.

Temporal redundancy: Execute operations at different times and compare results. Time separation makes it difficult for single glitches to affect all computations identically.

Infection countermeasures: Propagate faults to affect all output bits rather than just a few. When faults cause complete output randomization rather than localized changes, DFA becomes ineffective.

Sensors and detectors: Monitor for attack signatures such as voltage deviations, clock anomalies, light exposure, or temperature extremes. Trigger countermeasures when attacks are detected.

Secure failure modes: When faults or attacks are detected, fail securely by erasing keys, locking the device, or entering a safe state. Never output potentially compromised results.

Defense in Depth

Layer multiple independent countermeasures so that failure of any single mechanism does not compromise security. Combine constant-time algorithms with masking, add redundant computation with sensor monitoring, and implement both hardware and software protections.

Each layer should protect against different attack variants. Masking addresses DPA but not SPA; constant-time code prevents timing attacks but not power analysis. Comprehensive protection requires addressing all relevant attack categories.

Security Evaluation

Perform side-channel evaluation throughout development, not just at the end. Test Vector Leakage Assessment (TVLA), which applies Welch's t-test to power or electromagnetic traces collected under fixed versus random inputs, provides a statistical method for detecting information leakage without requiring a full attack implementation. A magnitude above the conventional threshold of 4.5 indicates that the two trace sets are distinguishable and that leakage is present. The test is a useful screen rather than a proof: passing it demonstrates only that no first-order leakage was detected with the traces collected, not that the device is secure against every attack.

Formal evaluation is performed by accredited laboratories. FIPS 140-3, which adopts ISO/IEC 19790, introduced non-invasive attack requirements at Security Levels 3 and 4, with the associated test metrics drawn from ISO/IEC 17825 and rooted in the TVLA methodology. Common Criteria evaluation under ISO/IEC 15408 takes a different approach for smart cards and secure elements, rating each demonstrated attack by the effort, equipment, and expertise it demands and requiring the product to withstand attackers below a stated attack potential. EMVCo runs its own approval process for payment products. Certification is often a market requirement for payment systems, electronic identity documents, and government deployments, so its schedule and cost belong in the project plan from the outset.

Algorithm Selection

Choose algorithms designed for efficient side-channel-resistant implementation. Some algorithms naturally resist certain attacks or admit efficient countermeasures. Ciphers built from bitwise operations and addition mask more cheaply than those built around large lookup tables, and elliptic-curve designs with complete addition formulas remove the special cases that produce exploitable branches. Consider these properties alongside cryptographic strength and performance requirements rather than after the algorithm has been fixed.

The post-quantum algorithms standardized by NIST in August 2024, including the lattice-based ML-KEM (FIPS 203, derived from Kyber) and ML-DSA (FIPS 204, derived from Dilithium), vary significantly in their side-channel characteristics. Masking them is harder than masking AES because their operations mix arithmetic in a modular ring with Boolean steps such as sampling and comparison, and converting a masked value between arithmetic and Boolean representations is expensive. Practical masked implementations exist, but the overhead is substantial and the field remains an active research area. Evaluate these properties carefully when selecting algorithms for long-term deployment.

Hardware-Software Co-design

Coordinate hardware and software countermeasures for maximum effectiveness. Hardware features such as random number generators, masking support, and redundancy checking enable efficient software countermeasures. Software that fails to utilize hardware protections wastes both security and performance.

Modern secure microcontrollers provide side-channel countermeasures including hardware masking, dual-rail logic, and protected cryptographic accelerators. Leveraging these features is far more effective than implementing software-only protections.