Side-Channel Attacks and Countermeasures

Side-Channel Attacks on Smart Cards

Side-channel attacks exploit physical information leakage — power consumption, electromagnetic emanation, timing behaviour, or induced faults — rather than mathematical weaknesses in an algorithm. A card that is theoretically secure against cryptanalysis can be fully broken by measuring its power trace for a few seconds. Common Criteria EAL4+ with AVA_VAN.5 requires that evaluation labs demonstrate resistance against these attacks at high attack potential.

Use the EAL Comparator to identify which certified cards have passed AVA_VAN.5 side-channel resistance verification.

Simple Power Analysis (SPA) and Differential Power Analysis (DPA)

SPA/DPA — collectively side-channel attacks on power consumption — are the most widely studied class of physical attacks on smart cards.

Simple Power Analysis (SPA) uses a single power trace to visually identify algorithm steps. In an unprotected RSARSACryptographyPublic-key algorithm for smart card signatures and key exchange.Click to view → implementation, the conditional square-and-multiply steps in the exponentiation loop are visible as distinct power patterns — each "multiply" segment corresponds to a '1' bit in the private exponent.

Differential Power Analysis (DPA) is a statistical attack requiring many traces. The attacker partitions traces by a hypothesis about a small portion of the secret (e.g., one byte of an AESAESCryptographyNIST symmetric block cipher for smart card encryption.Click to view → key), computes a statistical distinguisher (difference-of-means or correlation), and iterates over all key byte hypotheses until the correct one yields a higher correlation than the rest.

Fault Injection Attacks

Fault injectionFault injectionSecurityPhysical attack inducing errors to bypass security.Click to view → introduces transient errors in the card during cryptographic operations to extract key material or bypass security checks. Attack vectors include:

• Voltage glitching — momentarily dropping VCC below specification causes the CPU to skip instructions or corrupt register values
• Clock glitching — inserting a spurious clock edge causes the CPU to execute two instructions in one cycle
• Laser fault injection — a focused laser beam ionises transistors in the chip, flipping individual bits with spatial precision

The classic fault attack on RSA-CRT (Bellcore attack, 1997) requires a single faulty signature: the attacker computes gcd(faulty_sig - correct_sig, N) to recover a private key prime in milliseconds. Modern secure element implementations counter this with redundant CRT computation and output verification.

Template Attacks and Machine Learning

Template attacks are the most powerful side-channel variant when the attacker has access to a characterisation device (same chip, open key). They build a multivariate statistical profile of the power leakage for each key hypothesis across all time samples simultaneously, then apply maximum likelihood matching to a single target trace.

Modern attacks increasingly use deep learning (convolutional neural networks, attention models) on raw traces, eliminating the need for a hand-crafted power model and reducing the number of attack traces needed by one to two orders of magnitude compared to classical DPA on masked implementations.

Countermeasures

Certified cards implement multiple layers of complementary countermeasures:

Higher-order masking — splitting a secret into d+1 shares so that any d shares are independent of the secret — is the dominant software countermeasure against DPA of order d. Cards targeting EAL 5+ routinely implement second-order masking and active hardware shields.

See Smart Card Cryptography for the algorithmic foundations that these countermeasures protect.