IM Engineer Study Notes
← Back to list
Security & Privacy
#부채널 공격#전력분석#타이밍 공격#Spectre/Meltdown#마스킹
Last updated · 2026-10-15

Side-Channel Attack

1. Overview

Definition: A side-channel attack recovers secret values (keys, plaintext) not by breaking the logical or mathematical security of a cryptographic algorithm or system directly, but by measuring and analyzing the incidental information (computation time, power consumption, electromagnetic emanations, cache state, sound, and so on) that unintentionally leaks while that computation is physically performed. In other words, it is not an attack that "breaks the lock" but one that "eavesdrops on the sound the lock makes as it turns and the tremor of the hand."

Classical cryptanalysis treats an algorithm as an abstract mathematical function and attacks only the mathematical relationship among plaintext, ciphertext, and key. Real cryptography, however, is inevitably implemented as electrical signals on a physical device (CPU, smart card, HSM, IoT chip), and that implementation is not a perfect abstraction. Depending on which bits are processed, transistors switch more or less; depending on branch conditions, execution time varies; depending on memory-access patterns, cache hits and misses diverge. As long as a correlation exists between "the content of a computation" and "a physical observable," even a mathematically perfect algorithm (AES, RSA, ECC) can leak secrets through its implementation. A side-channel attack bores precisely into this gap between the abstraction and the physical reality.

From a Professional Engineer's perspective, side channels should be treated not as "cryptographic theory" but as "a convergence topic linking implementation engineering, physical security, and procurement/certification." Choosing a secure algorithm (AES-256, RSA-3072) does not by itself protect a secret; real-world security is determined only when one also accounts for which device the cryptography runs on, in what code, how closely an attacker can approach, and under what certification its safety was verified. This essay proceeds in the order of attack principles and threat model, techniques by type, real cases, standards/certification, and finally a multi-layered defense strategy from the engineering perspective.

The background to this threat's rise is the reality that cryptography has spread widely into places within reach of an attacker's physical hands. Smart-card chips in transit and credit cards, automotive electronic control units (ECUs), secure chips in smartphones (SE/TEE), IoT sensors, and USB security tokens are all placed in the hands of people who are both users and potential attackers. As attackers came to own devices directly and measure power waveforms or disturb the clock as much as they liked, the side-channel attack—once a theoretical curiosity—became a realistic attack vector threatening payment, authentication, and intellectual-property protection. Furthermore, the 2018 Spectre/Meltdown episode showed that side-channel attacks hold even between virtual machines in a shared cloud, and even in a web browser's JavaScript, impressing that this is a threat possible remotely without physical access.

Three features distinguish side-channel attacks from others. First, implementation dependence: because the code, circuit, and microarchitecture that implement an algorithm—not its specification—determine success, the same AES can be safe or vulnerable depending on implementation. Second, non-invasiveness and low cost: many side-channel attacks measure only power or electromagnetic emanations externally, without physically disassembling the chip, leaving no trace, and can be carried out even with an oscilloscope costing a few hundred dollars. Third, statistical amplification: the signal-to-noise ratio (SNR) in a single measurement is low, but statistically accumulating thousands to millions of measurements lets a faint correlation converge onto secret bits. Because of these three features, side-channel defense becomes not a matter of "changing the algorithm" but an engineering task of "physically flattening the implementation."

An important classification axis here is the distinction between passive and active. Passive attacks only observe the device's normal operation—timing, power, electromagnetic, and cache analysis—whereas active attacks disturb the device with voltage, clock, or laser to induce malfunction (fault injection). The former "eavesdrops on the secret," the latter "shakes the device to make it spit the secret out," and the defenses differ accordingly—leakage minimization versus error detection/recovery. Another axis is whether the attacker can choose their own input (chosen plaintext); when this is possible, the efficiency of statistical attacks such as DPA and CPA rises sharply. Threat modeling must therefore begin by assuming whether the attacker can control inputs and whether repeated measurement is possible.

2. Attack Principles and Threat Model

The starting point of a side-channel attack is the leakage hypothesis that "a physical quantity correlated with the secret is observable." For example, a CMOS circuit consumes meaningful dynamic power only when a bit switches from 0→1 or 1→0, so the power consumed at a given instant tends to be proportional to the Hamming weight or Hamming distance of the data being processed at that instant. The attacker exploits this physical model in reverse: computing the correlation between the observed power waveform and "predicted power consumption under a key guess," and judging the guess with the highest correlation to be the correct key.

flowchart LR
    SEC["Secret value<br/>(crypto key)"] --> OP["Physical crypto op.<br/>(CMOS switching)"]
    DATA["Input plaintext/ciphertext"] --> OP
    OP --> LEAK["Incidental leakage channels"]
    LEAK --> T["Timing"]
    LEAK --> P["Power"]
    LEAK --> E["EM emanation"]
    LEAK --> C["Cache/state"]
    LEAK --> A["Acoustic/thermal"]
    T --> MEAS["Measurement/capture<br/>(oscilloscope/timer)"]
    P --> MEAS
    E --> MEAS
    C --> MEAS
    A --> MEAS
    MEAS --> STAT["Statistical analysis<br/>(correlation/differential)"]
    STAT --> KEY["Key recovery"]

The key point of the diagram above is that the secret value is not exposed directly but leaks, distributed, into several side channels by way of the physical computation. The attacker selects whichever of these channels is easy to measure and reconstructs the secret through statistical analysis. From the defense standpoint, making leakage exactly zero is physically impossible, so the realistic goal is to make the leakage independent of the data (flattened) or bury it in noise so that the attacker's required number of measurements becomes impractical.

The core tool for quantifying leakage is the leakage model. The most widely used Hamming-weight (HW) model assumes power is proportional to the number of 1-bits in the value loaded into a register at a given moment, while the Hamming-distance (HD) model assumes it is proportional to the number of bits flipped in going from a previous value to a new one. Because CMOS spends dynamic power only on state transitions, the HD model often fits actual hardware better. The attacker picks an intermediate value to target (e.g., the first-round AES S-box output = SubBytes(plaintext ⊕ key byte)), computes this intermediate value for each of 256 key hypotheses, builds predicted power via the leakage model, and correlates it with the measurements. Here the target point must be "a nonlinear intermediate value depending on only a few key bits" so that divide-and-conquer and correlation sharpness are secured simultaneously; thus which intermediate value is chosen governs attack efficiency.

The threat model is layered by the attacker's access capability. An attacker who physically owns the device can measure waveforms directly by attaching a resistor to the power pin (low invasiveness), or even perform fault injection that deliberately malfunctions the computation by disturbing the clock or voltage. A remote attacker, by contrast, reaches the side channel only indirectly, through network response time or shared hardware (the same physical CPU or same LLC cache in the cloud). The following sequence shows the typical procedure of power analysis (DPA).

sequenceDiagram
    participant ATK as Attacker
    participant DEV as Crypto device
    participant OSC as Oscilloscope
    participant PC as Analysis system
    loop Thousands to millions of repetitions
        ATK->>DEV: Input known plaintext
        DEV->>DEV: Perform crypto op. with secret key
        DEV-->>OSC: Power waveform leaks during op.
        OSC-->>PC: Store waveform samples
    end
    PC->>PC: "Set hypotheses per key byte(0-255)"
    PC->>PC: "Correlate predicted vs measured power per hypothesis"
    PC-->>ATK: "Max-correlation hypothesis = correct key byte"

What is notable in this procedure is that the attack does not guess the entire key at once but divides the key into small units (bytes) and conquers (divide-and-conquer). The AES-128 key is 2^128, infeasible to brute-force, but DPA recovers the first round's 16 key bytes independently by verifying only 2^8 = 256 possibilities each, so the whole search space collapses to 16×256 = 4,096 trials. In this way the essence of a side-channel attack is to target the cipher's "divisible intermediate value" and drop exponential difficulty to linear.

3. Attack Types

Side channels divide into several types by the physical quantity observed, and because each differs in the access level required and the countermeasures, the distinction matters.

A. Timing Attack. Holds when computation time depends on the secret. The most typical leakage sources are conditional branches that depend on secret data and memory accesses at secret indices. RSA's square-and-multiply exponentiation performs an extra multiplication only when an exponent bit is 1, so total decryption time is proportional to the Hamming weight of the exponent; and when a memory compare (memcmp) returns early at the first mismatching byte, MAC/token/password verification time is linearly proportional to "how many leading bytes matched." The attacker measures response time while varying inputs, narrowing the answer one byte at a time.

In 1996 Kocher first formalized timing attacks against RSA, Diffie-Hellman, and DSS, and in 2003 Boneh and Brumley measured OpenSSL's RSA decryption time millions of times across the network, proving that remote timing attacks are genuinely feasible and demolishing the assumption that "only the internal network is safe." The core defense is constant-time implementation—writing code so that branches, memory accesses, and operation counts do not vary with the secret; comparisons run to the end and accumulate the result with OR (constant-time comparison), and conditional selection is replaced by bitmask operations rather than branches. In RSA, blinding—decrypting after masking the input with a random value—is used alongside.

B. Power Analysis. Measures the power waveform a device consumes during computation. Simple Power Analysis (SPA) identifies the computation pattern itself by eye from just one or two waveforms (e.g., distinguishing square-only segments from square-and-multiply segments in RSA exponentiation) to read key bits. Differential Power Analysis (DPA) and Correlation Power Analysis (CPA), by contrast, statistically accumulate thousands to hundreds of thousands of waveforms to raise faint correlations when data-dependent leakage is buried in noise and invisible to SPA.

CPA builds "predicted power consumption per key hypothesis" with the Hamming-weight/distance model and compares it with actual measured power via the Pearson correlation coefficient, judging the highest-correlation hypothesis to be the correct key byte—placing it among the most powerful techniques. Targets are mainly low-cost devices the attacker physically owns, such as smart cards, security tokens, and IoT chips. Defenses split into masking (splitting the secret into random shares so the intermediate value becomes uncorrelated with the secret) and hiding (flattening power consumption via shuffling, random delay insertion, and dual-rail logic), with the goal of raising attack cost by making the required number of measurements impractical.

C. EM Analysis. Captures, with a near-field probe, the electromagnetic emanations radiated when current flows in a circuit. The mathematical principle is the same as power analysis, but it is advantageous to the attacker in that it can locally target only a specific chip region (the crypto core), giving high spatial resolution, and can be performed without contact, with no need to insert a power-measurement resistor. It is hard to detect, as it can even be measured without opening the packaging in some cases.

The classic of this category is TEMPEST, which addresses a nation-state-level threat: receiving, from a distance, the electromagnetic emanations leaking from displays, cables, and keyboards to reconstruct screen content or keystrokes. Defenses use electromagnetic shielding, grounding/filtering, and circuit design that reduces leakage, and military/government facilities use TEMPEST-certified equipment.

D. Microarchitectural/Cache Attacks. Use state changes in shared hardware resources as a side channel without any physical measurement. Flush+Reload flushes a shared cache line (clflush), then measures the reaccess time to that line after the victim runs to determine "whether the victim accessed that address," while Prime+Probe fills the cache with the attacker's data and, after the victim runs, infers access patterns from which cache set was evicted. Both strongly threaten AES implementations whose crypto-table (S-box) reference index depends on the key.

Spectre/Meltdown, disclosed in 2018, are composite attacks in which the CPU's speculative execution transiently reads memory it has no permission to, changes cache state according to that value, and then leaks the value via the cache-timing side channel; they affected virtually all modern CPUs. Because this type needs no physical access at all, it holds between cloud tenants sharing the same physical server and even inside a browser's JavaScript sandbox—making its impact especially large.

Beyond these, Fault Injection is active disturbance rather than observation. Using voltage glitches, clock glitches, lasers, or electromagnetic pulses to deliberately make a computation wrong, the attacker back-computes the key from the difference between correct and faulty results (Differential Fault Analysis, DFA). RSA-CRT is a fatal case where a single error during signing factors the modulus, defended by redundant computation and result verification. Acoustic analysis is typified by a 2014 study (Genkin et al.) that distinguished different RSA keys by the ultrasonic vibration noise from a CPU's power-supply coils, showing that side channels extend beyond power and EM to sound, heat, and light.

4. Comparison and Real Cases

Comparing the characteristics by type clarifies the resources an attacker needs and the priority of defenses. The table below organizes representative side-channel types by measurement target, access level, and representative defense.

Type Observed quantity Access level Representative case Core defense
Timing Execution/response time Remote possible OpenSSL RSA remote attack(2003) Constant-time impl.
Power(SPA/DPA/CPA) Power consumption Physical ownership Smart-card AES key recovery Masking/hiding
EM Radiated EM Near-field contactless TEMPEST screen reconstruction Shielding
Cache/microarch. Cache hit time Shared HW(remote) Spectre·Meltdown(2018) Isolation/spec.-exec. mitigation
Fault injection Faulty value after disturbance Physical ownership RSA-CRT DFA factoring Op. verification/redundant exec.

The core implication the table reveals is that the lower the access level (the more remote), the harder the defense. Power and fault attacks that require physical ownership are largely suppressed by tamper-resistant design and tamper-detection sensors in a hardware security module (HSM), but cache and timing attacks hold over the network or a shared cloud alone, so physical defense does not help and countermeasures at the software/microarchitectural level become essential. That is, the risk of side channels spikes precisely where the traditional control of "blocking physical access" is neutralized.

For concrete cases, first, smart-card payment and transit cards are classic DPA targets. In the early 2000s, researchers extracted keys from unprotected DES/AES smart cards in minutes with just thousands of power measurements, and this became the direct impetus for EMV payment chips to mandate DPA-resistance certification (Common Criteria CC EAL) and masking. Second, in shared cloud CPUs, the 2018 Meltdown/Spectre revealed that one virtual machine could read another tenant's memory on the same physical server, so AWS, Azure, and GCP deployed emergency microcode/kernel patches (KPTI), and some workloads accepted performance degradation of a few percent to 30%. Third, in TLS implementations, the 2013 Lucky Thirteen attack recovered plaintext from the timing difference in padding verification of CBC-mode decryption (a timing side channel), accelerating the shift to constant-time padding verification and AEAD mode (GCM).

Fourth, hardware wallets and IoT devices are also fault-injection targets. Into the 2020s, cases were disclosed in which researchers bypassed PIN verification or read protected memory on some cryptocurrency hardware wallets using voltage glitches alone, bringing fault-injection resistance of low-cost IoT/wearable security chips to the fore as a practical issue. What these cases commonly imply is that the secret leaked through nothing but the gap between implementation and physical environment, even though the cryptographic algorithm itself was not broken at all; thus one must clearly distinguish "using a FIPS/CC-certified algorithm" from "that implementation being side-channel safe" as entirely different assurances.

5. Deep Dive — Latest Trends and Standardization

A. An Expanding Attack Surface

Recent side-channel threats are expanding in two directions. The first is the deepening of microarchitectural side channels. Even after Spectre, attacks kept appearing—MDS (Microarchitectural Data Sampling), LVI (Load Value Injection), and 2022's Hertzbleed, which observes via remote timing how a CPU's dynamic frequency scaling (DVFS) changes power/frequency depending on data. This exposed the limits of software-only defense: "even with constant-time code, timing leaks out if the hardware modulates power in a data-dependent way." The second is the side-channel safety of post-quantum cryptography (PQC). Lattice-based algorithms standardized by NIST in 2024, such as ML-KEM (Kyber) and ML-DSA (Dilithium), present new side-channel surfaces in their polynomial operations and sampling, so constant-time/masking implementation rose as a key task concurrent with the standards transition.

B. Standards/Certification and Industry Application

Standards and certification frameworks address side channels head-on. The US FIPS 140-3 (based on ISO/IEC 19790) and Common Criteria (CC, ISO/IEC 15408) require non-invasive attack (power/EM/timing) resistance testing for high-grade crypto modules, and ISO/IEC 17825 specifies that testing methodology (Test Vector Leakage Assessment, TVLA). TVLA is an industry-standard evaluation method that quantitatively judges "whether there is statistically distinguishable leakage" by comparing, with a t-test, the power distribution difference between a fixed-input group and a random-input group; exceeding the threshold |t|>4.5 is deemed a leakage risk. Thus side-channel safety has now moved beyond a research topic to a mandatory pass criterion for procurement and certification.

Side channels are also a core issue in industry-specific application. In payments, EMV chips and transit cards have effectively mandated CC-based DPA-resistance certification, and in automotive, ISO 21434 (cybersecurity) and ISO 26262 (functional safety) require fault-injection/power-analysis resistance for ECUs and security gateways. In telecom, USIM/eSIM and e-passport/national-ID smart cards all undergo high-grade side-channel evaluation. In this way, "crypto devices that physically enter an attacker's hands" have made side-channel safety verification a mandatory gate before mass production regardless of field, and domestically the National Intelligence Service's crypto module validation (KCMVP) applies similar requirements.

6. Considerations and Implications

From an engineering perspective, side-channel response must be approached not as a single technique but as a multi-layered strategy spanning design, implementation, verification, and procurement. The countermeasure taxonomy below is organized by which layer suppresses the leakage; actual design overlaps several layers to match the threat model.

flowchart TD
    ROOT["Side-channel defense strategy"] --> SW["Software layer"]
    ROOT --> HW["Hardware layer"]
    ROOT --> VER["Verification/operations layer"]
    SW --> SW1["Constant-time impl.<br/>(branch/memory independent)"]
    SW --> SW2["Masking<br/>(random share split)"]
    SW --> SW3["Blinding<br/>(input randomization)"]
    HW --> HW1["Hiding<br/>(shuffle/delay/dual-rail)"]
    HW --> HW2["Shielding/tamper detection"]
    HW --> HW3["Fault detection<br/>(redundant op./verification)"]
    VER --> VER1["TVLA leakage assessment"]
    VER --> VER2["FIPS 140-3 / CC certification"]
    VER --> VER3["Spec.-exec. mitigation/isolation"]

As the taxonomy shows, software measures alone cannot block power/EM/fault attacks, and hardware measures alone cannot block remote timing/cache attacks. One must therefore combine the following items to compose a defense in depth.

  • Application strategy — combining defense in depth. Because no single countermeasure is complete, overlap constant-time implementation (timing), masking (power/EM), hiding/noise insertion (raising measurement difficulty), hardware shielding/tamper detection (physical), and speculative-execution mitigation/site isolation (microarchitecture) to match the threat model. The starting point is to first classify asset value and the attacker's expected access level (remote/near/physical ownership) and set investment priorities.
  • Trade-off — performance/cost versus safety. Masking raises computation by several-fold depending on order, constant-time implementation gives up early-exit optimization, and speculative-execution mitigation patches lower throughput. In low-power IoT and real-time systems this cost can be fatal, so selective hardening limited to the protection target (the key-handling region) rather than blanket defense is realistic.
  • Verification/procurement perspective. Self-implemented cryptography readily harbors side-channel vulnerabilities, so adopt verified constant-time libraries (e.g., libsodium, BoringSSL's constant-time paths) and CC/FIPS 140-3-certified hardware (HSM/SE) first. On adoption, specify leakage-assessment results such as TVLA and certification grade (EAL) in procurement requirements to enforce verification at the supply-chain level.
  • Outlook and related technologies. As cloud/multi-tenancy spreads, microarchitectural side channels connect directly to zero-trust/tenant-isolation design, and during the PQC transition, securing new algorithms' side-channel resistance becomes part of crypto-agility. In the long run, leakage-resilient design that suppresses leakage at the hardware-design stage, and research into circuits (dual-rail logic) that make power consumption independent of data, draw attention as fundamental solutions.

References

In one line: A side-channel attack recovers a secret key by statistically analyzing the time, power, electromagnetic emanations, and cache state that leak not from the mathematics of cryptography but from its physical implementation, so one must overlap constant-time implementation, masking, hardware tamper defense, and microarchitectural mitigation to match the threat model and verify them with FIPS 140-3/CC certification.