An Adaptive Acquisition Approach to Localize Electromagnetic Information Leakage from Cryptographic Modules

An adaptive acquisition protocol is presented to rapidly identify optimal near-field measurement configurations for performing electromagnetic side-channel analysis attacks on physical implementations of cryptographic modules. Because measured fields vary with probe parameters as well as the data being encrypted, identifying the optimal configurations requires searching among a large number of possible configurations. The proposed protocol is a multi-step acquisition that corresponds to a greedy search in a 4-D configuration space consisting of probe coordinates, orientation, and number of signals acquired. To demonstrate its feasibility, the protocol is tested by identifying the best attack configuration for a probe just above an 18mm × 18mm FPGA realization of the advanced encryption standard (AES), subject to the precision of the equipment. It is found that the protocol requires ~35× less acquisition time compared to an exhaustive search for the optimal configuration.