contributed articles DOI:10.1145/2851486 needs to never output it or anything that Computers broadcast their secrets via may reveal it. (The operating system may be misused to allow someone else’s inadvertent physical emanations that process to peek into the program’s are easily measured and exploited. memory or files, though we are getting better at avoiding such attacks, too.) BY DANIEL GENKIN, LEV PACHMANOV, ITAMAR PIPMAN, Yet programs’ control over their ADI SHAMIR, AND ERAN TROMER own outputs is a convenient fiction, for a deeper reason. The hardware run- ning the program is a physical object and, as such, interacts with its envi- ronment in complex ways, including Physical electric currents, electromagnetic fields, sound, vibrations, and light emissions. All these “side channels” may depend on the computation per- Key Extraction formed, along with the secrets within it. “Side-channel attacks,” which ex- ploit such information leakage, have been used to break the security of nu- merous cryptographic implementa- Attacks on PCs tions; see Anderson,2 Kocher et al.,19 and Mangard et al.23 and references therein. Side channels on small devices. Many past works addressed leakage from small devices (such as smart- cards, RFID tags, FPGAs, and simple embedded devices); for such devices, CRYPTOGRAPHY IS UBIQUITOUS. Secure websites and physical key extraction attacks have financial, personal communication, corporate, and been demonstrated with devastating effectiveness and across multiple phys- national secrets all depend on cryptographic algorithms ical channels. For example, a device’s operating correctly. Builders of cryptographic systems power consumption is often correlated with the computation it is currently ex- have learned (often the hard way) to devise algorithms ecuting. Over the past two decades, this and protocols with sound theoretical analysis, physical phenomenon has been used write software that implements them correctly, extensively for key extraction from small devices,19,23 often using power- and robustly integrate them with the surrounding ful techniques, including differential applications. Consequentially, direct attacks against power analysis.18 state-of-the-art cryptographic software are getting key insights increasingly difficult. ˽ Small differences in a program’s data For attackers, ramming the gates of cryptography is can cause large differences in acoustic, electric, and electromagnetic emanations not the only option. They can instead undermine the as the program runs. fortification by violating basic assumptions made by ˽ These emanations can be measured through inexpensive equipment and used the cryptographic software. One such assumption is to extract secret data, even from fast and software can control its outputs. Our programming complex devices like laptop computers and mobile phones. courses explain that programs produce their outputs ˽ Common hardware and software are through designated interfaces (whether print, write, vulnerable, and practical mitigation of these risks requires careful application- send, or mmap); so, to keep a secret, the software just specific engineering and evaluation. 70 COMMUNICATIONS OF THE ACM | JUNE 2016 | VOL. 59 | NO. 6 The electromagnetic emanations emanations from transistors, as they transistors, on a motherboard with other from a device are likewise affected by the switch state, are exploitable as a side circuitry and peripherals, running an computation-correlated currents inside channel for reading internal registers operating system and handling various it. Starting with Agrawal et al.,1 Gandolfi leading and extracting keys.29 asynchronous events. All these intro- et al.,11 and Quisquater and Samyde,28 See Anderson2 for an extensive sur- duce complexity, unpredictability, and such attacks have been demonstrated vey of such attacks. noise into the physical emanations as on numerous small devices involving Vulnerability of PCs. Little was the cryptographic code executes. various cryptographic implementations. known, however, about the possibility Second is speed. Typical side-chan- Optical and thermal imaging of cir- of cryptographic attacks through physi- nel techniques require the analog leak- cuits provides layout information and cal side channels on modern commod- age signal be acquired at a bandwidth coarse activity maps that are useful for ity laptop, desktop, and server com- greater than the target’s clock rate. reverse engineering. Miniature probes puters. Such “PC-class” computers (or For PCs running GHz-scale CPUs, this can be used to access individual inter- “PCs,” as we call them here) are indeed means recording analog signals at nal wires in a chip, though such tech- very different from the aforementioned multi-GHz bandwidths requiring ex- niques require invasive disassembly small devices, for several reasons. pensive and delicate lab equipment, in of the chip package, as well as con- First, a PC is a very complex environ- addition to a lot of storage space and IMAGE BY IWONA USAKIEWICZ/ANDRIJ BORYS ASSOCIATES BORYS USAKIEWICZ/ANDRIJ IWONA BY IMAGE siderable technical expertise. Optical ment—a CPU with perhaps one billion processing power. JUNE 2016 | VOL. 59 | NO. 6 | COMMUNICATIONS OF THE ACM 71 contributed articles Figure 1. An acoustic attack using a parabolic microphone (left) on a target laptop (right); various trade-offs among attack range, keys can be extracted from a distance of 10 meters. speed, and equipment cost. The follow- ing sections explore our findings, as pub- lished in several recent articles.12,15,16 Acoustic. The power consumption of a CPU and related chips changes dras- tically (by many Watts) depending on the computation being performed at each moment. Electronic compo- nents in a PC’s internal power supply, struggling to provide constant voltage to the chips, are subject to mechani- cal forces due to fluctuations of volt- ages and currents. The resulting vi- brations, as transmitted to the ambient air, create high-pitched acoustic noise, known as “coil whine,” even though it of- ten originates from capacitors. Because this noise is correlated with the ongo- Figure 2. Measuring the chassis potential by touching a conductive part of the laptop; ing computation, it leaks information the wristband is connected to signal-acquisition equipment. about what applications are running and what data they process. Most dramati- cally, it can acoustically leak secret keys during cryptographic operations. By recording such noise while a target is using the RSA algorithm to decrypt ciphertexts (sent to it by the attacker), the RSA secret key can be ex- tracted within one hour for a high-grade 4,096-bit RSA key. We experimentally demonstrated this attack from as far as 10 meters away using a parabolic micro- phone (see Figure 1) or from 30cm away through a plain mobile phone placed next to the computer. Electric. While PCs are typically grounded to the mains earth (through their power supply “brick,” or ground- ed peripherals), these connections are, in practice, not ideal, so the elec- tric potential of the laptop’s chassis A third difference involves attack many other effects can be used to fluctuates. These fluctuations depend scenarios. Traditional techniques for glean sensitive information across the on internal currents, and thus on the side-channel attacks require long, un- boundaries between processes or even ongoing computation. An attacker interrupted physical access to the target virtual machines. Here, we focus on can measure the fluctuations directly device. Moreover, some such attacks physical attacks that do not require de- through a plain wire connected to a involve destructive mechanical intru- ployment of malicious software on the conductive part of the laptop, or in- sion into the device (such as decapsu- target PC. directly through any cable with a con- lating chips). For small devices, these Our research thus focuses on two ductive shield attached to an I/O port scenarios make sense; such devices main questions: Can physical side- on the laptop (such as USB, Ethernet, are often easily stolen and sometimes channel attacks be used to nonintru- display, or audio). Perhaps most sur- even handed out to the attacker (such sively extract secret keys from PCs, prising, the chassis potential can be as in the form of cable TV subscription despite their complexity and operating measured, with sufficient fidelity, cards). However, when attacking other speed? And what is the cost of such at- even through a human body; human people’s PCs, the attacker’s physical tacks in time, equipment, expertise, attackers need to touch only the tar- access is often brief, constrained, and and physical access? get computer with a bare hand while must proceed unobserved. Results. We have identified multiple their body potential is measured (see Note numerous side channels in side channels for mounting physical Figure 2). PCs are known at the software level; key-extraction attacks on PCs, appli- This channel offers a higher band- timing,8 cache contention,6,26,27 and cable in various scenarios and offering width than the acoustic one, allowing 72 COMMUNICATIONS OF THE ACM | JUNE 2016 | VOL. 59 | NO. 6 contributed articles observation of the effect of individual TEMPEST. Most of this work remains prone to side-channel leakage due to key bits on the computation. RSA and classified. What little is declassified their physical nature and lower operat- ElGamal keys can thus be extracted confirms the existence and risk of ing speed; for example, acoustic noise from a signal obtained from just a few physical information leakage but says from keyboards can reveal keystrokes,3 seconds of measurement, by touching nothing about the feasibility of the key printer-noise printed content,4 and sta- a conductive part of the laptop’s chas- extraction scenarios discussed in this tus LEDs data on a communication sis, or by measuring the chassis po- article. Acoustic leakage, in particular, line.22 Computer screens inadvertently tential from the far side of a 10-meter- has been used against electromechan- broadcast their content as “van Eck” long cable connected to the target’s ical ciphers (Wright31 recounts how electromagnetic radiation that can be I/O port.