NL 2023 | Understanding Physics To Break AES With Side-channel Hardware -Stephan & Roman

### Overview In this presentation, embedded systems/electronics designer Matthew and security researcher Roman examine side-channel hardware setups from an electronic design perspective. Originating from Matthew's critique of Roman's test setup while repeating a side-channel attack on a Jade crypto wallet, the talk bridges physical electronics engineering with cryptographic side-channel analysis. The speakers demonstrate how wiring, decoupling capacitors, probe noise, and power supplies directly impact correlation power analysis (CPA) on hardware AES implementations, targeting an ESP32 microcontroller with a built-in cryptographic engine.

### Key Topics - **Impact of Wires and Inductance**: Evaluating how wire length and loop area introduce parasitic inductance, which attenuates high-frequency current content and degrades correlation quality. - **Decoupling Capacitors**: Investigating the common practice of removing decoupling capacitors to prevent high-frequency operational currents from bypassing external current-measurement instrumentation. - **Target Clock vs. Leakage Bandwidth**: Analyzing filtering cutoffs to discover the optimal frequency band for recovering AES keys, contrasting system clock speed with cryptographic leakage frequencies. - **Measurement Hardware and Ground Loops**: Comparing measurement instruments (differential probes, current probes, LISNs, shunt resistors) and solving ground loops and oscilloscope input noise. - **Low-Cost Custom Hardware Solutions**: Designing accessible, budget-friendly low-side and inline side-channel acquisition hardware.

### Technical Details - **Wiring and Parasitic Inductance**: Testing signal transmission from 1 MHz to 500 MHz confirmed that larger wiring loops increase inductance and introduce up to 10 dB of high-frequency attenuation. In time-domain AES measurements on the ESP32, connecting the target directly via solder joints preserved high-frequency spikes and allowed key recovery at 50,000 traces. Introducing just 2 cm wires significantly damped these transients and forced the Pearson correlation to require far more traces for successful key recovery. - **Decoupling Capacitors**: Because decoupling capacitors sit near the microcontroller to supply transient switching currents locally, leaving them populated shunts the high frequencies away from the power supply sensing path. While slow operations like ciphertext transfers remained detectable with capacitors present, the actual AES key could not be recovered within 300,000 traces without removing them. However, removing decoupling capacitors means long supply wires can cause severe voltage dips, potentially causing target reboots. - **Bandwidth and Filtering**: Even though the ESP32 CPU runs at 160 MHz, low-pass filtering experiments revealed that the highest Pearson correlation coefficient and clearest key separation occurred when low-pass filtering from DC to 95 MHz. Adding content between 95 MHz and 100 MHz degraded correlation, proving that high-cost gigahertz measurement equipment is unnecessary. - **Noise Optimization and Instrumentation**: Environmental noise, power supply ripple, and probe self-noise hinder trace quality. Standard bench power supplies performed poorly compared to clean battery setups or power supplies conditioned with low-dropout (LDO) regulators. Current probes (limited to ~100 MHz and introducing ~75 µA RMS noise) and differential probes (flat response dominated by ~28 µA RMS noise) performed worse in correlation attacks than custom pre-amplified boards. - **Custom Acquisition Hardware**: To eliminate ground loops and drown out the oscilloscope's internal noise floor without requiring averaging across acquisitions, Matthew developed two low-cost hardware platforms: 1. *Low-side board ($125)*: Integrates target power delivery, an on-board shunt resistor, and a two-stage op-amp amplifier with potentiometers for variable gain, achieving up to 1 GHz bandwidth. 2. *Inline/high-side board ($25)*: Designed to connect in-line across power traces using a balun transformer to isolate DC from high-frequency components, paired with RF amplifiers, avoiding ground loops. - **EM Side-Channel Applicability**: Addressing an audience question, Matthew explained that removing decoupling capacitors also benefits electromagnetic (EM) side-channel attacks by enlarging the high-frequency current loop path, effectively turning it into a larger loop antenna that radiates stronger EM signals.

### Takeaways To achieve fast, reliable, and low-cost side-channel key recovery, practitioners should eliminate jumper wires by soldering directly, desolder local decoupling capacitors, power targets via batteries or LDO-filtered supplies, and amplify signals prior to the oscilloscope. Hardware AES on chips like the ESP32 can be broken efficiently using inexpensive secondhand oscilloscopes and custom front-end boards without spending thousands of dollars on high-end differential probes.