The Re-emission Side Channel

Conventional side-channel attacks which exploit the dynamic power consumption of CMOS devices to extract secret information from cryptographic devices are well established. The presence of an additional side channel utilising scattered electromagnetic emissions has previously been suggested, though a practical demonstration of the effect on cryptographic hardware has not been published. This paper presents an experimental validation of the presence of a re-emission side channel, which exploits the modulated scattering due to the illumination of an integrated circuit by an external RF carrier. Data dependent re-emission behaviour is shown on both a discrete logic inverter chain and a smartcard microcontroller. The re-emission side channel is not detectable using standard smartcard anti-tampering detectors.