Fundamental Study on Simple Power Analysis Using Backscattering from Switching Regulators

Even cryptographic modules once deemed immune to electromagnetic analysis (EMA) attacks through passive measurements have been reported as potentially vulnerable to EMA through active measurements. These measurements exploit backscattering induced by intentional electromagnetic interference (IEMI). In this paper, we conduct a fundamental investigation into the feasibility of EMA through active measurement. It focuses on the behaviour of the output circuit of a switching regulator (SWR) integrated circuit (IC) with the sensitivity of active measurement in the MHz band, where attenuation effects are notably minimal. We discovered that it is possible to restore the output status of the SWRIC through backscattering in the MHz band. Furthermore, we demonstrate successful attacks, achieving an accuracy of 4.3% in correctly estimating the secret keys of 1024-bit RSA encryption, employing simple power analysis (SPA) based on their outputs.