Attacking at non-harmonic frequencies in screaming-channel attacks - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2023

Attacking at non-harmonic frequencies in screaming-channel attacks


Screaming-channel attacks enable Electromagnetic (EM) Side-Channel Attacks (SCAs) at larger distances due to higher EM leakage energies than traditional SCAs, relaxing the requirement of close access to the victim. This attack can be mounted on devices integrating Radio Frequency (RF) modules on the same die as digital circuits, where the RF can unintentionally capture, modulate, amplify, and transmit the leakage along with legitimate signals. Leakage results from digital switching activity, so the hypothesis of previous works was that this leakage would appear at multiples of the digital clock frequency, i.e., harmonics. This work demonstrates that compromising signals appear not only at the harmonics and that leakage at non-harmonics can be exploited for successful attacks. Indeed, the transformations undergone by the leaked signal are complex due to propagation effects through the substrate and power and ground planes, so the leakage also appears at other frequencies. We first propose two methodologies to locate frequencies that contain leakage and demonstrate that it appears at non-harmonic frequencies. Then, our experimental results show that screaming-channel attacks at non-harmonic frequencies can be as successful as at harmonics when retrieving a 16-byte AES key. As the RF spectrum is polluted by interfering signals, we run experiments and show successful attacks in a more realistic, noisy environment where harmonic frequencies are contaminated by multi-path fading and interference. These attacks at non-harmonic frequencies increase the attack surface by providing attackers with an increased number of potential frequencies where attacks can succeed.
Embargoed file
Embargoed file
0 2 23
Year Month Jours
Avant la publication
Monday, May 27, 2024
Embargoed file
Monday, May 27, 2024
Please log in to request access to the document

Dates and versions

hal-04309083 , version 1 (27-11-2023)
hal-04309083 , version 2 (30-11-2023)


Attribution - NonCommercial - NoDerivatives


  • HAL Id : hal-04309083 , version 2


Jeremy Guillaume, Maxime Pelcat, Amor Nafkha, Ruben Salvador. Attacking at non-harmonic frequencies in screaming-channel attacks. 22nd Smart Card Research and Advanced Application Conference (CARDIS 2023), Nov 2023, Amsterdam, Netherlands. pp.1--20. ⟨hal-04309083v2⟩
89 View
31 Download


Gmail Facebook X LinkedIn More