3
$\begingroup$

In the Book, "Endpoint Security" Page 265, It includes Electromagnetic Interference / Electromagnetic Compatibility Testing in Heading Level 1.

  1. Why is it necessary for Cryptographic Equipment to have EMI/EMC
    Testing?

  2. What equipment is used to carry out such testing?

$\endgroup$
  • 3
    $\begingroup$ I suppose that emitted electromagnetic fields can be used in a side attack; is that what this is about? $\endgroup$ – Ruben De Smet Jan 14 '18 at 21:00
  • $\begingroup$ you mean side channel attacks? $\endgroup$ – khan Jan 15 '18 at 5:34
  • $\begingroup$ Yes. Woah. Forgot a word there. $\endgroup$ – Ruben De Smet Jan 15 '18 at 12:34
3
$\begingroup$

It’s my understanding that the information gained from a side channel attack would typically be isolated to the particular cryptographic algorithm’s structure, and physical hardware implementation. Provided the context of the article completing EMI/EMC testing would generally be a requirement of governing bodies like the Federal Communication Commission, which have jurisdiction even if the hardware is not running cryptographic systems.

So in the interest of security and responsibility it would be necessary to complete this testing to ensure that the particular cryptographic software/hardware is resistant to side channel attacks, while simultaneously maintaining compliance with regard to preventing the emission/receiving of harmful EM interference. Personally completing side channel testing adds nothing to security except to gain insight on the capabilities of a potential attacker on a particular system, because even if the system being tested is resistant to side channel attacks the tester will gain zero insight into undocumented modes of operation.

$\endgroup$
2
$\begingroup$

In the case mentioned, that is just the specification that we use to say that a circuit must accept electronic interference and that it does not fail. Usually FCC specifications (in the USA) say that you must accept interference even if it causes undesirable behaviors in your hardware.

In order to tell if something "failed", we usually have a checksum scheme. In hardware, we are good a passing the logic and the complimented logic. I generally put these into an XOR gate and if all of the bits are a "1" in the XOR result tree, I know that things went well. This will let you know if you need to re-run something. I'm sure that in the case in the book, it has nothing to do with attacking the cipher.

To look at the EMI outputs, we just use a network analyzer that can operate at the frequency range of the clock in the system. If you want to attack the cipher, you use the same type of equipment; however, it's a lot easier with clock control. With clock control and access to a power bus, you can extract a lot of information.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.