Simple Electromagnetic Analysis vs symmetric cryptography

Question

I've asked this question here and was advised to post this question on this forum in hopes of an answer.

I'm currently taking a security class and i came into this issue when writing a report about side channel attacks. When reading about electromagnetic attacks, more specifically about Simple Electromagnetic Analysis in Wikipedia (https://en.wikipedia.org/wiki/Electromagnetic_attack), it states:

It is very effective against asymmetric cryptography implementations...

I understand why it is effective agaisnt an algorithm such as RSA, which is asymmetric, but doesn't the reason for its effectiveness resides on the way the algorithm is implemented and not if its symmetric or asymmetric cryptography?

For example, a common attack on asymmetric RSA relies on the fact that the encryption steps rely on the value of the key bits. Every bit is processed with a square operation and then a multiplication operation if and only if the bit is equal to 1. An attacker with a clear trace can deduce the key simply by observing where the multiplication operations are performed.

So i don't really understand why it says its effective against asymmetric cryptography.

Thanks for your attention!

Answer 1

SEMA is effective against a naive implementation (e.g. using binary square and multiply) of raising to a secret value in some group. Raising to a secret value in some group is used in common asymmetric cryptography techniques, including based on hardness of integer factorization (RSA) or the discrete logarithm (DSA, ECDSA..). That's why SEMA happens to be effective against naive implementations of common asymmetric cryptography.

It would be wrong to say that only asymmetric algorithms are vulnerable to SEMA. For example, the Pohlig-Hellman exponentiation cipher is a symmetric encryption algorithm where encryption goes $x\mapsto x^k\bmod p$ for public prime $p$ with $(p-1)/2$ prime, and $k$ a secret exponent. A naive implementation would be vulnerable to SEMA just like a naive implementation of RSA is. And it is all too frequent that a very naive implementation of DES is vulnerable to SPA/SEMA.

It would also be wrong to say that all asymmetric algorithms are vulnerable to SEMA. Careful implementation of raising to a secret value can be made secure (using the Montgomery ladder or other techniques, including blinding). And some asymmetric algorithms (e.g. Lamport signature) do not raise to a secret value, and can be made immune to SEMA with careful coding and control of the underlying hardware.