The Chip Tells You the Key If You Know How to Listen.

A correct cryptographic implementation computes the right output and reveals nothing about the key — in theory. In practice it runs on physical hardware, and that hardware cannot compute without drawing current, taking time, and radiating a field. Each of those is a function of what the chip is doing, and what the chip is doing depends on the key. The secret you were so careful never to transmit is being broadcast anyway, through channels your threat model most likely never named.

Side-channel analysis is the discipline of reading those channels, and it is deeply counterintuitive to anyone who reasons about software as logic. It does not attack the algorithm — the mathematics can be flawless and the key still walks out through the power pins. The leak is not in the logic at all. It is in the physics the logic runs on, the layer the datasheet treats as an implementation detail beneath notice, and that is exactly the layer a side-channel attacker treats as the main event.

The secret leaks through the physics

Every operation a processor performs has a physical cost that varies with the data it operates on. Flipping a bit from zero to one draws a slightly different amount of current than leaving it unchanged. A multiply costs a different amount of energy than an add. A branch taken executes different code than a branch not taken. Taken individually these differences are vanishingly small; taken together, and correlated against the data, they amount to a readout of what the device is doing internally.

The insight that makes this an attack rather than a curiosity is that the leakage is data-dependent, and the data includes the key. If the current the chip draws at a particular instant depends on a key bit, then measuring that current measures the key bit — not directly, not cleanly, but statistically. And statistics are patient: a signal far too faint to see in one measurement becomes unmistakable once you average enough of them. The attacker does not need a clean leak. They need a consistent one.

Timing, the cheapest channel

The cheapest side channel needs no probe at all, only a clock: how long an operation takes. If a comparison bails out early on the first mismatched byte, then a guess that matches more leading bytes takes measurably longer, and an attacker refines their guess by watching the clock. If a modular exponentiation does extra work for one-bits and not for zero-bits, the total time leaks the exponent's weight. The timing becomes an oracle that answers questions about the secret without ever being asked directly.

Timing leaks hide in the most ordinary-looking code: an early-return comparison on a message authentication code, a table lookup whose cache behaviour depends on a secret index, a branch whose direction depends on a key bit. The defence is constant-time coding — no secret-dependent branches, no secret-dependent memory access patterns, no early exits — and it is harder than it sounds, because the compiler and the processor are both working to make your code faster precisely by making it data-dependent. Writing constant-time code means fighting optimisations that are, in every other context, exactly what you want.

Power analysis, SPA and DPA

When the attacker can measure the device's power consumption — a small resistor in the ground line and an oscilloscope — the channel becomes far richer than timing alone. Simple power analysis, SPA, reads the key from a single trace or a handful, essentially by eye: the shape of the power curve reveals the sequence of operations the device performed, and if that sequence depends on key bits, the key is legible directly in the waveform. A conditional step that only happens for a one-bit shows up as a visible bump, and the pattern of bumps spells out the secret.

Differential power analysis, DPA, is stronger and needs no visible pattern at all. It gathers many traces over many inputs and uses statistics to correlate tiny, consistent power differences with hypotheses about individual key bits. The key-dependent signal can sit far below the noise floor and still be recovered, because averaging across enough traces pulls a correlated signal out of the random fluctuation surrounding it. Correlation power analysis sharpens this further by matching the measured power against a model of how consumption should vary with each candidate key value. The lesson is blunt: a secret is not safe merely because its leakage is invisible to the eye, because DPA sees precisely what SPA cannot.

Cryptography assumes the attacker sees only inputs and outputs. A device on a bench offers two more: how long it took, and how much power it drew. The key is present in both, and no amount of algorithmic strength removes it from them.

EM and the no-contact attacker

Electromagnetic analysis is power analysis without the wires. The switching currents inside a chip produce a magnetic field, and a small probe held just above the package picks that field up — no modification to the board, frequently no electrical contact at all. Everything DPA accomplishes with a current measurement, EM analysis can accomplish with a field measurement, and it gains a spatial advantage in the process: a probe positioned over one region of the die can isolate the emanations of a single block, improving the signal compared with a measurement that sums the whole chip's activity together.

The practical consequence is that "we do not expose the power rail" is not a defence. The field leaks straight through the package, and an attacker with physical proximity and an inexpensive probe has a channel you did not design away by routing the power cleanly or by hiding the test points. Physical access, not electrical access, is the thing that matters, and physical access is exactly what the open market grants anyone willing to buy a unit.

Constant-time is necessary, not sufficient

Constant-time coding is essential, and it is also widely mistaken for the finish line. It closes the timing channel — provided it genuinely holds all the way through the compiler and the microarchitecture, which is something to verify rather than assume. But a flawlessly constant-time implementation can still leak through power and EM, because those channels do not care how long you took. They care what you did, bit by bit, and a constant-time routine still flips key-dependent bits that draw key-dependent current at key-dependent moments.

So constant-time is a necessary first move against one specific channel, not a general solution to side channels. Treating it as the whole answer is a common and costly error: the timing channel is closed, an audit ticks the box marked side-channel, and the device goes on leaking its key through the power pins exactly as it did before. The channels are independent, and closing one says nothing about the others.

Masking and hiding

Where the threat model demands real resistance, two families of countermeasure do the work, and serious implementations use them together because each raises the attacker's cost in a different dimension.

• Masking splits the secret — the key is combined with fresh random values and processed as shares, so the power drawn at any single instant correlates with random data rather than with the key, forcing an attacker to combine leakage from several points at once, which is dramatically harder than attacking one.
• Hiding flattens the signal — added noise, randomised execution order, dummy operations, and timing jitter weaken the correlation between any one trace and the secret, so that recovering the same information demands far more traces than it otherwise would.
• The two compose — masking reduces how much the signal depends on the key in the first place, while hiding buries whatever remains under noise; applied together they attack the analysis from both ends.
• Neither is free, and neither is absolute — both cost performance, silicon area, and a supply of good randomness, and a determined attacker with enough traces can still make progress; the honest goal is to push the cost of extraction past the value of the secret, not to claim immunity.

When side-channel resistance actually matters

Not every product needs any of this, and spending masking and hiding on a device no attacker can reach is wasted engineering. Side-channel resistance earns its cost when the threat model includes an adversary with physical access to the device and the ability to take many measurements of it: a payment card, a hardware wallet, a metering or access-control token, any unit sold on the open market whose internal key protects something a buyer would like to clone or forge. These are devices that live in hostile hands by design.

The deciding questions are concrete. Can an attacker obtain the device? Can they take repeated measurements of its power or its field? Is there a key inside whose extraction would actually pay? Where the answers are yes, side-channel resistance is not a luxury — it is the difference between a key that stays secret and one recovered on a bench over a weekend. Where the answers are no, the right and sufficient discipline is constant-time coding and nothing heavier. When 6QURE evaluates a cryptographic device, we begin from that threat model and then ask the physical question the datasheet omits: not "is the algorithm sound" but "what does the device leak while it runs, and who is positioned to listen." The algorithm is almost never where the key escapes. It escapes through the current, the clock, and the field — and whether that matters is a decision to make deliberately, before the product is in the hands of someone holding a probe.