Home / Attacks & tests / Side-Channel Attacks Testing for Mobile and Embedded Applications
2 test cases
Side-Channel Attacks Testing for Mobile and Embedded Applications
Side channel testing examines what the device reveals through the physical characteristics of its operation rather than through its interfaces. A correct implementation can still disclose the key it is using, through how long it takes or how much power it draws while using it.
What an attacker is trying to achieve
The attacker wants key material without breaking the algorithm. Where a device is physically accessible and performs a cryptographic operation repeatedly, the measurements taken across many operations can recover the key the algorithm itself protects.
Test cases
2 test cases in this category. Each states what the test proves, how it is carried out, what has to be in place beforehand, what a positive result looks like, and whether the work is manual, automated or a mixture.
IOT-SIDE-01 Power Analysis
Objective — Determine whether the device's power consumption during a cryptographic operation correlates with the key material being used.
How it is tested — Instrument the device's power supply to measure consumption at sufficient resolution, and trigger the target operation repeatedly with controlled input. Examine individual traces for structure that reveals the sequence of operations. Where that is insufficient, collect a large trace set and apply statistical analysis correlating consumption against hypothesised key values. Establish whether the implementation applies any masking or randomisation.
Prerequisites — A device that may be modified to insert a measurement shunt; an oscilloscope or capture board; the ability to trigger the operation many thousands of times.
Indicators — Operation sequence visible in a single trace; consumption correlating with hypothesised key values; no masking or randomisation; key material recovered from the trace set.
Coverage — CWE-1300CWE-1255
Depth — Manual Specialised equipment and large sample counts; this is deliberate laboratory work rather than part of a routine assessment.
IOT-SIDE-02 Timing Analysis
Objective — Determine whether the time the device takes to perform an operation depends on secret data, allowing that data to be inferred from measurement.
How it is tested — Identify operations that handle secrets — credential comparison, signature verification, decryption, PIN checking — and measure their duration across many repetitions with systematically varied input. Establish whether duration correlates with how much of the input is correct, which permits recovery one element at a time. Measure at the device rather than across the network where possible, since network variance obscures small differences.
Prerequisites — A device on an isolated segment or, better, direct measurement at the device; the ability to repeat the operation many times; controlled input.
Indicators — Duration varying with the correctness of input; a comparison that returns early on first mismatch; secret recovered element by element; no constant-time implementation where one is warranted.
Coverage — CWE-208CWE-1254
Depth — Hybrid Measurement and statistics automate once set up; deciding which operations are worth measuring, and eliminating variance, does not.
What we need from you
Physical access to a device that may be modified; measurement equipment appropriate to the channel; the ability to trigger the target operation many times with controlled input; and enough engagement time, since these tests require large sample counts.
Standards this category maps to
Every identifier below is quoted from the published control list it belongs to. Where a test has no defensible mapping, none is given rather than an approximate one.
- CWE-1300 — Improper Protection of Physical Side Channels
- CWE-1255 — Comparison Logic is Vulnerable to Power Side-Channel Attacks
- CWE-208 — Observable Timing Discrepancy
- CWE-1254 — Incorrect Comparison Logic Granularity
Tell us what the system does and what worries you.
If a penetration test is not what you need yet, we will say so.