Side-Channel Analysis Lab

What side-channel analysis is

While a chip runs encryption, its power use and electromagnetic field change slightly with the data it handles. With enough measurements, those changes can reveal a secret key. Side-channel analysis (SCA) testing measures this leakage so you can fix it before an attacker finds it.

What's in the lab

Hardware

• Near-field EM leakage probes, including Langer 1 mm and ICR probes with built-in pre-amplifiers
• Motorized XYZ benches for mapping a chip's EM leakage automatically
• Oscilloscopes, from entry level up to 20 GS/s with 12-bit resolution
• Pattern Detector, a 500 MHz real-time trigger
• Smart card readers and Cold Reset for secure ICs

→ Full list: eShard Lab Equipment

Software: esDynamic controls the equipment, stores the traces and runs the analysis. It can send heavy processing to GPUs or a cluster to handle millions of traces.

Attack methods covered

• Advanced SCA: higher-order combinations, horizontal analysis, collision attacks and lattice attacks on ECC, RSA and hardened symmetric algorithms
• Deep-learning SCA with PyTorch and TensorFlow, including profiled attacks on public datasets such as ASCAD
• Post-quantum: ML-KEM (Kyber), ML-DSA (Dilithium), SLH-DSA (SPHINCS+) and Falcon

Starter kits

• ML-KEM on STM32: correlation power analysis (CPA) on the NTT multiplication of a public implementation
• AES on i.MX8 (Arm Cortex-A53): key recovery against the dedicated AES instructions
• AES-256 on a Spartan-7 FPGA: EM techniques that defeat register randomization

Typical targets

Secure elements, ASICs, SoCs, FPGAs and microcontrollers.

Documentation

• Side-Channel Analysis solution brief (PDF)

Questions and answers

What is side-channel analysis?

Side-channel analysis recovers secrets such as encryption keys by measuring a chip's power consumption or electromagnetic emissions. It measures physical effects while the chip works instead of attacking the algorithm itself.

What does eShard's side-channel analysis lab include?

eShard's side-channel analysis lab includes near-field EM probes, motorized XYZ benches and oscilloscopes up to 20 GS/s. It also includes a 500 MHz pattern-detector trigger, smart card readers, the esDynamic software platform and ready-to-run attack notebooks.

Can it test post-quantum cryptography?

eShard's side-channel analysis lab supports post-quantum cryptography testing with tools and notebooks for ML-KEM, ML-DSA, SLH-DSA and Falcon. It also offers a starter kit that attacks ML-KEM on an STM32.

Does it support deep-learning side-channel attacks?

eShard's side-channel analysis lab supports deep-learning side-channel attacks with PyTorch and TensorFlow libraries. It includes profiled-attack examples on public datasets such as ASCAD.

How does eShard's SCA lab compare with ChipWhisperer?

eShard's SCA lab supports professional evaluation of modern chips, while ChipWhisperer (NewAE) is an affordable, open-source kit widely used for learning power analysis on simple targets. eShard's lab includes near-field EM probes with motorized mapping and scopes up to 20 GS/s. It also provides GPU trace processing and shared projects for multiple analysts.

Can I use my existing oscilloscope?

esDynamic, the software platform in eShard's SCA lab, can control third-party oscilloscopes and stages. It works with equipment from different vendors.

Where can I buy a side-channel analysis lab in Israel?

You can buy eShard's side-channel analysis lab from Pertech Embedded Solutions, eShard's partner in Israel. Pertech handles configuration, installation, training and support.