Sidoskanalattacker

Sidoskanalattacker is a term used in cybersecurity to describe an attacker who exploits side-channel information to compromise the security of a system. The term blends Finnish “sidoskanava” (side channel) with “attacker.” A sidoskanalattacker typically aims to recover secret data such as cryptographic keys, passwords, or authentication tokens by observing leakage during normal operation.

Side-channel leakage can occur through various observable quantities, including processing time, power consumption, electromagnetic emissions, acoustic signals, or memory access patterns. The attacker collects measurements, often multiple samples, and applies statistical or machine learning methods to infer secrets. Attacks may target embedded devices like smart cards, IoT modules, or mobile processors, but can also affect servers and desktop systems with vulnerable hardware.

Common techniques include simple power analysis (SPA), differential power analysis (DPA), timing attacks, electromagnetic analysis (EMA), and cache or memory-based side-channel attacks. More recently, microarchitectural side channels resulting from speculative execution or related effects have been described. The effectiveness depends on the quality of leakage, the device’s sensitivity, and the attacker’s proximity and resources.

Mitigations include constant-time programming, masking or blinding techniques, randomization of operation timing, noise generation, shielding, tamper-evident hardware, and architectural protections like secure enclaves and side-channel resistant cryptographic implementations.

Research into side-channel attacks is conducted under controlled conditions with appropriate authorization. Unauthorized exploitation of side channels is illegal in many jurisdictions.