Far correlation-based EMA with a precharacterized leakage model

Electromagnetic analysis is an important class of attacks against cryptographic devices. In this article, we prove that Correlation-based on ElectroMagnetic Analysis (CEMA) on a hardware-based high-performance AES module is possible from a distance as far as 50 cm. First we show that the signal-to-noise ratio (SNR) tends to a non-zero limit when moving the antenna away from the cryptographic device. An analysis of the leakage structure shows that the Hamming distance model, although suitable for small distances gets more and more distorted when the antenna is displaced far from the device. As we cannot devise any physical model that would predict the observations, we instead pre-characterized it using a first order templates construction. With this model, we enhanced the CEMA by a factor up to ten. Therefore, we conclude that EMA at large distance is feasible with our amplification strategy coupled to an innovative training phase aiming at precharacterizing accurate coefficients of a parametric weighted distance leakage model.