safemode.space
← All techniques
EXF-0002.01
ST0008Exfiltration
sub-technique

Power Analysis Attacks

Parent: EXF-0002

Description

The attacker infers secrets by measuring instantaneous power consumption of target devices, often crypto engines or controllers, and correlating traces with hypothesized internal operations. Simple power analysis (SPA) extracts structure (operation sequences, key-dependent branches); differential/correlation power analysis (DPA/CPA) uses many traces and statistics to recover key bits from tiny data-dependent variations. Practically, measurements may come from instrumented rails during I&T, from a compromised payload monitoring local supplies, or from co-located hardware that senses current/voltage fluctuations. With sufficient traces and alignment (triggering on command/crypto invocation), internal values become observable through their power signatures.

Mappings

EU regulation articles

  • craAnnex I, Part I, (2)(e)
    addresses
    high
    direct

    Power-analysis recovery of key bits defeats the confidentiality (2)(e) requires; the 'state-of-the-art mechanisms' clause directly contemplates DPA/CPA-resistant implementations.

  • craAnnex I, Part I, (2)(k)
    addresses
    high
    direct

    Masking, randomization, and power-balanced crypto cores are exactly the exploitation-mitigation mechanisms (2)(k) places on the manufacturer at design time.

  • craAnnex I, Part II, (3)
    addresses
    moderate
    direct

    Power-analysis attacks (primary mapping: Annex I, Part I, (2)(k)) require regular DPA/CPA testing under (3) — masking and randomization countermeasures lose effectiveness if not validated under realistic measurement scenarios.

  • eu-space-actArt. 85(1)
    addresses
    high
    direct

    DPA/CPA-resistant crypto implementations (masking, randomization, power-balanced cores) are part of the cryptographic concept 85(1) requires the operator to define.

  • eu-space-actArt. 85(2)
    addresses
    moderate
    direct

    Power-analysis attacks (primary: Art. 85(1)) cascade to 85(2) — key rotation cadence limits how many traces an attacker can amass against a single key.

  • nis2Art. 21(2)(h)
    addresses
    moderate
    inferred

    Art. 21(2)(h) crypto policy does not interdict power-analysis key recovery; side-channel-resistant implementation (power masking, hiding) is hardware/implementation hardening, not use-of-cryptography policy. Addresses (domain relevance).

  • nis2-implAnnex 13.2.1
    addresses
    high
    derived

    Power-analysis attacks exploit instantaneous power consumption; the protection-against-physical-and-environmental-threats obligation covers power-rail conditioning, balanced-logic design and other physical-layer controls that resist SPA/DPA.

  • nis2-implAnnex 6.2.1
    addresses
    moderate
    derived

    Secure-development implementations (masking, blinding, randomized scheduling) reduce the data-dependent leakage measurable through power analysis.

ENISA controls

  • ENISA-STL-2025-03-sD.21-i06
    addresses
    high

    Hardware-level power-consumption noise injection directly counters SPA/DPA/CPA attacks correlating power traces with internal operations.

  • ENISA-STL-2025-03-sD.23-i13
    addresses
    high

    Power masking obfuscates the relationship between internal variables and observable power-consumption side channels.

Cross-reference controls

SPARTA countermeasures

Cite as SafeMode Space, EXF-0002.01 (SPARTA v3.2).

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.