Electromagnetic Leakage Attacks

Description

Switching activity in chips, buses, and clocks radiates EM energy that can be captured and analyzed to reveal internal computation. Near-field probes (in test) or proximity receivers (on-orbit assets) can observe harmonics and modulation tied to cipher rounds, key schedules, or protocol framing, sometimes with finer granularity than power analysis. Coupling paths include packages, harnesses, SDR front ends, and poorly shielded enclosures. By training on known operations and comparing spectra or time-domain signatures, an adversary can recover keys or reconstruct processed data without touching logical interfaces.

Mappings

EU regulation articles

craAnnex I, Part I, (2)(e)
addresses
high
direct
EM emanations leaking key schedules and protocol framing defeat (2)(e)'s confidentiality property; state-of-the-art mechanisms include shielding, decorrelation, and constant-power design.
craAnnex I, Part I, (2)(k)
addresses
high
direct
EM-leakage countermeasures (TEMPEST-grade shielding, harness routing, package selection) are the manufacturer-side exploitation-mitigation mechanisms (2)(k) requires.
craAnnex I, Part II, (3)
addresses
moderate
direct
Electromagnetic-leakage attacks (primary mapping: Annex I, Part I, (2)(k)) cascade to (3) — TEMPEST shielding requires regular validation by near-field probe testing in the security review.
eu-space-actArt. 85(1)
addresses
moderate
direct
EM-leakage countermeasures (TEMPEST shielding, harness routing, decorrelation) are part of the cryptographic concept 85(1) places on the operator.
eu-space-actArt. 85(2)
addresses
moderate
direct
EM-leakage attacks (primary: Art. 85(1)) cascade to 85(2) — key rotation limits exposure window.
nis2Art. 21(2)(h)
addresses
moderate
inferred
Art. 21(2)(h) crypto policy does not interdict EM-emanation key recovery; the operative mitigation is TEMPEST shielding and emission control, not use-of-cryptography policy. Addresses (domain relevance).
nis2-implAnnex 13.2.1
addresses
high
derived
Electromagnetic leakage is exactly the unintentional emission class the protection-against-physical-and-environmental-threats obligation is established to govern; chassis shielding, harness routing and TEMPEST-style controls reduce EM-channel leakage.

ENISA controls

ENISA-STL-2025-03-sD.21-i06
mitigates
moderate
Hardware power-system design with switching-noise obfuscation reduces EM emissions correlated with cipher-round activity.
ENISA-STL-2025-03-sD.22-i02
addresses
moderate
Tamper protection is a physical-hardware-protection control relevant to the hardware EXF-0002.02 targets, but the shipping and receiving tamper-proofing and inspection excerpt does not actively counter operational electromagnetic-leakage observation, which needs shielding or masking.
ENISA-STL-2025-03-sD.23-i13
addresses
high
Power masking is the named control against EM-leakage-based partial-key recovery — the EXF-0002.02 vector.

Cross-reference controls

d3fendD3-RFS RF Shielding
addresses
moderate
The technique is the capture of unintentional EM emissions from chips, buses, and clocks by near-field probes or proximity receivers. A conductive barrier around the platform attenuates that radiated energy and is the textbook interdiction (the TEMPEST control class). Confidence is moderate rather than high for an excerpt reason a reviewer should weigh: D3FEND frames RF shielding as preventing interference reaching the platform, which is the inbound direction, whereas this technique is outbound emanation. The barrier is physically the same and attenuates both ways, but the cited text does not say so, so a reviewer preferring the excerpt's literal scope should downgrade this to addresses. [Curation] The proposal flagged this itself and the flag is upheld. D3FEND's excerpt describes RF shielding as preventing undesired interference REACHING the platform, which is the inbound direction, while EXF-0002.02 is the capture of emissions LEAVING it. The physical barrier is the same and attenuates both ways, but the corpus standard is what the excerpt supports, not what the mechanism could do, so the claim is recorded at addresses. Shielding remains the right control family; only the strength of the assertion changes.
nist-80053-rev5AC-4 Information Flow Enforcement
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5AC-4(23)Modify Non-releasable Information
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5AC-4(24)Internal Normalized Format
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5AC-4(26)Audit Filtering Actions
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5AC-4(31)Failed Content Transfer Prevention
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5AC-4(32)Process Requirements for Information Transfer
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5PE-19 Information Leakage
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5PE-19(1)National Emissions Policies and Procedures
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5PE-21 Electromagnetic Pulse Protection
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5PL-8 Security and Privacy Architectures
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5PL-8(1)Defense in Depth
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SA-3 System Development Life Cycle
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SA-8 Security and Privacy Engineering Principles
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SA-8(18)Trusted Communications Channels
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SA-8(19)Continuous Protection
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SA-8(9)Trusted Components
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SA-9(6)Organization-controlled Cryptographic Keys
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-13 Cryptographic Protection
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-16 Transmission of Security and Privacy Attributes
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-16(1)Integrity Verification
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-16(2)Anti-spoofing Mechanisms
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-16(3)Cryptographic Binding
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-8(1)Cryptographic Protection
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SC-8(3)Cryptographic Protection for Message Externals
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SI-19(4)Removal, Masking, Encryption, Hashing, or Replacement of Direct Identifiers
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SI-4(10)Visibility of Encrypted Communications
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
nist-80053-rev5SI-4(25)Optimize Network Traffic Analysis
relates to
moderate
Referenced in: sparta-data
Mapped by SPARTA, not curated by SafeMode Space.
space-shieldT2029.002 Electromagnetic reconnaissance
addresses
moderate
T2029.002 'Electromagnetic reconnaissance' explicitly covers EM-emission measurement to attempt side-channel attacks at proximity — addresses the proximity-vantage-point subset of EXF-0002.02.
space-shieldT2035 Side-channel exfiltration
addresses
moderate
T2035 covers all side-channel exfiltration mechanisms — addresses EXF-0002.02 EM Leakage Attacks (capturing radiated EM energy from switching activity).

SPARTA countermeasures

CM0003 TEMPEST
Mapped by SPARTA, not curated by SafeMode Space.
CM0050 On-board Message Encryption
Mapped by SPARTA, not curated by SafeMode Space.
CM0060 Secret Shares
Mapped by SPARTA, not curated by SafeMode Space.
CM0061 Power Masking
Mapped by SPARTA, not curated by SafeMode Space.

Cite as SafeMode Space, EXF-0002.02 (SPARTA v3.2).

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.

# Description