Paper 2024/1107

Phase Modulation Side Channels: Jittery JTAG for On-Chip Voltage Measurements

Colin O'Flynn, Dalhousie University, NewAE Technology Inc.

Measuring the fluctuations of the clock phase of a target was identified as a leakage source on early electromagnetic side-channel investigations. Despite this, only recently was directly measuring the clock phase (or jitter) of digital signals from a target connected to being a source of exploitable leakage. As the phase of a clock output will be related to signal propagation delay through the target, and this propagation delay is related to voltage, this means that most digital devices perform an unintended phase modulation (PM) of their internal voltage onto clock output phases. This paper first demonstrates an unprofiled CPA attack against a Cortex-M microcontroller using the phase of a clock output, observing the signal on both optically isolated and capacitively isolated paths. The unprofiled attack takes only 2-4x more traces than an attack using a classic shunt-resistor measurement. It is then demonstrated how the JTAG bypass mode can be used to force a clock through a digital device. This forced clock signal can then be used as a highly effective oscilloscope that is located on the target device. As the attack does not require modifications to the device (such as capacitor removal or heat spreader removal) it is difficult to detect using existing countermeasures. The example attack over JTAG uses an unprofiled CPA attack, requiring only about 5x more traces than an ideal shunt-resistor based measurement. In addition, a version of this attack using a fault correlation analysis attack is also demonstrated. Countermeasures are discussed, and a simple resampling countermeasure is tested. All tools both offensive and defensive presented in the paper have been released under open-source licenses.

Available format(s)
Publication info
Published by the IACR in TCHES 2024
power analysisphase modulationremote power analysisJTAG
Contact author(s)
coflynn @ dal ca
2024-07-15: last of 3 revisions
2024-07-08: received
See all versions
Short URL
Creative Commons Attribution


      author = {Colin O'Flynn},
      title = {Phase Modulation Side Channels: Jittery {JTAG} for On-Chip Voltage Measurements},
      howpublished = {Cryptology ePrint Archive, Paper 2024/1107},
      year = {2024},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.