CWE-1300: Improper Protection of Physical Side Channels

Description:
The device does not contain sufficient protection
	mechanisms to prevent physical side channels from exposing
	sensitive information due to patterns in physically observable
	phenomena such as variations in power consumption,
	electromagnetic emissions (EME), or acoustic emissions.

Extended Description:
An adversary could monitor and measure physical
	  phenomena to detect patterns and make inferences, even if it
	  is not possible to extract the information in the digital
	  domain. 
	   Physical side channels have been well-studied for
	  decades in the context of breaking implementations of
	  cryptographic algorithms or other attacks against security
	  features. These side channels may be easily observed by an
	  adversary with physical access to the device, or using a
	  tool that is in close proximity.  If the adversary can
	  monitor hardware operation and correlate its data processing
	  with power, EME, and acoustic measurements, the adversary
	  might be able to recover of secret keys and data.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-203, CWE-203

Consequences:
  - Confidentiality: Read Memory

Detection methods:
  - Manual Analysis: Perform a set of leakage detection tests such as the procedure outlined in the Test Vector Leakage Assessment (TVLA) test requirements for AES [REF-1230].  TVLA is the basis for the ISO standard 17825
  - Manual Analysis: Post-silicon, perform full side-channel attacks (penetration testing) covering as many known leakage models as possible against test code.
  - Manual Analysis: Pre-silicon - while the aforementioned TVLA methods can be performed post-silicon, models of device power consumption or other physical emanations can be built from information present at various stag

Mitigations:
  - [Architecture and Design] Apply blinding or masking techniques to implementations of cryptographic algorithms.
  - [Implementation] Add shielding or tamper-resistant protections to the device to increase the difficulty of obtaining measurements of the side-channel.

Demonstrative examples:
Consider a device that checks a
		    passcode to unlock the screen.
PIN numbers used to unlock a cell phone
		    should not exhibit any characteristics about
		    themselves. This creates a side channel. An
		    attacker could monitor the pulses using an
		    oscilloscope or other method. Once the first
		    character is correctly guessed (based on the
		    oscilloscope readings), they can then move to the
		    next character, which is much more efficient than
		    the brute force method of guessing every possible
		    sequence of characters.
As each character of
		    the PIN number is entered, a correct character
		    exhibits one current pulse shape while an
		    incorrect character exhibits a different current
		    pulse shape.
Rather than comparing
		    each character to

Consider the device vulnerability CVE-2021-3011, which affects certain microcontrollers [REF-1221]. The Google Titan Security Key is used for two-factor authentication using cryptographic algorithms. The device uses an internal secret key for this purpose and exchanges information based on this key for the authentication. If this internal secret key and the encryption algorithm were known to an adversary, the key function could be duplicated, allowing the adversary to masquerade as the legitimate user.

The local method of extracting the secret key consists of plugging the key into a USB port and using electromagnetic (EM) sniffing tools and computers.
Several solutions could have been considered by the manufacturer. For example, the manufacturer could shield the circuitry in the key or ad

Real-world examples:
  - CVE-2022-35888: Power side-channels leak secret information from processor
  - CVE-2021-3011: electromagnetic-wave side-channel in security-related microcontrollers allows extraction of private key
  - CVE-2019-14353: Crypto hardware wallet's power consumption relates to total number of pixels illuminated, creating a side channel in the USB connection that allows attackers to determine secrets displayed such as PIN
  - CVE-2020-27211: Chain: microcontroller system-on-chip contains uses a register value stored in flash to set product protection state on the memory bus but does not contain protection against fault injection (CWE-1319
  - CVE-2013-4576: message encryption software uses certain instruction sequences that allows RSA key extraction using a chosen-ciphertext attack and acoustic cryptanalysis