Screaming-channel attacks enable Electromagnetic (EM) Side-Channel Attacks (SCAs) at larger distances due to higher EM leakage energies than traditional SCAs, relaxing the requirement of close access to the victim. This attack can be mounted on devices integrating Radio Frequency (RF) modules on the same die as digital circuits, where the RF can unintentionally capture, modulate, amplify, and transmit the leakage along with legitimate signals. Leakage results from digital switching activity, so the hypothesis of previous works was that this leakage would appear at multiples of the digital clock frequency, i.e., harmonics. This work demonstrates that compromising signals appear not only at the harmonics and that leakage at non-harmonics can be exploited for successful attacks. Indeed, the transformations undergone by the leaked signal are complex due to propagation effects through the substrate and power and ground planes, so the leakage also appears at other frequencies. We first propose two methodologies to locate frequencies that contain leakage and demonstrate that it appears at non-harmonic frequencies. Then, our experimental results show that screaming-channel attacks at non-harmonic frequencies can be as successful as at harmonics when retrieving a 16-byte AES key. As the RF spectrum is polluted by interfering signals, we run experiments and show successful attacks in a more realistic, noisy environment where harmonic frequencies are contaminated by multi-path fading and interference. These attacks at non-harmonic frequencies increase the attack surface by providing attackers with an increased number of potential frequencies where attacks can succeed.

翻译：尖叫信道攻击利用电磁侧信道攻击，因电磁泄露能量高于传统侧信道攻击，可在更大距离处实施，从而降低了对受害者近距离访问的要求。该攻击可针对将射频模块与数字电路集成在同一芯片上的设备实施，其中射频模块会无意中捕获、调制、放大并随合法信号一起传输泄露信号。泄露源于数字开关活动，因此先前研究的假设是这种泄露会出现在数字时钟频率的倍数（即谐波）处。本研究证明，泄露信号不仅出现在谐波处，非谐波处的泄露也可被利用实施成功攻击。事实上，由于通过衬底及电源和地平面传播的效应，泄露信号经历的变换极其复杂，因此泄露也会出现在其他频率处。我们首先提出两种定位包含泄露频率的方法，并证明泄露出现在非谐波频率处。随后，实验结果表明，在检索16字节AES密钥时，非谐波频率处的尖叫信道攻击可达到与谐波频率处相同的成功率。由于射频频谱受干扰信号污染，我们在更现实的噪声环境中开展实验，证明当谐波频率受多径衰落和干扰污染时，非谐波频率处的攻击仍能成功。这些非谐波频率处的攻击通过为攻击者提供更多潜在的成功攻击频率，从而扩大了攻击面。