This work is about TEMPEST (Transient Electro-Magnetic Pulse Emanation Standard) which is a term for describing the gathering of secret information that leak from a system. The specific observed system is the touchscreen of a smartphone. The aim is to firstly examine the information needed for an identification of the touched area on a touchscreen of a smartphone by TEMPEST. Given this information, the work then examines the accuracy of such an identification. The method is based on experimental examinations, observations and measures as well as probability distributions. Conclusions from the results are the fact that the accuracy of an identification becomes higher when synchronizing the communication between the smartphone and its display with a measuring instrument. Moreover, the accuracy of an identification varies with chosen measurement method and this work showed that a higher accuracy was achieved when taking measurements with an absorbing clamp compared to a near-field probe.

<p>This master thesis has been performed at Sectra Communications AB in Linköping where they manufacture electronic encryption devices. In cryptology it is essential that an eavesdropper cannot find the plain text. To assure that a system is safe, all devices are thoroughly examined so that they don’t emit any secret information, so called Compromising Emanations (CE). This is done by comparing the secret signal with measured signals on the screen of an oscilloscope, a process that is very time consuming and furthermore, the risk of missing compromising emanations is high. The purpose of this thesis is to investigate the possibilities to let a computer do this job. Two methods for comparing the signals have been suggested and implemented; cross covariance and model estimation. In the cross covariance method, the cross covariance is calculated and its highest value determine how well the signals match. In the model estimation method, a number of ARX models are estimated, and if the best model is successful in explaining the output signal, it is assumed that there exists CE. </p><p>The work shows that both these methods are functional for solving the task, yet with a few limitations. Both methods announce CE for clock signals, which really aren’t compromising. The cross covariance method is limited only to find compromising emanations that look like the secret signal or certain frequently occurring non-linearities of it. The model estimation method is more general and detects CE for all linear systems, along with the known non-linearities. However, this method has a flaw: the time delay in the system must be known approximately. Further, the results show that the model estimation method is considerably more time consuming than the cross covariance method. The measurement is carried out with a computer communicating with oscilloscope and spectrum analyzer via the GPIB interface. The implementation has been done in LabView with calculation modules coded in C++.</p>

This master thesis has been performed at Sectra Communications AB in Linköping where they manufacture electronic encryption devices. In cryptology it is essential that an eavesdropper cannot find the plain text. To assure that a system is safe, all devices are thoroughly examined so that they don’t emit any secret information, so called Compromising Emanations (CE). This is done by comparing the secret signal with measured signals on the screen of an oscilloscope, a process that is very time consuming and furthermore, the risk of missing compromising emanations is high. The purpose of this thesis is to investigate the possibilities to let a computer do this job. Two methods for comparing the signals have been suggested and implemented; cross covariance and model estimation. In the cross covariance method, the cross covariance is calculated and its highest value determine how well the signals match. In the model estimation method, a number of ARX models are estimated, and if the best model is successful in explaining the output signal, it is assumed that there exists CE. The work shows that both these methods are functional for solving the task, yet with a few limitations. Both methods announce CE for clock signals, which really aren’t compromising. The cross covariance method is limited only to find compromising emanations that look like the secret signal or certain frequently occurring non-linearities of it. The model estimation method is more general and detects CE for all linear systems, along with the known non-linearities. However, this method has a flaw: the time delay in the system must be known approximately. Further, the results show that the model estimation method is considerably more time consuming than the cross covariance method. The measurement is carried out with a computer communicating with oscilloscope and spectrum analyzer via the GPIB interface. The implementation has been done in LabView with calculation modules coded in C++.

In a short time touchscreens has become one of the most used methods for input to smartphones and other machines such as cash registers, card terminals and ATMs. While the technology change was quick it introduces the possibility of new security holes. Compromising emanations is a possible security hole in almost all electronic equipment. These emanations can be used in a side-channel attack if they leak information that compromise the security of the device. This thesis studies a single-board computer (SBC) with a touchscreen and a smartphone in order to evaluate if any usable information leaks regarding what is done on the touchscreen i.e. where on the screen a user touches. It is shown that the location of a touch can be read out from information leaking through the power cable and wirelessly from the single-board computer. It is also shown that basic information can be read out wirelessly from the smartphone but further testing is required to evaluate the possibility to extract usable information from the device.

Genom ett undersökande experiment med elektromagnetisk sidokanalattack mot en knappsats för ett kommersiellt passersystem påvisas att informationsläckage i sidokanaler är ett fortsatt aktuellt problem och hur det gör fysisk åtkomstkontroll sårbart genom avlyssning och kopiering av användaruppgifter. Med enkel radioutrustning kan knapptryckningar registreras och avkodas genom oönskad elektromagnetisk strålning och teoretiskt är det möjligt att genomföra avlyssningen på en längre distans med särskilt utformad antenn och anpassad mottagare. Rapporten diskuterar problematiken med emission security hos konsumentprodukter som i militära sammanhang benämns Tempest eller RÖS (röjande signaler) och kräver kostsamma tester för att detekteras och hanteras. I regelverk för EMC (elektromagnetisk kompatibilitet) behandlas elektriska apparaters och näts utstrålning och påverkan av elektromagnetiska vågor, men inte direkt hur information kan läcka från informationsteknologisk utrustning vilket denna rapport vill problematisera. / Through an exploratory experiment using electromagnetic side-channel attack against a keypad for a commercial entry system it is demonstrated that information leakage through side-channels are an ongoing issue and may make entry systems vulnerable by recording of user data. Using simple radio equipment, keypresses can be recorded and decoded by undesired electromagnetic radiation and theoretically it is possible to carry out the attack on a longer distance with a specially designed antenna and a custom recieiver. The report discusses emission security in consumer products which in military context is termed Tempest or compromising emanations (Swedish: RÖS) and requires expensive tests to be detected and handled. The EMC regulations (electromagnetic compatibility) handles radiation and influence of electromagnetic waves in electronic apparatus and nets, but not directly how information can leak from information technology equipment which this report wants to problematize.