{"id":19621927,"url":"https://github.com/kiooku/side-channel-notebook","last_synced_at":"2026-03-04T10:31:26.605Z","repository":{"id":245142954,"uuid":"817334171","full_name":"Kiooku/Side-Channel-Notebook","owner":"Kiooku","description":"Great resources and my learning about side channel attacks, with the end goal of creating resources to facilitate learning about side channel attacks","archived":false,"fork":false,"pushed_at":"2025-11-20T13:23:09.000Z","size":24,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-11-21T10:07:28.836Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Kiooku.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-06-19T13:41:48.000Z","updated_at":"2025-11-20T13:23:12.000Z","dependencies_parsed_at":"2024-06-20T03:20:07.973Z","dependency_job_id":"6bf47ec7-18f2-4d88-bf8a-b2629da24b49","html_url":"https://github.com/Kiooku/Side-Channel-Notebook","commit_stats":null,"previous_names":["kiooku/side-channel-notebook"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/Kiooku/Side-Channel-Notebook","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kiooku%2FSide-Channel-Notebook","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kiooku%2FSide-Channel-Notebook/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kiooku%2FSide-Channel-Notebook/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kiooku%2FSide-Channel-Notebook/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Kiooku","download_url":"https://codeload.github.com/Kiooku/Side-Channel-Notebook/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Kiooku%2FSide-Channel-Notebook/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30078308,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-04T08:01:56.766Z","status":"ssl_error","status_checked_at":"2026-03-04T08:00:42.919Z","response_time":59,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-11T11:25:15.405Z","updated_at":"2026-03-04T10:31:26.549Z","avatar_url":"https://github.com/Kiooku.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Side-Channel-Notebook\n\n\u003e [!WARNING]\n\u003e Work in progress\n\n\u003e [!NOTE]\n\u003e All the resources mentioned are ones I've studied/used, am currently studying or will be studying.\n\n**Side-channel attacks *(SCA)*:**  An attack enabled by **leakage of information from a physical cryptosystem**. Characteristics that could be exploited in a side-channel attack include **timing, power consumption, and electromagnetic and acoustic emissions**. *[(Source)](https://csrc.nist.gov/glossary/term/side_channel_attack)*\n\n## Types of Attacks on embedded system\n\n\u003e [!NOTE]\n\u003e This section is taken from \"[The Hardware Hacking Book](#book-resources)\"\n\nThere are tons of types of attack on embedded systems, and here's a list of some of them:\n\n- **Software Attacks on Hardware**\n    - **Fault Injection:** Practice of pushing hardware to a point that induces processing errors.\n        - *DRAM Hammering*\n        - *CPU overclocking*\n    - **Side-Channel Attacks**\n        - **Microarchitectural attacks**\n- **PCB-Level Attacks**\n- **Logical Attacks:** Attack at the level of logical interfaces.\n- **Debugging and Tracing**\n- **Fuzzing Devices:** The goal is to find crashes to exploit for code injection.\n    - **Dump fuzzing:** Send random data to a target and observe its behavior.\n    - **Smart fuzzing:** Focuses on protocols, data structures, typical crash-causing values, or code structure.\n    - **Generation-based fuzzing:** Fuzzing that creates inputs from scratch.\n    - **Mutation-based fuzzing:** Fuzzing that takes existing inputs and modifies them.\n    - **Coverage-guided fuzzing:** Fuzzing that takes existing data to allow you to find deeper bugs.\n- **Flash Image Analysis**\n\n## Side-Channel Attacks (SCA)\n\nAs for hardware attacks, there're a large number of possible side-channel attacks. Here is a non-exhaustive list of SCA categories [(Source)](https://en.wikipedia.org/wiki/Side-channel_attack):\n- **Cache attack**\n- **Timing attack**\n- **Power-monitoring attack**\n- **Electromagnetic attack**\n- **Acoustic cryptanalysis**\n- **Differential fault analysis**\n- **Data remanence**\n\n## Difference between Side-channel attacks and  Invasive attacks\n\n\u003e [!NOTE]\n\u003e The information on this section are from [An Introduction to Mathematical Cryptography (Second Edition)](https://link.springer.com/book/10.1007/978-1-4939-1711-2)\n\n- **Black-box model:** The attacker only sees what goes in and out of the cipher.\n- **Gray-box model:** The attacks has access to a cipher implementation.\n\nBoth of this attacks believe in the **gray-box model**.\n\nHowever, SCA are noninvasive, whereas invasive attacks are.\n\nInvasive attacks are more powerful than SCA, but more expensive because they require sophisitacted equipment. They require tools such as a high-resolution microscopes and a chemical lab.\n\n# Attacks implementation and labs\n\n\u003e [!NOTE]\n\u003e I find it very difficult to find free resources to perform SCA safely, which make the learning process longer, as we need theory and practice to fully understand SCA. That's why I would like to provide some practical labs, but it's going to take some time.\n\u003e\n\u003e However, if I find practical labs for certain attacks, I'll link to those resources as well.\n\n- [ ] **Timing Attacks**\n- [ ] **Website Fingerprinting**\n- [ ] **Cache Attacks**\n- [ ] **Spectre**\n- [ ] **Meltdown**\n- [ ] **Rowhammer**\n- [ ] **ASLR Bypasses**\n- [ ] **CPU Fuzzing**\n\n# Web Resources\n\n|                                                    **Name**                                                   |                                             **Type**                                             |       **Source**      |\n|:-------------------------------------------------------------------------------------------------------------:|:------------------------------------------------------------------------------------------------:|:---------------------:|\n|              [Side Channel Security](https://www.youtube.com/@SideChannelSecurity) *(All Season)*             |                                              Theory                                              |        TU Graz        |\n|              [Side-Channel Security – Materials (2025)](https://www.isec.tugraz.at/teaching/materials/scs/slides/)            |                                              Theory / Lectures                                   |        TU Graz        |\n| [Coursebook for attack on Implementation](https://orenlab.sise.bgu.ac.il/AttacksonImplementationsCourseBook/) | Theory / [Labs](https://github.com/Yossioren/AttacksonImplementationsCourseBook/tree/master/Labs) | Ben-Gurion University |\n|                              [Secure Hardware Design](https://shd.mit.edu/2025/)                              |                 Theory / [Lab](https://github.com/CSAIL-Arch-Sec/SHD-StarterCode)                |          MIT          |\n| [Sécurité matérielle _(L’interface matériel/logiciel)_](https://ronan.lashermes.0nline.fr/courses/poly_AHP.pdf) | Theory / [Labs](https://gitlab.com/hardsec) | Université de Rennes |\n|                               [Hackropole](https://hackropole.fr/fr/challenges/)                              |                                                CTF                                               |         ANSSI         |\n|                                        [Root-me](https://root-me.org/)                                        |                                                CTF                                               |        Root-Me        |\n|                                [CryptoHack](cryptohack.org/)                                                  |                                                CTF                                               |      CryptoHack       |\n|                       [ASCAD](https://github.com/ANSSI-FR/ASCAD) *(ANSSI SCA Database)*                       |                                    Databases / Trained models                                    |         ANSSI         |\n| [COSIC (Computer Security and Industrial Cryptography)](https://www.youtube.com/@cosicbe/videos) |  Seminar / Workshop / Summer School | Theory / Video |      \n| [OpenSecurityTraining2](https://opensecuritytraining.info/Home.html) |  Courses | Theory |      \n| [Intel SGX Explained](https://eprint.iacr.org/2016/086.pdf) |  Theory | Paper _(118 pages)_ |\n| [The Dead Drop lab](https://drive.google.com/drive/folders/1eRkmi6ZYTaWsAXcA7UY11z2spBqx1454) |  Lab | UIUC |\n| [MAD (micro-architecture attacks and defenses) Tutorial](https://sites.google.com/view/mad-isca22) | Theory / [Labs](https://github.com/jprx/mad22-labs) | ISCA 2022 |\n\n# Book Resources\n\n- [The Hardware Hacking Book - *Breaking Embedded Security with Hardware Attacks*](https://nostarch.com/hardwarehacking)\n- [Sécurité matérielle des systèmes - Vulnérabilité des processeurs et techniques d’exploitation](https://www.dunod.com/sciences-techniques/securite-materielle-systemes-vulnerabilite-processeurs-et-techniques-d)\n- [Principles of Secure Processor Architecture Design](https://link.springer.com/book/10.1007/978-3-031-01760-5)\n- [Security Basics for Computer Architects](https://caslab.io/books/processor-security/Szefer_Sample.pdf)\n\n# Resources not directly related to SCA but useful/necessary for understanding certain concepts/attacks\n\n| **Name** | **Content** | **Type** |\n|:--------:|:-----------:|:--------:|\n| [MIT - Introduction to Deep Learning](http://introtodeeplearning.com/2023/) | Deep Learning | [Youtube](https://www.youtube.com/@AAmini) / [GitHub](https://github.com/aamini/introtodeeplearning) |\n| [Artificial Intelligence: A Modern Approach, 4th Global ed.](https://aima.eecs.berkeley.edu/global-index.html) | AI textbook | Book |\n| [A Journey in Creating an Operating System Kernel - 539kernel](https://539kernel.com/) | Operating System | Book |\n| [The Fuzzing Project](https://fuzzing-project.org/) | Fuzzing | Website |\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkiooku%2Fside-channel-notebook","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkiooku%2Fside-channel-notebook","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkiooku%2Fside-channel-notebook/lists"}