Designing Maximal Resolution Loop Sensorsfor Electromagnetic Cryptographic Analysis

Wim Aerts #♦∗1, Elke De Mulder ♦∗2, Bart Preneel ♦∗, Guy A.E. Vandenbosch #, Ingrid Verbauwhede ♦∗

#dep. ESAT-TELEMIC K.U.Leuven∗dep. ESAT-COSIC K.U.Leuven

Kasteelpark Arenberg 10, B-3001 Leuven, Belgium♦ Interdisciplinary Institute for BroadBand Technology (IBBT)

1wim.aerts@esat.kuleuven.be 2elke.demulder@esat.kuleuven.be

Abstract—In this paper, the maximal spatial resolution of acircular loop sensor is investigated. This will result in a practicallimit determined by the desired signal amplitude and workingfrequency band.

I. INTRODUCTION

Mid nineties, Kocher [1] published a first paper on timingattacks. It was the foundation of a whole new cryptographicfield: side channel analysis. Instead of using mathematicaltechniques to break cryptographic ciphers, physical propertiesof the device on which an implementation of the cipher isrunning are used to recover the secret key. Some examples ofphysical properties that can contain sensitive information are:power consumption [2], electromagnetic radiation [3], [4] andsound [5], [6].

This paper focuses on sensors for electromagnetic analysis.Such sensors should capture the radiation surrounding thedevice as accurate as possible with a reasonable amplitude.Most radiation emerging from the device is magnetic innature as inside the device currents are flowing to charge anddischarge capacitors. As such, a loop sensor would be a naturalchoice. Previous work [7] zoomed in on shielded loops. Thoseloops were quite large in comparison with a micro-controller,ASIC or even FPGA and were consequently not suited forlocalized measurements. Smaller implementations of the sameconcept do manage to achieve smaller resolutions. Masuda etal. [8] reports an aperture of 20 µm × 1 mm.

Sect. II of this paper, discusses the maximal spatial res-olution of a non-shielded loop sensor, which can inherentlybe made smaller than the shielded loops, in a theoretical way.Examples in Sect. III give numerical results. A straight forwarddesign methodology can not be derived from the ideas inthis work due to the complexity of the equations. Numericalsearch methods are to be applied. The practical limits on theresolution are however at hand.

II. THEORY

In this section the minimum achievable dimension of acircular inductive sensor for usage in a frequency interval[fL, fH ] is evaluated and values for the number of turns Nand the loop radius rl are derived starting from the value ofthe magnetic field strength B and a minimum amplitude Vminthat should be generated over a load Z, the input impedance

of the measurement device, in parallel with the loop. Thisvalue Vmin is determined by the measurement equipment andrelates to the minimum voltage that can be measured by anoscilloscope or the minimum signal amplitude that has to befed to an amplifier connected to the loop to obtain a reasonablesignal-to-noise ratio or the like.

A. General Case: Arbitrary Z

Faraday-Lenz law states that a varying magnetic fluxthrough a surface induces an extra voltage V along the lineenclosing the surface:

|V | =

∣

∣

∣

∣

dφB

dt

∣

∣

∣

∣

= ωNAB, (1)

with φB the magnetic flux through the sensor, ω = 2πf , Nthe number of turns in the loop, A the area surrounded byone turn and B the magnetic field strength. The rightmostequality sign implies that the loop is positioned orthogonallyto the magnetic field.

If a load Z is attached to the terminals of the loop sensor,current will flow, resulting in a voltage over Z equal to:

|V | = ωNAB

∣

∣

∣

∣

Z

jωL + R + Z

∣

∣

∣

∣

, (2)

with the loop inductance L [9]:

L = N2µ0rl

(

ln

(

8rl

rw

)

− 2

)

(3)

with rw the wire radius, and the loop resistance R [10]:

R =2πrlN

σπ (r2w − (rw − δ)2)

with δ =

√

2

µ0ωσ, (4)

with δ the skin depth and σ the electrical conductivity of themetal, e.g. 58 MS/m for copper. If δ > rw, δ should bereplaced by rw in the formula, for then not the skin depth, butthe wire diameter is the limiting factor.

The contour lines of Eq. (2) for rl/rw = 16, f = 250 kHzand Z = 50 Ω are drawn in Fig. 1. Designing a loop sensorwith maximal resolution for signal amplitude Vmin boils downto finding the pair (N, rl) on the |V | = Vmin contour where rl

is minimum. These loci are connected by the solid black lineon Fig. 1.

415

100 200 300 400 500 600 700 800 900 1000

1

2

3

4

5

6

7

8

9

10x 10−4

PSfragreplacem

ents

N

r lin

[m]

Fig. 1. The contour lines of Eq. (2) as a function of rl and N . The solid blackline connects the minima for rl on the different contour lines. rl/rw = 16,f = 250 kHz and Z = 50 Ω.

The optimum value for N is a trade off between increasingN to increase the induced voltage of Eq. (1), and decreasing Nto lower L ∝ N2 and R ∝ N , avoiding that |jωL+R| À |Z|in the denominator of Eq. (2).

Still, not all (N, rl) pairs found as the minimum on theappropriate contour are valid. Eq. (2) implies that the totalwire length of the loop is small to avoid signal cancellationdue to phase differences over the loop:

N2πrl <λH

10or Nrl <

λH

20π=

c

10ωH

(5)

with c the speed of light. Due to the inverse proportionalitywith ω, this inequality condition only has to be validated forfH , the upper bound of the intended frequency band.

Moreover, for similar reasons, the resonance frequency ofthe system fres, consisting of loop sensor and measuringdevice, should be higher than ten times the highest frequencyin the working frequency band:

fres =1

2π√

LtotCtot

=1

2π√

N2L1,N=1

(

Ctt

N+ CZ

)

> 10fH

(6)with CZ the capacitive part of Z. The capacitance betweentwo turns Ctt can be calculated with Magnusson [11]:

Ctt = 2πrl

ε0π

ln(

d2rw

+√

( d2rw

)2 − 1) , (7)

with ε0 the dielectric constant and d = 2(rw + t) thedistance between the centers of two turns, with t the insulationthickness. The inductance of one turn (in the absence of theother turns) is:

L1,N=1 = µ0rl

(

ln

(

8rl

rw

)

− 2

)

, (8)

with µ0 the magnetic permeability of vacuum.

Filling in Eq. (7) and (8) into Eq. (6) results in:

λ

10> 2π

√

Nrl

√

√

√

√

(

ln(

8rl

rw

)

− 2)(

2π2rl + NCZ

ε0ln (α)

)

ln (α)(9)

with α =d

2rw

+

√

(

d

2rw

)2

− 1

In conclusion, in the general case, for arbitrary values ofZ, the minima for rl on the contour lines of Eq. (2) must besought for: e.g. by a minimum search, in the (N, rl) domainbound by the conditions Eq. (5) and (9), for all frequencies inthe [fL, fH ] interval.

B. Ideal Case: Z = ∞In the ideal1 case that no load is attached to the loop sensor,

the voltage between its terminals simply equals the voltageinduced by the varying magnetic field, see Eq. (1).

Combining Eq. (5) with (1), only to be checked for fL,the lower bound of the intended frequency band, due to theproportionality of |V | ∝ ω, results in the maximum amplitudethat can be obtained with the best sensor, still obeying thecondition imposed on the total wire length:

|V | ≤ πc2ωLB

100ω2HN

= Vmax. (10)

This leads to the obvious conclusion that, in case Z = ∞, formaximum amplitude, N = 1. rl, related to the choice for Nvia Eq. (5), will then be as large as possible and A maximal.

If the voltage that is needed, Vmin < Vmax, then N ≥ 1. Inthis case a trade-off between good resolution, meaning smallA, and large frequency band, meaning small N , can be made,still resulting in the same value for NA. As soon as N > 1,however, Eq. (9) again bounds the solution space. Eq. (9) canbe rewritten, in case Z = ∞ and CZ = 0, as:

Nrl <c

10ωH

√

N

Nswitch(11)

with Nswitch the value where both Eq. (5) and (9) are equiva-lent:

Nswitch = 2π2ln(

8rl

rw

)

− 2

ln

(

d2rw

+

√

(

d2rw

)2

− 1

) . (12)

If N > Nswitch, only Eq. (5) should be checked, and the(integer) number of turns for the loop with minimal dimensionor maximal resolution is found with Eq. (10) as:

Nmax =

⌊

πωLc2B

100ω2HVmin

⌋

, (13)

else, only Eq. (11) should be checked. Eq. (11) combined withEq. (1):

Nrl =

√

NVmin

πωLB<

c

10ωH

√

N

Nswitch(14)

1This case is ideal in the sense that the voltage measured over the loopterminals is maximal. Any load between the terminals would cause a currentthrough the loop, resulting in a smaller loop voltage.

416

reveals that this condition is independent of the value for N .Stated otherwise, Eq. (11) for any value of N is equivalentwith Eq. (5) for N = Nswitch.

Consequently, the design of an ideal inductive loop sensorwith optimal resolution consists of: calculating Nmax withEq. (13) and Nswitch with Eq. (12). If Nmax ≥ Nswitch, thenN = Nmax, else N = 1. Once N is determined, rl followsfrom Eq. (1), again only to be evaluated for the lower workingfrequency, due to |V | ∝ ω:

rl =

√

Vmin

ωLBπN. (15)

III. RESULTS - MAXIMAL RESOLUTION

To give some realistic numeric values, this section evaluatesthe formulas in Sect. II for a circular inductive sensor tomeasure a magnetic field of B = 2µT that should deliverat least Vmin = 1 mV.

The values for rw and d are set to:

rw = rl/16 (16)d = 2.4rw (17)

corresponding to the rules of thumb of bending radii of wiresin [12] and breakdown voltage between conductors.

The rl calculated below are of the order of magnitude of10 µm. Loops of such small diameter, with conductors ofeven smaller dimensions can be produced, as is illustrated ine.g. Seidermann and Buttgenbach [13].

A. Ideal Case: Z = ∞

Evaluating Eq. (12) with the values in Eq. (16) and (17)results in Nswitch = 91. Calculating Nmax with Eq. (13) andevaluating Eq. (15) with the appropriate N as explained inSect. II-B, for zero bandwidth, meaning fL = fH , resultsin the radii depicted by the solid line in Fig. 3. This is thepractical resolution limit for Vmin = 1 mV. The suddendiscontinuity in the curve as f = 10 GHz is due to the jumpfrom N = 91 → 1, as indicated on Fig. 2. Also note thatthe curve stops at f = 900 GHz, as above this frequency, nosensor can be designed to deliver V ≥ Vmin due to Eq. (10).

Fig. 4 depicts the loop radius in case fL is fixed and fH isvaried from 1MHz → 10 GHz. This figure nicely illustratesthe trade-off between resolution and working frequency band.At a certain value for fH , no sensor can be designed to deliverV ≥ Vmin due to Eq. (10) and the curve goes to zero. The curvehas no meaning for values of fH < fL and is hence set to zero.The flat part in the curves corresponds with N = 1. For zerobandwidth, Fig. 3, the radius decreased again with increasingfrequency after the steep rise, due to the proportionality of Vwith ω in Eq. (1). For a non-zero bandwidth, fL limits theresolution, resulting in the flat part of the curve.

106 107 108 109 1010 1011 1012100

101

102

103

104

105

106

PSfragreplacem

ents

fL = fH in [Hz]

N

Z = ∞Z = 1 MΩ

Fig. 2. N as function of fL = fH for Z = ∞ and Z = 1 MΩ.

106 107 108 109 1010 1011 10120

1

2

3

4

5

6x 10−5

PSfragreplacem

ents

fL = fH in [Hz]

r lin

[m]

Z = ∞Z = 1 MΩ

Fig. 3. Minimum rl as a function of fL = fH for Z = ∞ and Z = 1 MΩ.

Effects of the parameters on the optimal resolution

Eq. (12) reveals that Nswitch depends slightly on rw/rl

and heavily on d/2rw (especially for d/2rw ≈ 1, which isoften the case when winding a conductor). Fig. 5 plots thisdependency in the interval of interest for rw/rl and d/2rw

If Nswitch drops, a higher frequency upper bound can beachieved with the sensor, although this implies that if the sameresolution has to be kept, the lower frequency bound has togo up. Fig. 6 shows the effect of varying ratio d/2rw on theresolution.

B. General Case: Arbitrary Z

As soon as a load is attached to the sensor, the resolutionis equal to or worse than in the ideal case of no load over theloop. This is due to the division in Eq. (2). For Z = 1 MΩ, thedifference in resolution is negligibly small, except for smallerfrequencies. The dashed line in Fig. 3 indeed deviates fromthe solid line below 300 MHz. This is due to the differencein N . In case of no load Z = ∞, N should be taken as high

417

108 109 1010 10110

1

2

3

4

5

6x 10−4

PSfragreplacem

ents

fH in [Hz]

r lin

[m]

fL = 100 MHz fL = 1 GHz

Fig. 4. Minimum rl for two loop sensors with varying working frequencyband.

020406080100

11.2 1.4 1.6 1.8

2

0

50

100

150

200

250

300

350

400

PSfrag replacements

rl/rwd/2rw

Nsw

itch

Fig. 5. Variation of Nswitch as function of rl/rw and d/2rw .

as possible with Eq. (13). In case of a finite load, however,an excessive2 value for N results in a smaller loop voltage as|jωL + R| À |Z| in Eq. (2).

The cases of Sect. III-A are reviewed here, for Z = 50 Ωand Z = 1 MΩ ‖ 13 pF, which are typical oscilloscope inputimpedances. For the high impedance and zero bandwidth case,in Fig. 7, the curve for rl shows several spikes. Those abruptchanges in resolution are due to a a decrease by one of N(which has to be an integer), similar to the spike in the idealcase for the transition of N : Nswitch → 1. The results in thenon-zero bandwidth case are depicted in Fig. 8.

As the number of turns in e.g. Fig. 2 is impractically highfor some values of fL = fH , the effect of limiting N ≤ 30 isillustrated for the case of Z = 50 Ω in Fig. 9. This deterioratesthe resolution for lower values of fL.

2From a practical point of view, N = 104 can be regarded as excessivetoo. This treatment is however purely mathematical as a starting point.

106 107 108 109 1010 1011 10120

1

2

3

4

5

6x 10−5

PSfragreplacem

ents

fL = fH in [Hz]

r lin

[m]

d/2rw = 1.2d/2rw = 1.5d/2rw = 2

Fig. 6. rl as function of fL = fH for unloaded loops with different d/2rw .

106 107 108 109 1010 1011 10120

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1x 10−3

PSfragreplacem

ents

fL = fH in [Hz]

r lin

[m]

Z = 1 MΩ ‖ 13 pF

Z = 50

Fig. 7. Minimum rl as function of fL = fH for some common oscilloscopeinput impedances.

Effects of the parameters on the optimal resolution

d/2rw now no longer has any effect. The curves for d/rw =1.5 and 2 coincide with the curve for d/rw = 1.2 (and Z =1 MΩ ‖ 13 pF) on Fig. 7. Fig. 10 shows the effect of varyingratio rw/rl on the resolution in case of Z = 1 MΩ ‖ 13 pF.

IV. CONCLUSION

In this paper, the practical resolution limit for a circularloop sensor, based on the magnetic field strength and theminimum voltage amplitude that should be provided by theloop, was evaluated. This resulted in numerical values forloops with an infinite load as well as for loops connected toa common oscilloscope input impedance. A straight forwarddesign method could not be derived from the theory developed.A numerical search routine was used to achieve the optimalvalues for loop radius and number of turns.

418

106 107 108 109 1010 1011 10120

0.002

0.004

0.006

0.008

0.01

0.012

0.014

0.016

PSfragreplacem

ents

fH in [Hz]

r lin

[m]

fL = 0.1 MHz, Z = 1 MΩ ‖ 13 pF

fL = 0.1 MHz, Z = 50 ΩfL = 1 MHz, Z = 1 MΩ ‖ 13 pF

fL = 1 MHz, Z = 50 Ω

Fig. 8. Minimum rl for some common oscilloscope input impedances withvarying working frequency band.

106 107 108 109 1010 1011 10120

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1x 10−3

PSfragreplacem

ents

fL = fH in [Hz]

r lin

[m]

N ≤ 30N is unbound

Fig. 9. Minimum rl as function of fL = fH for Z = 50 Ω with andwithout restriction on N .

ACKNOWLEDGMENT

This research is partially funded by the FWO underproject G.0475.05, the “Institute for the Promotion of Inno-vation through Science and Technology in Flanders (IWT-Vlaanderen)”, the IAP Programme P6/26 BCRYPT of theBelgian State (Belgian Science Policy) and K.U.Leuven-BOF(OT/06/40).

The authors would like to thank Frederik Vercauteren forthe mathematical support.

106 107 108 1090

1

2

3

4

5

6

7

8x 10−4

PSfragreplacem

ents

fL = fH in [Hz]

r lin

[m]

rl/rw = 16rl/rw = 20

Fig. 10. rl as function of fL = fH for Z = 1 MΩ ‖ 13 pF and severalrw/rl.

REFERENCES

[1] P. Kocher. Timing attacks on implementations of Diffie-Hellman, RSA,DSS and other systems. In Advances in Cryptology: Proceedings ofCRYPTO’96, 1996.

[2] P. Kocher, J. Jaffe, and B. Jun. Differential power analysis. In Advancesin Cryptology: Proceedings of CRYPTO’99, 1999.

[3] K. Gandolfi, C. Mourtel, and F. Olivier. Electromagnetic analysis:Concrete results. In C. K. Koc, D. Naccache, and C. Paar, editors,CHES, 2001.

[4] J.-J. Quisquater and D. Samyde. Electromagnetic analysis (EMA):Measures and counter-measures for smard cards. In E-smart, 2001.

[5] Dmitri Asonov and Rakesh Agrawal. Keyboard acoustic emanations. InIEEE Symposium on Security and Privacy, 2004.

[6] Adi Shamir and Edan Tromer. Acoustic cryptanalysis: on nosy peopleand noisy machines. In Eurocrypt rump session, 2004.

[7] W. Aerts, E. De Mulder, B. Preneel, G.A.E. Vandenbosch, and I. Ver-bauwhede. Matching shielded loops for cryptographic analysis. InEuCAP, 2006.

[8] Norio Masuda, Naoya Tamaki, Toshihide Kuriyama, Jin Ching Bu,Masahiro Yamaguchi, and Ken-Ichi Arai. High frequency magnetic nearfield measurement on lsi chip using planar multi-layer shielded loop coil.In IEEE International Symposium on Electromagnetic Compatibility,2003.

[9] Frederick W. Gover. Inductance Calculations: Working Formulas andTables. Dover Publications, 1946.

[10] Dr. J.J. Goedbloed. Elektromagnetische compatibiliteit. Ten Hagen enStam, Den Haag/Deventer, 2000.

[11] Philip C. Magnusson, Gerald C. Alexander, Vijai K. Tripathi, andAndreas Weisshaar. Transmission Lines and Wave Propagation. CRCPress, 2001.

[12] The Okonite Company. Minimum bending radii. Technical report, TheOkonite Company, September 2008.

[13] Volker Seidermann and Stephanus Buttgenbach. Closely coupled microcoils with integrated flux guidance: Fabrication technology and appli-cation to proximity and magnetoelastic force sensors. IEEE SensorsJournal, 2003.

419