MedTech Terms
    The authoritative reference
    All terms

    Side-Channel Attack

    An attack that extracts secrets by analyzing physical or timing signals rather than breaking cryptography directly.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 5, 2026

    Definition

    A side-channel attack extracts secret data - typically cryptographic keys, PINs, or biometric templates - by measuring physical phenomena that leak from a device while it processes those secrets, rather than by breaking the cryptographic algorithm itself. Common side channels include power consumption (DPA - Differential Power Analysis), electromagnetic emissions (TEMPEST/EM-SCA), execution timing, cache access patterns, and acoustic emissions. The 2018 Meltdown/Spectre family demonstrated the relevance of cache-timing side channels even on commodity CPUs.
    What the regulation says
    FDA's 2023 guidance does not call side-channel attacks out by name but expects threat models to consider physical-access scenarios for devices that store credentials or keys locally. NIST SP 800-90B covers entropy considerations relevant to side-channel exposure of RNGs. For high-assurance devices (implantables, devices handling biometric authentication), side-channel resistance should be addressed in design.

    What this means in practice

    Side-channel resistance matters most for devices an attacker can physically possess (implantable programmers, home-use devices) and for any device where extracting a single device's keys would compromise an entire fleet. Commodity hardware typically lacks side-channel hardening; secure elements and dedicated crypto coprocessors include countermeasures.
    Common pitfalls
    • •Storing per-device keys in commodity microcontroller flash with no side-channel hardening.
    • •Implementing cryptography in software with non-constant-time operations.
    • •Re-using a single signing key across an entire device fleet - one extraction compromises all.

    Frequently asked questions

    Standard pen testing typically does not include side-channel analysis. It requires specialized equipment (oscilloscopes, EM probes) and is usually scoped separately for high-risk devices.
    Grouped by theme

    Primary references

    3 sources
    Link health: 3 verified· last checked 2026-06-20
    NIST·1FDA·1MDCG·1
    1. 1
      NIST SP 800-90B Recommendation for the Entropy Sources
      Verified
      NISTcsrc.nist.gov
    2. 2
      FDA Cybersecurity Guidance (Sept 2023)
      Verified
      FDAfda.gov
    3. 3
      MDCG Cybersecurity Guidance
      Verified
      MDCGhealth.ec.europa.eu

    Inline markers like [1] jump to the matching reference above.