Imagine holding your phone while authorizing a payment or accessing your European digital identity. Everything feels secure, but there's a detail few consider: every time the processor performs a cryptographic calculation, it emits faint electromagnetic signals. Like invisible whispers, these can reveal the secret keys protecting your data if intercepted with the right equipment.
Researchers tested this on two modern devices: a Raspberry Pi 4 and a Fairphone 4 with a Snapdragon 750G. They used a technique called "Nonce@Once" to steal ECDSA keys — the standard signing messages and transactions — straight from OpenSSL. Surprise: even libgcrypt's countermeasure, designed to block such attacks, falls short.
The issue is that new SoCs pack heterogeneous cores, run above 2 GHz, and use sub-10 nm processes. This complexity creates more "noise" but also more opportunities for those who know where to look. The study maps how Android handles crypto today and outlines realistic threat models for the upcoming EUDI wallet.
The conclusion is clear: software implementations have flaws. Real defense requires an independently certified secure element (SE), physically isolated from the main processor. Until that's standard on all phones, your digital secrets may be more exposed than you think.
