Side-channel attacks extract secret information by observing physical characteristics of a device — such as power consumption, timing, electromagnetic emissions, or even LED blinking patterns — rather than attacking the algorithm mathematically.

* Simple Power Analysis: a multiply-and-square draws more power than a square alone, so RSA exponent bits show directly in the trace. *

Simple Power Analysis (SPA) on RSA:

• RSA uses repeated squaring and multiplying to compute $y = x^e \mod N$
• For each bit of the key: a "1" requires both a multiplication AND a squaring; a "0" requires only a squaring
• These operations consume different amounts of electrical power
• By measuring the power trace on an oscilloscope, the attacker can literally read the key bit by bit

Example: The power trace shows a clear pattern — tall peaks (multiply + square) for "1" bits, short peaks (square only) for "0" bits. The test key F0 00 81 0F FF A5 is directly visible in the power trace.

Modern side channels:

• Video-Based Cryptanalysis (2023): Researchers extracted secret keys from non-compromised devices by filming the power LED with a commercial video camera — different computations cause different LED brightness
• Timing attacks: Different keys cause different execution times
• Electromagnetic emissions: EM radiation leaks key-dependent information

Countermeasures: Constant-time implementations, power consumption masking, EM shielding — but side channels remain one of the most practical attack vectors against real hardware.

Go deeper:

• Side-channel attack (Wikipedia) — the family of physical-leak attacks.
• Power analysis (Wikipedia) — SPA and DPA, including reading RSA bits from a trace.
• Video-Based Cryptanalysis (Nassi et al., 2023) — recovering keys by filming a device's power LED with a commercial camera.

Both are "easy forward, hard backward," but the discrete logarithm has NO known trapdoor — nobody can compute it efficiently, regardless of what they know. This makes it fundamentally different from RSA's e-th root.

* Exponentiation mod p scrambles the output: 15ˣ mod 19 already jumps around, and 627ˣ mod 941 looks purely random — so inverting it (the discrete log) has no shortcut. *

Concrete example: $15^x \mod 19$ (15 is a generator of $\mathbb{Z}_{19}^*$, so its powers cycle through all of $1..18$)

The output jumps around with no pattern. Going forward ($x \mapsto 15^x$) is easy with SAM, but going backward is a search: to find $\log_{15} 4 \mod 19$ you must hunt for the $x$ with $15^x \equiv 4$ — here $x = 10$. With a 3000-bit prime in place of 19, that search is hopeless.

Comparison:

Why "no trapdoor" matters: In RSA, the key holder CAN decrypt (using the trapdoor). In DH, nobody computes discrete logs — instead, the protocol is cleverly designed so both parties reach a shared secret without either one solving the hard problem.

Go deeper:

• Discrete logarithm (Wikipedia) — the no-trapdoor hard problem behind DH and ECC.