infoGC-2026-0001

Power side-channel leaks billing keys on Tideglass meters

A correlation power-analysis side channel on the FlowMeter G3 leaks a static billing HMAC key over roughly twenty thousand traces, a low-severity issue given the physical access and equipment required.

Vendor
Tideglass Metering
Product
FlowMeter G3 residential unit
Severity
Info · CVSS 3.7
Target
Utility metering
Disclosed
Status
Acknowledged — masking planned for next silicon
  • Side channel
  • Cryptography
  • Hardware

Overview

The FlowMeter G3 signs usage reports with an HMAC under a per-unit key stored in flash. We instrumented the meter's power rail during signing.

Correlation power analysis against the HMAC inner hash recovers the key after about 20,000 traces — practical only with physical access, a shunt, and a scope.

Impact

With the key, an attacker could forge usage reports for a single unit. The physical-access barrier and per-unit key scope keep real-world severity low.

Remediation

Tideglass acknowledged the finding and plans hiding/masking countermeasures in the next silicon revision. We recommend per-unit key rotation at meter replacement intervals.

Disclosure timeline

  1. Disclosure to Tideglass
  2. Vendor acknowledges
  3. Informational advisory published