Monitoring Tamper-Sensing Meshes Using Low-Cost, Embedded Time-Domain Reflectometry
Jan has a new paper published [in TCHES 2026/1](https://tches.iacr.org/index.php/TCHES/article/view/12692), which they will present at [CHES 2026 in Antalya, Turkey](https://ches.iacr.org/2026/) in October. The paper presents a method for monitoring tamper-sensing meshes via time-domain reflectometry using low-cost, off-the-shelf components. The research resulted in a circuit that achieves TDR measurement resolution in the range of a few hundred picoseconds at a BoM cost of about 10 €.
Background: Tamper-Sensing Meshes
Tamper-sensing meshes are meandering circuit traces used to physically protect high-security hardware such as hardware security modules, ATM PIN pads, and countertop card payment terminals. Any area that should be protected against drilling or sawing attacks is covered with one or more such traces in a dense, meandering pattern. For a deep dive on tamper-sensing mesh design, read our post on Tamper Sensing Meshes in the Wild and on our Kicad tamper sensing mesh generator plugin
Until now, the state of the art in mesh monitoring has largely centered on measuring ohmic resistance in the analog domain. This approach comes with notable drawbacks: the circuitry is relatively complex, and there is a steep trade-off between sensitivity and false-positive rate, since the entire mesh yields only a single analog measurement carrying around 12–16 bits of entropy. Some prior work has explored more advanced RF-based techniques, but these have generally required either expensive hardware or highly specialized mesh geometries that cannot be easily adapted to arbitrary form factors.
Applying Time Domain Reflectometry
In this paper, Jan describes a method combining the high-resolution timer of an inexpensive STM32G4-series microcontroller with DisplayPort/HDMI redriver ICs — chips designed for amplifying high-speed display signals — to generate fast pulse edges. Several redriver chips were characterized for this purpose, with the strongest performers being TI's TDP0604 and Diodes' PI3HDX12211, priced at €2–5 depending on volume and sourcing. These fast edges are then fed into four-diode sampling gates using commodity RF Schottky diodes, forming a low-cost but high-performance time-domain reflectometer.
The resulting TDR circuit produces a spatial fingerprint of the mesh trace along its full length, enabling significantly more precise tamper detection than resistance-based methods.
Results
The paper includes over 1,000 measurements characterizing the system's behavior. The results show strong sensitivity to physical attacks while maintaining robustness against environmental variation. Notably, the system is sensitive enough to distinguish between multiple identical copies of the same mesh based solely on manufacturing tolerances such as FR-4 fiber weave alignment.
The open-access publication is available free of charge at the IACR. The project source code is available at git.jaseg.de/sampling-mesh-monitor.git.
Kicad tamper sensing mesh generator plugin: {{ <ref research/kicad-tamper-sensing-mesh-generator-plugin> }} Tamper Sensing Meshes in the Wild: {{ <ref research/tamper-sensing-meshes-in-the-wild> }}