A New Second-Order Side Channel Attack Based on Linear Regression

Abstract

Abstract-Embedded implementations of cryptographic primitives need protection against Side Channel Analysis. Stochastic attacks, introduced by Schindler et al. at CHES 2005, are an example of such an analysis. They offer a pertinent alternative to template attacks which efficiency is optimal, and they can theoretically defeat any kind of countermeasure including masking. In both template and stochastic attacks, the adversary needs to be able to carry out a profiling stage on a perfect copy of the target device. This makes them interesting tools to study the resistance of implementations against such a powerful adversary, but it limits their pertinency in practice. It is indeed difficult to have an open access to a copy of the device under attack and, even when it is possible, it remains difficult to exploit templates acquired on one device to attack another one. In this paper, we propose a new attack technique which shares many similarities with stochastic attacks but does not require any profiling stage. As a consequence, no copy of the device is needed anymore. We conduct an in-depth analysis of this new attack to highlight its core foundations. Then, we apply it to widely used masking schemes and we illustrate its interest by a series of experiments on simulated and real curves.

Behind the Scene of Side Channel Attacks

“…They also argued that the LRA can be applied in the same context as the CPA, but with weaker assumption on the device behavior. Subsequently, these results of Doget et al have been extended in [10] to apply against masked implementations. In parallel, linear regression attacks have been used to analyse/model the deterministic part of the information leakage for complex circuits [14,15].…”

“…the DPA [17] or the multi-bit DPA [23]) were actually originally written as such, whereas the other ones were developed in a partitioning way after their introduction (see e.g. [18] for the CPA, [10] for the LRA and [33] for the MIA). To the best of our knowledge, this property has however never been exploited to improve the attacks efficiency.…”

“…Fortunately this complexity can be significantly reduced. It can indeed be easily shown (see [10]) that the processing of the vectors − → β is unchanged if performed for the set of averaged leakages ( …”

“…In spite of the evidence of this observation, it is rarely taken into account when analysing the effectiveness of a side channel attack. Such an analysis is indeed frequently done under the assumption, sometimes implicit, that a small number of points of interest (POI) has already been extracted from the traces either by pattern matching [21], or by dimension reduction [1,6,7,32] or thanks to a previous successful attack [10,29]. However, the two first categories of techniques are not yet perfect and, after reduction, the traces are often still composed of several points in practice.…”

Detecting Hidden Leakages

“…If the two leaking operations are similar, e.g., two computations of S-box, then the attack is referred to as a collision attack [6]. Otherwise, the attack is generally termed bivariate, and can consist in second-order CPA [28], multivariate MIA [18], or any other variant (e.g., [15]). For this reason, every intermediate variable is masked independently (e.g., the same masked S-box cannot be used twice), and the sharing is done with strictly more than two shares.…”