First Principal Components Analysis: A New Side Channel Distinguisher

Souissi, Youssef; Nassar, Maxime; Guilley, Sylvain; Danger, Jean‐Luc; Flament, Florent

doi:10.1007/978-3-642-24209-0_27

Cited by 26 publications

(13 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Like other clustering-based distinguishers [2,12,23], the KDA distinguisher can be performed using different power models. In the dimensionality reduction setting, 256-class, 9-class (Hamming weight), and 3-class KDA have been investigated [6].…”

Section: Flexible Power Modelmentioning

confidence: 99%

A Novel Use of Kernel Discriminant Analysis as a Higher-Order Side-Channel Distinguisher

Zhou

Whitnall

Oswald

et al. 2018

Smart Card Research and Advanced Applications

View full text Add to dashboard Cite

Abstract. Distinguishers play an important role in Side Channel Analysis (SCA), where real world leakage information is compared against hypothetical predictions in order to guess at the underlying secret key. However, the direct relationship between leakages and predictions can be disrupted by the mathematical combining of d random values with each sensitive intermediate value of the cryptographic algorithm (a so-called "d-th order masking scheme"). In the case of software implementations, as long as the masking has been correctly applied, the guessable intermediates will be independent of any one point in the trace, or indeed of any tuple of fewer than d + 1 points. However, certain d + 1-tuples of time points may jointly depend on the guessable intermediates. A typical approach to exploiting this data dependency is to pre-process the trace -computing carefully chosen univariate functions of all possible d + 1-tuples -before applying the usual univariate distinguishers. This has a computational complexity which is exponential in the order d of the masking scheme. In this paper, we propose a new distinguisher based on Kernel Discriminant Analysis (KDA) which directly exploits properties of the mask implementation without the need to exhaustively pre-process the traces, thereby distinguishing the correct key with lower complexity. Experimental results for 2nd and 3rd order attacks (i.e. against 1st and 2nd order masking) verify that the KDA is an effective distinguisher in protected settings.

show abstract

Section: Flexible Power Modelmentioning

confidence: 99%

A Novel Use of Kernel Discriminant Analysis as a Higher-Order Side-Channel Distinguisher

Zhou

Whitnall

Oswald

et al. 2018

Smart Card Research and Advanced Applications

View full text Add to dashboard Cite

show abstract

“…First Principal Components Analysis (FPCA) as a distinguisher for SCA is proposed by Souissi et al in [12]. The procedure is to sort the total power con- Linear Discriminant Analysis Linear Discriminant Analysis (LDA) is another widely-used-in this case, supervised-dimensionality reduction method.…”

Section: Cluster-based Distinguishersmentioning

confidence: 99%

Categorising and Comparing Cluster-Based DPA Distinguishers

Zhou

Whitnall

Oswald

et al. 2017

Selected Areas in Cryptography – SAC 2017

View full text Add to dashboard Cite

Abstract. Side-channel distinguishers play an important role in differential power analysis, where real world leakage information is compared against hypothetical predictions in order to guess at the underlying secret key. A class of distinguishers which can be described as 'cluster-based' have the advantage that they are able to exploit multi-dimensional leakage samples in scenarios where only loose, 'semi-profiled' approximations of the true leakage forms are available. This is by contrast with univariate distinguishers exploiting only single points (e.g. correlation), and Template Attacks requiring concise fitted models which can be overly sensitive to mismatch between the profiling and attack acquisitions. This paper collects together-to our knowledge, for the first time-the various different proposals for cluster-based DPA (concretely, Differential Cluster Analysis, First Principal Components Analysis, and Linear Discriminant Analysis), and shows how they fit within the robust 'semi-profiling' attack procedure proposed by Whitnall et al. at CHES 2015. We provide discussion of the theoretical similarities and differences of the separately proposed distinguishers as well as an empirical comparison of their performance in a range of (real and simulated) leakage scenarios and with varying parameters. Our findings have application for practitioners constrained to rely on 'semi-profiled' models who wish to make informed choices about the best known procedures to exploit such information.

show abstract

“…Thus, in low-noise scenario, where most of the variations in the traces is due to the target S, PCA projects the data dependent variations (signal) into the first PC while variations in all other PCs are mainly caused by noise. As a result, performing DPA only on the first PC greatly improves the performance of the attack [5], [22]. However, in high-noise scenario, data-dependent variations are rather scattered among all the PCs [5], [15].…”

Section: A Eigenvector Domainmentioning

confidence: 99%

Reaching the Limit of Nonprofiling DPA

Hajra

Mukhopadhyay

2015

IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst.

View full text Add to dashboard Cite

Many profiling differential power analysis (DPA) attacks estimate the multivariate probability distribution using a profiling step, and thus, can optimally combine the leakages of multiple sample points. Though there exist several approaches like filtering or principal component analysis for combining the leakages of multiple sample points in nonprofiling DPA, their optimality has been rarely studied. We study the issue of optimally combining the leakages of multiple sample points in nonprofiling DPA attacks using a linear function. In this paper, we introduce a multivariate leakage model based on some observations obtained by profiling the power traces of Advanced Encryption Standard (AES) encryption on Virtex-5 field programmable gate array (FPGA) device. Then, we use the introduced multivariate leakage model to propose optimal combining functions for nonprofiling DPA. The theoretical claims are supported by experimental evidence. We have also discussed different sides of the proposed combining functions in various practical scenarios.Index Terms-Correlation power analysis (CPA), differential power analysis (DPA), discrete Fourier transform (DFT), filtering, principal component analysis (PCA), side channel analysis. 0278-0070

show abstract

First Principal Components Analysis: A New Side Channel Distinguisher

Cited by 26 publications

References 18 publications

A Novel Use of Kernel Discriminant Analysis as a Higher-Order Side-Channel Distinguisher

A Novel Use of Kernel Discriminant Analysis as a Higher-Order Side-Channel Distinguisher

Categorising and Comparing Cluster-Based DPA Distinguishers

Reaching the Limit of Nonprofiling DPA

Contact Info

Product

Resources

About