Profiling DPA: Efficacy and Efficiency Trade-Offs

Abstract

Abstract. Linear regression-based methods have been proposed as efficient means of characterising device leakage in the training phases of profiled side-channel attacks. Empirical comparisons between these and the 'classical' approach to template building have confirmed the reduction in profiling complexity to achieve the same attack-phase success, but have focused on a narrow range of leakage scenarios which are especially favourable to simple (i.e. efficiently estimated) model specifications. In this contribution we evaluate-from a theoretic perspective as much as possible-the performance of linear regression-based templating in a variety of realistic leakage scenarios as the complexity of the model specification varies. We are particularly interested in complexity tradeoffs between the number of training samples needed for profiling and the number of attack samples needed for successful DPA: over-simplified models will be cheaper to estimate but DPA using such a degraded model will require more data to recover the key. However, they can still offer substantial improvements over non-profiling strategies relying on the Hamming weight power model, and so represent a meaningful middleground between 'no' prior information and 'full' prior information.

Recent advances in deep learning‐based side‐channel analysis

“…The Hamming weight and Hamming distance models are frequently used as a power model. For a leakage model, leakage characterization and average traces are occasionally used, because they are more similar to the actual leakage model than the Hamming weight or Hamming distance . In , an MLP was trained using the Sbox output value and real power trace as the data and label, respectively.…”

Reaching the Limit of Nonprofiling DPA

“…Depending upon the selection of the covariate set {f j } b j=0 , stochastic attack can be adopted to incorporate a very simple model to a very generic model. For example, in Hamming weight model, covariate set is chosen to be {f 0 , f 1 } where f 0 : S → R is a constant function and f 1 is such that f 1 (s) = HW(s) for all s ∈ S. In bit model, the covariate set is {f j } r j=0 where r is the number of bits of S, f 0 : S → R is a constant function, and f j : S → R maps the target S to its jth bit where 1 ≤ j ≤ r. A more generic model takes less number of power traces for a successful attack in the attack phase at the cost of more power traces and more computational effort in the profiling phase [14].…”

“…Thus, the optimization of SNR of the output leakage L o is equivalent to the optimization of the SR. Comparing (14) and (18), we note that Ñ in the denominator of the definition of SNR is replaced by L in the definition of SR. Thus, replacing Ñ by L in Theorem 1, we get the following lemma.…”

An Improved Side-Channel Attack Based on Support Vector Machine

“…For template attacks, Chari et al [3] proposed the multivariate Gaussian probability distribution model. Many machine learning and pattern classification models have also been introduced to perform profiled side-channel attacks, such as Linear Regression [7], Gaussian Mixture Models [8], Linear Discriminant Analysis (LDA) [9] models and Support Vector Machine (SVM) [10]. These profiled sidechannel attacks have achieved far more outstanding performance than conventional attack methods, which makes it a hot topic in the cryptanalysis research field.…”

“…Profiled side-channel attack is considered as the strongest type of all side-channel attack technologies [7]. In the profiling phase, an adversary can extract sufficient information to illustrate the characteristics of information leakages from the training device.…”