Statistical Analysis of Second Order Differential Power Analysis

Prouff, Emmanuel; Rivain, Matthieu; Bevan, Régis

doi:10.1109/tc.2009.15

Cited by 257 publications

(265 citation statements)

References 12 publications

Supporting

Mentioning

224

Contrasting

Order By: Relevance

“…Two of them are commonly used: the product combining [1] which consists in multiplying the two signals and the absolute difference combining [18] which computes the absolute value of the difference between two signals. [21] confirmed the hint of [1] that centering the leakages before combining them by product yields a better combining function in the context of a second-order DPA with leakages closely following a Hamming weight model. The resulting normalized product combining is defined as:…”

Section: Second-order Differential Power Analysissupporting

confidence: 52%

Mutual Information Analysis: a Comprehensive Study

et al. 2010

View full text Add to dashboard Cite

Abstract. Mutual Information Analysis is a generic side-channel distinguisher that has been introduced at CHES 2008. It aims to allow successful attacks requiring minimum assumptions and knowledge of the target device by the adversary. In this paper, we compile recent contributions and applications of MIA in a comprehensive study. From a theoretical point of view, we carefully discuss its statistical properties and relationship with probability density estimation tools. From a practical point of view, we apply MIA in two of the most investigated contexts for side-channel attacks. Namely, we consider first order attacks against an unprotected implementation of the DES in a full custom IC and second order attacks against a masked implementation of the DES in an 8-bit microcontroller. These experiments allow to put forward the strengths and weaknesses of this new distinguisher and to compare it with standard power analysis attacks using the correlation coefficient.

show abstract

Section: Second-order Differential Power Analysissupporting

confidence: 52%

Mutual Information Analysis: a Comprehensive Study

et al. 2010

View full text Add to dashboard Cite

show abstract

“…For each of them, we estimated the minimum number of observations N required for the attack to succeed with a probability at least equal to 0.9. As argued in [17,25], this is a sound way to evaluate the efficiency of a side-channel attack. Results are reported in Figure 3(a).…”

Section: Attack Simulationsmentioning

confidence: 99%

Redefining the transparency order

Chakraborty

Sarkar²,

Maitra

et al. 2016

Des. Codes Cryptogr.

View full text Add to dashboard Cite

Abstract. In this paper, we consider the multi-bit Differential Power Analysis (DPA) in the Hamming weight model. In this regard, we revisit the definition of Transparency Order (TO) from the work of Prouff (FSE 2005) and find that the definition has certain limitations. Although this work has been quite well referred in the literature, surprisingly, these limitations remained unexplored for almost a decade. We analyse the definition from scratch, modify it and finally provide a definition with better insight that can theoretically capture DPA in Hamming weight model for hardware implementation with precharge logic. At the end, we confront the notion of (revised) transparency order with attack simulations in order to study to what extent the low transparency order of an s-box impacts the efficiency of a side channel attack against its processing. To the best of our knowledge, this is the first time that such a critical analysis is conducted (even considering the original notion of Prouff). It practically confirms that the transparency order is indeed related to the resistance of the s-box against side-channel attacks, but it also shows that it is not sufficient alone to directly achieve a satisfying level of security. Regarding this point, our conclusion is that the (revised) transparency order is a valuable criterion to consider when designing a cryptographic algorithm, and even if it does not preclude to also use classical countermeasures like masking or shuffling, it enables to improve their effectiveness.

show abstract

“…the simulated leakage. Secondly, we launched second-order attacks on a binary masked implementation of AES: the leakage sample corresponding to the mask value and the sample corresponding to the masked SubBytes operation were combined using the 'centre and multiply' method (see e.g [17]), and then a standard Hamming-weight CPA was launched. To enable a direct comparison with the standard CPA attacks, we ran the template attacks using data with an SNR of 2 −7 .…”

Section: Distinguishers and Higher-order Attacksmentioning

confidence: 99%

Characterisation and Estimation of the Key Rank Distribution in the Context of Side Channel Evaluations

Martin

Mather²,

Oswald

et al. 2016

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Quantifying the side channel security of implementations has been a significant research question for several years in academia but also among real world side channel practitioners. As part of security evaluations, efficient key rank estimation algorithms were devised, which in contrast to analyses based on subkey recovery, give a holistic picture of the security level after a side channel attack. However, it has been observed that outcomes of rank estimations show a huge spread in precisely the range of key ranks where enumeration could lead to key recovery. These observations raise the question whether this is because of insufficient rank estimation procedures, or, if this is an inherent property of the key rank. Furthermore, if this was inherent, how could key rank outcomes be translated into practically meaningful figures, suitable to analysing the risk that real world side channel attacks pose? This paper is a direct response to these questions. We experimentally identify the key rank distribution and show that it is independent of different distinguishers and signal-to-noise ratios. Then we offer a theoretical explanation for the observed key rank distribution and determine how many samples thereof are required for a robust estimation of some key parameters. We discuss how this can be naturally integrated into real world side channel evaluation practices. We conclude our research by connecting non-parametric order statistics, in particular percentiles, in a practically meaningful way with business goals.

show abstract

Statistical Analysis of Second Order Differential Power Analysis

Cited by 257 publications

References 12 publications

Mutual Information Analysis: a Comprehensive Study

Mutual Information Analysis: a Comprehensive Study

Redefining the transparency order

Characterisation and Estimation of the Key Rank Distribution in the Context of Side Channel Evaluations

Contact Info

Product

Resources

About