Template Attacks in Principal Subspaces

Abstract

Abstract. Side-channel attacks are a serious threat to implementations of cryptographic algorithms. Secret information is recovered based on power consumption, electromagnetic emanations or any other form of physical information leakage. Template attacks are probabilistic sidechannel attacks, which assume a Gaussian noise model. Using the maximum likelihood principle enables us to reveal (part of) the secret for each set of recordings (i.e., leakage trace). In practice, however, the major concerns are (i) how to select the points of interest of the traces, (ii) how to choose the minimal distance between these points, and (iii) how many points of interest are needed for attacking. So far, only heuristics were provided. In this work, we propose to perform template attacks in the principal subspace of the traces. This new type of attack addresses all practical issues in principled way and automatically. The approach is validated by attacking stream ciphers such as RC4. We also report analysis results of template style attacks against an FPGA implementation of AES Rijndael. Roughly, the template attack we carried out requires five time less encrypted messages than the best reported correlation attack against similar block cipher implementations.

Information Theoretic Evaluation of Side-Channel Resistant Logic Styles

“…Due to the large dimensionality of the leakage traces, a number of heuristics have been proposed in the open literature in order to reduce the number of leakage samples to tractable values. In this paper, we consider the Principal Component Analysis (PCA) described in [3], of which we now recall the necessary background. For more details, we refer to the original paper.…”

Behind the Scene of Side Channel Attacks

“…Subsequent works have then been published which either show how to apply them against particular implementations (e.g. AES, RSA or ECDSA) or propose efficiency/effectiveness improvements [1,3,27,29]. In [27], the authors reduce the complexity of template attacks by first applying a pre-processing on the measurements (to go from time domain to frequency domain) and then by applying dimension reduction techniques (e.g.…”

“…PCA). The latter idea is also followed in [1] and [3]. In all those papers, the improvement of the template attacks efficiency is not studied at the algorithmic level.…”

“…In spite of the evidence of this observation, it is rarely taken into account when analysing the effectiveness of a side channel attack. Such an analysis is indeed frequently done under the assumption, sometimes implicit, that a small number of points of interest (POI) has already been extracted from the traces either by pattern matching [21], or by dimension reduction [1,6,7,32] or thanks to a previous successful attack [10,29]. However, the two first categories of techniques are not yet perfect and, after reduction, the traces are often still composed of several points in practice.…”

Multiple-Differential Side-Channel Collision Attacks on AES

“…Note that the notion of profiling for our collision detection techniques is different from that for template attacks [14], [15]. While template attacks require detailed knowledge of the implementation in the profiling stage, the only information needed in the profiling stage of the collision detection methods is the time interval when the S-boxes are executed.…”