Modified Template Attack Detecting Address Bus Signals of Equal Hamming Weight

Side channel attacks usually target implementations of cryptographic algorithms on smart cards or FPGA’s, but can also be used to recognize other microprocessor activities, such as program, instruction or argument executed. One particular article by Quisquater and Samyde [1] demonstrates how to automatically reverse engineer software code, based on power and electromagnetic signatures. In their article, it is stated that data/addresses of equal Hamming Weight (HW), such as 55 and AA cannot be distinguished without using localization principles (i.e positioning of tiny probes to identify the location of the emanation). Recent methods, such as the Template Attack [2] has overcome this limitation. This is achieved by building precise noise models using identical devices, prior to the attack. Key bytes or intermediate values of cryptographic algorithms, i.e data transfers , can be distinguished, using a Bayesian classifier, even for byte values of equal HW [2]. In this article we present experimental results, validating that the Template Attack can distinguish very similar micro processor activities. Using a modified Template Attack on electromagnetic emanation from smart cards, we are able to distinguish parallel address bus activities of equal HW. We also present an alternative method to select the application specific features necessary (i.e points of interest).