SNR-Centric Power Trace Extractors for Side-Channel Attacks

The existing power trace extractors consider the case that the number of power traces owned by the attacker is sufficient to guarantee his successful attacks, and the goal of power trace extraction is to lower the complexity rather than increase the success rates. Although having strict theoretical proofs, they are too simple and leakage characteristics of POIs have not been thoroughly analyzed. They only maximize the variance of data-dependent power consumption component and ignore the noise component, which results in very limited SNR to improve and seriously affects the performance of extractors. In this paper, we provide a rigorous theoretical analysis of SNR of power traces, and propose a novel SNR-centric extractor, named Shortest Distance First (SDF), to extract power traces with smallest the estimated noise by taking advantage of known plaintexts. In addition, to maximize the variance of the exploitable component while minimizing the noise, we refer to the SNR estimation model and propose another novel extractor named Maximizing Estimated SNR First (MESF). Finally, we further propose an advanced extractor called Mean optimized MESF (MMESF) that exploits the mean power consumption of each plaintext byte value to more accurately and reasonably estimate the data-dependent power consumption of the corresponding samples. Experiments on both simulated power traces and measurements from an ATmega328p micro-controller demonstrate the superiority of our new extractors.

[1]  Debdeep Mukhopadhyay,et al.  On the Optimal Pre-processing for Non-profiling Differential Power Analysis , 2014, COSADE.

[2]  Siva Sai Yerubandi,et al.  Differential Power Analysis , 2002 .

[3]  Sylvain Guilley,et al.  First Principal Components Analysis: A New Side Channel Distinguisher , 2010, ICISC.

[4]  François Durvaux,et al.  Towards Easy Leakage Certification , 2016, CHES.

[5]  Wan Wunan,et al.  An optimized cross correlation power attack of message blinding exponentiation algorithms , 2015, China Communications.

[6]  Cesar Pereida García,et al.  Cache-Timing Attacks on RSA Key Generation , 2019, IACR Cryptol. ePrint Arch..

[7]  Christophe Clavier,et al.  Correlation Power Analysis with a Leakage Model , 2004, CHES.

[8]  Moti Yung,et al.  A Unified Framework for the Analysis of Side-Channel Key Recovery Attacks (extended version) , 2009, IACR Cryptol. ePrint Arch..

[9]  Adi Shamir,et al.  Comparative Power Analysis of Modular Exponentiation Algorithms , 2010, IEEE Transactions on Computers.

[10]  François Durvaux,et al.  From Improved Leakage Detection to the Detection of Points of Interests in Leakage Traces , 2016, EUROCRYPT.

[11]  Sylvain Guilley,et al.  RSM: A small and fast countermeasure for AES, secure against 1st and 2nd-order zero-offset SCAs , 2012, 2012 Design, Automation & Test in Europe Conference & Exhibition (DATE).

[12]  Adi Shamir,et al.  RSA Key Extraction via Low-Bandwidth Acoustic Cryptanalysis , 2014, CRYPTO.

[13]  Pankaj Rohatgi,et al.  Template Attacks , 2002, CHES.

[14]  Yongdae Kim,et al.  Using Principal Component Analysis for Practical Biasing of Power Traces to Improve Power Analysis Attacks , 2013, ICISC.

[15]  Emmanuel Prouff,et al.  Masking against Side-Channel Attacks: A Formal Security Proof , 2013, EUROCRYPT.

[16]  Gernot Heiser,et al.  Last-Level Cache Side-Channel Attacks are Practical , 2015, 2015 IEEE Symposium on Security and Privacy.

[17]  Hailong Zhang.  On the Exact Relationship Between the Success Rate of Template Attack and Different Parameters , 2020, IEEE Transactions on Information Forensics and Security.

[18]  Ingrid Verbauwhede,et al.  Fast Leakage Assessment , 2017, CHES.

[19]  Bart Preneel,et al.  Mutual Information Analysis , 2008, CHES.

[20]  Cécile Canovas,et al.  Kernel Discriminant Analysis for Information Extraction in the Presence of Masking , 2016, CARDIS.

[21]  Liwei Zhang,et al.  A statistics-based success rate model for DPA and CPA , 2015, Journal of Cryptographic Engineering.

[22]  Yongdae Kim,et al.  Biasing power traces to improve correlation in power analysis attacks , 2010 .

[23]  Jun Chen,et al.  A Cluster Correlation power analysis against double blinding exponentiation , 2019, J. Inf. Secur. Appl..

[24]  Elena Marchiori,et al.  PCA, Eigenvector Localization and Clustering for Side-Channel Attacks on Cryptographic Hardware Devices , 2012, ECML/PKDD.

[25]  Daniel Genkin,et al.  Get your hands off my laptop: physical side-channel key-extraction attacks on PCs , 2014, Journal of Cryptographic Engineering.

[26]  François-Xavier Standaert,et al.  Leakage Certification Revisited: Bounding Model Errors in Side-Channel Security Evaluations , 2019, IACR Cryptol. ePrint Arch..

[27]  Patrick Schaumont,et al.  Changing the Odds Against Masked Logic , 2006, Selected Areas in Cryptography.

[28]  Jasper G. J. van Woudenberg,et al.  Improving Differential Power Analysis by Elastic Alignment , 2011, CT-RSA.

[29]  Jean-Louis Lacoume,et al.  Noise Reduction in Side Channel Attack Using Fourth-Order Cumulant , 2007, IEEE Transactions on Information Forensics and Security.

[30]  Pankaj Rohatgi,et al.  Introduction to differential power analysis , 2011, Journal of Cryptographic Engineering.

[31]  T. Mizuki,et al.  Using selected-plaintext sets for efficient evaluation of EM information leakage from cryptographic devices , 2012, 2012 Proceedings of SICE Annual Conference (SICE).

[32]  Degang Sun,et al.  Enhanced Correlation Power Analysis by Biasing Power Traces , 2016, ISC.

[33]  Amir Moradi,et al.  Leakage Detection with the χ 2-Test , 2018 .

[34]  Stefan Mangard,et al.  Power analysis attacks - revealing the secrets of smart cards , 2007 .

[35]  Robert H. Sloan,et al.  Examining Smart-Card Security under the Threat of Power Analysis Attacks , 2002, IEEE Trans. Computers.

[36]  François-Xavier Standaert,et al.  How (not) to Use Welch's T-test in Side-Channel Security Evaluations , 2018, IACR Cryptol. ePrint Arch..

[37]  An Wang,et al.  Adaptive Chosen-Plaintext Correlation Power Analysis , 2014, 2014 Tenth International Conference on Computational Intelligence and Security.

[38]  Benoit Feix,et al.  Power Analysis for Secret Recovering and Reverse Engineering of Public Key Algorithms , 2007, Selected Areas in Cryptography.

[39]  Dakshi Agrawal,et al.  The EM Side-Channel(s) , 2002, CHES.

[40]  Rached Tourki,et al.  Optimized power trace numbers in CPA attacks , 2011, Eighth International Multi-Conference on Systems, Signals & Devices.

[41]  Paul C. Kocher,et al.  Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems , 1996, CRYPTO.