A Comparative Study of Power Consumption Models for CPA Attack

Abstract

Power analysis attacks are types of side channel attacks that are based on analyzing the power consumption of the cryptographic devices. Correlation power analysis is a powerful and efficient cryptanalytic technique. It exploits the linear relation between the predicted power consumption and the real power consumption of cryptographic devices in order to recover the correct key. The predicted power consumption is determined by using the appropriate consumption model. Until now, only a few models have been proposed and used. In this paper, we describe the process to conduct the CPA attack against AES on SASEBO-GII board. We present a comparison between the Hamming Distance model and the Switching Distance model, in terms of number of power traces needed to recover the correct key using these models. The global successful rate achieves 100% at 11100 power traces. The power traces needed to recover the correct key have been decreased by 12.6% using a CPA attack with Switching Distance model.

FPGA implementation of enhanced key expansion algorithm for Advanced Encryption Standard

“…• w 8 = w 0 + w 4 • w 9 = w 1 + w 5 • w 10 = w 2 + w 6 • w 11 = w 3 + SubWord(Rotword(w 7 ))+Rcon (2) Supposing attackers have known the key (w 4 , w 5 , w 6 , w 7 ), it is hard to deduce the original key (w 0 , w 1 , w 2 , w 3 ) , because w 7 only depends on w 5 and w 6 , w 6 only depends on w 4 and w 5 ,while w 5 depends only on w 1 and w 3 . Even if w 5 known, 2 32 exhaustive attacks need to get w 1 and w 3 (each character length is 32bit).…”

Remote Side-Channel Attacks on Heterogeneous SoC

“…The synchronous update of 128 flip-flops induces a strong leakage clearly visible in figure 4. The CPA selection function is taken as the Hamming Distance between the 9th and 10th round register values and a 8-bit assumption is made on the last round key (last round attack [24]). Because the data-path is 128-bit wide, the prediction suffers a 120-bit noise that might yield errors.…”

Power analysis attacks on the AES-128 S-box using differential power analysis (DPA) and correlation power analysis (CPA)

“…Having a known variable is required since the Hamming Weight Power Model itself is built by hypothesising how many bits are set to 1 as a form of output during key stages of a cryptographic operation which involve or relate back to the cipher key. Originally presented in [8], the correlation coefficient (ρ) between actual power consumption and predicted Hamming weight power can be calculated using Equation 2. The variable W represents a set of real power consumption values while P is a set of predicted Hamming weight values.…”