A fair evaluation framework for comparing side-channel distinguishers

Abstract

Abstract. The ability to make meaningful comparisons between side-channel distinguishers is important both to attackers seeking an optimal strategy and to designers wishing to secure a device against the strongest possible threat. The usual experimental approach requires the distinguishing vectors to be estimated: outcomes do not fully represent the inherent theoretic capabilities of distinguishers and do not provide a basis for conclusive, like-for-like comparisons. This is particularly problematic in the case of mutual information-based side channel analysis (MIA) which is notoriously sensitive to the choice of estimator. We propose an evaluation framework which captures those theoretic characteristics of attack distinguishers having the strongest bearing on an attacker's general ability to estimate with practical success, thus enabling like-for-like comparisons between different distinguishers in various leakage scenarios. We apply our framework to an evaluation of MIA relative to its rather more well-established correlationbased predecessor and a proposed variant inspired by the Kolmogorov-Smirnov distance. Our analysis makes sense of the rift between the a priori reasoning in favour of MIA and the disappointing empirical findings of previous comparative studies, and moreover reveals several unprecedented features of the attack distinguishers in terms of their sensitivity to noise. It also explores-to our knowledge, for the first time-theoretic properties of near-generic power models previously proposed (and experimentally verified) for use in attacks targeting injective functions.

The Myth of Generic DPA…and the Magic of Learning

“…Unfortunately, this dependence on prior knowledge has been under-appreciated because of the apparent success of`arbitrary' work-arounds such as the practice of partitioning intermediate variables according to their 7 least signicant bits (sometimes called the 7LSB model). However, it is shown in [34] that this strategy is far from universally-applicable and only works to the extent that the seemingly indierent partition captures something meaningful about the leakage after all. For example, noise on top of a typical CMOS Hamming weight consumption distorts the trace measurements towards the 7LSB model suciently for MIA to succeed, but this is not the case in general (i.e in arbitrary leakage scenarios).…”

“…For the purposes of evaluating the theoretic capabilities of generic emulating and related strategies, we will focus on rst-order asymptotic success, as captured by the (ideal) nearest-rival distinguishing margin (see [33,34]):…”

Profiling DPA: Efficacy and Efficiency Trade-Offs

“…Following the example of [15] we wish to carry out our evaluations as far as possible from a theoretic perspective, computing underlying theoretic quantities from fully-specified leakage distributions so that our evaluations are not contingent on the quality of our chosen estimation procedures. This also removes the element of 'guesswork' which inevitably accompanies attempts to evaluate experimental results, where the true underlying distributions arise from a real device and are therefore unknown.…”

“…In an attempt to make unambiguous, like-for-like comparisons, which are not dependent on the estimation procedures used nor on the unknown underlying distributions arising in experimental scenarios, we follow the theoretic approach advocated in [15] in the context of non-profiled DPA. Namely, our analytic approach is (as far as possible) based on computed theoretic outcomes rather than estimated experimental outcomes, which entails focusing on fully-specified hypothetical leakage scenarios.…”

Behind the Scene of Side Channel Attacks

“…[8,9,11,12,31]). In order to to compare and classify them, theoretical frameworks have then been introduced [11,22,35,39]. Their main purpose is to identify the attacks similarities and differences, and to exhibit contexts where one is better than another.…”