How to Certify the Leakage of a Chip?

Abstract

Evaluating side-channel attacks and countermeasures requires determining the amount of information leaked by a target device. For this purpose, information extraction procedures published so far essentially combine a "leakage model " with a "distinguisher ". Fair evaluations ideally require exploiting a perfect leakage model (i.e. exactly corresponding to the true leakage distribution) with a Bayesian distinguisher. But since such perfect models are generally unknown, density estimation techniques have to be used to approximate the leakage distribution. This raises the fundamental problem that all security evaluations are potentially biased by both estimation and assumption errors. Hence, the best that we can hope is to be aware of these errors. In this paper, we provide and implement methodological tools to solve this issue. Namely, we show how sound statistical techniques allow both quantifying the leakage of a chip, and certifying that the amount of information extracted is close to the maximum value that would be obtained with a perfect model.

Template Attacks vs. Machine Learning Revisited (and the Curse of Dimensionality in Side-Channel Analysis)

“…Yet, we note that in general, assumption errors can also lead to imperfect models, that are more difficult to deal with (see, e.g. [8]) and are certainly worth further investigations. Besides, and as already mentioned, since we now want to compare TA, SVM and RF, we need to evaluate and compare them with security metrics (since the two latter ones do not output the probabilities required to estimate information theoretic metrics).…”

“…It implies that the parametersθ x,k correspond to mean vectorsμ x,k and covariance matricesΣ x,k . However, we note that any other PDF estimation could be considered by the adversary/evaluator [8]. We will further consider two types of TA: in the Naive Template Attack (NTA), we will indeed estimate one covariance matrix per intermediate value; in the Efficient Template Attack (ETA), we will pool the covariance estimates (assumed to be equal) across all intermediate values, as previously suggested in [5].…”

“…making measurement). Of particular interest for the next section will be the context of perfect profiling, where we assume that the adversary's model and the chip distribution are identical (which, strictly speaking, can only happen in simulated experimental settings since any profiling based on real traces will at least be imperfect because of small estimation errors [8]). In this context, the estimated PI will exactly correspond to the (worst-case) estimated MI.…”

Moments-Correlating DPA

“…Second, a fundamental question whenever performing a leakage detection is to determine whether the conclusions were obtained with sufficient confidence. A standard approach for answering this question is to perform cross-validation, which was recently suggested as an important part of leakage certification procedures [7]. Yet, this comes at the cost of additional data and time requirements.…”

Physical functions: the common factor of side-channel and fault attacks?

“…These techniques seem very different at first sight because they require different experimental methods and different algorithms. But several works have been proposed to described them in a common framework [13,17,6]. The aim of such frameworks is to provide strong theoretical basis but practical tools to fairly estimate the information leakage of circuits and thus increase the level of trust in such devices.…”