Redefining the transparency order

Abstract

Abstract. In this paper, we consider the multi-bit Differential Power Analysis (DPA) in the Hamming weight model. In this regard, we revisit the definition of Transparency Order (TO) from the work of Prouff (FSE 2005) and find that the definition has certain limitations. Although this work has been quite well referred in the literature, surprisingly, these limitations remained unexplored for almost a decade. We analyse the definition from scratch, modify it and finally provide a definition with better insight that can theoretically capture DPA in Hamming weight model for hardware implementation with precharge logic. At the end, we confront the notion of (revised) transparency order with attack simulations in order to study to what extent the low transparency order of an s-box impacts the efficiency of a side channel attack against its processing. To the best of our knowledge, this is the first time that such a critical analysis is conducted (even considering the original notion of Prouff). It practically confirms that the transparency order is indeed related to the resistance of the s-box against side-channel attacks, but it also shows that it is not sufficient alone to directly achieve a satisfying level of security. Regarding this point, our conclusion is that the (revised) transparency order is a valuable criterion to consider when designing a cryptographic algorithm, and even if it does not preclude to also use classical countermeasures like masking or shuffling, it enables to improve their effectiveness.

Düşük Saydamlık Derecesine Sahip Küçük Büyüklükte S-kutuları

“…Bu durumda, üstsimge T ile transpozu ve τ ile SD'nin sadeleştirilmiş versiyonunu [16] gös-terirsek, aşagıdaki çıkarımı elde ederiz:…”

“…Son olarak, özgün tanımında [1] sıfır oldugu varsayılan koordinat fonksiyonları arasındaki çapraz ilinti terimleri de hesaba katılarak, SD'nin farklı bir tanımı yapılmıştır [16]. Ele aldıgımız 6 × 6 DSSK'ların degiştirilmiş SD bakımın-dan degerlendirilmesi ve çapraz ilinti terimlerinin FGA dayanıklılıgı üzerindeki etkisinin pratik YKA uygulamalarıyla gösterilmesinin açık bir araştırma problemi oldugu düşünülmektedir.…”

“…SD'nin özgün tanımda [1], S-kutusunun dengeli koordinat fonksiyonlarından oluştugu varsayıl-maktadır. Ayrıca, bükük bir fonksiyonun [15] SD'sini ölçmenin mümkün olmadıgı gösterilmiştir [16]. Bu nedenle, τ için üst sınır n'nin bükük fonksiyonlar tarafından saglandıgını düşünmek dogru degildir.…”

Modified Transparency Order Property: Solution or Just Another Attempt

“…Regarding modified transparency order property, except for the paper that presented the property [17], there are currently no other works. However, when discussing the original transparency order property there are many (sometimes contradicting) results.…”

Confused by Confusion: Systematic Evaluation of DPA Resistance of Various S-boxes

“…Nevertheless, numerous inconclusive results for different ciphers, platforms and leakage models have led to an attempt to redefine the transparency order measure [16]. This new approach also remains to be convincing in practical results.…”