9780387718279-c1.zip_zip_security

<html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta charset="utf-8"> <meta name="generator" content="pdf2htmlEX"> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> <link rel="stylesheet" href="https://static.pudn.com/base/css/base.min.css"> <link rel="stylesheet" href="https://static.pudn.com/base/css/fancy.min.css"> <link rel="stylesheet" href="https://static.pudn.com/prod/directory_preview_static/6257928560196e4b84b35cb8/raw.css"> <script src="https://static.pudn.com/base/js/compatibility.min.js"></script> <script src="https://static.pudn.com/base/js/pdf2htmlEX.min.js"></script> <script> try{ pdf2htmlEX.defaultViewer = new pdf2htmlEX.Viewer({}); }catch(e){} </script> <title></title> </head> <body> <div id="sidebar" style="display: none"> <div id="outline"> </div> </div> <div id="pf1" class="pf w0 h0" data-page-no="1"><div class="pc pc1 w0 h0"><img class="bi x0 y0 w1 h1" alt="" src="https://static.pudn.com/prod/directory_preview_static/6257928560196e4b84b35cb8/bg1.jpg"><div class="t m0 x1 h2 y1 ff1 fs0 fc0 sc0 ls0 ws0">Chapter 2</div><div class="t m0 x1 h3 y2 ff1 fs1 fc0 sc0 ls1 ws0">Introduction to Side-Channel Attacks</div><div class="t m0 x1 h4 y3 ff1 fs2 fc0 sc0 ls2 ws0">Franc¸ois-Xavier Standaert</div><div class="t m0 x1 h5 y4 ff1 fs3 fc0 sc0 ls4 ws0">2.1 Introduction</div><div class="t m0 x1 h6 y5 ff2 fs2 fc0 sc0 ls3 ws0">A cryptographic primitive can be considered from two points of view: on the one</div><div class="t m0 x1 h6 y6 ff2 fs2 fc0 sc0 ls5 ws0">hand, it can be viewed as an abstract mathematical object or black box (i.e., a trans-</div><div class="t m0 x1 h6 y7 ff2 fs2 fc0 sc0 ls3 ws0">formation, possibly parameterized by a key, turning some input into some output);</div><div class="t m0 x1 h6 y8 ff2 fs2 fc0 sc0 ls3 ws0">on the other hand, this primitive will in ﬁne have to be implemented in a program</div><div class="t m0 x1 h6 y9 ff2 fs2 fc0 sc0 ls3 ws0">that will run on a given processor, in a given environment, and will therefore present</div><div class="t m0 x1 h6 ya ff2 fs2 fc0 sc0 ls3 ws0">speciﬁc characteristics. The ﬁrst point of view is the one of “classical” cryptanal-</div><div class="t m0 x1 h6 yb ff2 fs2 fc0 sc0 ls5 ws0">ysis; the second one is the one of physical security. Physical attacks on crypto-</div><div class="t m0 x1 h6 yc ff2 fs2 fc0 sc0 ls5 ws0">graphic devices take advantage of implementation-speciﬁc characteristics to recover</div><div class="t m0 x1 h6 yd ff2 fs2 fc0 sc0 ls5 ws0">the secret parameters involved in the computation. They are therefore much less</div><div class="t m0 x1 h6 ye ff2 fs2 fc0 sc0 ls5 ws0">general – since speciﬁc to a given implementation – but often much more power-</div><div class="t m0 x1 h6 yf ff2 fs2 fc0 sc0 ls3 ws0">ful than classical cryptanalysis and are considered very seriously by cryptographic</div><div class="t m0 x1 h6 y10 ff2 fs2 fc0 sc0 ls5 ws0">devices manufacturers.</div><div class="t m0 x2 h6 y11 ff2 fs2 fc0 sc0 ls5 ws0">Such physical attacks are numerous and can be classiﬁed in many ways. The</div><div class="t m0 x1 h6 y12 ff2 fs2 fc0 sc0 ls3 ws0">literature usually sorts them among two orthogonal axes:</div><div class="t m0 x1 h6 y13 ff2 fs2 fc0 sc0 ls6 ws0">1. Invasive vs. non-invasive: Invasive attacks require depackaging the chip to get</div><div class="t m0 x3 h6 y14 ff2 fs2 fc0 sc0 ls5 ws0">direct access to its inside components; a typical example of this is the connection</div><div class="t m0 x3 h6 y15 ff2 fs2 fc0 sc0 ls3 ws0">of a wire on a data bus to see the data transfers. A non-invasive attack only</div><div class="t m0 x3 h6 y16 ff2 fs2 fc0 sc0 ls3 ws0">exploits externally available information (the emission of which is, however,</div><div class="t m0 x3 h6 y17 ff2 fs2 fc0 sc0 ls5 ws0">often unintentional) such as running time, power consumption.</div><div class="t m0 x1 h6 y18 ff2 fs2 fc0 sc0 ls5 ws0">2. Active vs. passive: Active attacks try to tamper with the devices’ proper func-</div><div class="t m0 x3 h6 y19 ff2 fs2 fc0 sc0 ls3 ws0">tioning, for example, fault-induction attacks will try to induce errors in the com-</div><div class="t m0 x3 h6 y1a ff2 fs2 fc0 sc0 ls5 ws0">putation. As opposed, passive attacks will simply observe the devices behavior</div><div class="t m0 x3 h6 y1b ff2 fs2 fc0 sc0 ls3 ws0">during their processing, without disturbing it.</div><div class="t m0 x1 h7 y1c ff2 fs4 fc0 sc0 ls7 ws0">F.-X. Standaert (B)</div><div class="t m0 x1 h8 y1d ff2 fs4 fc0 sc0 ls8 ws0">UCL Crypto Group, Place du Levant 3, B-1348 Louvain-la-Neuve, Belgium</div><div class="t m0 x1 h8 y1e ff2 fs4 fc0 sc0 ls4 ws0">e-mail: fstandae@uclouvain.be</div><div class="t m0 x1 h8 y1f ff2 fs4 fc0 sc0 ls4 ws0">Postdoctoral researcher of the Belgian Fund for Scientiﬁc Research (FNRS).</div><div class="t m0 x1 h8 y20 ff2 fs4 fc0 sc0 ls8 ws0">I.M.R. Verbauwhede (ed.), Secure Integrated Circuits and Systems,</div><div class="t m0 x1 h8 y21 ff2 fs4 fc0 sc0 ls8 ws0">Integrated Circuits and Systems, DOI 10.1007/978-0-387-71829-3</div><div class="t m0 x4 h8 y22 ff2 fs4 fc0 sc0 ls9 ws0">2,</div><div class="t m0 x5 h9 y23 ff2 fs5 fc0 sc0 ls4 ws0">C</div><div class="t m0 x1 ha y24 ff5 fs6 fc0 sc0 ls4 ws0"></div><div class="t m0 x6 h8 y25 ff2 fs4 fc0 sc0 ls4 ws0">Springer Science+Business Media, LLC 2010</div><div class="t m0 x7 h8 y26 ff2 fs4 fc0 sc0 ls9 ws0">27</div></div><div class="pi" data-data='{"ctm":[2.037103,0.000000,0.000000,2.037103,0.000000,0.000000]}'></div></div> </body> </html>

<div id="pf2" class="pf w0 h0" data-page-no="2"><div class="pc pc2 w0 h0"><img class="bi x0 y0 w1 h1" alt="" src="https://static.pudn.com/prod/directory_preview_static/6257928560196e4b84b35cb8/bg2.jpg"><div class="t m0 x1 h8 y27 ff2 fs4 fc0 sc0 ls9 ws0">28 F.-X. Standaert</div><div class="t m0 x2 h6 y28 ff2 fs2 fc0 sc0 ls5 ws0">The side-channel attacks we consider in this chapter are a class of physical</div><div class="t m0 x1 h6 y29 ff2 fs2 fc0 sc0 ls3 ws0">attacks in which an adversary tries to exploit physical information leakages such</div><div class="t m0 x1 h6 y2a ff2 fs2 fc0 sc0 ls3 ws0">as timing information [9], power consumption [10], or electromagnetic radiation</div><div class="t m0 x1 h6 y2b ff2 fs2 fc0 sc0 ls3 ws0">[1]. Since they are non-invasive, passive and they can generally be performed using</div><div class="t m0 x1 h6 y2c ff2 fs2 fc0 sc0 ls3 ws0">relatively cheap equipment, they pose a serious threat to the security of most cryp-</div><div class="t m0 x1 h6 y2d ff2 fs2 fc0 sc0 ls5 ws0">tographic hardware devices. Such devices range from personal computers to small</div><div class="t m0 x1 h6 y2e ff2 fs2 fc0 sc0 ls5 ws0">embedded devices such as smart cards and RFIDs (radio frequency identiﬁcation</div><div class="t m0 x1 h6 y2f ff2 fs2 fc0 sc0 ls3 ws0">devices). Their proliferation in a continuously larger spectrum of applications has</div><div class="t m0 x1 h6 y30 ff2 fs2 fc0 sc0 ls5 ws0">turned the physical security and side-channel issue into a real, practical concern that</div><div class="t m0 x1 h6 y31 ff2 fs2 fc0 sc0 ls5 ws0">we aim to introduce in this chapter.</div><div class="t m0 x2 h6 y32 ff2 fs2 fc0 sc0 ls3 ws0">For this purpose, we start by covering the basics of side-channel attacks. We</div><div class="t m0 x1 h6 y33 ff2 fs2 fc0 sc0 ls5 ws0">discuss the origin of unintended leakages in recent microelectronic technologies</div><div class="t m0 x1 h6 y34 ff2 fs2 fc0 sc0 ls5 ws0">and describe how simple measurement setups can be used to recover and exploit</div><div class="t m0 x1 h6 y35 ff2 fs2 fc0 sc0 ls3 ws0">these physical features. Then, we introduce some classical attacks: simple power</div><div class="t m0 x1 h6 y36 ff2 fs2 fc0 sc0 ls3 ws0">analysis (SPA) and differential power analysis (DPA). In the second part of the</div><div class="t m0 x1 h6 y37 ff2 fs2 fc0 sc0 ls5 ws0">chapter, we put forward the different steps of an actual side-channel attack through</div><div class="t m0 x1 h6 y38 ff2 fs2 fc0 sc0 ls3 ws0">two illustrative examples. We take advantage of these examples to stress a number of</div><div class="t m0 x1 h6 y39 ff2 fs2 fc0 sc0 ls5 ws0">practical concerns regarding the implementation of side-channel attacks and discuss</div><div class="t m0 x1 h6 y3a ff2 fs2 fc0 sc0 ls3 ws0">their possible improvements. Finally, we list a number of countermeasures to reduce</div><div class="t m0 x1 h6 y3b ff2 fs2 fc0 sc0 ls5 ws0">the impact of physical information leakages.</div><div class="t m0 x1 h5 y3c ff1 fs3 fc0 sc0 ls4 ws0">2.2 Basics of Side-Channel Attacks</div><div class="t m0 x1 hb y3d ff6 fs3 fc0 sc0 lsa ws0">2.2.1 Origin of the Leakages</div><div class="t m0 x1 h6 y3e ff2 fs2 fc0 sc0 ls5 ws0">Side-channel attacks are closely related to the existence of physically observable</div><div class="t m0 x1 h6 y3f ff2 fs2 fc0 sc0 ls5 ws0">phenomenons caused by the execution of computing tasks in present microelec-</div><div class="t m0 x1 h6 y40 ff2 fs2 fc0 sc0 ls3 ws0">tronic devices. For example, microprocessors consume time and power to perform</div><div class="t m0 x1 h6 y41 ff2 fs2 fc0 sc0 ls3 ws0">their assigned tasks. They also radiate an electromagnetic ﬁeld, dissipate heat,</div><div class="t m0 x1 h6 y42 ff2 fs2 fc0 sc0 ls3 ws0">and even make some noise [22]. As a matter of fact, there are plenty of infor-</div><div class="t m0 x1 h6 y43 ff2 fs2 fc0 sc0 ls5 ws0">mation sources leaking from actual computers that can consequently be exploited</div><div class="t m0 x1 h6 y44 ff2 fs2 fc0 sc0 ls5 ws0">by malicious adversaries. In this chapter, we focus on power consumption and</div><div class="t m0 x1 h6 y45 ff2 fs2 fc0 sc0 ls3 ws0">electromagnetic radiation that are two frequently considered side-channels in prac-</div><div class="t m0 x1 h6 y46 ff2 fs2 fc0 sc0 ls5 ws0">tical attacks. Since a large part of present digital circuits is based on CMOS</div><div class="t m0 x1 h6 y47 ff2 fs2 fc0 sc0 ls3 ws0">gates, this introduction also only focuses on this technology. As will be men-</div><div class="t m0 x1 h6 y48 ff2 fs2 fc0 sc0 ls5 ws0">tioned in Section 2.4, other types of logic circuits could be considered for side-</div><div class="t m0 x1 h6 y49 ff2 fs2 fc0 sc0 ls5 ws0">channel attacks, sometimes providing improved resistance compared with standard</div><div class="t m0 x1 h6 y4a ff2 fs2 fc0 sc0 lsb ws0">CMOS.</div><div class="t m0 x2 h6 y4b ff3 fs2 fc0 sc0 ls5 ws0">Power consumption in CMOS devices. Static CMOS gates have three distinct</div><div class="t m0 x1 h6 y4c ff2 fs2 fc0 sc0 ls3 ws0">dissipation sources [19]. The ﬁrst one is due to the leakage currents in transistors.</div><div class="t m0 x1 h6 y4d ff2 fs2 fc0 sc0 ls3 ws0">The second one is due to the so-called short-circuit currents: there exists a short</div><div class="t m0 x1 h6 y4e ff2 fs2 fc0 sc0 ls5 ws0">period during the switching of a gate while NMOS and PMOS are conducting</div></div><div class="pi" data-data='{"ctm":[2.037103,0.000000,0.000000,2.037103,0.000000,0.000000]}'></div></div>

<div id="pf3" class="pf w0 h0" data-page-no="3"><div class="pc pc3 w0 h0"><img class="bi x0 y0 w1 h1" alt="" src="https://static.pudn.com/prod/directory_preview_static/6257928560196e4b84b35cb8/bg3.jpg"><div class="t m0 x1 h8 y27 ff2 fs4 fc0 sc0 ls4 ws0">2 Introduction to Side-Channel Attacks 29</div><div class="t m0 x1 hc y4f ff1 fs4 fc0 sc0 ls7 ws0">Fig. 2.1 Charge vs. discharge of a CMOS inverter</div><div class="t m0 x1 h6 y50 ff2 fs2 fc0 sc0 ls5 ws0">simultaneously. Finally, the dynamic power consumption is due to the charge and</div><div class="t m0 x1 h6 y51 ff2 fs2 fc0 sc0 lsb ws0">discharge of the load capacitance C</div><div class="t m0 x8 hd y52 ff3 fs7 fc0 sc0 ls4 ws0">L</div><div class="t m0 x9 h6 y53 ff2 fs2 fc0 sc0 ls5 ws0">represented by the dotted paths in Fig. 2.1.</div><div class="t m0 x1 h6 y54 ff2 fs2 fc0 sc0 ls5 ws0">The respective importance of these dissipation sources typically depends on tech-</div><div class="t m0 x1 h6 y55 ff2 fs2 fc0 sc0 ls5 ws0">nology scalings. But the dynamic power consumption is particularly relevant from</div><div class="t m0 x1 h6 y56 ff2 fs2 fc0 sc0 ls5 ws0">a side-channel point of view since it determines a simple relationship between a</div><div class="t m0 x1 h6 y57 ff2 fs2 fc0 sc0 ls5 ws0">device’s internal data and its externally observable power consumption. It can be</div><div class="t m0 x1 h6 y58 ff2 fs2 fc0 sc0 ls6 ws0">written as</div><div class="t m0 xa he y59 ff3 fs2 fc0 sc0 ls4 ws0">P</div><div class="t m0 xb hf y5a ff7 fs7 fc0 sc0 ls4 ws0">dyn</div><div class="t m0 xc he y5b ff5 fs2 fc0 sc0 ls4 ws0">= C</div><div class="t m0 xd hd y5a ff3 fs7 fc0 sc0 ls4 ws0">L</div><div class="t m0 xe he y5b ff3 fs2 fc0 sc0 ls4 ws0">V</div><div class="t m0 xf h10 y5c ff2 fs7 fc0 sc0 ls4 ws0">2</div><div class="t m0 x10 hd y5d ff3 fs7 fc0 sc0 lsc ws0">DD</div><div class="t m0 x11 he y5b ff3 fs2 fc0 sc0 ls4 ws0">P</div><div class="t m0 x12 h10 y5a ff2 fs7 fc0 sc0 ls4 ws0">0→1</div><div class="t m0 x13 h6 y5b ff3 fs2 fc0 sc0 ls4 ws0">f (2.1)</div><div class="t m0 x1 h6 y5e ff2 fs2 fc0 sc0 ls5 ws0">where P</div><div class="t m0 x14 h10 y5f ff2 fs7 fc0 sc0 ls4 ws0">0→1</div><div class="t m0 x15 h6 y60 ff3 fs2 fc0 sc0 ls4 ws0">f is called the switching activity, P</div><div class="t m0 x16 h10 y5f ff2 fs7 fc0 sc0 ls4 ws0">0→1</div><div class="t m0 x17 h6 y60 ff2 fs2 fc0 sc0 ls3 ws0">is the probability of a 0 → 1</div><div class="t m0 x1 h6 y61 ff2 fs2 fc0 sc0 ls4 ws0">transition, f is the work frequency of the device, and V</div><div class="t m0 x18 hd y62 ff3 fs7 fc0 sc0 lsc ws0">DD</div><div class="t m0 x19 h6 y63 ff2 fs2 fc0 sc0 ls3 ws0">is the voltage of the</div><div class="t m0 x1 h6 y64 ff2 fs2 fc0 sc0 ls5 ws0">power supply. In CMOS devices, when measuring the power consumption (either at</div><div class="t m0 x1 h6 y65 ff2 fs2 fc0 sc0 ls5 ws0">the ground pin or at the power pin), the highest peak will appear during the charge</div><div class="t m0 x1 h6 y66 ff2 fs2 fc0 sc0 ls5 ws0">of the capacitance (i.e., 0 → 1 event). During the discharge, the only current we can</div><div class="t m0 x1 h6 y67 ff2 fs2 fc0 sc0 ls5 ws0">measure is the short-circuit path current. This data-dependent power consumption</div><div class="t m0 x1 h6 y68 ff2 fs2 fc0 sc0 ls3 ws0">is the origin of side-channel information leakages.</div><div class="t m0 x2 h6 y69 ff3 fs2 fc0 sc0 ls3 ws0">EM radiation in CMOS devices. Just as the power consumption of CMOS devices</div><div class="t m0 x1 h6 y6a ff2 fs2 fc0 sc0 ls3 ws0">is data-dependent, it can be showed that its electromagnetic radiation also is. From</div><div class="t m0 x1 h6 y6b ff2 fs2 fc0 sc0 ls5 ws0">a t heoretical point of view, electromagnetic leakages are usually explained from the</div><div class="t m0 x1 h6 y6c ff2 fs2 fc0 sc0 ls3 ws0">Biot–Savart law:</div><div class="t m0 x1a h4 y6d ff3 fs2 fc0 sc0 ls4 ws0">dB =</div><div class="t m0 x1b h4 y6e ff8 fs2 fc0 sc0 ls4 ws0">μId l ×r</div><div class="t m0 x1c h6 y6f ff2 fs2 fc0 sc0 ls4 ws0">4πr</div><div class="t m0 x1d h10 y70 ff2 fs7 fc0 sc0 ls4 ws0">2</div><div class="t m0 x1e h6 y71 ff2 fs2 fc0 sc0 ls3 ws0">(2.2)</div><div class="t m0 x1 h6 y72 ff2 fs2 fc0 sc0 ls5 ws0">where μ is the magnetic permeability, I is the current carried on a conductor of</div><div class="t m0 x1 h4 y73 ff2 fs2 fc0 sc0 ls3 ws0">inﬁnitesimal length dl, r is the unit vector specifying the distance between the cur-</div><div class="t m0 x1 h6 y74 ff2 fs2 fc0 sc0 lsb ws0">rent element and the ﬁeld point, and r is the distance from the current element to the</div><div class="t m0 x1 h6 y75 ff2 fs2 fc0 sc0 ls5 ws0">ﬁeld point. Although such a simple equation does not describe the exact (complex)</div><div class="t m0 x1 h6 y76 ff2 fs2 fc0 sc0 ls3 ws0">radiation of an integrated circuit, it already emphasizes two important facts: (1) the</div></div><div class="pi" data-data='{"ctm":[2.037103,0.000000,0.000000,2.037103,0.000000,0.000000]}'></div></div>

<div id="pf4" class="pf w0 h0" data-page-no="4"><div class="pc pc4 w0 h0"><img class="bi x0 y0 w1 h1" alt="" src="https://static.pudn.com/prod/directory_preview_static/6257928560196e4b84b35cb8/bg4.jpg"><div class="t m0 x1 h8 y27 ff2 fs4 fc0 sc0 ls9 ws0">30 F.-X. Standaert</div><div class="t m0 x1 h6 y28 ff2 fs2 fc0 sc0 ls5 ws0">ﬁeld is data-dependent due to the dependence on the current intensity and (2) the</div><div class="t m0 x1 h6 y29 ff2 fs2 fc0 sc0 ls5 ws0">ﬁeld orientation depends on the current direction. This data-dependent radiation</div><div class="t m0 x1 h6 y2a ff2 fs2 fc0 sc0 ls5 ws0">is again the origin of side-channel information leakages. In general, any physi-</div><div class="t m0 x1 h6 y2b ff2 fs2 fc0 sc0 ls5 ws0">cally observable phenomenon that can be related to the internal conﬁguration or</div><div class="t m0 x1 h6 y2c ff2 fs2 fc0 sc0 ls5 ws0">activity of a cryptographic device can be a source of useful information to a mali-</div><div class="t m0 x1 h6 y2d ff2 fs2 fc0 sc0 ls3 ws0">cious adversary.</div><div class="t m0 x2 h6 y2e ff3 fs2 fc0 sc0 ls5 ws0">Leakage models. From the previous physical facts, side-channel adversaries have</div><div class="t m0 x1 h6 y2f ff2 fs2 fc0 sc0 ls5 ws0">derived a number of (more or less sophisticated) leakage models. They can be used</div><div class="t m0 x1 h6 y30 ff2 fs2 fc0 sc0 ls5 ws0">both to simulate the attacks or to improve an attack’s efﬁciency. For example, the</div><div class="t m0 x1 h6 y31 ff3 fs2 fc0 sc0 ls5 ws0">Hamming distance model assumes that, when a value x</div><div class="t m0 x1f h10 y77 ff2 fs7 fc0 sc0 ls4 ws0">0</div><div class="t m0 x20 h6 y78 ff2 fs2 fc0 sc0 ls5 ws0">contained in a CMOS</div><div class="t m0 x1 h6 y79 ff2 fs2 fc0 sc0 ls5 ws0">device switches into a value x</div><div class="t m0 x21 h10 y7a ff2 fs7 fc0 sc0 ls4 ws0">1</div><div class="t m0 x22 h6 y7b ff2 fs2 fc0 sc0 ls5 ws0">, the actual side-channel leakages are correlated with</div><div class="t m0 x1 h6 y7c ff2 fs2 fc0 sc0 ls5 ws0">the Hamming distance of these values, namely H</div><div class="t m0 x23 hd y7d ff3 fs7 fc0 sc0 ls4 ws0">D</div><div class="t m0 x24 h6 y7e ff2 fs2 fc0 sc0 ls4 ws0">(x</div><div class="t m0 x25 h10 y7d ff2 fs7 fc0 sc0 ls4 ws0">0</div><div class="t m0 x26 he y7e ff8 fs2 fc0 sc0 ls4 ws0">, x</div><div class="t m0 x27 h10 y7d ff2 fs7 fc0 sc0 ls4 ws0">1</div><div class="t m0 x28 h6 y7e ff2 fs2 fc0 sc0 ls4 ws0">) = H</div><div class="t m0 x29 hd y7d ff3 fs7 fc0 sc0 ls4 ws0">W</div><div class="t m0 x2a h6 y7e ff2 fs2 fc0 sc0 ls4 ws0">(x</div><div class="t m0 x2b h10 y7d ff2 fs7 fc0 sc0 ls4 ws0">0</div><div class="t m0 x2c he y7e ff5 fs2 fc0 sc0 ls4 ws0">⊕ x</div><div class="t m0 x2d h10 y7d ff2 fs7 fc0 sc0 ls4 ws0">1</div><div class="t m0 x2e h6 y7e ff2 fs2 fc0 sc0 ls4 ws0">). The</div><div class="t m0 x1 h6 y7f ff3 fs2 fc0 sc0 lsb ws0">Hamming weigh model is even simpler and assumes that, when a value x</div><div class="t m0 x2f h10 y80 ff2 fs7 fc0 sc0 ls4 ws0">0</div><div class="t m0 x30 h6 y81 ff2 fs2 fc0 sc0 ls3 ws0">is com-</div><div class="t m0 x1 h6 y82 ff2 fs2 fc0 sc0 ls5 ws0">puted in a device, the actual side-channel leakages are correlated with the Hamming</div><div class="t m0 x1 h6 y83 ff2 fs2 fc0 sc0 ls5 ws0">weight of this value, namely H</div><div class="t m0 xb hd y84 ff3 fs7 fc0 sc0 ls4 ws0">W</div><div class="t m0 x31 h6 y85 ff2 fs2 fc0 sc0 ls4 ws0">(x</div><div class="t m0 x32 h10 y84 ff2 fs7 fc0 sc0 ls4 ws0">0</div><div class="t m0 x33 h6 y85 ff2 fs2 fc0 sc0 ls3 ws0">). As will be emphasized in Section 2.4, good</div><div class="t m0 x1 h6 y86 ff2 fs2 fc0 sc0 ls5 ws0">leakage models have a strong impact on the efﬁciency of a side-channel attack.</div><div class="t m0 x1 h6 y87 ff2 fs2 fc0 sc0 ls5 ws0">Hamming weight and distance models assume both that there are no differences</div><div class="t m0 x1 h6 y88 ff2 fs2 fc0 sc0 lsb ws0">between 0 → 1 and 1 → 0 events and that every bit in an implementation con-</div><div class="t m0 x1 h6 y89 ff2 fs2 fc0 sc0 ls3 ws0">tributes identically to the overall power consumption. Improved models relax these</div><div class="t m0 x1 h6 y8a ff2 fs2 fc0 sc0 ls3 ws0">assumptions, e.g., by considering different leakages for the 0 → 1 and 1 → 0 events</div><div class="t m0 x1 h6 y8b ff2 fs2 fc0 sc0 ls5 ws0">[18], assigning different weights to the leakage contributions of an implementa-</div><div class="t m0 x1 h6 y8c ff2 fs2 fc0 sc0 ls3 ws0">tion’s different parts [23] by considering advanced statistical tools to characterize a</div><div class="t m0 x1 h6 y8d ff2 fs2 fc0 sc0 ls5 ws0">device’s leakage [6].</div><div class="t m0 x1 hb y8e ff6 fs3 fc0 sc0 ls4 ws0">2.2.2 Measurement Setups</div><div class="t m0 x1 h6 y8f ff2 fs2 fc0 sc0 ls5 ws0">As far as the practical implementation of a side-channel attack is concerned, the</div><div class="t m0 x1 h6 y90 ff2 fs2 fc0 sc0 ls5 ws0">building of a good measurement setup is of primary importance. They aim to convert</div><div class="t m0 x1 h6 y91 ff2 fs2 fc0 sc0 ls5 ws0">the physical features of an observable device into digitally exploitable data. Such</div><div class="t m0 x1 h6 y92 ff2 fs2 fc0 sc0 ls5 ws0">setups are generally made of the following elements [12]:</div><div class="t m0 x1 h6 y93 ff2 fs2 fc0 sc0 ls5 ws0">– A target cryptographic device, e.g., a smart card, FPGA of integrated circuit run-</div><div class="t m0 x34 h6 y94 ff2 fs2 fc0 sc0 ls3 ws0">ning some cryptographic primitive, e.g., a block cipher.</div><div class="t m0 x1 h6 y95 ff2 fs2 fc0 sc0 lsb ws0">– If not embedded on-chip, an external power supply, clock generator, and any</div><div class="t m0 x34 h6 y96 ff2 fs2 fc0 sc0 ls3 ws0">additional circuitry required for the device to run properly.</div><div class="t m0 x1 h6 y97 ff2 fs2 fc0 sc0 ls5 ws0">– A leakage probe. For example, power consumption can be monitored by i nserting</div><div class="t m0 x34 h6 y98 ff2 fs2 fc0 sc0 ls3 ws0">a small resistor within the supply chain of the target device. Electromagnetic</div><div class="t m0 x34 h6 y99 ff2 fs2 fc0 sc0 ls5 ws0">radiation can be captured with simple handmade coils.</div><div class="t m0 x1 h6 y9a ff2 fs2 fc0 sc0 ls3 ws0">– An acquisition device, e.g., digital oscilloscope with sufﬁcient features (typically,</div><div class="t m0 x34 h6 y9b ff2 fs2 fc0 sc0 ls3 ws0">1 GS/s, 8 bits of resolution, etc.), connected to a computer for the statistical anal-</div><div class="t m0 x34 h6 y9c ff2 fs2 fc0 sc0 ls5 ws0">ysis of the side-channel traces.</div></div><div class="pi" data-data='{"ctm":[2.037103,0.000000,0.000000,2.037103,0.000000,0.000000]}'></div></div>