Template Attacks Sample Clauses

Template Attacks. Template attacks are the original form of profiling attacks as proposed for SCA by Xxxxx et al. [7]. These attacks are based on building a multivariate model of the probability distribution of the leakage. The Probability Density Function (PDF) is usually computed assuming that the leakages follow a Gaussian distri- bution, as in the case of unprotected devices (devices without SCA countermea- sures). This is a parametric estimation and we focus on this kind of templates technique because of its fast convergence and the fact that it is widely used and consolidated by many previous works. Nevertheless, it should be mentioned that there are other non-parametric estimations that are able to capture any distribution (which might be helpful with protected devices) like histogram and kernel-based estimators and also some other advanced tools [33]. Σ The main goal in a “traditional” template attack is to deduce the secret (key) used to perform cryptographic operations. Thus, the attacker has to first take measurements of some device’s physical property (commonly the power consumption or the electromagnetic radiation emitted by the device) during the manipulation of some intermediate value iv = f (p, k) related to the plaintext p and the secret key k. In the profiling phase the attacker uses a set of np profiling traces (Tp,k) to build a Gaussian multivariate model (pdf) for each possible iv. In order to do that, the mean vector μp,k and the covariance matrix p,k are estimated for each iv, creating the so-called templates. Then, in the attack phase, from a set of na real power traces and its input data (plaintext), the attacker tries to guess the correct iv value (or its Hamming Weight) by using the maximum likelihood principle. Since iv = f (p, k), knowing iv and p the secret key k can be recovered. Template attacks are optimal from an information-theoretic point of view but in practice, they have several limitations: preprocessing dependency (the effort of an expert in the field is mandatory most of the times), computational complexity problems and the need for dimensionality reduction. The latter is usually solved by selecting only a subset of the typically huge amount of samples in each power trace (Points of Interest [POI] selection [28]), applying another data-dimensionality reduction method as Principal Component Analysis (PCA)