Implement Correlation-Enhanced Power Analysis Collision Attack

[lowrisc]

Implement Correlation-Enhanced Power Analysis Collision Attack

[vogelpi]

Thanks @moidx for creating the issue, I have started working on this.

[vogelpi]

I have been thinking more about this. Whatever I do, the correlations (formula at the bottome of Page 10) are close to 1. For example the plot below shows the correlation of Byte 0 and 1, 0 and 2, 0 and 3 over the full range of deltas:

This tells us that the average traces m_alpha_j (middle formula on Page 10) are too similar. Due to the parallel 16 S-Boxes we probably just get too much noise. On Page 13 (Attack on parallel architectures/influence of noise), the paper says that in parallel implementations, the focus should be on the same S-Box instantiation. For example, with 4 S-Boxes, Byte 0 and Byte 4 should be compared (Appendix B). The paper also says that in fully parallel architectures like ours, the effectiveness much depends on the similarity of S-Boxes. I am not sure what exactly is done in the framework you have access to @moidx and @alphan . Maybe they do a different comparison across rounds.

What we could try out is to modify the capture: Say we first focus on Byte 0 and Byte 1 only and fix the other 14 plaintext bytes. My expectation is to get more variation in the correlations as 14 out of 16 S-Boxes always see the same plaintext. WDYT?

[moidx]

Hi Pirmin, afaik, the tool we use references the same paper. We will spend some time tomorrow recreating the attack with the traces you uploaded and report back results.

Are the correlation plots above for the masked implementation?

[vogelpi]

Update: I've managed to get it working. I needed to perform the attack on the output and to normalize the correlations. The correlation plot now looks more reasonable:

PR #18 is updated accordingly.

[vogelpi]

I am closing this issue as the corresponding PR has been merged already a while ago.