Using Second-Order Power Analysis to Attack DPA Resistant Software

By Thomas S. Messerges. Workshop on Cryptographic Hardware and Embedded Systems, 2000

554 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Hardware and Architecture

View Paper: https://www.semanticscholar.org/paper/f1c19831826e4f4ec76cdb765c86948cbef47678

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Hardware and Architecture

Citations in the corpus

Introduction to differential power analysis (2011, background): “16 Masked shares of a secret This is the traditional secondorderDPA attack described in literature [45,46,34,47–50].”
Correlation Power Analysis with a Leakage Model (2004, background): “In theory sophisticated attacks such as higher order analysis [15] can overcome the data masking method; but they are easy to thwart in practice by using desynchronization for instance.”
I Know What You See: Power Side-Channel Attack on Convolutional Neural Network Accelerators (2018, background): “By analyzing the dierence of multiple power traces with diverse inputs, aackers are able to uncover the secret key in widely used symmetric encryption standards, such as DES [17] and AES [3, 9, 23].”
Mutual Information Analysis: a Comprehensive Study (2011, methodology): “Two of them are commonly used: the product combining [1] which consists in multiplying the two signals and the absolute difference combining [18] which computes the absolute value of the difference between two signals.”
Provably Secure Higher-Order Masking of AES (2010, background): “However, this kind of masking have been shown to be efficiently breakable in practice by second-order SCA [24,27,42].”
Successfully Attacking Masked AES Hardware Implementations (2005, background): “It is important to point out that it is not necessary to perform higher-order DPA attacks (see [9] and [18]) in order to exploit this side-channel leakage.”
Hardware Countermeasures against DPA ? A Statistical Analysis of Their Effectiveness (2004, background): “The second one is that many algorithmic countermeasures do not provide sufficient protection against higher-order DPA attacks [13] or sophisticated SPA attacks [11,18].”
Multiplicative Masking and Power Analysis of AES (2002, background): “However, such a solution may be vulnerable to a relatively simple second-order DPA attack similar to the one proposed in [12], especially for implementations in which the executions of S-box transformations are well separated in time (e.”
An Implementation of DES and AES, Secure against Some Attacks (2001, methodology): “Fundamentally we are subject to second-order DPA (see [8,9]) due to the method of masking.”
Mutual Information Analysis (2008, background): “Both theory and practice have been developed and as a consequence several more advanced power analysis attacks such as correlation [2], template [3], and higher-order attacks [11] have been proposed as well as a broad range of countermeasures [4,6,7,10].”
Statistical Analysis of Second Order Differential Power Analysis (2009, background): “For instance (neglecting the noise), if we have j 1 2j > n, then 1 2 þHðZ MÞ HðMÞ is either strictly positive or strictly negative and, as noticed by Messerges in [11], difference without absolute value is not a sound combining function (i.”
The World is Not Enough: Another Look on Second-Order DPA (2010, background): “[10, 13, 23]) in which he “combines” the leakages corresponding to the d shares in order to extract key-dependent information.”
A dynamic and differential CMOS logic with signal independent power consumption to withstand differential power analysis on smart cards (2002, background): “DPA has been modified to handle masking [5].”
Threshold Implementations Against Side-Channel Attacks and Glitches (2006, background): “If the attacker can corrupt several functions simultaneously, then the attack is called a higher-order attack [13, 17].”
Template Attacks (2002, background): “Since Paul Kocher’s original paper [12], a number of devastating attacks, such as Simple Power Analysis (SPA) and Differential Power Analysis (DPA) have been reported on a wide variety of cryptographic implementations [15,18, 6,11,17,8,3,4,10,16,7,5,21].”