**Time-Frequency Analysis for Second-Order Attacks**

*Pierre BELGARRIC and Shivam BHASIN and Nicolas BRUNEAU and Jean-Luc DANGER and Nicolas DEBANDE and Sylvain GUILLEY and Annelie HEUSER and Zakaria NAJM and Olivier RIOUL*

**Abstract: **Second-order side-channel attacks are used to break first-order masking protections.
A practical reason which often limits the efficiency of second-order attacks is the temporal localisation of the leaking samples.
Several leakage samples must be combined which means high computational power.
For second-order attacks, the computational complexity is quadratic.
At CHES '04, Waddle and Wagner introduced attacks with complexity $\mathcal{O}(n \log_2 n)$ on hardware traces, where $n$ is the window size, by working on traces auto-correlation.
Nonetheless, the two samples must belong to the same window which is (normally) not the case for software implementations.
In this article, we introduce preprocessing tools that improve the efficiency of bi-variate attacks (while keeping a complexity of $\mathcal{O}(n \log_2 n)$),
even if the two samples that leak are far away one from the other (as in software).
We put forward two main improvements.
Firstly, we introduce a method to avoid loosing the phase information.
Next, we empirically notice that keeping the analysis in the frequency domain can be beneficial for the attack.
We apply these attacks in practice on real measurements, publicly available under the DPA Contest v4, to evaluate the proposed techniques.
An attack using a window as large as 4000 points is able to reveal the key in only 3000 traces.

**Category / Keywords: **implementation / Bi-variate attacks, zero-offset 2O-CPA, discrete Hartley transform, leakage in phase

**Original Publication**** (with minor differences): **CARDIS 2013
**DOI: **10.1007/978-3-319-08302-5_8

**Date: **received 10 Aug 2016, last revised 15 Jan 2017

**Contact author: **sylvain guilley at telecom-paristech fr

**Available format(s): **PDF | BibTeX Citation

**Note: **Better explaining the complexity of the 5 new attacks.
Thanks to Jong-Hyeok Lee (Kookmin U., Korea), for pointing the fact the complexity was unclear. Now, we made it very clear that all attacks have complexity $n \log_2 n$.

**Version: **20170115:125852 (All versions of this report)

**Short URL: **ia.cr/2016/772

**Discussion forum: **Show discussion | Start new discussion

[ Cryptology ePrint archive ]