Cryptology ePrint Archive: Report 2016/987
A Key to Success -- Success Exponents for Side-Channel Distinguishers
Sylvain Guilley and Annelie Heuser and Olivier Rioul
Abstract: The success rate is the classical metric for evaluating the
performance of side-channel attacks. It is generally computed empirically from measurements for a particular device or using simulations. Closed-form expressions of success rate are desirable because they provide an explicit functional dependence on relevant parameters such as number of measurements and signal-to-noise ratio which help to understand the effectiveness of a given attack and how one can mitigate its threat by countermeasures. However, such closed-form expressions involve high-dimensional complex statistical functions that are hard to estimate.
In this paper, we define the success exponent (SE) of an arbitrary side-channel distinguisher as the first-order exponent of the success rate as the number of measurements increases. Under fairly general assumptions such as soundness, we give a general simple formula for any arbitrary distinguisher and derive closed-form expressions of it for DoM, CPA, MIA and the optimal distinguisher when the model is known (template attack). For DoM and CPA our results are in line with the literature.
Experiments confirm that the theoretical closed-form expression of the
SE coincides with the empirically computed one, even for reasonably
small numbers of measurements. Finally, we highlight that our study
raises many new perspectives for comparing and evaluating side-channel
attacks, countermeasures and implementations.
Category / Keywords: implementation /
Original Publication (with minor differences): INDOCRYPT 2015
Date: received 12 Oct 2016, last revised 5 Feb 2017
Contact author: sylvain guilley at telecom-paristech fr
Available format(s): PDF | BibTeX Citation
Note: Adding a remark (footnote 7) stating that optimal distinguishers remain optimal if composed by any strictly increasing function.
However, the success exponent (in manageable cases) requires in addition that the distinguisher be additive. Hence, only strictly positive scalings are allowed.
Version: 20170205:233902 (All versions of this report)
Short URL: ia.cr/2016/987
Discussion forum: Show discussion | Start new discussion
[ Cryptology ePrint archive ]