Cryptology ePrint Archive: Report 2016/987

A Key to Success -- Success Exponents for Side-Channel Distinguishers

Sylvain Guilley and Annelie Heuser and Olivier Rioul

Abstract: The success rate is the classical metric for evaluating the performance of side-channel attacks. It is generally computed empirically from measurements for a particular device or using simulations. Closed-form expressions of success rate are desirable because they provide an explicit functional dependence on relevant parameters such as number of measurements and signal-to-noise ratio which help to understand the effectiveness of a given attack and how one can mitigate its threat by countermeasures. However, such closed-form expressions involve high-dimensional complex statistical functions that are hard to estimate.

In this paper, we define the success exponent (SE) of an arbitrary side-channel distinguisher as the first-order exponent of the success rate as the number of measurements increases. Under fairly general assumptions such as soundness, we give a general simple formula for any arbitrary distinguisher and derive closed-form expressions of it for DoM, CPA, MIA and the optimal distinguisher when the model is known (template attack). For DoM and CPA our results are in line with the literature.

Experiments confirm that the theoretical closed-form expression of the SE coincides with the empirically computed one, even for reasonably small numbers of measurements. Finally, we highlight that our study raises many new perspectives for comparing and evaluating side-channel attacks, countermeasures and implementations.

Category / Keywords: implementation /

Original Publication (with minor differences): INDOCRYPT 2015

Date: received 12 Oct 2016, last revised 5 Feb 2017

Contact author: sylvain guilley at telecom-paristech fr

Available format(s): PDF | BibTeX Citation

Note: Adding a remark (footnote 7) stating that optimal distinguishers remain optimal if composed by any strictly increasing function. However, the success exponent (in manageable cases) requires in addition that the distinguisher be additive. Hence, only strictly positive scalings are allowed.

Version: 20170205:233902 (All versions of this report)

Short URL:

Discussion forum: Show discussion | Start new discussion

[ Cryptology ePrint archive ]