DPA Success Metrics and Leakage Assessment

• Radboud University presents study notes on DPA Success Metrics and Leakage assessment, presented by Ileana Buhan, March 2024

DPA Attacks

• DPA attacks involve an encryption process E(k) and a distinguisher to analyze leakage models.
• DPA attacks use multiple message inputs (m1...mq) to perform cryptographic encryption E(k), then correlate with leakage models.
• Distinguisher (dq) processes predicted hypothetical values for each target intermediate.

Lecture Topics

• DPA Success Metrics
• Hypothesis Testing: A Primer
• Leakage Assessment

Success Metrics in SCA

• Success Metrics in Side Channel Analysis.

Guessing Entropy/Key Rank

• A key recovery experiment uses q queries to determine the correct value v*.
• The guess vector, denoted as gq, is the ordered ranking of guesses based on distinguisher values.
• Guessing entropy gives the correct key's average position in several experiments
• GE(q) = E[i, gi(v*) ∈ gq]
• GE (q) denotes the guessing entropy, defined as the expected position of the correct key v* within the guess vector gq
• The position of the correct key candidate is averaged over multiple experiments to compute GE(q).
• Helps to measure the average number of key candidates to be tested after a side-channel attack
• Helps to measure how much a side-channel attack reduced the complexity of an exhaustive key search

Success Rate

• Assesses if the correct target intermediate is ranked within the first 'o' positions.
• Success Rate of order o is expressed as SR°(q) = Pr{v* ∈ [g1, ... go]}.

Hypothesis Testing

• Used to check vulnerability to side-channel attacks
• Used to decide that a device is leaking information.
• The two hypothesis are device is or isn't guilty of leaking information
• Null Hypothesis Significance Testing (NHST) used

Types of questions

• Two-sample test- compares the test statics of 2 samples
• One-sample test- compares the test statics to a value

Hypothesis

• A tentative assumption that draws out logical or empirical consequences.

Population vs sample

• Population: The average concentration of salt for the water in the lake is 3%.
• Sample data: what is taken from the population to be tested
• When determining the salt concentration in the lake is testing a single sample: one-sample test

What Is Hypothesis Testing

• A tool for making decisions about a population (lake) given some sample data (glass of water).
• Evaluates two mutually exclusive statements about a population using sample data.

Test Statistic

• A number calculated from sample data- used to evaluate compatibility of experimental results with the hypothesis test.

Null Hypothesis Significance Testing in Three Steps

• Select the null hypothesis (H0) and significance level (α).
• Collect data.
• Test, to see if the null hypothesis can be rejected

Step 1: Selecting the Null Hypothesis

• The null hypothesis is a specific statement about a population parameter formulated by the researcher.
• A good null hypothesis should be interesting to reject and must be specific.
• The polio vaccine has no effect on the probability of developing paralytic polio is a good choice of H0
• Adding free gifts does not increase sales is a good choice of H0
• The power consumption of a device does not depend on the processed data is a good choice of H0
• The ratio of left to right-handed people is equal in the population is a good choice of H0

Step 2: Collecting Sample Data

• The sample collected must be representative of the population
• Known Techniques are: Random sampling, convenience sampling, counting off.

Step 3: Testing the Significance

• Consists of three parts: Null-distribution, P-values, Significance level.
• Null-distribution: Describes the universe where the null hypothesis is true.
• P-values: Measure the surprise, how surprised are we if we observe these data.
• Significance level.

3A: The Null-Distribution

• The sampling distribution of the outcomes for a test statistic under the assumption that the null hypothesis is true.

3B: P-Value

• The probability that a value at least as extreme as the test statistics is observed, assuming the null hypothesis is correct.
• If a small p value results, the observed sample test is unlikely which would case the H0 to be rejected
• Compute a p-value needing: null-distribution and an observed sample statistic.

3C: Significance Level

• The probability at which there is preparation to reject the null hypothesis and conclude the effect is statistically significant.

Leakage Assessment

• Test Vector Leakage Detection (TVLA) most popular leakage detection test.
• Non-Specific or General test: Aims to detect any leakage that depends on input data (or key); aka fixed vs random
• Specific-Test: Targets a specific intermediate value of the cryptographic algorithm that could be exploited to recover keys or other sensitive information; aka fixed -vs- fixed

TVLA

• Compare AES original implementation, to AES with ROSITA.

TVLA 1: Null Hypothesis

• H0: device is NOT guilty of leaking information -> μfixed = μrandom
• Ha: device is guilty of leaking information -> μfixed ≠ μrandom

TVLA 2: Collecting Data

• Involves collecting mean traces from encryption operations E(k) processing message inputs.

TVLA 3: Testing Significance

• Compute the sample statistic (standardized difference or t-score).
• Produce the appropriate null distribution (a t-distribution).
• Compute the p-value.
• Compare the p-value to the chosen significance level (α).

TVLA - Two-Sample t-Test

• First order tests analyze each sample independently.
• Can be expressed as t = (Xf - Xr) / √(sf² + sr² / (n-1))
• Where s² is average of sum from i=1 to n (xi - x)²

Experiment 1 (μf ≠ μr)

• T-scores and corresponding p-values are calculated to evaluate the statistical significance of the observed results.
• Power consumption tests for a device.

Experiment 2 (μf = μr)

• Analyzes power consumption with T-scores and corresponding p-values.

T-Scores and P-Values

• Help to measure the question: if I live in a world where H0 is true, how surprizing is to measure a t-score of -6.019?

TVLA Notes

• TVLA tests are qualitative, not quantitative, measure of leakage.
• When dealing with a high-order implementation, always check if lower orders leak.

Action Time

• TVLA results when using a fixed vs random data.
• Byte-Masked-AES TVLA result real vs. simulatio.

Final Notes

• Rejecting H0 vs. Accepting H0:
• A lack of evidence to support the guilty verdict does not mean the device is "innocent"; "We fail to reject HO" and NOT "we accept HO"
• The evidence supports the decision to reject HO at a significance level α.
• Why would TVLA fail: sample size too small, effect size too small because of wrong fixed input, too much noise, or bad luck from statistical tests being probabilistic.