Article: Theoretical and practical aspects of mutual information-based side channel analysis Journal: International Journal of Applied Cryptography (IJACT) 2010 Vol.2 No.2 pp.121 - 138 Abstract: A large variety of side channel analyses performed on embedded devices involve the linear correlation coefficient as wrong-key distinguisher. This coefficient is actually a sound statistical tool to quantify linear dependencies between univariate variables. At CHES 2008, Gierlichs et al. proposed to use the mutual information measure as an alternative to the correlation coefficient since it detects any kind of statistical dependency. Substituting it for the correlation coefficient may indeed be considered as a natural extension of the existing attacks. Nevertheless, the first published applications have raised several open issues. In this paper, we conduct a theoretical analysis of MIA in the Gaussian leakage model to explore the reasons why and when it is a sound key recovery attack. Also, we generalise MIA to higher-orders (i.e., against masked implementations). Secondly, we address the main practical issue of MIA: the mutual information estimation which itself relies on the estimation of statistical distributions. We describe three classical estimation methods and we apply them in the context of MIA. Eventually, we present various attack simulations and practical attack experiments that allow us to check the efficiency of MIA in practice and to compare it to classical correlation-based attacks. Inderscience Publishers - linking academia, business and industry through research

Title: Theoretical and practical aspects of mutual information-based side channel analysis

Authors: E. Prouff, M. Rivain

Addresses: Oberthur Technologies, 71-73, rue des Hautes Patures, 92726 Nanterre Cedex, France. ' CryptoExperts, 37 Cours de Vincennes, F-75020 Paris, France

Abstract: A large variety of side channel analyses performed on embedded devices involve the linear correlation coefficient as wrong-key distinguisher. This coefficient is actually a sound statistical tool to quantify linear dependencies between univariate variables. At CHES 2008, Gierlichs et al. proposed to use the mutual information measure as an alternative to the correlation coefficient since it detects any kind of statistical dependency. Substituting it for the correlation coefficient may indeed be considered as a natural extension of the existing attacks. Nevertheless, the first published applications have raised several open issues. In this paper, we conduct a theoretical analysis of MIA in the Gaussian leakage model to explore the reasons why and when it is a sound key recovery attack. Also, we generalise MIA to higher-orders (i.e., against masked implementations). Secondly, we address the main practical issue of MIA: the mutual information estimation which itself relies on the estimation of statistical distributions. We describe three classical estimation methods and we apply them in the context of MIA. Eventually, we present various attack simulations and practical attack experiments that allow us to check the efficiency of MIA in practice and to compare it to classical correlation-based attacks.

Keywords: applied cryptography; embedded security; side channel analysis; SCA; mutual information analysis; MIA; density estimation; Gaussian leakage model; key recovery attacks; attack simulation; correlation-based attacks.

DOI: 10.1504/IJACT.2010.038306

International Journal of Applied Cryptography, 2010 Vol.2 No.2, pp.121 - 138

Published online: 28 Jan 2011 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article

Title: Theoretical and practical aspects of mutual information-based side channel analysis

Keep up-to-date