Laboratorul 07 - Correlation Power Analysis
In this lab we'll implement a side-channel attack known as Correlation Power Analysis.
The principle is quite simple:
- Choose your target (generally the S-box output of some block cipher - in our case AES)
- Obtain a large number (thousands) of leakage samples for that target, when processing different plaintexts
- Choose a suitable leakage model (usually the hamming weight of the target value)
- For each possible key candidate (e.g. all values from 0 to 255), compute Pearson's correlation coefficient between the leakage model estimate for that key candidate and the leakage traces.
- Decide for the key that gives maximum correlation
We'll discuss more in detail at the lab.
In this lab we shall use Matlab or Octave (MATLAB is preferred for speed reasons):
Octave main page Download link for Windows
You might also need these additional packages:
Use these files as starting point: lab6.zip
Exercise 1 (2p)
Open the file lab6_cpa.m and plot the leakage data from simdata.mat and the correlation for the first key hypothesis.
Exercise 2 (4p)
Compute the correlation for all the possible key values. Plot this correlation against all the possible key values. That is, use the plot(x, y) command, where x is a vector having values [0:255] (or [1:256]) and y is a vector with the correlation values corresponding to each key value).
Exercise 3 (4p)
To evaluate the security of a device against these attacks, evaluation labs typically compute a measure known as the success rate, which measures how effective is a side channel attack. To compute the success rate, do the following.
Run the attack on different sets of traces (e.g. R=50 subsets of N traces) and for each attack determine whether the correct key (K) leads to the highest correlation. Then compute the success rate as the number of times the correct key lead to the highest correlation divided by the total number of experiments: $SR={#correct key first}/{#experiments}$
Compute the success rate (SR) for different amounts of leakage traces (e.g. $N \in \{10, 20, 50, 100, 200, 500, 1000\}$) and then plot the SR as a function of N.
