On Adaptive Bandwidth Selection for Efficient MIA

Abstract

Recently, a generic DPA attack using the mutual information index as the side channel distinguisher has been introduced. Mutual Information Analysis’s (MIA) main interest is its claimed genericity. However, it requires the estimation of various probability density functions (PDF), which is a task that involves the complicated problem of selecting tuning parameters. This problem could be the cause of the lower efficiency of MIA that has been reported. In this paper, we introduce an approach that selects the tuning parameters with the goal of optimizing the performance of MIA. Our approach differs from previous works in that it maximizes the ability of MIA to discriminate one key among all guesses rather than optimizing the accuracy of PDF estimates. Application of this approach to various leakage traces confirms the soundness of our proposal.

A Appendix

From Sect. 2, modeling leakage consists essentially in choosing a selection function $L$ to classify the leakage samples $o(m)$, based on the predictions $v_{m,k}$ according to $m \in \mathcal {M}$ and $k \in \mathcal {K}$, either at the word level or at the bit level (Multi-bit).

• Word. In view of the additive property of the power consumption in CMOS technologies, traditional leakage models inspired are based on works in [2, 21], aims at mapping activities of components using intermediate values to the physical observations by equal summation of $w$ bits

  $$\begin{aligned} L:\mathbb {F}_2^w&\rightarrow [0;w]\nonumber \\ v_{m,k}=([v_{m,k}]_1,\ldots ,[v_{m,k}]_w)&\rightarrow L(v_{m,k})={\displaystyle \sum _{b=1}^{w}[v_{m,k}]_b}. \end{aligned}$$

  (16)

  with $[.]_b : \mathbb {F}_2^w \rightarrow \mathbb {F}_2$ being the projection onto the $i^{th}$ bit. (AES (resp. DES) output Sbox : $w=8$ (resp. $w=5$))

• Multi-bit. Alternatively, as mentioned in [22], the leakage could be analyzed bit by bit, summing up at the end each equal contribution. The multi-bit version of a distinguisher $\mathcal {D}_{k,t}$ ($\mathcal {D} \equiv MI$ in this paper) is calculated as

  $$\begin{aligned} \mathcal {D}_{k,t}={\displaystyle \sum _{b=1}^{w}\left| [\mathcal {D}_{k,t}]_{b}\right| }. \end{aligned}$$

  (17)

  This model seems better adapted to the EM side-channel for which the assumption of additivity may be less plausible. Initially introduced for the distinguisher using the difference of means, it can be extended to other distinguishers [23].