# Simulation of Timing Attacks and Challenges for Early Side-Channel Security Analysis

Marcel Schoppmeier, Paula Herber

► To cite this version:

Marcel Schoppmeier, Paula Herber. Simulation of Timing Attacks and Challenges for Early Side-Channel Security Analysis. 7th International Embedded Systems Symposium (IESS), Nov 2022, Lippstadt, Germany. pp.16-27, 10.1007/978-3-031-34214-1_2 . hal-04645290

HAL Id: hal-04645290

https://inria.hal.science/hal-04645290v1

Submitted on 11 Jul 2024

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# Simulation of Timing Attacks and Challenges for Early Side-Channel Security Analysis

Marcel Schoppmeier and Paula Herber

University of Münster, Einsteinstr. 62, 48149 Münster, Germany
{marcel.schoppmeier,paula.herber}@uni-muenster.de

**Abstract.** Side-channel attacks (SCA) enable attackers to gain access to non-disclosed information by measuring emissions of a system, e.g., timing, electromagnetic waves or power consumption. The emissions of a system can typically only be measured on the final system. As a consequence, the analysis of such security threats is often only possible at a very late stage in the development process. In this paper, we present an approach to simulate timing attacks in early stages of the development process with SystemC and discuss the potentials and limitations of this approach. Our results show that the simulation of SCA in SystemC is generally possible, but currently difficult due to an explanation gap. It is, to the best of our knowledge, not well understood where the causal connection between physical quantities and data, which is exploited in SCA, comes from. This poses a major challenge for the design of precise models that accurately reflect physical insights for early security analysis.

**Keywords:** Side-Channel Attacks · Modeling and Simulation · SystemC

## 1 Introduction

Many cyber-physical systems (CPS) are safety-critical (e.g. cars or airplanes) or handle sensitive data (e.g. cryptowallets or health monitoring devices). Thus, it is important that they are secured against malicious attacks. In side-channel attacks (SCA), the attacker extracts non-disclosed information provided by emissions of the CPS, e.g., timing information, power consumption, electromagnetic waves, sound or other output signals. Securing CPS against SCA is difficult for three major reasons: First, CPS are directly exposed to the attacker and offer a large attack surface. Second, how strongly secret information correlates with hardware activities can not easily be analyzed early in the development process because the emissions of a system can only be measured for the produced system. Third, a prerequisite to model and simulate CPS and analyze vulnerabilities early is a detailed model of their attack surface and the physical information that might be exploited with SCA. Such a model usually does not exist.

In this paper, we present a modeling and simulation approach for timing attacks using the system level design language SystemC. Our key idea is to describe the system and its physical emissions on a comparatively high level of abstraction. In this way, we can identify side-channel vulnerabilities early in the
design process. SystemC [8] is a C++ library and provides an event-driven sim-
ulation interface. This enables the simulation of an hardware-software-co-design
on various levels of abstraction. We chose SystemC as a library for the simulation
of physical quantities because it offers the possibility to simulate CPS in an early
design phase. Results can be achieved with suitable models of physical quanti-
ties, which serve to assess the security. Furthermore, modeling can be specified
and implemented on a more concrete design level if the required information is
available. However, as physical information is only abstractly available in early
design stages, an attack or related physical information that is not precisely cap-
tured cannot provide any insights into system security. In order to investigate
this in more detail, we added physical information in several steps to be able to
examine what effect it has on the capabilites to model an attack. This enabled
us to identify details that are important when modeling physical attacks. We
have visualized the results such that we could compare and analyze them. As
a representative exemplary attack, we chose the timing attack by Kocher [10],
which is the first and most cited publication on this topic.

The rest of this paper is structured as follows: In Sec. 2, we introduce pre-
liminaries. In Sec. 3, we discuss related work. In Sec. 4, we present our approach
for modeling and simulation of timing attacks in SystemC. Then, we discuss
modeling and simulation of other SCA. We conclude in Sec. 5.

## 2 Overview: Side-Channel and Timing attacks

A SCA is a security exploit that gathers information from side-channels, e.g., from cache data or from physical parameters like power consumption, execution time, electromagnetic emission, noise or light [16]. This information is used to deduce secrets of a CPS (for example, a keyphrase) by analyzing the observed data. This is possible because there is often a correlation between the measured data and the hidden internal state of the processing device, which is itself related to the secret key. As an attack is very specific to a given implementation, SCA are less general, but often much more powerful than classical cryptanalysis. A secure system depends not only on an encryption algorithm, but also on its implementation and the hardware that is used during execution, which should not allow conclusions about processed data. To perform traditional SCA, the attacker usually needs physical access to the device. In recent years, remote software execution via apps or websites is attacked more frequently. Modern SCA target potentially millions of devices at the same time [16].

A commonly used taxonomy of SCA [1] distinguishes between invasive (e.g. reverse engineering) and non-invasive (e.g. fault injection, traffic analysis) attacks, and between passive (e.g. timing, traffic, power analysis) and active (e.g. fault injection) attacks. In this paper, we focus on non-invasive passive attacks.

Timing Attacks

During a timing attack, the execution time of a system for varying inputs is
used to deduce non-disclosed information. The execution time differs for varying
<figure><img src="image_3.png" /><figcaption>Fig. 1: The square-and-multiply algorithm [17]</figcaption></figure>

inputs because an implemented algorithm often performs computations in non-
constant time. Logical operations, e.g. used for memory accesses, arithmetic op-
erations, comparisons or conditional statements consume varying time. Another
reason are performance optimizations by the compiler. The resulting timing vari-
ations can leak information about the observed system. For example, with some
knowledge about the implementation, statistical analysis can reveal private keys
of cryptosystems in an inexpensive way. Timing attacks have a special position
among SCA because they can be applied remotely, through a network.

A representative example of a timing attack is Kocher's approach to attack
Diffie-Hellman and RSA private key operations that use the square-and-multiply
algorithm [10], which is shown in Figure 1. In the timing attack presented by
Kocher, the attacker makes use of the fact that the algorithm performs the
multiplication and modulo operation in line 6 only if the bit position of the
private key contains a one.

To model such an attack early in the development process requires a precise
model of the underlying physical effects. In the following, we describe the exact
procedure of the attack based on Section 2, 4 and 5 of [10]. However, we have
slightly refined the explanation of how it is possible to identify correctly guessed
exponent bits, since in [10] this topic is only dealt with superficially.

In the first step, we start to attack $d_1$ which is the first unknown bit we
want to find out. First, for a given $j$ and messages $y_0, \dots, y_j$, we measure how
much time the algorithm takes for each individual message so that we get the
corresponding timing measurements $T_0, \dots, T_j$. Second, we simulate the time it
takes to execute all known bits and the following unknown exponent bit. Thereby,
we obtain two different simulation times $TS0$ and $TS1$ for each message, since
there are two options for the last simulated bit. Third, we calculate the variance
of the difference between the timing measurements and the simulation times:

$$ \mathrm{Var}[T - TS0] := \frac{1}{n} \sum_{i=0}^{j} ((T_i - TS0_i) - \mathrm{E}[T - TS0])^2 \quad (1) $$

$$ \mathrm{Var}[T - TS1] := \frac{1}{n} \sum_{i=0}^{j} ((T_i - TS1_i) - \mathrm{E}[T - TS1])^2 $$

The crucial observation in [10] is that a correctly-emulated iteration reduces the expected variance, since iterations followed by a false exponent bit increases the variance. This identifies the correct exponent bit.

We want to elucidate this issue in more detail and in more general terms by not only estimating a bit, but an arbitrary number. Let therefore $w$ be the number of total bits of the private key, $b$ the number of guessed bits and $c$ the number of the first exponent bit guesses that are still correct. Then, the difference between the timing measurement and the simulation time of one message can be described as follows. Hereby, $t_j$ is the time required for one algorithm iteration for bit $j$, $a_j$ is the time for a wrong guess for bit $j$. We do not consider timing errors like measurement errors or loop overhead for simplification.

If $b$ was guessed correctly, the following applies:

$$ T_i - TS_i = \sum_{j=0}^{w-1} t_j - \sum_{j=0}^{b-1} t_j = \sum_{j=b}^{w-1} t_j $$

If otherwise only guesses right up to exponent bit position $c-1$ are correct, the difference is composed as follows:

$$ \begin{aligned} T_i - TS_i &= \sum_{j=0}^{w-1} t_j - \sum_{j=0}^{c-1} t_j - \sum_{j=c}^{b-1} a_j \\ &= \sum_{j=0}^{w-1} t_j - \sum_{j=0}^{c-1} t_j - \underbrace{\sum_{j=c}^{b-1} t_j}_{0} + \sum_{j=c}^{b-1} a_j - \sum_{j=c}^{b-1} a_j \\ &= \sum_{j=b}^{w-1} t_j + \sum_{j=c}^{b-1} t_j - \sum_{j=c}^{b-1} a_j \\ &= \sum_{j=b}^{w-1} t_j + \sum_{j=c}^{b-1} (t_j - a_j) \end{aligned} $$

If we now consider both results, we can understand why the variance should be higher in the second case. The incorrectly guessed bits can both lead to the second summand being positive or negative, which leads to higher deviations.

In his experimental results, Kocher observed $10^6$ modular multiplication execution times ($a \cdot b \mod n$) with random input on a 120-MHz Pentium computer
running MSDOS. The result was approximately a normal distribution. It shows
that the time consumption depends on operands *a* and *b*. In addition, for 250
timing measurements he estimated the probability that subtracting the time for
a correct iteration from each sample will reduce the total variance more than
subtracting an incorrect iteration to be 84% for the first bit guess. Since the
known bits become larger, the probability should improve [10].

There are two main ways to defeat a timing attack. First, we can perform
a constant time operation in code sections that depend on the secret key [2].
A disadvantage of this approach is that time consumption is always the worst
case. The second way is masking [13]. Here, random numbers are added to the
cryptographic calculation that do not affect the result. This avoids dependencies
between the key and the timing duration but works only for algorithms that
have an algebraic structure to allow such a manipulation.

## 3 Related Work

There exists some work on the early analysis of fault injection [1, 15, 4, 6]. But they do not consider security threats that exploit physical emissions. There also exists a variety of work on the simulation of side-channel attacks, which are surveyed in [20]. However, to the best of our knowledge, none of the existing approaches proposes to model time and physical effects early in the development process. Instead, they focus on providing very detailed side channel information on the final implementation. In [5], attacks on smart cards are modeled in SystemC. But they model a man-in-the-middle-attack and a DOS-attack and do not consider SCA. In [19], power attacks are simulated in SystemC. However, they do not consider timing attacks or other SCA. There exists an approach to analyze timing imbalance [12] and an approach which identifies timing disparate secure paths that could lead to information leakage through information flow analysis [11]. Indeed, these approaches can not simulate attacks and only consider systems on register-transfer-level. In [9], the authors propose an approach for the evaluation and testing of timing attacks for a pass-code key breaker. However, the simulation and evaluation is done on the assembler level. With our SystemC based approach, we are targeting earlier phases of the development process, where only abstract models are available. Partial results of our work agree with [18]. Despite a different approach, they also came to the conclusion that side-channel security cannot be isolated at one abstraction level, and that it is important that physical simulation models at a high abstraction level accurately reflects the reality. They showed that minor differences in the power model can have a big influence on security assessment.

## 4 Modeling and Simulation of Kocher's Timing Attack

In this section, we discuss a SystemC model and simulation of the classical timing
attack on the square-and-multiply algorithm [10]. To investigate which accuracy
of modeling time is sufficient for the attack, we implement four different time
<figure><img src="image_4.png" /><figcaption>Fig. 2: Setup for the attack simulation</figcaption></figure>

models with increasing accuracy. In the following, we present the general model, the four different time models and associated results. The SystemC model is licensed under GPL and freely available<fnref n="1" />.

## 4.1 General test setup and procedure

Our SystemC model consists of two modules, namely the attacker (*Timeanalyzer*) and the subject that is attacked (*Subject*). An overview of the setup is shown in Fig. 2. The *Timeanalyzer* generates random messages and sends them to the *Subject*. The *Subject* then executes the decryption procedure using the square-and-multiply algorithm (see Fig. 1). To simulate time, we use SystemC `wait(t)`-statements, which delay the execution for *t* time units. In our model, we simulate the time consumption of all assignments and calculations. The *Timeanalyzer* saves the time spent per decrypted number and simulates the time of all guessed bits and the new guess bit (two possibilities) for each number, so that we get two different simulated times. Then, the variances discussed in Section 2 are calculated to determine the new bit. This process is repeated until the key has been completely guessed. In the setup, it is possible to perform this procedure not only for one key, but an interval can be specified in a header named *constants*, in which the described procedure is carried out for all numbers contained therein. In this way, we get an overview of which keys can be guessed successfully and which guesses fail. Furthermore, the modulo for the square-and-multiply algorithm, the number of messages sent per round, the number of bits guessed at the same time (one or two) and the time model variant can be specified in the header *constants*. Whether the key was guessed right or wrong and the wrongly guessed keys can be analyzed in a result chart.

## 4.2 Modeling time

We have modeled the time consumption within the square-and-multiply algorithm in four variants:

1. **Time dependency on the input length.** In this variant, we assume that calculations with greater numbers take more time than with smaller numbers and that an assignment takes up constant time. Thus, the simulated time for each calculation depends on the length of the input in bits.

<footnote n="1">¹ https://www.uni-muenster.de/EmbSys/research/SysCSec.html</footnote>
<figure><img src="image_5.png" /><figcaption>Fig. 3: Instructions of the loop of the algorithm from Fig. 1 with assigned times</figcaption></figure>

2. **Time dependency on intermediate results.** In this variant, we assume that the time of calculations depends on the length of both, the intermediate result *s* and the input value *x*. Furthermore, we take into account that an additional subtraction is necessary if the intermediate result of the multiplication is greater than the modulus [7].

3. **Time dependency on the number of ones in intermediate results.** In this variant, we assume that more ones cause longer computations due to additional carry bits. Fig. 3 shows the implementation of the loop body of the square-and-multiply algorithm with the assigned times and the case distinction for the modulo-operation. The number of ones is calculated using the method `Utils:numberBits(bigint number)`. To simulate the time of a multiplication, the number of ones of the two operands is totaled.

4. **Time dependency refined by the Booth-algorithm.** In our fourth variant, the multiplication is implemented closer to hardware using the Booth-algorithm [3] for numbers in two's complement. The multiplication is carried out by shift operations, additions and subtractions, and we simulate the time of each single instruction. The time for the shift operation is constant, other calculations are dependent on the number of bits again.

## 4.3 Results and improvements

We have evaluated our four time models with two different bit guess variants. First, with the classic procedure that only one bit is guessed and second with an extension designed by us where two bits are guessed.

*One bit guess.* This variant was carried out with the first three time models. The same results were always achieved for each variant in any test run. The guessed keys had almost always the structure 1...10...0. With this approach, it was not possible to determine the order of the ones in the key. The results for Variant 1 for 500 messages and the key interval from 0 to 256 is shown on the top of Fig. 4. A higher number of 10000 messages led to the same result. We can see
that two numbers, before the next power of two is reached, are guessed correctly, since the order of ones and zeros is not relevant here. Because of this, we got 241 errors. This phenomenon can be explained using the first time model and can be transferred to the subsequent ones. Let us consider the example with key 23 (in binary representation $10111_b$). The first step with the associated variance calculation is visualized on the left in Fig. 5. Each box symbolizes the simulation time for the displayed bit and a crossed-out bit means that the simulation time was subtracted. In the first time model the multiplication time is only dependent on the input size $x$. For this reason, all ones and all zeros have the same time consumption regardless of their position. For example, consider the length of the message to be processed is 10, giving a time consumption of 20 for every one and 10 for every zero. The total time that the *Timeanalyzer* measures during decryption is 90. Since the first digit of a number is always a one, the time for $[1,0]$ and $[1,1]$ is simulated in the first run and is subtracted from the measured time. For the guess 0, the exact time for the first two numbers of the correct key is subtracted and for the wrong guess 1, the leading 1 and the time of any other 1 are subtracted from the measured time because the time of the ones is not dependent on the position. The remaining time for guess 0 is the time consumed by three ones, thus 60. For guess 1, the resulting time with two ones and one zero is 50. For further messages, guess 1 will also result in a smaller resulting time than guess 0. When calculating the variance, there is therefore a smaller deviation for guess 1, so that this is assumed to be correct. Analogously, a one is always recommended for the following two bit guesses. When guessing the last bit, the time for the guess 0 is canceled with the measured time, so that there is no deviation and a zero is guessed in the last step. The resulting key is $[1,1,1,1,0]$ and is a sort of ones and zeros. In the following two time models, time is also made dependent on the intermediate results, but it is still the case that guessing a 1 leads to a greater subtraction than guessing a 0. This results in smaller numbers and fewer deviations for a 1, so that this digit is assumed to be correct, although it is often not the case. For this reason, the other two result charts for Variant 2 and Variant 3 yield the same results and the key interval $[0, 256]$ also results in 241 errors. This suggests that our time model does not meet Kocher's assumption that subtracting the time for a correct iteration from each sample reduces the total variance more than subtracting an incorrect iteration.

*Two bits guess.* To overcome the problem described above, we guess a bit by simulating two bits at once, calculate the corresponding variances again and use a modified query to decide whether to guess a zero or a one (see right picture in Fig. 5). As an example, consider key 23 again. First, the *Timeanalyzer* measures the time for the key and subtracts its simulated time. This consists of the simulation time of the leading one and two other bits. Thus, there are four cases for the later variance calculation. In the example, in case of $[1,0,1]$, the measured time can be subtracted perfectly from the simulated time, so that only the measured time for $[1,1]$ remains. In the other three cases, the simulated time of the numbers marked in green can also be subtracted perfectly from the measured time, but the numbers marked in red cannot. It should be noted that we only consider one
<figure><img src="image_6.png" /><figcaption>Fig. 4: Results for Variant 1 with one bit and for Variants 2 and 4 with two bit guess</figcaption></figure>

<figure><img src="image_7.png" /><figcaption>Fig. 5: Examples for the difference between total and remaining time</figcaption></figure>

of the last three time models, in which the time depends on the intermediate results. To decide whether we guess a 0 or a 1, we compare:

$$Var_{00} + Var_{01} < Var_{10} + Var_{11}.$$

This results in a larger deviation in case that a 1 is guessed because four simulated times ([1,0] and [1,1]) do not match the measured time and therefore lead to larger differences in deviation. Guessing two bits directly is not possible, since if [1,0,0] and [1,0,1] were compared, the same problem would arise as with the one bit guess. With this decision approach, we could see an improvement towards the one bit guess. The result chart for the second time model is shown in the middle of Fig. 4. Compared to the results with one bit (at the top of Fig. 4), we can see a clear improvement. In tests, we got 11 to 33 errors. A closer look at the errors reveals that almost all of them occur for the first two bit guesses. We achieved the best results with Variant 3. In tests, we got 0 to 3 errors per run with the same parameters as for Variant 2.

The last approach, by implementing the Booth-algorithm, results in a test in 193 errors for the key interval [0,256]. The results are shown on the bottom of
Fig. 4. When we look at the errors, we see again a sorting by ones and zeros. We see that most correct guesses at higher numbers occur before a number, which is a power of two, is reached, because there the number of leading ones is very high and the last bits can be guessed correctly.

## 4.4 Discussion

Although Kocher's timing attack was difficult to model on a high level of abstraction, our simulation still worked after we improved the attack with the new bit guess method. We have succeeded in further developing Kocher's attack in the simulation environment. Variant 3 showed an improvement compared to Variant 2. The measurements by Kocher on the pentium-processor for the time of modular multiplication provide an indication of why the third time model works well. Kocher described the time for the modular multiplication in his results as an approximate normal distribution. In the third time model, we make the modular multiplication dependent on the number of bits in the operands. So each operand for the multiplication is binomially distributed and the sum of both operands is also binomially distributed which represents the time consumption. As a binomial distribution can be approximated by a normal distribution, this approach has the greatest similarity to Kocher's real measurements.

Variant 4 shows a significant deterioration compared to Variant 2 and Variant 3. It can be assumed that the higher effort in the multiply step no longer leads to a good correlation between data and time, since, for example, a binary representation with a lot of switches of ones and zeros causes a lot of time in the square step. It becomes clear that attacks are highly dependent on the hardware implementation. As a result, it is important to know at an early stage of development what the later hardware will look like in order to be able to abstract it for an accurate simulation that can find vulnerabilities. Since, as already mentioned, it is not clear where correlations between data and physical quantities come from, it is currently still difficult to simulate physical quantities in a meaningful way. There is also the danger that details are simulated in a more dominant way than they will be in the produced device. This would lead to false conclusions in an early security analysis.

# 5 Conclusion

In this paper, we have modeled and simulated the Kocher timing attack and the physical quantity time with increasing accuracy in SystemC to enable an early security analysis. We have created a test environment in which it was possible to simulate, to evaluate and to graphically represent these different approaches. We were able to show that the time for set bits in the private key is influenced too dominantly by our models. Through the simulation environment, we were able to identify this problem and modify the guess query of the attack. With the improvement, we were able to get different results for our time models. Variant 2 worked well and Variant 3 achieved even better results. We have shown that
the model of Variant 3 corresponds most closely to reality (binomial distribution is similar to Kocher's measured values for modular multiplication), whereas the hardware-related Variant 4 achieved poor results.

We conclude that it is important to know how time values on the finished device will look like for operations that are being attacked to enable an early security analysis of SCA. An important result is that in the early design stage it is possible to simulate time in such a way that vulnerabilities can be identified in the manufactured device. The prerequisite, which is also a major difficulty, is that it has to be known in the early stage how operations are carried out by the hardware in later design phases and how this affects time consumption in order to be able to simulate approximated times in the early stage.

The above result also applies to other side-channel attacks, e.g. the power attacks modeled in [19]. There exists an *explanation gap*. The theoretical concept is designed by observing the physical quantity, but it is not yet well understood where the causal connection between the physical quantity and the data comes from. Thus, it remains an open challenge for future work how more elaborate physical effects that are exploited in SCA can be modeled early in the development process.

To solve the problem of the explanation gap, it appears appropriate to choose a similar approach to the simulation of the electromagnetic waves by designing a model through measurements. However, the model only applies to devices with the same design, since operations on different processors are optimized and implemented differently in hardware and thus have different emanations. Pipelining, out-of-order execution, parallelization and microcode also have an impact on physical quantity. For this reason, our assumptions for the time models are not universal for all processors. Due to the explanation gap, we were forced to make assumptions. Often, in different devices the same components are installed and the platform-based design is used. This does not only save costs and time, but could also offer the possibility of making devices more secure in the future if the manufacturer also creates a physical quantity simulation model of produced device components. These would have to be compatible and combinable with models from further components produced by other manufacturers. The approach could make more exact modeling possible in the future and improve the quality of models for physical quantities.

## References

1. Abrishamchi, M.A.N., Abdullah, A.H., Cheok, A.D., Bielawski, K.S.: Side channel attacks on smart home systems: A short overview. In: IECON 2017-43rd Annual Conference of the IEEE Industrial Electronics Society. pp. 8144–8149. IEEE (2017)

2. Barthe, G., Grégoire, B., Laporte, V.: Secure compilation of side-channel countermeasures: The case of cryptographic “constant-time”. In: 2018 IEEE 31st Computer Security Foundations Symposium (CSF). pp. 328–343 (2018)

3. Booth, A.D.: A signed binary multiplication technique. The Quarterly Journal of Mechanics and Applied Mathematics 4(2), 236–240 (1951)
4. Burns, F., Murphy, J., Shang, D., Koelmans, A., Yakorlev, A.: Dynamic global security-aware synthesis using systemc. IET Computers & Digital Techniques 1(4), 405–413 (2007)

5. Bushager, A., Zwolinski, M.: Modelling Smart Card Security Protocols in SystemC TLM. In: IEEE/IFIP International Conference on Embedded and Ubiquitous Computing. pp. 637–643 (12 2010). https://doi.org/10.1109/EUC.2010.102

6. Chen, Y.Y., Hsu, C.H., Leu, K.L.: Analysis of system bus transaction vulnerability in systemc tlm design platform. In: WSEAS International Conference. Proceedings. Mathematics and Computers in Science and Engineering. No. 3, World Scientific and Engineering Academy and Society (2009)

7. Dhem, J.F., Koeune, F., Leroux, P.A., Mestré, P., Quisquater, J.J., Willems, J.L.: A practical implementation of the timing attack. In: International Conference on Smart Card Research and Advanced Applications. pp. 167–182. Springer (1998)

8. IEEE: IEEE Standard for Standard SystemC Language Reference Manual. IEEE Std 1666-2011 (Revision of IEEE Std 1666-2005) pp. 1–638 (2012)

9. Kaur, S., Singh, B., Gupta, L.: Simulation-based method for analyzing timing attack against pass-code breaking system. In: Recent Innovations in Computing, pp. 795–808. Springer (2022)

10. Kocher, P.C.: Timing attacks on implementations of diffie-hellman, rsa, dss, and other systems. In: Koblitz, N. (ed.) Advances in Cryptology — CRYPTO '96. pp. 104–113. Springer Berlin Heidelberg, Berlin, Heidelberg (1996)

11. Lai, X., Jenihhin, M., Raik, J., Paul, K.: Pascal: Timing sca resistant design and verification flow. In: 2019 IEEE 25th International Symposium on On-Line Testing and Robust System Design (IOLTS). pp. 239–242. IEEE (2019)

12. Park, J., Corba, M., Antonio, E., Vigeant, R.L., Tehranipoor, M., Bhunia, S.: Atave: A framework for automatic timing attack vulnerability evaluation. In: 2017 IEEE 60th International Midwest Symposium on Circuits and Systems (MWS-CAS). pp. 559–562. IEEE (2017)

13. Prouff, E., Rivain, M.: Masking against side-channel attacks: A formal security proof. In: Johansson, T., Nguyen, P.Q. (eds.) Advances in Cryptology – EUROCRYPT 2013. pp. 142–159. Springer, Berlin, Heidelberg (2013)

14. Rothbart, K., Neffe, U., Steger, C., Weiss, R., Rieger, E., Mühlberger, A.: High level fault injection for attack simulation in smart cards. In: 13th Asian Test Symposium. pp. 118–121. IEEE (2004)

15. Rothbart, K., Neffe, U., Steger, C., Weiss, R., Rieger, E., Mühlberger, A.: An environment for design verification of smart card systems using attack simulation in SystemC. In: ACM/IEEE International Conference on Formal Methods and Models for Co-Design (MEMOCODE). pp. 253–254. IEEE (2005)

16. Spreitzer, R., Moonsamy, V., Korak, T., Mangard, S.: Systematic classification of side-channel attacks: A case study for mobile devices. IEEE Communications Surveys & Tutorials 20(1), 465–488 (2017)

17. Stamp, M.: Information Security - Principles and Practice. John Wiley and Sons, New York (2011)

18. Tiri, K., Verbauwhecle, I.: Simulation models for side-channel information leaks. In: Design Automation Conference. pp. 228–233. IEEE (2005)

19. Treus, J., Herber, P.: Early analysis of security threats by modeling and simulating power attacks in systemc. In: IEEE Vehicular Technology Conference. pp. 1–5. IEEE (2020)

20. Veshchikov, N., Guilley, S.: Use of simulators for side-channel analysis. In: European Symposium on Security and Privacy Workshops. pp. 104–112. IEEE (2017)