# A Template Attack Against VERIFY PIN Algorithms

Hélène Le Bouder, Thierno Barry, Damien Couroussé, Jean-Louis Lanet, Ronan Lashermes

<figure><img src="image_1.png" /></figure>

## To cite this version:

Hélène Le Bouder, Thierno Barry, Damien Couroussé, Jean-Louis Lanet, Ronan Lashermes. A Template Attack Against VERIFY PIN Algorithms. SECRYPT 2016, Jul 2016, Lisbonne, Portugal. pp.231 - 238, 10.5220/0005955102310238. hal-01383143

HAL Id: hal-01383143

https://inria.hal.science/hal-01383143

Submitted on 18 Oct 2016

HAL is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
A template attack against VERIFY PIN algorithms

Hélène Le Bouder¹, Thierno Barry², Damien Couroussé², Jean-Louis Lanet¹ and Ronan Lashermes¹

¹LHS-PEC TAMIS INRIA Campus Beaulieu 35000 Rennes, France

²Univ. Grenoble Alpes, F-38000 Grenoble, France; CEA, LIST, MINATEC Campus, F-38054 Grenoble, France

**Keywords:** Template attack, Side Channel Analysis, Electromagnetic Emission, VERIFY PIN Algorithm, Embedded Systems' Security.

**Abstract:** This paper presents the first side channel analysis from electromagnetic emissions on VERIFY PIN algorithms. To enter a PIN code, a user has a limited number of trials. Therefore the main difficulty of the attack is to succeed with very few traces. More precisely, this work implements a template attack and experimentally verifies its success rate. It becomes a new real threat, and it is feasible on a low cost and portable platform. Moreover, this paper shows that some protections for VERIFY PIN algorithms against fault attacks introduce new vulnerabilities with respect to side channel analysis.

# 1 INTRODUCTION

In many smart cards, a Personal Identification Number (PIN or PIN code) is used to authenticate the user. These PIN codes are used, for example, in payment cards or SIM cards. Hence, they are targets of choice for malicious adversaries. When discussing about the security of embedded devices, a critical aspect is: the interaction of the computing unit with its physical environment. This interaction is used by physical attacks.

## State of the art.

The physical attacks are mainly divided in two families: the Side Channel Analysis (SCA) and the Fault Injection Attacks (FIA).

FIA consist in disrupting the circuit behavior (with EM pulse, laser, clock glitch...). VERIFY PIN algorithms are designed to resist FIA such as (Moro et al., ; Riviere et al., ).

SCA are based on observations of the circuit behavior during the computation. They exploit the fact that some physical values of a circuit depend on intermediary values of the computation. This is the so-called information leakage of the device. The most classic leakages are timing (Kocher, 1996), power consumption (Mangard et al., 2008a; Mangard, ) and electromagnetic emissions (EM) (Quisquater and Samyde, 2001). VERIFY PIN algorithms are designed to resist timing attacks (Foo Kune and Kim, 2010). To the best of our knowledge, there is no published work on EM analysis against VERIFY PIN algorithms.

In this paper we are interested in statistical categorizations more precisely template attacks. Templates were introduced as the strongest side channel attack possible from an information theoretic point of view (Chari et al., 2003). They have been used in many attacks, such as (Archambeau et al., ; Elaabid et al., 2007; Oswald and Mangard, 2006; Rechberger and Oswald, 2005) since.

## Motivation.

The most classical SCA are Correlation Power Analysis (CPA) (Brier et al., 2004). In these attacks many traces are required to break the secret. But in a PIN code, a user has a limited number of trials, so an attacker can exploit only a few EM traces. This is a major difficulty, which explains why there are no known CPA attacks on PIN codes. The ultimate goal of our work is to test the resistance of a VERIFY PIN against a SCA with only few traces. That is why we are interesting by Template attacks.

## Contribution.

This paper presents what is, to the best of our knowledge, the first EM SCA attack on VERIFY PIN algorithms. We have chosen to study template attacks because they can be effective with only one trace.

Template analyzes are statistical categorizations divided in two steps: a profiling phase and an attack phase. Because of this, the attacker can perform the first phase ahead of time. And then the attack phase becomes extremely fast because only few traces are used. The experimental bench can be purchased at a very low cost and can be portable.
Additionally this paper shows that some countermeasures against FIA can introduce new vulnerabilities in SCA.

**Organization.**

This paper is organized as follows. The section 2 describes the target implementation. The attack is detailed in section 3. The experimental set-up and the results are presented in section 4. Finally the conclusion is drawn in section 5.

## 2 IMPLEMENTATION OF THE TARGET: VERIFY PIN ALGORITHM

In our settings, a PIN code is an array of 4 bytes indexed by $b$ ($b \in [0,3]$), where each byte can take up to 10 values. The set of these values is noted $\mathbb{K} = [0,9]$. So, there are $10^4$ different PIN codes.

A PIN code is used to authenticate a user. A particular PIN, called **true PIN**, noted $U$ is embedded in the smart card, and only its rightful owner knows this true PIN value. The protocol to authenticate a user is as follows. A user proposes a PIN called **candidate PIN**, noted $V$, to the device (smart-card). A `VERIFY PIN` algorithm compares the candidate PIN and the true PIN. A candidate PIN is valid if and only if it is equal to the true PIN ($U = V$). In that case, the user is authenticated.

**Algorithm 1 Simplified VERIFY PIN**

1: **procedure** VERIFY PIN(candidate PIN $V$)
2:     counter = counter - 1
3:     **if** counter > 0 **then**
4:         status = COMPARISON($U, V$)
5:         status₂ = COMPARISON($U, V$)
6:         **if** status ≠ status₂ **then**
7:             ERROR, device is blocked
8:             **else**
9:                 **if** status = TRUE **then**
10:                counter initialized at original value: $C$
11:                **end if**
12:                **end if**
13:                **else**
14:                    device is blocked
15:                **end if**
16:            **return** status
17:        **end procedure**

**Algorithm 2 Comparison of two PIN codes**

1: **procedure** COMPARISON(candidate PIN $V$, true PIN $U$)
2:     status = FALSE
3:     diff = FALSE
4:     fake = FALSE
5:     **for** $b = 0$ to 3 **do**
6:         **if** $U_b \neq V_b$ **then**
7:             diff = TRUE
8:             **else**
9:                 fake = TRUE
10:            **end if**
11:            **if** ($b = 3$) and ($diff = FALSE$) **then**
12:                status = TRUE
13:                **else**
14:                    fake = TRUE
15:            **end if**
16:        **end for**
17:        **return** status
18: **end procedure**

In theory, the correct user should always propose a valid candidate PIN, but a human error is still possible. That is why in practice, in a `VERIFY PIN` algorithm, the user has several trials, number noted $C$. Usually it is 3 in a SIM card or a payment card, but it is possible that more tries are authorized, for example in an electronic lock. In the device, there is a ratification counter which decreases when a failed candidate PIN is tested. This counter is reset to the original value when a valid candidate PIN is proposed. If it is equal to zero, the device is blocked; nobody can use it again. We emphasize the fact that an attacker has to keep a trial to be authenticated. It is of no interest to retrieve a PIN code if the device is blocked.

In our attack, the implementation of `VERIFY PIN` proposed by (Riviere, 2015) is chosen. This implementation respects the verifications of (Folkman, 2007). But, to clarify our description only a very simplified version is described in **Algorithm 1**.

A classic countermeasure against FIA is to compare the candidate PIN with the true PIN twice, as in **Algorithm 1** at line 4 and line 5. This countermeasure doubles the opportunities of leakage on COMPARISON, as shown in the Table 1.

In our case, the attacker focuses on leakages from the COMPARISON algorithm. The algorithm used in this paper is described in COMPARISON Algorithm 2.

To resist the timing attack (Foo Kune and Kim, 2010; Kocher, 1996), the comparison between the true PIN $U$ and the candidate PIN $V$ has to be in a constant time. All bytes have to be compared even if the previous bytes are false. The computation time for
a valid candidate PIN or a false candidate PIN has to be the same.

<table><caption>Table 1: Number of traces corresponding to COMPARISON, obtained by the attacker according to the implementation of VERIFY PIN, C is the number of trials.</caption><thead><tr><td>Implementation</td><td>C = 2</td><td>C = 3</td></tr></thead><tbody><tr><td>1 COMPARISON</td><td>1 trace</td><td>2 traces</td></tr><tr><td>2 COMPARISON</td><td>2 traces</td><td>4 traces</td></tr></tbody></table>

# 3 DESCRIPTION OF THE ATTACK

## 3.1 Preliminaries

Generally template attacks are used against crypto-systems, but to the best of our knowledge, it is the first time they are tested with a VERIFY PIN algorithm.

To implement a template attack, a pair of identical devices is needed. One is called the profiling device, the attacker has full control of it; and the other is the targeted device.

The first step, called profiling phase, is to build a physical model of the EM traces for all possible secret values with the profiling device. A model for one value is called a **template**. After that, the attack phase starts by obtaining traces on the targeted device. These traces are confronted to the different templates.

In our attack, it is assumed that the attacker has the same device as the targeted device, where true PIN is known. She can obtain all the desired measurements on the profiling device, only a valid candidate PIN is proposed after every other candidate PIN. Namely she can:

* obtain one trace on the targeted device;

* change the true PIN in her profiling device;

* obtain many traces on her profiling device.

In this way, it is possible to build a template attack on VERIFY PIN algorithms.

The attack is divided in two parts and six steps. The profiling phase is split in:

1. Campaign on the profiling device,

2. Detection of the points of interest,

3. Building templates.

The attack phase is split in:

4. Campaign on the targeted device,

5. Confrontation between measurements,

6. Discrimination of one guess.

In this template attack, 3 PIN codes are considered. The true PIN in the targeted device is noted $U$ and the true PIN in the profiled device is noted $U'$. The goal of the attack is to learn $U$. The candidate PIN is the same in the profiling phase and in the attack phase and it is noted $V$.

In SCA a divide and conquer approach is generally chosen; so in this case only one secret byte is retrieved at a time. So the target is a byte $U_b$. A guess on a byte $U_b$ ($b \in \llbracket 0, 3 \rrbracket$) is noted $k \in \mathbb{K}$; and $v$ denotes the value of $V_b$.

## 3.2 The profiling phase

### Step 1: Campaign on the profiling device.

The profiling phase consists in collecting many traces on the profiling device, for the purpose of building templates. A campaign is for one given byte $b$.

* The byte $U'_b$ of the true PIN takes all values $k$ in $\mathbb{K}$ and the other PIN bytes stay to zero.

* The candidate PIN byte $V_b$ is always fixed to a chosen value $v$.

For each guess $k$, the attacker acquires a campaign of $n$ curves with a true PIN byte $U'_b$ fixed to $k$ and candidate PIN byte fixed to $v$, ($U'_b = k$ and $V_b = v$).

### Step 2: Detection of points of interest.

A window of points of interest, denoted $PoI$, is a set of points of a trace such as information on the secret can be retrieved from them. They are the moment of information leakage.

The first step of the traces treatment is to detect the $PoI$. In our case, it is first to detect in the VERIFY PIN, when the COMPARISON (Algorithm 2) is computed.

To respect a divide and conquer approach, the second step is to find where each comparison for each byte occurs in a trace of COMPARISON.

A time window is selected for each byte to perform the template attack byte per byte. If this step is not performed, in the best case, the attacker can retrieve the values of all the bytes but she cannot put them in the right order, so the attack fails. Generally it is possible to detect the $PoI$ where the difference between the means of the template traces are the most significant or using variance analysis as in (Linge et al., ). In our implementation the bytes of a candidate PIN $V$ are tested one after another. So, in practice a trigger signal is put around the COMPARISON and the traces are split in 4.

### Step 3: Building templates.

In this paragraph, the attacker has selected a good $PoI$
window on traces for each byte, to respect a divide and conquer approach.

The attacker obtains a matrix $M_{v,k} = \{xk_{(i,j)}\}$, with $i \in \llbracket 0, n \rrbracket$ and $j \in \llbracket 0, p \rrbracket$; n is the number of traces and p the number of points in a trace. The column vector j of $M_{v,k}$ is noted $xk_j$ and $\overline{xk}_j$ is the mean of this vector. The mean vector is noted $\overline{xk} = \{\overline{xk}_j\}$.

$$ \overline{xk}_j = \frac{1}{n} \sum_{i=1}^{n} xk_{i,j} . $$

Template attacks apply advanced statistical methods. However, in this paper the optimizations presented in (Choudary and Kuhn, 2014), are used.

The first step is to compute the covariance matrix $S_{v,k}$, a square matrix of size $p \cdot p$. The elements of $S_{v,k} = \{sk_{(j,j')}\}$ are computed with equation (1)<fnref n="1" />.

$$ sk_{(j,j')} = \frac{1}{n-1} \cdot (xk_j - \overline{xk}_j)^t (xk_{j'} - \overline{xk}_{j'}) . \quad (1) $$

## 3.3 Attack phase

### Step 4: Campaign on the targeted device.

During this step the attacker obtains one trace such that:

* the value of the true PIN byte $U_b$ is unknown, it is the target;

* the candidate PIN byte $V_b$ is equal to v.

The trace is a vector $T_v = \{xt_j\}_{j \in \llbracket 0, p \rrbracket}$ of p points. Of course $T_v$ corresponds at a good windows of $PoI$.

### Step 5: Confrontation between measurements.

The goal of the attack is to confront the trace $T_v$ to the template matrix $S_{v,k}$.

In SCA, it is classic to suppose that the electronic noise at each point of a power trace is normally distributed as described in (Mangard et al., 2008b). So the probability density function $f_v$, given $S_{v,k}$ and $\overline{xk}$ is computed with (2)<fnref n="2" />.

$$ f_v(T_v | S_{v,k}, \overline{xk}) = \frac{1}{\sqrt{2\pi p \cdot |S_{v,k}|}} \cdot \exp\left(-\frac{1}{2} \cdot (T_v - \overline{xk}) \cdot S_{v,k}^{-1} \cdot (T_v - \overline{xk})^t\right) . \quad (2) $$

As explained in (Choudary and Kuhn, 2014), several problems appear when implementing the template attack, so our attack follows their given advices. The logarithm is used for the multivariate normal distribution in (3),

$$ F_v(T_v, k) = \ln(f_v(T_v | S_{v,k}, \overline{xk})) = -\frac{1}{2} \cdot \left( \ln(|S_{v,k}|) + (T_v - \overline{xk}) \cdot S_{v,k}^{-1} \cdot (T_v - \overline{xk})^t + c \right) . \quad (3) $$

where c is a constant,

$$ c = -p \cdot \ln(2\pi) . \quad (4) $$

Moreover, the logarithm of the determinant is computed with the equation (5),

$$ \ln(|S_{v,k}|) = 2 * \sum_{d_{ii} \in \text{diag}(D)} \ln(d_{ii}) ; \quad (5) $$

where D is the Cholesky decomposition of $S_{v,k}$:

$$ S_{v,k} = D^t \cdot D . $$

One has to remark than D can be pre-computed in the profiling phase. In this paper, this way is used to compute $F_v$.

### Step 6: Discriminating guesses.

The attack returns the guess $k_v$ for which $F_v$ is maximal for a given $T_v$. This guess maximizes $F_v$ as in equations (6). Let $\max^{-1}$ be the function that returns the fiber of the maximum.

$$ \begin{aligned} \max_{k \in \mathbb{K}} (F_v(T_v, k)) &= F_v(T_v, k_v) \\ \max_{k \in \mathbb{K}}^{-1} (F_v(T_v, k)) &= k_v \end{aligned} . \quad (6) $$

The attack succeeds if the guess, noted $k_v$ defined in (6) is equal to the real value of $U_b$.

It is possible to rank the guesses k according to the value of $F_v(T_v, k)$. If the attack fails, it shows how well the correct value $U_b$ is ranked.

# 4 EXPERIMENTAL RESULTS

## 4.1 Acquisition protocol of EM traces

Once the theoretical framework has been setup, an experimental benchmark was performed. The VERIFY PIN algorithm is implemented on an ARM-based STM32-F100RB micro-controller embedding a Cortex-M3 core and running in our case at 24MHz. The board used is the STM32VLDICOVERY. This chip does not embed any countermeasures against side channels but it is a popular choice for Internet Of Things (IoT) applications.

The experimental bench is composed of a control computer, a 3405A Picoscope and an EM probe. The experimental bench is described in Fig. 1.

1. The STM32 sends (via an USB/UART FTTDI232) that it is ready to test a PIN code, to the computer.

<footnote n="1">¹$M^t$ means transposed of $M$.</footnote>

<footnote n="2">² $|M|$ is the determinant of $M$.</footnote>
2. Still via the UART, the computer sends the PIN candidate to the STM32.

3. A trigger signal measured by the Picoscope means that the STM32 tests the PIN candidates.

4. The probe and the Picoscope measure the EM leakage and store the traces.

5. The Picoscope sends the traces to the computer.

<figure><img src="image_3.png" /><figcaption>Figure 1: Experimental bench</figcaption></figure>

The EM probe from Langer (RF-R0,3-3) is used to measure the signal. This last one is amplified by a Preamplifier from Langer (PA 303), before the measurements by the Picoscope 3405A (USB oscilloscope). The bandwidth of the measurement setup is limited by the Picoscope with an upper frequency of 100MHz. The traces obtained are composed of $p = 3700$ points, with a 1GS/s sampling rate. We remind that 100MHz is a cutoff frequency marking an *attenuation* of the relevant signal, not its total removal.

One has to remark that the required equipment comes at a very low cost, under 2000€ excluding the computer.

The computation heavy step is the profiling phase. The program is written with the julia language (Bezanson et al., ), which is particularly efficient for computing-intensive tasks. Considering the large size of the covariance matrices, the computation requires a lot of memory. To create 10 templates (for guesses in $K = [0, 9]$, of size $n = 400000$ traces, we have used a server with 16 cores and 128GB of RAM, where the computation lasted 4 hours (64 core-hours). It is however possible to manage the computation of the covariance matrix computation in smaller tasks in order to reduce memory consumption, at the expense of an increased computation time.

## 4.2 Results

### 4.2.1 Intermediate results

To start this section, results on only one trace of VERIFY PIN, so 1 or 2 trace(s) on COMPARISON Algorithm 2, are studied.

For each value $v \in K$, and each value of $k$, we have built a template $S_{v,k}$ with matrix $M_{v,k}$ of size $n = 100000$ traces and $p = 3700$ points. Results for 10000 attacks, on a byte $U_b$, are in Tables 3 and 2.

<table><caption>Table 2: Success rate (in percents) according to different values of $V_b$ and $U_b$, for template size $n = 100000$, results computed for 10 · 1000 attacks.</caption><thead><tr><th colspan="4">1 trace of COMPARAISON</th></tr><tr><th>v</th><th>U<sub>b</sub> ∈ K</th><th>U<sub>b</sub> ≠ v</th><th>U<sub>b</sub> = v</th></tr></thead><tbody><tr><td>0</td><td>27.7</td><td>17.7</td><td>100</td></tr><tr><td>1</td><td>34.33</td><td>24.33</td><td>100</td></tr><tr><td>2</td><td>22.49</td><td>12.49</td><td>100</td></tr><tr><td>3</td><td>20.52</td><td>10.52</td><td>100</td></tr><tr><td>4</td><td>21.12</td><td>11.12</td><td>100</td></tr><tr><td>5</td><td>21.75</td><td>11.75</td><td>100</td></tr><tr><td>6</td><td>21.5</td><td>11.5</td><td>100</td></tr><tr><td>7</td><td>25.23</td><td>15.23</td><td>100</td></tr><tr><td>8</td><td>20.61</td><td>10.61</td><td>100</td></tr><tr><td>9</td><td>24.38</td><td>14.38</td><td>100</td></tr></tbody></table>

<table><caption>Table 3: Success rate (in percents) according to different values of $V_b$ and $U_b$, for template size $n = 100000$, results computed for 10 · 1000 attacks.</caption><thead><tr><th colspan="4">2 traces of COMPARAISON</th></tr><tr><th>v</th><th>U<sub>b</sub> ∈ K</th><th>U<sub>b</sub> ≠ v</th><th>U<sub>b</sub> = v</th></tr></thead><tbody><tr><td>0</td><td>31.71</td><td>21.71</td><td>100</td></tr><tr><td>1</td><td>34.13</td><td>24.13</td><td>100</td></tr><tr><td>2</td><td>21.28</td><td>11.28</td><td>100</td></tr><tr><td>3</td><td>20.94</td><td>10.94</td><td>100</td></tr><tr><td>4</td><td>20.68</td><td>10.68</td><td>100</td></tr><tr><td>5</td><td>22.00</td><td>12.00</td><td>100</td></tr><tr><td>6</td><td>21.71</td><td>11.71</td><td>100</td></tr><tr><td>7</td><td>27.12</td><td>17.12</td><td>100</td></tr><tr><td>8</td><td>21.35</td><td>11.35</td><td>100</td></tr><tr><td>9</td><td>26.37</td><td>16.37</td><td>100</td></tr></tbody></table>

These preliminaries results on only one trace are important for the three following points.

1. If the true PIN byte $U_b$ is equal to the candidate PIN byte $v$, the attack always succeed i.e: $v = U_b \Rightarrow k_v = U_b$

2. If the true PIN byte $U_b$ is different to the candidate PIN byte $v$, the attack succeed better than a
plate where 0 is the preimage of the second maximum of $F_0(T_0)$ after $k_0$. In other words, the attacker can test all values of $v$ according to the rank of the guesses in the first template attack with $v = 0$.

### 4.2.3 Final results

The rank of the correct guess $k = U_b$ for one trace on VERIFY PIN is given in Table 4.

<table><thead><tr><th colspan="4">1 trace of COMPARAISON</th></tr><tr><th>rank of k \ n</th><th>100000</th><th>20000</th><th>40000</th></tr></thead><tbody><tr><td>1</td><td>27.70</td><td>29.28</td><td>29.56</td></tr><tr><td>2</td><td>13.77</td><td>14.99</td><td>14.55</td></tr><tr><td>3</td><td>12.37</td><td>12.52</td><td>11.89</td></tr><tr><td>4</td><td>10.15</td><td>10.62</td><td>10.88</td></tr><tr><td>5</td><td>9.08</td><td>9.25</td><td>9.08</td></tr><tr><td>6</td><td>8.26</td><td>7.25</td><td>8.08</td></tr><tr><td>7</td><td>7.18</td><td>6.77</td><td>6.54</td></tr><tr><td>8</td><td>6.28</td><td>5.33</td><td>5.51</td></tr><tr><td>9</td><td>5.21</td><td>3.99</td><td>3.91</td></tr><tr><td>10</td><td>0.0</td><td>0.0</td><td>0.0</td></tr></tbody></table>

<table><caption>Table 4: Percentage of the rank of the correct guess $k = U_b$ for the different sizes of template, statistics are for 10000 attacks.</caption><thead><tr><th colspan="4">2 traces of COMPARAISON</th></tr><tr><th>rank of k \ n</th><th>100000</th><th>20000</th><th>40000</th></tr></thead><tbody><tr><td>1</td><td>31.71</td><td>32.72</td><td>32.91</td></tr><tr><td>2</td><td>14.85</td><td>16.8</td><td>16.28</td></tr><tr><td>3</td><td>11.26</td><td>12.44</td><td>13.25</td></tr><tr><td>4</td><td>9.94</td><td>10.09</td><td>10.38</td></tr><tr><td>5</td><td>8.87</td><td>8.44</td><td>8.35</td></tr><tr><td>6</td><td>7.73</td><td>7.04</td><td>6.64</td></tr><tr><td>7</td><td>6.32</td><td>5.7</td><td>5.63</td></tr><tr><td>8</td><td>5.44</td><td>4.18</td><td>3.96</td></tr><tr><td>9</td><td>3.88</td><td>2.59</td><td>2.60</td></tr><tr><td>10</td><td>0.0</td><td>0.0</td><td>0.0</td></tr></tbody></table>

For example, with a template of size $n = 400000$, the correct guess is the first in 32.91% and second in 16.28% of the analyses. So if the attacker has only two traces the attack has a success rate of $32.91 + 16.28 = 48.38\%$.

Final results of our attack are in Table 5. One has to remark that if the implementation of VERIFY PIN has two calls to COMPARISON, the success rate increases.

The results are given for one byte, to have the success rate for the whole PIN, the results have to be put to the power of the number of bytes.

$$ \text{success for PIN} = \text{success for 1 byte}^{\text{number of bytes}} $$

For example, with a template of size $n = 400000$, 4 trials ($C = 4$) so 3 traces, and a VERIFY

<table><thead><tr><th colspan="4">1 trace of COMPARAISON</th></tr><tr><th>number traces \ n</th><th>100000</th><th>20000</th><th>40000</th></tr></thead><tbody><tr><td>1</td><td>27.70%</td><td>29.28%</td><td>29.56%</td></tr><tr><td>2</td><td>41.47%</td><td>44.27%</td><td>44.11%</td></tr><tr><td>3</td><td>53.84%</td><td>56.79%</td><td>56.0%</td></tr><tr><td>4</td><td>67.76%</td><td>72.05%</td><td>71.68%</td></tr><tr><td>5</td><td>73.07%</td><td>76.66%</td><td>75.96%</td></tr><tr><td>6</td><td>81.33%</td><td>83.91%</td><td>84.04%</td></tr><tr><td>7</td><td>88.51%</td><td>90.68%</td><td>90.58%</td></tr><tr><td>8</td><td>100%</td><td>100%</td><td>100%</td></tr></tbody></table>

<table><caption>Table 5: Success rate to retrieve a byte $U_b$ according to the size $n$ of the templates and the number and the choice of traces</caption><thead><tr><th colspan="4">2 traces of COMPARAISON</th></tr><tr><th>number traces \ n</th><th>100000</th><th>20000</th><th>40000</th></tr></thead><tbody><tr><td>1</td><td>31.71%</td><td>32.72%</td><td>32.91%</td></tr><tr><td>2</td><td>46.56%</td><td>49.52%</td><td>48.38%</td></tr><tr><td>3</td><td>57.82%</td><td>61.96%</td><td>60.88%</td></tr><tr><td>4</td><td>67.76%</td><td>72.05%</td><td>71.68%</td></tr><tr><td>5</td><td>76.63%</td><td>80.49%</td><td>80.07%</td></tr><tr><td>6</td><td>84.36%</td><td>87.53%</td><td>86.91%</td></tr><tr><td>7</td><td>90.68%</td><td>93.23%</td><td>92.94%</td></tr><tr><td>8</td><td>100%</td><td>100%</td><td>100%</td></tr></tbody></table>

PIN with two COMPARISON, the success rate is $0.6088^4 \approx 0.1374$ thus $13.74\%$.

But whatever the number of bytes in the PIN code, the attack always succeed in at most 8 traces.

# 5 CONCLUSION

In this paper, we have presented the first SCA attack with EM traces on VERIFY PIN algorithms. It is an application of template attacks to a situation where very few traces are available.

Indeed, we have shown that we can always retrieve a PIN code with 8 traces (9 trials), whatever the number of bytes in the PIN code.

For a classical PIN code with 4 bytes in a VERIFY PIN with 3 trials, our attack has a success rate of 48.38% per byte, so finally 5.48% for the whole PIN. For a classical PIN code with 4 bytes in a VERIFY PIN with 4 trials, our attack has a success rate of 60.88% per byte, so finally 13.74% for the whole PIN. These results are not optimal, but the experimental set-up used is very low cost; moreover the biggest template managed had a size of $n = 400000$ traces. With a better measurement setup and bigger templates, results should be drastically improved. So we can imagine that an attacker with a better equipment (a high bandwidth oscilloscope and a better computation power to manage more than 400000 traces) can
have better results.

Furthermore, an attacker can combine this attack with other information. For example in (Andriotis et al., 2013), the authors detect the print touch on a phone.

Another important remark is that the double Comparison of the PIN code to protect against FIA introduces new vulnerabilities for SCA.

By using templates, the attack is made portable. The attacker can perform the profiling phase ahead of time. Then on the target location, the measures and the analysis are fast as only a few traces are required. Moreover, she can easily perform batch attacks where multiple targets are attacked with the same templates.

For all these points, our attack is a real threat.

A countermeasure against our attack could be to compare the different bytes in a random order. The attacker can retrieve the PIN but not in the right order; so for example, for a PIN code with 4 bytes, with 4 different values, there is 4! = 24 possibilities. In most cases, this number of possibilities is too big to be authenticated before the device gets blocked. In future works, we plan to test the practical application of this countermeasure.

**Acknowledgment** This work was partially funded by the French National Research Agency (ANR) as part of the program Digital Engineering and Security (INS-2013), under grant agreement ANR-13-INSE-0006-01. The authors would like to thank Thibault Cattelani and Gaël Thomas for their helpful comments and discussions.

## REFERENCES

Andriotis, P., Tryfonas, T., Oikonomou, G., and Yildiz, C. (2013). A pilot study on the security of pattern screen-lock methods and soft side channel attacks. In *Proceedings of the sixth ACM conference on Security and privacy in wireless and mobile networks*, pages 1–6.

Archambeau, C., Eric Peeters, Standaert, F.-X., and Quisquater, J.-J. Template attacks in principal sub-spaces. In *Cryptographic Hardware and Embedded Systems-CHES 2006*, pages 1–14. Springer.

Bezanzon, J., Karpinski, S., Shah, V., and Edelman, A. Julia: A Fast Dynamic Language for Technical Computing. In *Lang.NEXT*.

Brier, E., Clavier, C., and Olivier, F. (2004). Correlation Power Analysis with a Leakage Model. In *Cryptographic Hardware and Embedded Systems-CHES*, pages 16–29.

Chari, S., Rao, J. R., and Rohatgi, P. (2003). Template attacks. In *Cryptographic Hardware and Embedded Systems-CHES 2002*, pages 13–28. Springer.

Choudary, O. and Kuhn, M. G. (2014). Efficient template attacks. In *Smart Card Research and Advanced Applications*, pages 253–270. Springer.

Elaabid, M. A., Guilley, S., and Hoogvorst, P. (2007). Template Attacks with a Power Model. *IACR Cryptology ePrint Archive*, 2007:443.

Folkman, L. (2007). The use of a power analysis for influencing PIN verification on cryptographic smart card. *Bakalásk práce, Masarykova univerzita, Fakulta informatiky*.

Foo Kune, D. and Kim, Y. (2010). Timing attacks on pin input devices. In *Proceedings of the 17th ACM conference on Computer and communications security*, pages 678–680. ACM.

Kocher, P. C. (1996). Timing attacks on implementations of Diffie-Hellman, RSA, DSS, and other systems. In *Advances in Cryptology—CRYPTO’96*, pages 104–113. Springer.

Linge, Y., Dumas, C., and Lambert Lacroix, S. Using the Joint Distributions of a Cryptographic Function in Side Channel Analysis. In *Constructive Side-Channel Analysis and Secure Design - COSADE 2014*, pages 199–213. Springer.

Mangard, S. A simple power-analysis (SPA) attack on implementations of the AES key expansion. In *Information Security and Cryptology—ICISC 2002*, pages 343–358. Springer.

Mangard, S., Oswald, E., and Popp, T. (2008a). *Power analysis attacks: Revealing the secrets of smart cards*, volume 31. Springer Science & Business Media.

Mangard, S., Oswald, E., and Popp, T. (2008b). *Power analysis attacks: Revealing the secrets of smart cards*, volume 31. Springer Science & Business Media.

Moro, N., Dehbaoui, A., Heydemann, K., Robisson, B., and Encrenaz, E. Electromagnetic fault injection: towards a fault model on a 32-bit microcontroller. In *Fault Diagnosis and Tolerance in Cryptography (FDTC), 2013 Workshop on*, pages 77–88. IEEE.

Oswald, E. and Mangard, S. (2006). Template attacks on masking—resistance is futile. In *Topics in Cryptology–CT-RSA 2007*, pages 243–256. Springer.

Quisquater, J.-J. and Samyde, D. (2001). Electromagnetic analysis (EMA): Measures and counter-measures for smart cards. In *Smart Card Programming and Security*, pages 200–210. Springer.

Rechberger, C. and Oswald, E. (2005). Practical template attacks. In *Information Security Applications*, pages 440–456. Springer.

Riviere, L. (2015). *Sécurité des implémentations logicielles face aux attaques par injection de faute sur systemes embarqués*. PhD thesis, Telecom Paris Tech.

Riviere, L., Najm, Z., Rauzy, P., Danger, J.-L., Bringer, J., and Sauvage, L. High precision fault injections on the instruction cache of ARMv7-M architectures. In *Hardware Oriented Security and Trust (HOST), 2015 IEEE International Symposium on*, pages 62–67. IEEE.