Maximal overlap discrete wavelet transform‐based power trace alignment algorithm against random delay countermeasure

ETRI JournalEarly View ORIGINAL ARTICLEFree Access Maximal overlap discrete wavelet transform-based power trace alignment algorithm against random delay countermeasure Saravanan Paramasivam, Corresponding Author Saravanan Paramasivam dpsaravanan@gmail.com orcid.org/0000-0003-0785-807X Department of Electronics and Communication Engineering, PSG College of Technology, Coimbatore, India Correspondence Saravanan Paramasivam, Department of Electronics and Communication Engineering, PSG College of Technology, Coimbatore, India. Email: dpsaravanan@gmail.comSearch for more papers by this authorSrividhyaa Alamelu PL, Srividhyaa Alamelu PL Department of Electronics and Communication Engineering, PSG College of Technology, Coimbatore, IndiaSearch for more papers by this authorPrashanth Sathyamoorthi, Prashanth Sathyamoorthi Silicons and Systems, Juniper Networks India Pvt. Ltd., Bangalore, IndiaSearch for more papers by this author Saravanan Paramasivam, Corresponding Author Saravanan Paramasivam dpsaravanan@gmail.com orcid.org/0000-0003-0785-807X Department of Electronics and Communication Engineering, PSG College of Technology, Coimbatore, India Correspondence Saravanan Paramasivam, Department of Electronics and Communication Engineering, PSG College of Technology, Coimbatore, India. Email: dpsaravanan@gmail.comSearch for more papers by this authorSrividhyaa Alamelu PL, Srividhyaa Alamelu PL Department of Electronics and Communication Engineering, PSG College of Technology, Coimbatore, IndiaSearch for more papers by this authorPrashanth Sathyamoorthi, Prashanth Sathyamoorthi Silicons and Systems, Juniper Networks India Pvt. Ltd., Bangalore, IndiaSearch for more papers by this author First published: 03 March 2022 https://doi.org/10.4218/etrij.2021-0074AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinked InRedditWechat Abstract Random delay countermeasures introduce random delays into the execution flow to break the synchronization and increase the complexity of the side channel attack. A novel method for attacking devices with random delay countermeasures has been proposed by using a maximal overlap discrete wavelet transform (MODWT)-based power trace alignment algorithm. Firstly, the random delay in the power traces is sensitized using MODWT to the captured power traces. Secondly, it is detected using the proposed random delay detection algorithm. Thirdly, random delays are removed by circular shifting in the wavelet domain, and finally, the power analysis attack is successfully mounted in the wavelet domain. Experimental validation of the proposed method with the National Institute of Standards and Technology certified Advanced Encryption Standard-128 cryptographic algorithm and the SAKURA-G platform showed a 7.5× reduction in measurements to disclosure and a 3.14× improvement in maximum correlation value when compared with similar works in the literature. 1 INTRODUCTION Side channel attacks break cryptography by exploiting the information leaked by the physical implementation of cryptography, such as monitoring the power consumption, known as a power analysis attack (PAA), electromagnetic field (EMF) radiation, execution time, and so on [1]. The two important countermeasures known as masking and hiding are highlighted as the front line of defense against PAA in many secure cryptographic implementations. Time randomization, one of the key techniques in hiding countermeasures, plays a vital role in desynchronizing the attack points in the power traces and operations that are performed in the cryptographic algorithm. This can be performed either at the software level by random delay insertion (RDI) using dummy operations [2, 3] or at the hardware level by varying the clock jitter [4]. A novel gate-level countermeasure was proposed by inserting random delays in the data path of a cryptographic processor [5]. Split-RDI technique was incorporated as a random delay countermeasure [6] and data-dependent instantaneous (intra-cycle) power dissipation was used as an additional source of randomness to mitigate PAA [7]. A combinational counter-based approach to randomize the power profile of crypto-cores to resist against differential power analysis (DPA) attacks was presented in [8]. A random delay countermeasure can be reverse engineered by applying suitable alignment algorithms, which lead to the cancellation of the countermeasure and make the implementation open for attack. Several alignment algorithms exist in the literature to align the following measurements: static alignment [9], elastic alignment [10], and rapid alignment algorithms [11]. A sliding window DPA against random process that interrupts countermeasure using Hamming integration variant method was proposed in [12]. A high-resolution DPA using phase-based waveform matching was proposed in [13] to adjust for the misalignments among waveforms and to defeat random delay countermeasures. An end-to-end profiling attack strategy based on convolutional neural networks robust to trace misalignment was proposed in [14]. PAA was also performed in the frequency domain by mapping the time domain information to the frequency domain [15]. A unified wavelet-based attack framework was proposed against random delay countermeasure in [16] using discrete wavelet transform (DWT). The shift-variant property of DWT makes it inappropriate for time series analysis, and hence, the removal of random delays using DWT coefficients creates an ambiguity in their work. To overcome this drawback, maximal overlap discrete wavelet transform (MODWT)-based random delay estimation and removal is proposed in this paper. Because MODWT is shift invariant and nondecimated, it can be used to analyze both stationary and nonstationary behaviors of power traces, which are also time series signals. Experiments have shown that MODWT can eliminate alignment artifacts with good resolution and less complexity. The following are the major contributions of this work: It has been proved that the DWT-based attack framework [16] cannot be used for aligning the power traces due to the shift-variant property of DWT through mathematical model and power spectrum. A novel attack framework is proposed to detect random delay in the power traces and to remove it using MODWT, which has shift-invariant property. The proposed attack framework in wavelet domain outperforms the existing works in literature. Demonstration of the experimental proof is shown in state-of-the-art SAKURA-G PAA platform using the National Institute of Standards and Technology (NIST) certified Advanced Encryption Standard (AES)-128 cryptographic algorithm. The organization of the paper is given as follows. Section 2 covers the concepts in the DWT. Section 3 highlights the drawbacks of DWT-based power trace alignment. Section 4 describes the significance of MODWT in power trace alignment. Section 5 details the proposed method to attack the random delay countermeasure. Section 6 compares the performance metrics with the existing work. Section 7 draws the conclusion of the paper with the necessary references. 2 DISCRETE WAVELET TRANSFORM DWT partitions the energy in time series into pieces that are associated with different scales and times by filtering the time series signal through a set of low pass and high pass filters at every level j. That is, DWT decomposes a time series signal in terms of coefficients that are associated with a particular time and a particular dyadic scale 2j−1 where the decomposition level j ranges from 1 to J. The coefficients obtained after passing the input signal through the high pass filter (wavelet filter h), called as wavelet coefficients (W), are associated with the changes in weighted averages on a dyadic scale, and those obtained by passing the input signal through the low pass filter (scaling filter g), scaling coefficients (V), are associated with the average of the entire data. Thus, the multiresolution analysis (MRA) of the time series signal X(t) can be represented as the series summation of wavelet coefficients over the decomposition levels W j , j = 1 , . . . , J, and the scaling coefficient VJ at the Jth level, which is mathematically depicted in (1): X = ∑ j = 1 J W j + V J . (1) 3 DRAWBACKS OF EXISTING DWT-BASED POWER TRACES ALIGNMENT This section covers the mathematical proof to justify the inability of the DWT-based power trace alignment algorithm. Consider a time series signal (x1) and a shifted version (x2) of it. The DWT of the above two signals is different, making the DWT susceptible to shifting. This is because the discrete wavelet empirical power spectrum of a time series and the shifted version are not the same. This can be mathematically proven by considering an example. Let x 1 = 0 0 − 4 2 4 0 0 0 , x 2 = 0 0 0 − 4 2 4 0 0 . x2 is the time-shifted version of x1. The discrete wavelet empirical power spectrum PW for different dyadic scales τj is given by (2): P w ( τ j ) ≡ 1 N ‖ W j ‖ 2 , (2)where N is the sample size, here N = 8, and ‖ W j ‖ 2 is the squared normalization of the wavelet coefficients. In the above example, the Haar wavelet is considered the mother wavelet because of its simple representation. The Haar wavelet is a two-member family whose impulse response of the high pass filter (wavelet filter h) is [ 1 / 2 , − 1 / 2 ] and the low pass filter (scaling filter g) is [ 1 / 2 , 1 / 2 ]. The DWT coefficients for the signals x1 and x2 at each level are determined by decomposing the signal using the high pass and low pass filters specified in Tables 1 and 2. The discrete Haar wavelet transform is theoretically composed of averages and differences between the members of the average pair and the computed average at each level. The discrete wavelet empirical power spectrum is calculated using (2) and is shown in Table 3. Thus, as illustrated in Table 3, the empirical power spectrum of the Haar discrete wavelet is distinct for the time series x1 and x2 (time-shifted version of x1). TABLE 1. DWT coefficients of signal x1 Signal x1/scale 0 0 −4 2 4 0 0 0 1 0 −1 2 0 0 −3 2 0 2 −1/2 1 1/2 1 0 −3 2 0 4 1/4 −3/4 1/2 1 0 −3 2 0 TABLE 2. DWT coefficients of signal x2 Signal x2/scale 0 0 0 −4 2 4 0 0 1 0 −2 3 0 0 2 −1 0 2 −1 3/2 1 3/2 0 2 −1 0 4 1/4 −5/4 1 3/2 0 2 −1 0 TABLE 3. Haar DWT power spectrum of x1 and x2 Scale P(τ) of x1 P(τ) of x2 1 13/4 5/4 2 5/8 13/4 4 9/16 25/16 The same is true for DWT using any other mother wavelets. This demonstrates that the DWT of a time series signal and its time-shifted version are different, and hence, DWT is a shift variant. The shift variance can be explained by considering the DWT wavelet coefficients as the difference between the signal's weighted averages and the high pass filters. The intervals, over which these averages are computed, are rigidly fixed; hence, the time series characteristics may not line up well. Thus, altering the series' starting point produces different results when using the DWT-defined averaging intervals. Due to DWT's inability to shift, it is unsuitable for alignment in the wavelet domain as it interprets the shifted signal as a distinct signal. 4 PROPOSED MODWT-BASED POWER TRACES ALIGNMENT Decimation in signal processing refers to downsampling, and DWT is a decimated wavelet transform. That is, the input sample size N must be an integer multiple of 2J, and the number of scaling and wavelet coefficients at each level of decomposition j decreases by a factor of 2 due to the decimation process required at the output of the corresponding filters. It is because of the reduction in the sample size that the delay information in the power traces is not properly mapped to the DWT coefficients; hence, it treats the shifted signal as a different signal. A modified version of DWT known as MODWT can be used to overcome the shift-variant problem of DWT. Like DWT, MODWT also decomposes the input signal into wavelet and scaling coefficients by filtering the input signal through a series of low and high pass filters, but it is an undecimated wavelet transform, so the signal length remains constant across decomposition levels. The undecimated property of MODWT introduces redundancy in the time axis and tends to reinforce the signal characteristics and features by keeping a significant overlap among the wavelets within and across the decomposition levels, thereby making MODWT shift invariant. Hence, MODWT treats a time-shifted power trace same as a power trace without the shift. It is possible to recover the power trace from its shifted version by proportionally shifting the wavelet and the scaling coefficients. The MODWT coefficients of signals x1 and x2 are shown in Tables 4 and 5, respectively. The power spectrum of both the signals x1 and x2 (shifted in the time domain) using MODWT coefficients is similar; hence, the shift invariance property of MODWT has preserved the time shift in the wavelet domain as shown in Table 6. TABLE 4. MODWT coefficients of signal x1 Signal x1/scale 0 0 −4 2 4 0 0 0 1 0 0 −2 3 1 −2 0 0 2 0 0 −1.0 −0.5 2.5 1.5 −1.5 −1.0 4 −0.25 −0.25 −1.25 −0.75 0.25 0.25 1.25 0.75 Scaling coefficient 0.25 0.25 0.25 0.25 0.25 0.25 0.25 0.25 TABLE 5. MODWT coefficients of signal x2 Signal x2/scale 0 0 0 −4 2 4 0 0 1 0 0 0 −2 3 1 −2 0 2 −1.0 0 0 −1.0 −0.5 2.5 1.5 −1.5 4 0.75 −0.25 −0.25 −1.25 −0.75 0.25 0.25 1.25 Scaling coefficient 0.25 0.25 0.25 0.25 0.25 0.25 0.25 0.25 TABLE 6. Haar MODWT power spectrum of x1 and x2 Scale P(τ) of x1 P(τ) of x2 1 4.5 4.5 2 6.5 6.5 4 4.5 4.5 The shift invariance is accomplished due to the circular filtering operation that is incorporated in the computation of MODWT. The circular filtering of the power trace can be interpreted as calculating the coefficients over all possible averaging intervals rather than fixed intervals. It is achieved by periodizing the scaling and wavelet filters to the length of the power trace. This added redundancy across time makes MODWT a variation of DWT suitable for alignment of features in the wavelet domain and insensitive to the starting point of the power trace; that is, the features can be uniquely identified irrespective of their position in the power trace. The MODWT coefficients are expressed in the same way as DWT except that the wavelet filter h ˜ and scaling filter g ˜ are rescaled versions of those used in DWT as given in (3) and (4), respectively. h l ˜ ≡ h l / 2 , (3) g l ˜ ≡ g l / 2 . (4) Considering the Haar wavelet as the mother wavelet, the rescaled version of the Haar wavelet filter h ˜ is denoted as [1/2, −1/2]. The scaling filter is the quadrature mirror of the wavelet filter, which is mathematically denoted in (5). The rescaled version of Haar scaling filter g ˜ is denoted as [1/2, 1/2]. g l ≡ ( − 1 ) l + 1 h L − 1 − l . (5) To qualify as a wavelet filter, the filter coefficients must sum to zero, have unit energy, and be orthogonal to even shifts for all nonzero integers n. The conditions to be satisfied considering the rescaled version of Haar wavelet filter are given in (6). Similarly, the conditions to be satisfied to qualify as a scaling filter are given in (7) for all nonzero integers n considering the rescaled version of Haar scaling filter. In both cases, L denotes the length of the filter. ∑ l = 0 L − 1 h l ˜ = 0 , ∑ l = 0 L − 1 h l 2 ˜ = 1 2 , and ∑ l = − ∞ ∞ h l ˜ h ˜ l + 2 n = 0 , (6) ∑ l = 0 L − 1 g l ˜ = 1 , ∑ l = 0 L − 1 g l 2 ˜ = 1 2 , and ∑ l = − ∞ ∞ g l ˜ g ˜ l + 2 n = 0 . (7) These conditions are applicable to any other mother wavelet. The MODWT wavelet coefficients ( W ˜ ) and scaling coefficients ( V ˜ ) are obtained by circularly filtering the power trace Xt with the MODWT wavelet filter h ˜ and scaling filter g ˜ for level J = 1 as given in (8) and (9), respectively. W ˜ 1 , t ≡ ∑ l = 0 L − 1 h ˜ l X t − l mod N , (8) V ˜ 1 , t ≡ ∑ l = 0 L − 1 g ˜ l X t − l mod N , (9)where t = 0, …, N − 1; N, length of the power trace and mod N, stands for the circular filtering operation, which produces the same number of coefficients at each scale during the decomposition of the power trace Xt. The pyramid algorithm to compute MODWT for a time series signal incorporating circular filtering is given in [17]. The MODWT coefficients of signals x1 and x2 (shifted version of x1) shown in Tables 4 and 5, respectively, are computed using (8) and (9). It can be observed that the MODWT coefficients of signal x2 are circular shifted by the same amount of delay inserted in time domain when compared to the MODWT coefficients of signal x1. Thus, the delay in time domain is preserved in the wavelet domain as well, and this delay can be removed by properly circular shifting the MODWT coefficients of the delayed power trace. 5 PROPOSED METHOD TO ATTACK RANDOM DELAY COUNTERMEASURE In the standard attack framework [9], the power traces are aligned in the time domain by using the static alignment method, and then the attack is mounted. As the time domain-based attack framework is not efficient, the power traces in the time domain are mapped to the frequency domain by applying Fourier transform in the frequency-based attack framework [15]. In order to further improve the efficiency of the attack against random delay countermeasure, the power traces in the time domain are mapped to the wavelet domain by applying DWT on different scales [16]. Because DWT is time variant, it treats the delayed signal as a different signal, which makes it unsuitable for alignment of power traces. In order to overcome this drawback, a novel power trace alignment algorithm is proposed in this work, which makes use of the time-invariant MODWT to align the power traces. The randomly delayed power traces in the time domain are mapped to the wavelet domain by applying MODWT at different scales, and the attack is mounted in the wavelet domain itself after the detection and removal of random delays with the proposed alignment algorithm. Because the attack framework is proposed in wavelet domain, the power traces need not be separately denoised. The information contained in the noisy power trace can be extracted by performing MRA of MODWT coefficients. 5.1 Threat model and attack environment The proposed method uses AES-128 cryptographic implementation in the SAKURA-G platform, and the target platform for attack is the output of the AES SBox in the first round. The power traces are captured by using Keysight MSOX3104T. MATLAB 9.7 (R2019b) version is used to perform wavelet analysis on the power traces. The attacks are performed by utilizing the correlation power analysis (CPA) where Pearson's correlation coefficient (CC) value is used as a distinguisher, difference of means attack, and test vector leakage assessment (TVLA). The hypothetical power is obtained by using the Hamming weight model. There are three approaches available in literature for random delay countermeasures, such as random propagation delay, RDI, and random clock jitter. Among them, the RDI technique is used as a software-level countermeasure wherein a counter is running inside a loop to create the random delay execution. In the hardware-level countermeasure, random propagation delay method is used to shift the start of the encryption operation with a random delay, which in turn shifts all the operations in the subsequent rounds of the cryptographic algorithm. Random clock jitter is another hardware-level countermeasure wherein the clock signal is randomly delayed with different frequencies. The impact of random propagation delay and random clock jitter on the ideal clock signal is shown in Figure 1. FIGURE 1Open in figure viewerPowerPoint Illustration of random delay in clock signal In the case of iterative architecture-based cryptographic implementation, each round of operation takes one clock cycle for execution, and hence, each round operation will be shifted with a variable delay due to clock jitter. Considering a single round of operation among the 10 rounds of operation in AES, both the random propagation delay and the random clock jitter methods produce similar results, as the round operation will be delayed randomly in both cases in iterative architecture. It is well known that AES cryptographic algorithm can be attacked either in the first round or last round of operation. Therefore, if the first round or the last round alone is considered for a PAA, then the effect of these two hardware-level countermeasures will be the same. Hence, the random propagation delay method has been chosen to develop a random delay countermeasure, and subsequently, this is used for random delay removal with our proposed approach. Random numbers are generated separately by using maximal length linear feedback shift register (LFSR) and they are used to generate random delays. The nonzero random delay is inserted in the start signal of the cryptographic implementation as shown in Figure 2. FIGURE 2Open in figure viewerPowerPoint PAA setup with random delay insertion 5.2 Proposed attack framework The attack framework starts with capturing power traces from the random delay countermeasure implemented cryptographic hardware. The complete steps involved in our proposed framework for mounting the attack against random delay countermeasure are shown in Figure 3. The power traces are captured in the time domain (TD), and all the remaining steps in the proposed attack are performed in the wavelet domain (WD). FIGURE 3Open in figure viewerPowerPoint Steps involved in the proposed attack framework 5.2.1 Random delay sensitization In this step, a wavelet transform is applied to the captured power traces in order to sensitize the random delay component. In order to show the inability of DWT to time series analysis, firstly, the DWT is applied to the power traces and the coefficients are analyzed. The power traces captured while running the AES-128 algorithm are decomposed using the db6 wavelet family up to seven levels above which the coefficients are distorted. To justify our point, the Level 7 approximation coefficient values are plotted in Figure 4 for a range of delay values inserted into the start signal. The coefficients are not similar in all cases due to the downsampling required in the computation of DWT, which makes them shift variant. This observation makes it clear that the DWT cannot be used for time series analysis such as PAA against random delay countermeasure. The original and delayed power traces are then decomposed with MODWT using the db6 wavelet family. The Level 7 approximation coefficient values are plotted for a range of delay values in Figure 5, and the coefficients are similar in all the cases with only a shift in values. This is mainly due to the shift-invariant property of MODWT, which eliminates downsampling during computation. These observations hold true for other wavelet families also. Hence, the proposed attack method uses MODWT to mount PAA against random delay countermeasures. FIGURE 4Open in figure viewerPowerPoint Level 7 approximation coefficient values for a range of delayed power traces using DWT FIGURE 5Open in figure viewerPowerPoint Level 7 approximation coefficient values for a range of delayed power traces using MODWT 5.2.2 Random delay detection In the threat model, it has been assumed that the random delay is inserted at the start signal of the cryptographic operation through a separate random number generator. For example, if a 4-bit random number generator is used, then the execution of the cryptographic operation will be delayed from 1 to 15 units, and this random delay is reflected in the power traces also. Because there are no reference traces to match and align the power traces as in template attack, a virtual reference trace has to be identified from the available power traces. The candidate trace for the virtual reference trace should have a minimum delay and should resemble the pattern of the power trace without the random delay countermeasure. A novel algorithm is proposed in this work in order to identify the virtual reference trace (a trace with a minimum delay inserted) and to further align all the remaining power traces with the virtual reference trace. The proposed algorithm uses linear search and the complexity of our algorithm is O(n) where n is the number of traces. The following are the stages involved in the proposed algorithm: Choose MODWT coefficients of one trace as a reference trace randomly. Compute wavelet cross correlation estimates of MODWT coefficients among the randomly chosen reference trace and the remaining traces. Estimate the delay among the reference trace and all the remaining traces using the lag value of cross correlation estimates. Identify the trace with maximum delay with respect to the reference trace chosen randomly in Step 1. If any of the remaining traces except the reference trace is advanced in time with respect to the reference trace, choose that trace as the reference trace. Recompute the delay by repeating Steps 3 and 4, if the reference trace is altered. Identification of the virtual reference trace with a minimum delay in the last stage requires special attention. Wavelet cross correlation is a scale localized version of the usual cross correlation, which returns the correlation estimates between the two series along with the lag value for each scale. The lag value indicates the offset of one series with respect to the other. A positive lag value indicates that the second series is advanced with respect to the first series, whereas a negative lag value indicates that the second series is delayed with respect to the first series. The lag value corresponding to the maximum wavelet cross-CC value is the estimated delay between the chosen reference and the remaining traces. If the estimated delay of all the remaining traces with respect to the reference trace is negative, then the chosen reference trace is advanced in time compared with the remaining traces. Hence, the chosen reference is the trace with minimum delay. Alternatively, if any one of the remaining traces has positive estimated delay, then that trace will be the one advanced in time with least delay. Hence, choose the trace with most positive estimated delay as the reference trace. 5.2.3 Removal of random delays The chosen reference trace is treated as a virtual reference trace and all the remaining traces are aligned with respect to the virtual reference trace by performing a circular shift in the MODWT coefficients with the appropriate estimated delay. Once the MODWT coefficients are aligned with the reference trace, the effect of the random delay countermeasure is completely nullified in the MODWT coefficients of the power traces. 5.2.4 Pseudo code of the proposed algorithm The above pseudo code depicts the first three stages of the proposed attack framework. The detailed explanation of each stage is given in Sections 5.2.1 to 5.2.3. In Step 1, random delay sensitization is performed where MC(T) is the MODWT coefficients of the input traces. Steps 2 to 9 correspond to random delay detection. MODWT_CROSS_CORR function performs cross correlation between the chosen reference trace and the remaining traces in WD. Removal of random delay is performed in Step 10 where MC_aligned is the MODWT coefficients of the power traces after the removal of random delays. CIRC_SHIFT function performs circular shifting operation by the amount of detected random delays for each of the power traces. This is clearly illustrated with an example. Assume that there are five traces (T[1] to T[5]) with varying delays inserted in each trace as shown below. The alignment of these power traces using the proposed algorithm for the various possible initial reference traces is shown in Table 7. T [ 1 ] = 0 0 − 4 2 4 0 0 0 ; T [ 2 ] = 0 0 0 − 4 2 4 0 0 ; T [ 3 ] = 0 0 0 0 0 − 4 2 4 ; T [ 4 ] = 0 − 4 2 4 0 0 0 0 ; T [ 5 ] = − 4 2 4 0 0 0 0 0 ; TABLE 7. Illustration of proposed alignment algorithm Possible R Ref Delay [min_delay] [min_index] Ref Delay (Step 2) (Step 3) (Step 6) (Step 7) (Step 8) (Step 9) (After Step 9) 1 MC (1) [0, −1, −3, 1, 2] [2] [5] MC (5) [−2, −3, −5, −1, 0] 2 MC (2) [1, 0, −2, 2, 3] [3] [5] MC (5) [−2, −3, −5, −1, 0] 3 MC (3) [3, 2, 0, 4, 5] [5] [5] MC (5) [−2, −3, −5, −1, 0] 4 MC (4) [−1, −2, −4, 0, 1] [1] [5] MC (5) [−2, −3, −5, −1, 0] 5 MC (5) [−2, −3, −5, −1, 0] [0] [5] MC (5) [−2, −3, −5, −1, 0] 5.2.5 PAA in wavelet domain The PAA attack can be performed on the aligned MODWT coefficients either in the TD by reconstructing the MODWT coefficients using the inverse MODWT (iMODWT) operation