# SIV: Raise the Correlation of Second-Order Correlation Power Analysis to 1.00  
[PERSON]  
1 Department of Mathematics, Kookokmin University, Seoul 02707, Korea; 22 [EMAIL_ADDRESS]  
2  
[PERSON]  
1 Department of Mathematics, Kookmin University, Seoul 02707, Korea; 22 [EMAIL_ADDRESS]  
2  
[PERSON]  
1 Department of Mathematics, Kookmin University, Seoul 02707, Korea; 22 [EMAIL_ADDRESS]  
2  
Footnote 1: email: {j.m. masking, which splits an intermediate value into two random variables, is utilized. That is, it spreads the power consumption related to the intermediate value into two points. The first-order masked implementation is vulnerable to the second-order correlation power analysis (SOCPA) that utilizes the correlation between guessable intermediate value and two split points of power consumption. Two points of power consumption are preprocessed to related to the guessable intermediate value, and the preprocessing function determines the SOCPA performance. For the SOCPA, the longer bit length of the intermediate value reduces the correlation between the hypothetical intermediate value and preprocessed power consumption. That is, 1-bit intermediate value has the highest correlation with the preprocessed power consumption when performing the SOCPA. However, 1-bit intermediate is generally not used because shorter bit length reduces the accuracy of the power model. In this tradeoff relation, analysts commonly use an 8-bit intermediate value to improve the performance of the SOCPA. SOCPA requires more power traces than the FOCPA to determining whether the guessed key is the right key because the correlation of the SOCPA is much lower than the FOCPA. Accordingly, several preprocessing functions had been suggested to raise the correlation of the SOCPA. The first function is the product of two points [8]. If the power model is the Hamming weight model and the length of the intermediate value is 8, the absolute correlation coefficient is only about 0.09. In this case, theoretically, the general SOCPA requires at least \(\frac{1}{0.09^{2}}\approx 123\) times more traces than the FOCPA because the correlation is only 0.09 [9]. Thus, the first function is generally not used. In 2000, the absolute-difference (AD) function was proposed by [PERSON] [10]. However, the correlation was still only 0.24, much lower than 1.00. To raise the correlation, [PERSON] suggested the product-combining (PC) function in 2009, and the correlation was enhanced to 0.35 [11]. Existing researches are focused on the preprocessing function to enhance SOCPA performance, and the correlation has not raised significantly. As discussed above, a 1-bit intermediate value is typically not used because it decreases the accuracy of the power model. However, the correlation between the hypothetical intermediate value and preprocessed power consumption is 1.00, if the preprocessing function is AD or PC. Thus, if there exists the 8-bit intermediate value that has the same characteristic as 1-bit, it allows significantly raising the correlation. We focus on the characteristic that the number of cases is 2, for 1-bit intermediate value. Therefore, unlike existing researches, we aim to find the intermediate values that have a smaller cardinality, such as a 1-bit intermediate value. In this paper, we propose the special intermediate value, named sparse intermediate value (SIV), based on the operational characteristics of the cryptographic algorithm, and remarkably raise the correlation from 0.35 to 1.00. That is, we reduce the the minimum trace to disclose the secret key to the same as the FOCPA. The rest of this paper is organized as follows. Section 2 briefly describes the overview of the CPA and MixColumns of the advanced encryption algorithm (AES). We analyze the operational characteristics to find the SIV and demonstrate the existence of the power consumption related to SIV in Section 3. Section 4 analyzes OpenSSL AES and compares the general SOCPA using 8-bit SubBytes output to SIV-based SOCPA.