# Comprehensive Evaluation on an ID-Based Side-Channel Authentication with FPGA-Based AES
## 6 Evaluation of Authentication Accuracy
### Relationship Among \(M\), \(n\), and False Errors  
Following the approach in [4], the relationship between \(M\), \(n\), and the false acceptance and false rejection errors \(S_{1}(h)\) and \(S_{2}(h)\) can be visualized when changing \(h\), as shown in Figure 6. The threshold \(h\) was set in the range from \(-1\) to \(1\).  
There are two major differences between the work of [4] and the proposed scheme. One is that the parameter \(M\) is regarded as the number of authentication trials in this paper, although it was previously taken to mean the number of provers in [4] by assuming that each prover was only accessed once. That is, \(M\) corresponded to the number of distinguishable provers. In contrast, in this study, it is assumed that \(M\) fake provers access the authentication system as well as \(M\) legitimate provers. In total, \(2M\) trials are assumed when estimating the false errors, whereas \(M^{2}\) trials were used in [4]. This  
\begin{table}
\begin{tabular}{c c c c} \hline \hline  & **1000 Traces of AES-128 [1]** & \multicolumn{3}{c}{**1000-Round AES**} \\  & **(1000 Round Function Calls)** \\ \hline
**Used Model** & **HD model**1  & **HD Model** & **XOR Model**2  \\ \hline Acquisition & 43 & 0.50 \\ Data Processing & 0.34\(\cdot q\) & 0.083 & 0.086 \\ Total & 43 + 0.34\(\cdot q\) & 0.583 & 0.586 \\ \hline \hline \end{tabular}
\end{table}
Table 2: The difference in authentication time in seconds.  
assumption affects the variance parameter and the mean values of approximated normal distributions because the number of samples is different. The other difference relates to the parameter \(n\), which is defined as the number of rounds of 128-bit AES in this paper, whereas it was defined as the number of traces of 128-bit AES encryption in [4].  
To derive the histogram of acceptance and rejection trials, Fisher \(z\)-transformation was applied to achieve approximation. After that, we verified the validity with the Jarque-Bera test. Since the histogram can approximate a normal distribution, it was found that the correlation coefficients dependent on secret keys and plaintext were not derived. Then, the histograms of the acceptance and rejection trials were approximated to follow normal distributions (see Figure 6), respectively, as \(\mathcal{N}(\mu_{1},\sigma_{1}^{2})\) and \(\mathcal{N}(\mu_{2},\sigma_{2}^{2})\) where the variances \(\sigma_{1}^{2}\) and \(\sigma_{2}^{2}\) are described with \(n\) as  
\[\sigma_{1}^{2}=\frac{\beta_{1}}{n},\ \ \sigma_{2}^{2}=\frac{\beta_{2}}{n} \tag{1}\]  
where \(\beta_{1}\) and \(\beta_{2}\) are constants that are experimentally determined with the correlation coefficients between the observed \(n\)-round side-channel information and the leakage model. Therefore, with the threshold, defined as \(h\), the probability of a false rejection ratio \(S_{1}(h)\) and false acceptance ratio \(S_{2}(h)\) are represented by  
\[S_{1}(h) =\frac{1}{2}\text{erfc}\Big{(}\frac{\mu_{1}-h}{\sqrt{2\sigma_{1}^{ 2}}}\Big{)}, \tag{2}\] \[S_{2}(h) =\frac{1}{2}\text{erfc}\Big{(}\frac{h-\mu_{2}}{\sqrt{2\sigma_{2}^ {2}}}\Big{)}. \tag{3}\]  
As the total number of false errors should be equal to or less than one for \(2M\) trials, we have  
\[MS_{1}(h)+MS_{2}(h)\leq 1. \tag{4}\]  
Therefore, the total number of trials \(M\) can be derived from  
\[M\leq\frac{1}{S_{1}(h)+S_{2}(h)}. \tag{5}\]  
By increasing the number of rounds, the system is capable of distinguishing many provers.