## 5 Experimental Evaluation
### Success Rate and Performance of Our Key Recovery Algorithm  
To run simulations of our algorithm, we set partition to \([0,4,8,12,16,20,24,28,32]\), meaning the number of blocks is \(8\), and M to \([M,M,M,M,M,M,M]\) with \(M\in\{256,512,1024\}\) and \(\texttt{limit}\in\{2^{30},2^{40},2^{50}\}\). Note that, since the number of blocks is \(8\), a full enumeration during the second phase would enumerate \(2^{8\cdot 0\log_{2}M}\) complete candidates. In addition, according to our cold boot attack model, one of the probabilities is normally a fixed value (circa 0.001), while the other probability values vary in a memory region. Thus, in particular, \(\alpha\) was set to \(0.001\), while \(\beta\in\{0.001,0.01,0.02,0.03,\ldots,0.19,0.2\}\). Additionally, we made some small changes to our key recovery algorithm so that we could estimate success rates without running either a prohibitively costly full enumeration or partial enumerations during the second phase. To do so, we exploited a function of NOKEA that returns an interval of the form \([max-\sigma,max]\) such that the number of candidates in the interval is the smallest upper bound for a given parameter limit. We denote it as \(\texttt{getInterval}(\cdot)\). Our results were obtained by running our tweaked algorithm 100 times for each combination of the parameters. Also, the success rate for such combination is calculated as the number of successful trials over the number of trials. In particular, a simulation was run as follows. First, a 256-bit seed representing the real private seed, private_seed, was randomly generated and stored in a 32 byte array, and then perturbed according to \(\alpha\) and \(\beta\) to obtain its noisy version, ns. The tweaked algorithm was then called along with the following parameters ns, private_seed, partition, M, \(\alpha\) and \(\beta\). It ran Phase I, thus obtaining the lists \(L_{\texttt{B}^{j}}\) for \(j=1,2,\ldots,8\), and then checked if each corresponding block \(j\) of private_seed was found as value of some chunk candidate in the list \(L_{\texttt{B}^{j}}\). If such check was not satisfied for some \(j\), then it means that, if our recovery algorithm ran a full enumeration in Phase II, then the real private key would not be found. Therefore, the tweaked algorithm set output to \([0,0,0,0]\), returned it and exited. However, if such check was satisfied for all \(j\), then it means that a full enumeration run in Phase II would find the real private key. Therefore, the tweaked algorithm set output to \([1,0,0,0]\), calculated the score sc of the real private seed using private_seed, ns, \(\alpha\) and \(\beta\), and then retrieved three intervals \([max-\sigma_{1},max],[max-\sigma_{2},max],[max-\sigma_{3},max]\) for \(\texttt{limit}\in\{2^{30},2^{40},2^{50}\}\), respectively, by calling the function \(\texttt{getInterval}(\cdot)\) from NOKEA and updated the corresponding entries of output if sc is in the corresponding interval. It finally returned output. Figure 1a-c show a comparison between the success rates of a complete enumeration and partial enumerations with \(\texttt{limit}\in\{2^{30},2^{40},2^{50}\}\) for each value assumed by \(M\), respectively. As expected, the success rate of a full enumeration is greater than the success rate of a \(2^{50}\) enumeration, which in turn is greater than the success rate of a \(2^{40}\) enumeration, and this in turn greater than the success rate of a \(2^{30}\) enumeration. In addition, each plot shows the same trend, i.e., as \(\beta\) increases, the success rate declines until completely vanishing when \(\beta\geq 0.15\). Figure 2a,b show a comparison between the success rates of complete enumerations and between the success rates of \(2^{40}\) partial enumerations for each value assumed by \(M\), respectively. As expected, Figure 2a shows that, as \(M\) increases, the success rate for a complete enumeration also increases, i.e., the graphs for \(M\in\{256,512\}\) are dominated by the graph for \(M=1024\).