# SIV: Raise the Correlation of Second-Order Correlation Power Analysis to 1.00
## 2 Related Works
### MixColumns of AES  
The MixColumns of AES is defined as the multiplication of the constant matrix. In the equation below, \(s_{i,j}\) and \(s^{\prime}_{i,j}\) denote the input and output, respectively.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Preprocessing Function** & \multicolumn{4}{c}{**Bit Length (\(l_{I}\))**} \\  & **1** & **2** & **4** & **8** \\ \hline PC & 1.00 & 0.71 & 0.50 & 0.35 \\ AD & 1.00 & 0.53 & 0.34 & 0.24 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Correlation coefficients of Equation (1) for preprocessing functions and the bit length of intermediate values [11; 13].  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Preprocessing Function** & \multicolumn{4}{c}{**Bit Length (\(l_{I}\))**} \\  & **1** & **2** & **4** & **8** \\ \hline PC & 0.13 & 0.18 & 0.25 & 0.35 \\ AD & 0.08 & 0.12 & 0.17 & 0.24 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Theoretical correlation coefficients of Equation (2) for preprocessing functions and the bit length of intermediate values when the length of the register is 8.  
\[\left[\begin{array}{cccc}s_{0,0}^{\prime}&s_{0,1}^{\prime}&s_{0,2}^{\prime}&s_{0, 3}^{\prime}\\ s_{1,0}^{\prime}&s_{1,1}^{\prime}&s_{1,2}^{\prime}&s_{1,3}^{\prime}\\ s_{2,0}^{\prime}&s_{2,1}^{\prime}&s_{2,2}^{\prime}&s_{2,3}^{\prime}\\ s_{3,0}^{\prime}&s_{3,1}^{\prime}&s_{3,2}^{\prime}&s_{3,3}^{\prime}\\ \end{array}\right]=\left[\begin{array}{cccc}2&3&1&1\\ 1&2&3&1\\ 1&1&2&3\\ 3&1&1&2\\ \end{array}\right]\left[\begin{array}{cccc}s_{0,0}&s_{0,1}&s_{0,2}&s_{0,3} \\ s_{1,0}&s_{1,1}&s_{1,2}&s_{1,3}\\ s_{2,0}&s_{2,1}&s_{2,2}&s_{2,3}\\ s_{3,0}&s_{3,1}&s_{3,2}&s_{3,3}\\ \end{array}\right].\]  
In AES, byte values are interpreted as Galois field GF \(\left(2^{8}\right)\) elements, i.e., if the binary representation of the value \(d\) is \(\left(d_{7}d_{6}d_{5}d_{4}d_{3}d_{2}d_{1}d_{0}\right)_{2}\), it is interpreted as the element of the Galois field as follows:  
\[d_{7}x^{7}+d_{6}x^{6}+d_{5}x^{5}+d_{4}x^{4}+d_{3}x^{3}+d_{2}x^{2}+d_{1}x+d_{0}.\]  
Furthermore, AES operation is also defined in the Galois field GF \(\left(2^{8}\right)\). Multiplication is defined by multiplying two binary polynomials and reducing with an irreducible polynomial \(x^{8}+x^{4}+x^{3}+x+1\). The general approach to implement multiplication in the Galois field is to repeat the \(\mathtt{xtime}\) operation, i.e., multiplying the input with \(x\). Multiplying the above polynomial with the polynomial \(x\) results in  
\[d_{7}x^{8}+d_{6}x^{7}+d_{5}x^{6}+d_{4}x^{5}+d_{3}x^{4}+d_{2}x^{3}+d_{1}x^{2}+d _{0}x.\]  
As the degree of the irreducible polynomial is 8, if \(d_{7}\) is zero, the above result does not require reduction. However, if \(d_{7}\) is 1, subtraction of the irreducible polynomial is needed, i.e., byte-level implementation of the \(\mathtt{xtime}\) performs different operation depending on \(d_{7}\). The MSB of the input is determined as follows:  
\[\mathtt{xtime}\left(d\right)=\left\{\begin{array}{ll}d\ll 1&\text{if MSB}\left(d\right)=0,\\ \left(d\ll 1\right)\oplus 0\mathtt{x1}b&\text{if MSB}\left(d\right)=1. \end{array}\right. \tag{5}\]  
Note that the MSB extraction is required to implement the \(\mathtt{xtime}\) operation.  
Our Challenge  
The major challenge we faced in this paper is finding a special intermediate value, shortly SIV, that maintains the correlation coefficient presented in Table 2 when \(l_{I}=1\) because it is less affected by noise, unlike Equation (3). Thus, because the SIV can accurately model power consumption and retain the theoretical correlation coefficient of the SOCPA is 1.00, using the SIV can significantly increase the performance of the SOCPA.