# SIV: Raise the Correlation of Second-Order Correlation Power Analysis to 1.00
## 3 Sparse Intermediate Value in AES
### Finding the SIV Based on Operational Characteristics  
The \(\mathtt{xtime}\) performs different operations depending on the input's MSB, as shown in Equation (5). To determine the instruction to be executed in software implementation, the MSB must be extracted and stored in a register. When storing the MSB in an 8-bit register, only 1-bit changes depending on the MSB and the remaining 7 bits are always zero. Let the binary representation of the input \(d\) be \(\left(d_{7}d_{6}d_{5}d_{4}d_{3}d_{2}d_{1}d_{0}\right)_{2}\). Then the intermediate value \(S_{1}\), which is stored in the register when extracting MSB, is \(\left(s_{7}s_{6}s_{5}s_{4}s_{3}s_{2}s_{1}s_{0}\right)_{2}=\left(0000000d_{7} \right)_{2}\). The \(\left|C\left(S_{1}\right)\right|\) is only 2, which is much smaller than \(2^{8}=256\). Therefore, \(S_{1}\) can be utilized as the SIV. Thus, we define the Property 1 as follows. **Property 1**. : _MSB extraction is essential to implement_ **time**_. Therefore, the SIV exists as \(S_{1}=\left(0000000d_{7}\right)_{2}\), such that \(\left|C\left(S_{1}\right)\right|\) is only 2._  
\[C\left(S_{1}\right)=\left\{\left(0000000\right)_{2},\ \left(0000001 \right)_{2}\right\}=\left\{0x00,\ 0x01\right\}.\]  
Listing 1 is one of the xtime implementations in C language. It can be divided into two parts. One part is multiplication by \(x\) as the left-side of the XOR operator \(\left(\text{input}\ll 1\right)\), and the other part is reduction by the irreducible polynomial as the right-side \(\left(\left(\text{input}\gg 7\right)*0x1b\right)\). Listing 1: 8-bit implementation of xtime using C language. ```
1#definextime(input)((input<<1)^((input>>7)*0x1b))
```  
In the reduction part, the MSB is not only extracted at \(\left(\text{input}\gg 7\right)\) but also multiplied by 0x1b to decide whether to reduce the left-side result. The intermediate value \(S_{2}\), which is stored when the MSB is multiplied by 0x1b, is \(d_{7}\times\left(00011011\right)_{2}=\left(000d_{7}d_{7}0d_{7}\right)\). As the \(\left|C\left(S_{2}\right)\right|\) is only 2, \(S_{2}\) can be utilized as the SIV. Note that the difference between the Hamming weights of elements in \(C\left(S_{2}\right)\) is 4, whereas the difference of \(C\left(S_{1}\right)\) is only 1. The effect of \(S_{2}\) on power consumption is relatively greater compared to \(S_{1}\). \[ \begin{split} P_{S_{1}}&=\epsilon\times\text{HW} \left(S_{1}\right)+P_{noise}=\epsilon\times d_{7}+P_{noise}\\ P_{S_{2}}&=\epsilon\times\text{HW}\left(S_{2}\right) +P_{noise}=\epsilon\times\left(4d_{7}\right)+P_{noise}.\end{split}  \tag{6}\]  
Therefore, \(S_{2}\) can relatively reduce the effect of noise. Thus, we define the Property 2 as follows. **Property 2**. : _If SIV is computed using a certain constant, the computation result is not only utilized as the SIV, it may also significantly affect power consumption. Thus, the computation result can relatively reduce the effect of noise \(P_{noise}\). In the case of Listing 1, the multiplication result \(S_{2}=\left(000d_{7}d_{7}0d_{7}d_{7}\right)_{2}\) can reduce the effect. The power consumption of \(S_{2}\) and the collection of all possible outcomes of \(S_{2}\) are expressed as follows:_  
\[P_{S_{2}}=\epsilon\times\left(4d_{7}\right)+P_{noise}\]  
\[C\left(S_{2}\right)=\left\{\left(00000000\right)_{2},\ \left(0001101 1\right)_{2}\right\}=\left\{0x00,\ 0x1b\right\}.\]  
We demonstrate the existence of SIV via CPA and t-value. In this paper, we compare the two versions of the CPA, as follows. * GeneralCPA: CPA using SubBytes output as an intermediate value. * SIV-basedCPA: CPA using SIV as an intermediate value. Demonstration of Existence of SIV  
Our experiments demonstrated that the SIV-related power consumption occurs. We analyzed 100,000 power consumption traces at a 29.538 MS/s sampling rate when AES ran on a ChipWhispere-Lite ATXMEGA128D4 (8-bit processor) [14]. We utilized \(S_{2}\) as the SIV.