# Single Trace Analysis against HyMES by Exploitation of Joint Distributions of Leakages
## 1 Introduction  
Currently, main public-key cryptosystems in use (such as Rivest-Shamir-Adleman (RSA) and elliptic-curve cryptography (ECC)) are based on the difficulty of number theoretic problems. For example, RSA is based on the difficulty of factoring large numbers, while ECC is based on the difficulty of solving discrete logarithm problems on elliptic curves. However, when a quantum computer is put into practical use running the Shor algorithm, these problems can be solved in polynomial time, thus making the RSA and ECC insecure [1]. Studies on post-quantum cryptography have been actively conducted worldwide in attempts to solve this problem. Post-quantum cryptography involves a cryptographic algorithm that runs on a classical computer, and it is believed to be immune to quantum attacks. There are several categories of post-quantum cryptography: multivariate-based, lattice-based, code-based, isogeny-based cryptography, and hash-based digital signature algorithms. Multivariate cryptography is based on the difficulty of solving multivariate equation systems. Lattice-based cryptography is based on the difficulty of solving several lattice problems. Code-based cryptography is based on the difficulty of decoding general linear codes. Isogeny-based cryptography is based on the hardness of finding isogeny between elliptic curves. Finally, hash-based digital signature algorithms are based on the security of cryptographic hash functions. Among these categories, code-based cryptography has been researched the most due toits fast encryption and decryption speeds [2]. Additionally, code-based cryptosystems account for the second-most submitted categories to the National Institute of Standards and Technology (NIST) standardization project [3]. The first code-based cryptosystem was the McEliece cryptosystem, which was proposed by [PERSON] in 1978 [4]. The McEliece cryptosystem was cryptographic scheme to use randomization in the encryption process. Since the main building block in implementing a McEliece cryptosystem is matrix multiplication, it provides faster encryption and decryption speeds than RSA [2]. However, one disadvantage of code-based cryptosystems is the key size involved in such systems. For example, the public key size of McEliece base on the Goppa code is about 437 KB for 80-bit security [5]. Hybrid McEliece Scheme (HyMES) is a variant of the McEliece system that was proposed by [PERSON] in 2008 [6]. Since the public-key of HyMES uses a generator matrix represented in reduced row echelon form, it has a smaller key size than the classical McEliece. For 80-bit security, the public-key size of HyMES is 63 KB, and it also provides faster speed than the classical McEliece [5]. Although the McEliece cryptosystem is theoretically secure, there could be certain vulnerabilities when implementing such a system [7; 8; 9]. For example, the side-channel analysis proposed by [PERSON] et al. is an attack based on information gained from the implementation rather than from the algorithm itself [10; 11]. During the execution of an algorithm, additional information, such as time, power consumption, and electromagnetic information, can be used to reveal a secret key. Since the side-channel attack is now considered as a de facto standard, post-quantum cryptography (PQC) should similarly consider possible side-channel attacks in order to substitute RSA and ECC. The first proposed side-channel attack on McEliece is the timing attack, which was proposed by [PERSON] in 2008 [7]. In Reference [7], they revealed the secret key by exploiting the fact that the time difference information is related to the error bits of the codeword. Since the attack proposed by [PERSON], constant-time implementations have been considered when constructing and implementing code-based cryptosystems [12]. In 2010, [PERSON] et al. proposed the SPA (Simple Power Analysis) on McEliece [9]. Their attack involved analyzing the power consumption trace obtained during the decoding process.