# Side Channel Leakages Against Financial IC Card of the Republic of Korea +
## 3 Evaluation Methodology for the Financial IC Card Protocol
### Security Evaluation Methodology of Side Channel Analysis Under Black Box Model
#### 3.2.3 Recovering the Master Key via Some Round Keys
Case 1 \(Z_{0}\oplus Z_{1}\) (Refer to [19] for a detailed description)

\[Z_{0}\oplus Z_{1}= \{11000000_{2}\wedge(Y_{2}\oplus Y_{3})\}\] \[\oplus \{00110000_{2}\wedge(Y_{1}\oplus Y_{2})\}\] \[\oplus \{00001100_{2}\wedge(Y_{0}\oplus Y_{1})\}\] \[\oplus \{00000011_{2}\wedge(Y_{3}\oplus Y_{0})\}\]

Case 2 \(Z_{0}\oplus Z_{2}\)

\[Z_{0}\oplus Z_{2}= \{(M_{0}\wedge Y_{0})\oplus(M_{1}\wedge Y_{1})\oplus(M_{2}\wedge Y _{2})\oplus(M_{3}\wedge Y_{3})\}\] \[\oplus \{(M_{2}\wedge Y_{0})\oplus(M_{3}\wedge Y_{1})\oplus(M_{0}\wedge Y _{2})\oplus(M_{1}\wedge Y_{3})\}\] \[= \{(M_{0}\oplus M_{2})\wedge Y_{0}\}\oplus\{(M_{1}\oplus M_{3}) \wedge Y_{1}\}\] \[\oplus \{(M_{2}\oplus M_{0})\wedge Y_{2}\}\oplus\{(M_{3}\oplus M_{1}) \wedge Y_{3}\}\] Figure 9:0 Figure 9:1 Figure 9:2 Figure 9:3

Case 3 \(Z_{0}\oplus Z_{3}\)

Figure 9:4 Figure 9:5 Figure 9:6 Figure 9:7 Figure 9:8 Figure 9:9 \[Z_{0}\oplus Z_{1}= \{11000000_{2}\wedge(Y_{2}\oplus Y_{3})\}\]0 \[Z_{0}\oplus Z_{1}= \{11000000_{2}\wedge(Y_{2}\oplus Y_{3})\}\]1 \[Z_{0}\oplus Z_{1}= \{11000000_{2}\wedge(Y_{2}\oplus Y_{3})\}\]2 \[Z_{0}\oplus Z_{1}= \{11000000_{2}\wedge(Y_{2}\oplus Y_{3})\}\]3Case 4 \(Z_{1}\oplus Z_{2}\) \[Z_{0}\oplus Z_{1}= \{11000000_{2}\wedge(Y_{2}\oplus Y_{3})\}\]4 \[Z_{0}\oplus Z_{1}= \{11000000_{2}\wedge(Y_{2}\oplus Y_{3})\}\]5 \[Z_{0}\oplus Z_{1}= \{11000000_{2}\wedge(Y_{2}\oplus Y_{3})\}\]6 \[Z_{0}\oplus Z_{1}= \{11000000_{2}\wedge(Y_{2}\oplus Y_{3})\}\]7 \[Z_{0}\oplus Z_{1}= \{11000000_{2}\wedge(Y_{2}\oplus Y_{3})\}\]8 \[Z_{0}\oplus Z_{1}= \{11000000_{2}\wedge(Y_{2}\oplus Y_{3})\}\]9 \[\oplus \{00110000_{2}\wedge(Y_{1}\oplus Y_{2})\}\]0 \[\oplus \{00110000_{2}\wedge(Y_{1}\oplus Y_{2})\}\]1 \[\oplus \{00110000_{2}\wedge(Y_{1}\oplus Y_{2})\}\]2 \[\oplus \{00110000_{2}\wedge(Y_{1}\oplus Y_{2})\}\]3

Case 5 \(Z_{1}\oplus Z_{3}\) \[\oplus \{00110000_{2}\wedge(Y_{1}\oplus Y_{2})\}\]4 \[\oplus \{00110000_{2}\wedge(Y_{1}\oplus Y_{2})\}\]5 \[\oplus \{00110000_{2}\wedge(Y_{1}\oplus Y_{2})\}\]6 \[\oplus \{00110000_{2}\wedge(Y_{1}\oplus Y_{2})\}\]7 \[\oplus \{00110000_{2}\wedge(Y_{1}\oplus Y_{2})\}\]8 \[\oplus \{00110000_{2}\wedge(Y_{1}\oplus Y_{2})\}\]9 \[\oplus \{00001100_{2}\wedge(Y_{0}\oplus Y_{1})\}\]0 \[\oplus \{00001100_{2}\wedge(Y_{0}\oplus Y_{1})\}\]1

Case 6 \(Z_{2}\oplus Z_{3}\) \[\oplus \{00001100_{2}\wedge(Y_{0}\oplus Y_{1})\}\]2 \[\oplus \{00001100_{2}\wedge(Y_{0}\oplus Y_{1})\}\]3 \[\oplus \{00001100_{2}\wedge(Y_{0}\oplus Y_{1})\}\]4 \[\oplus \{00001100_{2}\wedge(Y_{0}\oplus Y_{1})\}\]5 \[\oplus \{00001100_{2}\wedge(Y_{0}\oplus Y_{1})\}\]6 \[\oplus \{00001100_{2}\wedge(Y_{0}\oplus Y_{1})\}\]7 \[\oplus \{00001100_{2}\wedge(Y_{0}\oplus Y_{1})\}\]8 \[\oplus \{00001100_{2}\wedge(Y_{0}\oplus Y_{1})\}\]9 \[\oplus \{00000011_{2}\wedge(Y_{3}\oplus Y_{0})\}\]0 \[\oplus \{00000011_{2}\wedge(Y_{3}\oplus Y_{0})\}\]1

Case 1, which is suggested in [19], is significantly analogous to Cases 3, 4, and 6. However, Cases 2 and 5 are distinct from the proposal in [19]. In other words, these combinations can only be leaked information about \((Y_{1}\oplus Y_{3})\) and \((Y_{0}\oplus Y_{2})\). Although Cases 2 and 5 are only associated with two combinations, more correlation bits are leaked for these cases due to four bits of eight bits being related to second-order leakage. Therefore, side channel analysis related to Cases 2 and 5 can first be performed to discover some leakages. ## References

* [PERSON] et al. (2006) [PERSON]; [PERSON]; [PERSON] An AES Smart Card Implementation Resistant to Power Analysis Attacks. In Proceedings of the International Conference on Applied Cryptography & Network Security (ACNS), Singapore, 6-9 June 2006; pp. 239-252. * [PERSON] et al. (2011) [PERSON]; [PERSON]; [PERSON]; [PERSON]; [PERSON] Efficient masked implementation for SEED based on combined masking. _ETRI J._**2011**, _33_, 267-274. [CrossRef]
* [PERSON] et al. (2013) [PERSON]; [PERSON]; [PERSON] [PERSON] AES Side-Channel Countermeasure using Random Tower Field Constructions. _Des. Codes Cryptogr._**2013**, _69_, 331-349.