# The Need for Speed: A Fast Guessing Entropy Calculation for Deep Learning-Based SCA
## 2 Background
### Deep Learning-Based SCA  
Profiling SCAs consider the strongest adversary with access to a clone device running the target cryptographic algorithm. The adversary can query the clone device with any set of plaintext \(P=(p_{0},p_{1},\ldots,p_{N-1})\) and chosen keys \(K=(K_{0},K_{1},\ldots,K_{N-1})\), and measure side-channel traces \(X=(x_{0},x_{1},\ldots,x_{N-1})\). These traces (\(X_{prof}\)) are used for training the classification algorithm (i.e., to build a machine learning model). This phase is known as the training or profiling phase. During this phase, a validation set, \(X_{val}\), containing \(V\) traces, is selected from the profiling set to validate the model. Next, the adversary obtains measurements from the target device, where traces (\(X_{attack}\)) are also captured with a known input but unknown (secret) key. The previously trained model is then exploited to recover the secret key \(k^{*}\) used in the target device. This phase is known as the attack or test phase.  
The template attack is the first introduced profiling approach in SCA [1]. This attack is also the best possible if sufficient (infinite) training traces are available [13]. Over the years, machine learning and deep learning algorithms have been shown to be more powerful in realistic scenarios, where noise and countermeasures further reduce the measurement quality [8; 9]. While the profiling attack assumes a more powerful attacker than a non-profiling one, it requires significantly fewer traces than direct attacks to break the target: sometimes, only one trace could be sufficient.  
Profiling SCA considers different methods to build or learn the statistical parameters representing a profiling model \(f(\theta)\). The template attack assumes that side-channel leakages follow a multivariate Gaussian distribution [1]. The profiling phase consists of computing statistical parameters for a Gaussian mixture model (\(\theta\) is given by mean and covariance parameters). Thus, the model is built for each possible hypothetical leakage class (e.g., all possible Hamming weight values of a byte). In the attack phase, the adversary computes the probability that a new side-channel measurement (under attack) belongs to a specific class by using the computed probability density function from the approximate statistics.  
In the case of machine learning (including deep learning), the statistical parameters \(\theta\) (e.g., weights and biases in the case of neural networks) are learned from profiling traces \(X_{prof}\) during the training phase. The deep neural network can skip feature selection from \(X_{prof}\), which is an advantage over classic machine learning techniques and template attacks [14].  
In the attack phase, the adversary obtains a probability \(v_{k}\) that the set of attack traces \(X_{attack}\) process the key byte \(k\in\mathbb{K}\), according to:  
\[v_{k}=\sum_{i=0}^{Q-1}\log p[l(d_{i},k)|x_{i}], \tag{1}\]where \(l(d_{i},k)\) is the leakage function computed from public information \(d_{i}\) and the key hypothesis \(k\). In our case, as we attack AES implementations running encryption executions, the leakage function is given by \(l(d_{i},k)=S-box(d_{i}\oplus k)\) for the Identity leakage model or \(l(d_{i},k)=HW(S-box(d_{i}\oplus k)\) for the Hamming weight (HW) leakage model. The public value \(d_{i}\) is the corresponding plaintext byte. The recovered (guessed) key byte \(k\) from \(X_{attack}\) is then obtained as:  
\[k=\underset{k\in\text{K}}{\text{argmax}}([v_{k}]). \tag{2}\]  
If the model is good (i.e., it learned the leakage), then the recovered key is \(k^{*}\) or at least \(k^{*}\) is among the best guesses.