# Key Schedule against Template Attack-Based Simple Power Analysis on a Single Target
## 4 Experiment Results
### Result of Keyless Template-Based Simple Power Analysis  
While all existing template attacks assume that an adversary acquires identical device that is different from the target device, in our proposal, we can eliminate it. Based on the above fact and Figure 1, we show how apply our approach to a key schedule.  
(1) Finding the PoI with Public Information  
In the first step, we should find the PoI with only public information which is different from the points used for extraction phase. As explained earlier, the saving of the plaintext is employed to create the templates, which is referred to Figure 2. In other words, the templates already created in classical template-based SPA can be utilized to our approach.  
(2) Identifying identical operation  
As shown in Figure 5, red boxes in each figure seem to show similar operations. More precisely, as previously stated, this is easily confirmed to use the relevant statistical tool in Figure 5. However, we might not be able to completely identify how operations are calculated from Figure 5 below. Therefore, in order to distinguish our target in the figure below, another statistical tool or function is required. Actually, the auto-correlation tool is used in order to distinguish the loading of plaintext and master key. The last condition which is analogous to the original assumption is the third condition of Assumption 1.  
Figure 4: Results for a classical template-based SPA when loading plaintext in block cipher AES with no countermeasure.  
As seen in Figure 6, we easily identified the operation that is similar to loading the plaintext. In addition, to compute \(\mathcal{F}_{\text{match}}\), we employed autocorrelation. As a result, the matching rate acquires more than 0.9. That is, the calculation of \(\mathcal{F}_{\text{transform}}\) was not required. Using Equation (1), we obtained the following expression.  
\[\begin{split} 0.9\approx\lambda\leftarrow&\mathcal{F}_{ \text{match}}(\text{t}_{\text{Pro}}^{\text{Pol}},\text{t}_{\text{Ext}}^{\text {Pol}})=\text{AutoCorrelation}(\text{t}_{\text{Pro}}^{\text{Pol}},\text{t}_{ \text{Ext}}^{\text{Pol}})\\ \text{t}_{\text{Ext}}^{\text{Pol}}=\text{t}_{\text{Ext}}^{\text{ Pol}}\leftarrow&\mathcal{F}_{\text{transform}}(\text{t}_{\text{Pro}}^{\text{ Pol}},\text{t}_{\text{Ext}}^{\text{Pol}})=\mathbb{1}(\text{t}_{\text{Ext}}^{\text{Pol}}) \end{split} \tag{2}\]  
where \(\mathbb{1}\) specifies the identity function.  
(3) Profiling Phase  
The hyper-parameter setting is identical to Table 2. The points to create templates for each HW values are also considered as the Area (1) in Figure 3.  
(4) Extraction Phase  
Similar to previous results in Section 4.1, the best result is represented corresponding to the number of traces used in the extraction phase. The results can be explained through categorization into three groups. In the first group, the guessing entropy converges to 1. Namely, half out of 16 bytes can be completely recovered using our suggestion. Moreover, in the second group, the recovered value is about 2, even though the HW value cannot be definitely retrieved. A few bytes have about guessing entropy 3 in the last group.  
Figure 5: Comparison with a trace of plaintext and a trace of keyschedule.  
Although all bytes cannot be retrieved, a brute force attack can be performed based on the recovered HW value. Moreover, to examine the detailed results, we compare the classical and keyless template-based SPAs in terms of the number of PoIs.