# Single Trace Analysis against HyMES by Exploitation of Joint Distributions of Leakages
## 2 Related Works
### Code-Based Cryptography
#### 2.2.1 McEliece Cryptosystem
\[h_{0}[t-2]=g_{t-1}+(\alpha_{0}\times h_{0}[t-1])\]4 Success rate according to noise standard deviation (using two random variables). the case of \(\alpha=2\). The data used is a random value according to the uniform distribution. The numbers of data point used were 2048, which is the minimum number for applying the slice method to 11-bit data, and 20,480, which is 10 times larger than the minimum number. The experimental result presented above shows that the more data points used and the larger the value of \(\alpha\), the better the performance of the slice method. ### Find \(g(z)\) Using Maximum Likelihood

If the Hamming weight of POI (Point of Interesting) is estimated with only one trace, it is very difficult to correct the error due to the noise. However, conducting an analysis using the maximum likelihood method [18] can improve the performance of the attack. This can be attributed to the fact that the maximum likelihood reflects the influence of the noise with probability. The results of the analysis of the maximum likelihood method are shown in \[h_{0}[t-2]=g_{t-1}+(\alpha_{0}\times h_{0}[t-1])\]5 \begin{table}
\begin{tabular}{c c c c c} \hline \hline  & \multicolumn{2}{c}{\(\alpha\) = 1} & \multicolumn{2}{c}{\(\alpha\) = 2} \\ \hline \(N\) & \(\sigma\) & **Correct Rate** & \(N\) & \(\sigma\) & **Correct Rate** \\ \hline \multirow{8}{*}{2048} & 0.1 & 0.9581 & & 0.1 & 0.9542 \\ \cline{2-5}  & 0.5 & 0.6975 & & 0.5 & 0.9335 \\ \cline{2-5}  & 1 & 0.4293 & & 1 & 0.6971 \\ \cline{2-5}  & 2 & 0.2790 & 2048 & 2 & 0.4280 \\ \cline{2-5}  & 3 & 0.2349 & & 3 & 0.3268 \\ \cline{2-5}  & 4 & 0.2149 & & 4 & 0.2772 \\ \cline{2-5}  & 5 & 0.2024 & & 5 & 0.2503 \\ \hline \multirow{8}{*}{20480} & 0.1 & 0.9846 & & 0.1 & 0.9856 \\ \cline{2-5}  & 0.5 & 0.7008 & & 0.5 & 0.9532 \\ \cline{2-5}  & 1 & 0.4288 & & 1 & 0.7012 \\ \cline{2-5}  & 2 & 0.2783 & 20480 & 2 & 0.4292 \\ \cline{2-5}  & 3 & 0.2337 & & 3 & 0.3272 \\ \cline{2-5}  & 4 & 0.2144 & & 4 & 0.2789 \\ \cline{2-5}  & 5 & 0.2035 & & 5 & 0.2509 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Performance of slice method. Figure 5: Success rate according to noise standard deviation (using maximum likelihood). In the case of using two variables, the success rate of the attack remains at 1 up to a noise standard deviation of 0.4, which results in a smaller but better result than the result of the method shown in Figure 3. In the case of using four variables, the success rate of the attack remain at 1 up to a noise standard deviation of 1.3, which is about twice as high as the analysis result obtained using the best result HMD performance. ### Find \(\alpha_{0}\)

Figure 6 shows the success rate of the attack according to the noise standard deviation when the horizontal correlation power analysis is conducted with 256 partial traces to identify \(\alpha_{0}\). The success rate of the attack was measured by increasing the noise standard deviation from 0 to 2.5 in increments of 0.1. The horizontal correlation power analysis was performed 10,000 times according to the noise standard deviation. The success rate of the attack remains at 1 up to a noise standard deviation of 2.7, and then starts to decrease from 2.8. ### Experiments Using Multiple Traces

In the previous experiments, only one trace was used for analysis. The experimental results obtained using the maximum likelihood yielded an analysis success rate of 1 up to a noise standard deviation of 1.3. However, the noise standard deviation of 1.3 is a small value in a typical actual analysis environment, and it may be difficult to analyze according to the trace collection environment. Therefore, we experimentally confirmed that the performance of the attack can be improved by using additional traces. For each experiment with one trace, we accumulate the scores from the most probable candidate key to the least probable candidate key. More concretely, 5-1 points were accumulated from the first candidate key to the fifth candidate key. Figure 7 shows the experimental result obtained using 10 traces.