# Key Bit-Dependent Side-Channel Attacks on Protected Binary Scalar Multiplication +
## 5 Experimental Results
### Key Bit-Dependent Power/Electromagnetic Attack on Hardware Implementation  
Our target binary scalar multiplication algorithm was the Montgomery-Lopez-Dahab ladder algorithm [24] protected by scalar randomization [18]. Therefore, the attacker is restricted to using a single trace. To attack algorithms operating on the first experimental platform, we focused on Properties 1 and 3, described in Sections 3.1.1 and 3.1.2, respectively. However, in hardware implementations, operations are executed in parallel. Thus, at the same time as secret scalar bits \(d_{i}\) are extracted at the beginning of each iterative operation, the addresses of registers \(R_{x}(x=0\text{ or }1)\) to be referenced are also determined. Thus, there is no SPA-resistant regular algorithm that only satisfies Property 1. Our target was an SPA-resistant regular algorithm. Hence, we modified the code as shown in Figure 7(a) to identify how much information was present according to Property 1. The code as shown in Figure 7(b) is a general implementation that satisfies Property 3. * Preprocessing Operations for the most significant bit \(d_{\lambda-1}\) do not exist in the Montgomery-Lopez-Dahab ladder algorithm, as shown in Algorithm A1 and Appendix A. In accordance, trace \(T\) is composed of \(\lambda\)-\(1\) subtraces for a \(\lambda\)-bit scalar, so we divided trace \(T\) into \(\lambda-1\) subtraces \(O_{i}\), and aligned them (\(0\leq i\leq\lambda-2\)). Figure 9 (top) shows one of the subtraces, consisting of six finite-field multiplications, captured from the first experimental platform. * Select Points of Interest The key bit identification phase is operated on the second clock cycle of each subtrace of the target algorithm. We also confirmed that points of the second clock cycle of each subtrace are PoIs \(p_{i}\), since the SOST value is the greatest on the points of the second clock cycle, as shown in Figure 9 (bottom) (\(0\leq i\leq\lambda-2\)). When we calculated the SOST value, we classified PoIs of subtraces \(p_{i}\) into two groups according to Property 1 (or 3). * Classify into Two Groups and Extract Secret Scalar Bits **(1)** When we targeted _Case Study 1_ and exploited the power-consumption trace, it was impossible to clearly split them into two groups through SPA-VI. Since two distributions are overlapped as shown in Figure 7(a), we could extract secret scalar bits \(d_{i}\) with a 96.75% success rate when we classified \(p_{i}\) into two groups based on the differences from an average trace. We could also extract secret scalar bits \(d_{i}\) with a 96.74% success rate when we applied the k-means clustering algorithm to classify \(p_{i}\) into two groups (i.e., 8 errors). Consequently, a brute-force attack to recover the entire secret scalar could be viable, because the error rate is sufficiently small. Therefore, it was confirmed that the key bit-dependent leakage based on Property 1 was sufficiently large to recover the secret scalar bits. **(2)** By using the low-pass filter to increase the signal-to-noise ratio, the success rate slightly improved to 97.17% when we applied the k-means clustering algorithm. It could not be classified into two groups through SPA-VI because distribution overlapped, as shown in Figure 7(c). **(3, 4)** When we targeted _Case Study 2_ and exploited the power-consumption trace, it was possible  
Figure 8: Hardware implementation: _Case Study 1_ (**a**) and _Case Study 2_ (**b**). to perfectly split it into two groups via SPA-VI, as shown in Figure 3b,d. The success rate of classification was 100%, as shown in Table 1; thus, we could acquire all the secret scalar bits \(d_{i}\). From this result, we noticed that changing a referring register leaks more significant information than changing the secret scalar bits. Moreover, we demonstrated that we could recover whole secret scalar bits based on Property 3 using only one power-consumption trace. We define attacks such as in Steps (1) to (4) as key bit-dependent power attacks (KBPA).