# Research on Side-Channel Analysis Based on Deep Learning with Different Sample Data
## 4 CPA Side-Channel Analysis Based on Deep Learning  
### CPA-Related Principles  
The principle of CPA is that the instantaneous energy consumed by electronic equipment during encryption and decryption operations is related to the data written in the register and the operation. Usually, the correlation between the Hamming weight and the voltage of the processed data is studied. The weight of Hamming is introduced as follows:  
\[r(H,V)=\frac{1}{N}\sum_{i=1}^{N}\left(z_{H}\right)_{i}\cdot\left(z_{V}\right)_{i} \tag{16}\]In an m-bit microprocessor, binary data are encoded as \(D=\sum\limits_{j=0}^{m-1}d_{j}\cdot 2^{j}\), where bit \(d_{j}=0\) or \(1\), and its Hamming weight refers to the number of nonzero symbols in the string, which can be expressed as \(H(D)=\sum\limits_{j=0}^{m-1}d_{j}\). In this paper, the Hamming weight model is defined as:  
\[T=a\cdot H(D)+b+r \tag{17}\]  
In the above formula, \(a\) and \(b\) are constants, \(H(D)\) is the Hamming weight, and \(r\) is random noise. The basic idea of CPA is as follows:  
(1) The selection of the attack position of the algorithm. The attack point needs to be selected after the key is used. For the AES algorithm, the target attack point is generally selected after the S-box or MixColumn. This paper selects the output position of the first round S-box of the AES-128 cipher algorithm as the target attack point.  
(2) Measure of relevance. The Hamming weight and voltage are regarded as two random variables H and V. Through analysis, an expression similar to \(V_{i}=\alpha\cdot H_{i}+\beta\) can be obtained to solve the correlation coefficient between them. In this paper, the Pearson correlation coefficient [30] describes the correlation between the Hamming weight and the voltage. The Pearson correlation coefficient is expressed as follows:  
\[r(H,V)=\frac{1}{N}\sum\limits_{i=1}^{N}\left(z_{H}\right)_{i}\cdot(z_{V})_{i} \tag{18}\]  
In the above formula \(z_{x}=\frac{\mathrm{v}-\overline{x}}{c_{x}}\), \(N\) is the total number of samples selected, and \(z\) is the result of the standardization of random variables.  
(3) The specific attack process:  
Step 1: Randomly select plaintext bytes \(P_{1},\cdots,P_{N}\), and input them into the encryption unit of the target cipher algorithm to perform the encryption operation. Then, the power trace in the encryption process, the voltage V is collected, and each power trace contains M sampling points. The power trace refers to the information leaked by different plaintexts in the encryption process under the correct key. In the experiment, the power trace at the same sampling point is selected as the N sample values of the variable V.  
Step 2: Generate the corresponding intermediate value by guessing the key and calculating the assumed energy consumption D according to the Hamming weight leakage of the intermediate value.  
Step 3: Calculate the correlation coefficient between the assumed energy consumption trace and the measured value. The pseudocode of the attack process is shown in Algorithm 2 below.  
```
For byte = 1:16 For \(k\) = 0:255 H = HammingWeight(Sbox(\(\mathrm{p}\)\(\mathrm{p}\)\(\mathrm{k}\))) // \(\mathrm{p}\)byte: The byte-th byte of each \(\mathrm{P}_{\mathrm{n}}\) For \(m\) = 1:M V = \(\mathrm{v}^{m}\) // \(\mathrm{v}^{m}\): The \(m\)-th sampling point of each power trace v  Corr (k) = \(r\)(V,H) rightkeybyte = find(max[Corr])
```  
**Algorithm 2**Randomly select plaintext \(P_{1},\cdots,P_{N}\) and collect a power trace; each power trace has M sampling points  
When distinguishing whether the key guessed is correct, it is not necessary to find when the attack point is executed, but only to solve the correlation coefficient of all positions and find the maximum value. The point with the greatest correlation corresponds to the correctly guessed key, so the correct key and the output position of the S-box are determined.