# Single Trace Analysis against HyMES by Exploitation of Joint Distributions of Leakages
## 2 Related Works
### Code-Based Cryptography
#### 2.2.1 McEliece Cryptosystem
To find \(\alpha_{0}\), we perform the horizontal correlation power analysis between the actual power consumption values that occur when values dependent on \(\alpha_{0}\) are processed and the Hamming weights of the values, which are calculated by guessing the value of \(\alpha_{0}\) in Equation (12). The number of equations containing \(\alpha_{0}\) in Equation (12) is \(t-1+1+t=2t\). Therefore, the number of data available for the horizontal correlation power analysis is \(2t\). Generally, HyMES with 88-bit security uses the parameter \(m=11,\ t=32\). Therefore, 64 data points are available for the horizontal correlation power analysis using these parameters, which is a little data for the actual analysis. This can be resolved by using \(\alpha_{0}\)-dependent values. By using all the \(\alpha_{0}\)-dependent values used in the multiplication and division operations in steps 2-21 of Algorithm 11, 8 \(t=256\) data can ultimately be used for the analysis. When the correlation coefficients between actual power consumption values and 8 \(t\) power consumption models, which are estimated from 0 to \(2^{11}-1\), are obtained, the estimated value with the highest correlation coefficient can be considered as the correct \(\alpha_{0}\). \[h_{0}[t-1]=1\]

\[h_{0}[t-2]=g_{t-1}+(\alpha_{0}\times h_{0}[t-1])\]

\[h_{0}[t-3]=g_{t-2}+(\alpha_{0}\times h_{0}[t-2])\]

\[...\]

\[h_{0}[0]=g_{1}+(\alpha_{0}\times h_{0}[1])\]

\[a=g_{0}+(\alpha_{0}\times h_{0}[0])\]\[h_{0}[0] =h_{0}[0]/a\] \[h_{0}[1] =h_{0}[1]/a\] \[...\] \[h_{0}[t-1] =h_{0}[t-1]/a. \tag{12}\]
```
0: Power consumption values of POI of HyMES \(\mathbf{P}\in\mathit{Mat}_{1\times 8t}\), A table \(\log[]\), \(\exp[]\) created with the primitive polynomial \(p(x)\), Goppa polynomial \(g(z)=z^{t}+g_{t-1}z^{t-1}+...+g_{0}\)
0:\(L_{sec}=\{\alpha_{0},...,\alpha_{n-1}\}\)
1:for\(i=0:n-1\)
2: for\(j=0:n-1\)
3:\(pm_{1}\gets hw(j)\)
4:\(pm_{2}\gets hw(\log[j])\)
5:\(pm_{3}\gets hw(\log[j]+\log[h_{i}[t-1]])\)
6:\(pm_{4}\gets hw(mod(\log[j]+\log[h_{i}[t-1]]))\)
7:\(pm_{5}\gets hw(\exp[mod(\log[j]+\log[h_{i}[t-1]]]))\)
8: for\(k=t-2:0\)
9:\(pm_{5(t-2-k)+6}\gets hw(h_{i}[k])\)
10:\(pm_{5(t-2-k)+7}\gets hw(\log[h_{i}[k]])\)
11:\(pm_{5(t-2-k)+8}\gets hw(\log[j]+\log[h_{i}[k]])\)
12:\(pm_{5(t-2-k)+9}\gets hw(mod(\log[j]+\log[h_{i}[k]]))\)
13:\(pm_{5(t-2-k)+9}\gets hw(\exp[mod(\log[j]+\log[h_{i}[k]])])\)
14: end
15: for\(k=0:t-1\)
16:\(pm_{3k+5t+1}\gets hw(\log[h_{i}[k]]-\log[a])\)
17:\(pm_{3k+5t+2}\gets hw(mod(\log[h_{i}[k]]-\log[a]))\)
18:\(pm_{3k+5t+3}\gets hw(\exp[mod(\log[h_{i}[k]]-\log[a])])\)
19: end
20:\(ct_{j}\leftarrow\rho(\mathbf{PM},\mathbf{T})\)
21: end
22:\(\alpha_{i}\gets argmax_{j}(\mathbf{CT})\)
23: end
24: return \(L_{sec}=\{\alpha_{0},...,\alpha_{n-1}\}\)
```

**Algorithm 11** Analysis for \(L_{sec}\)

## 4 Experiment

In this section, we describe the experimental results of the proposed attack. The experiments were conducted by using simulated power traces under the assumption that the power consumption models follow Equation (8). We assume that the \(\alpha\) and \(\beta\) in Equation (8) are equal to 1 and 0 at all points. We use the parameters \(m=11\) and \(t=32\)[6] for the analysis. We present the analysis results of the coefficients \(g_{31}\) and \(\alpha_{0}\), where \(g_{31}\) is the 32 nd term of the secret key \(g(z)\) and \(\alpha_{0}\) is the first element of the support \(L_{sec}\). Although we only present experimental results for when \(g_{31}\) is 1499 and \(\alpha_{0}\) is 999, similar results can be confirmed for other secret key values. ### Find \(g(z)\) Using Harmonic Mean Distance

To find \(g_{31}\), we conducted an analysis by exploiting the joint distributions of two random variables \(A=\alpha_{i}\times h_{i}[t-1]\) and \(B=\log[h_{i}[t-2]]=\log[g_{t-1}\oplus\alpha_{i}]\). The similarity between the theoretical distribution according to the guessing key \(g^{\prime}_{31}\) and the distribution estimated from the simulation trace were obtained using three similarity comparison methods.