# Assessment of Addition-Chain-Based Masked S-Box Using Deep-Learning-Based Side-Channel Attacks

Authors: Huizhong Li; Jingdian Ming; Yongbin Zhou
Journal: Security and Communication Networks
 (2022)

---

## Abstract

Masking schemes are considered to be effective countermeasures to protect Internet-of-Things devices from side-channel attacks. Deep-learning-based side-channel attacks (DL-SCAs) have been demonstrated to be very effective targeting on masked implementations. In this paper, we investigate the resistance of a popular computation-based masking scheme against DL-SCAs, that is, the addition-chain-based one. We find that addition chain introduces computations of intermediate monomials overF2n with smaller output sizes, which decreases its resistance against DL-SCAs. Specifically, we first use mutual information metric to evaluate the side-channel resistance of different monomials from an information theory point of view. Next, we further propose the Kullback–Leibler divergence ratio as an evaluation metric to analyze the impact of monomial output size on DL-SCAs. The measurement values show that the monomial with smaller output size is less-resistant against DL-SCAs. Then we conduct simulated and practical experiments respectively to verify it. In simulated experiments, we perform DL-SCAs on first-order masked implementations with different noise levels and training trace numbers. The results demonstrate that monomials with smaller output size are more vulnerable. Moreover, with the increase (resp. decrease) in noise level (resp. training trace number), the resistance difference of these monomials becomes more significant. In addition, we obtain similar results through simulated experiments on second-order masked scenario. In practical experiments based on an ARM Cortex-M4 architecture, we collect power and electromagnetic traces in consideration of low and high noise levels. The results show that the number of required traces for targeting the S-Box output is at least three times as much that for targeting the weakest monomial.


---

## Body

## 1. Introduction

With the emergence and explosive development of the Internet of Things (IoT), the security issues of IoT devices have attracted extensive attention in both the academic and industrial communities [1, 2]. On one hand, attackers can facilitate unauthorized and malicious activities by identifying and exploiting vulnerabilities in IoT devices [3, 4]. On the other hand, IoT devices have been exploited to create botnet networks to generate distributed denial of service (DDoS) traffic [5, 6]. Furthermore, as numerous IoT devices gather and investigate private data, they become a gold mine for hostile actors [1]. The potential to diagnose compromised nodes, as well as the collection and preservation of testimony of an attack or illegal activity, have become top priorities. Therefore, it puts forward new requirements for digital forensics to uncover vital evidence. Actually, IoT devices have been shown to provide new kinds of evidence sources that were not available in traditional digital forensics primarily used for desktop or laptop computers [7–9]. However, unlike desktop and laptop computers, the bespoke hardware and software employed on most IoT devices obstruct the use of classical digital forensic evidence acquisition methods [10]. This situation demands alternative approaches to forensically inspect IoT devices. Among various techniques, side-channel attacks (SCAs) have been demonstrated to be a promising digital forensics approach [11–13].SCAs exploit various physical leakages, for example, the running time [14], the power consumption [15], or the electromagnetic emanations [16], of a cryptosystem to recover its sensitive data. Generally speaking, side-channel attacks can be divided into two classes: nonprofiled attacks, such as differential power analysis (DPA) [17] and correlation power analysis (CPA) [18], and profiled attacks, such as template attacks (TAs) [15] and stochastic attacks (SAs) [19]. Among these SCAs, profiled attacks are recognized as more powerful ones and play a fundamental role of security evaluation of cryptographic algorithm implementations. Recently, a line of (since current research mainly focuses on using deep learning techniques for profiled attacks, we refer to deep-learning-based profiled attacks as DL-SCAs in this paper.) deep-learning-based side-channel attacks (DL-SCAs), raise SCA community’s concern [20–23]. The practical results have demonstrated that these techniques are very effective to attack the embedded implementations even when some well-known countermeasures are involved.Protecting cryptographic implementations from SCAs has been a challenging and longstanding issue for the embedded systems industry. Among countermeasures against SCAs, masking [24] is the most widely used because it is device-independent and provably secure. Generally speaking, masking aims to randomize the subtle dependency between sensitive intermediate and its corresponding side-channel leakages by splitting the sensitive values into d+1 shares [25], where d is called the masking order. Any d among d+1 shares are assigned uniform random and independent values. When protecting a cryptographic algorithm, it suffices to apply the operation individually to each share to perform a linear operation on masked data. In comparison, masked nonlinear operations are more difficult to implement [25]. There are mainly two ways at an acceptable level of cost to solve this problem: (1) implement by look-up tables or (2) compute the unrolled functions over a finite field. The first solution costs at least 4 times more in running time than that of the second one [26, 27] in higher-order masked implementations. As for implementations by computing over a finite field, addition chain has become a research hotpot [28–32]. Specifically, the nonlinear operation can be expressed as a sequence of squares and multiplications over F2n. These nonlinear multiplications can be then implemented using previously known schemes, such as ISW [25]. Until now, there is still a lack of research on the resistance of addition-chain-based implementations against DL-SCAs because most DL-SCAs focus on look-up-table-based masked implementations [20, 21]. Therefore, we comprehensively investigate the performance of DL-SCAs on addition-chain-based masked S-Box implementations in this work. In addition, as Boolean masking is one of the most popular schemes which enables high performance when implemented on practical circuits [31], we focus on the analysis of Boolean masked S-Box implementations.Our Contributions. In this paper, we investigate the side-channel resistance of addition-chain-based Boolean masked S-Box implementations when considering DL-SCAs. We find that in addition chains, the computations of intermediate monomials with smaller output sizes decrease the resistance of implementations against DL-SCAs. In order to analyze the impact of monomial output size on attacks, we use mutual information and propose the Kullback–Leibler (KL) divergence ratio as evaluation metrics, respectively. The measurement values show that the monomial with smaller output size is less resistant against DL-SCAs. Then we conduct simulated and practical experiments to verify it. In simulated experiments, we perform DL-SCAs on first- and second-order masked implementations respectively. The results show that monomials with smaller output size are more vulnerable. In addition, we evaluate the resistance of different monomials when the number of training traces is relatively small. With the decrease in training trace number, the resistance difference of these monomials becomes more significant, and the overall trend does not change. In practical experiments based on an ARM Cortex-M4 architecture, we collect power and electromagnetic traces in consideration of low and high noise levels. We obtain similar results to those of simulated experiments. Moreover, the practical results show that the number of required traces for targeting the S-Box output is at least three times as much that for targeting the weakest monomial.The rest of our paper is organized as follows. Section2 discusses the related work concerning addition-chain-based masked S-Box schemes and the analysis of side-channel security for these schemes. Section 3 reviews the notations and preliminaries. In section 4, we first use mutual information metric to evaluate the side-channel resistance of different monomials from an information theory point of view. Then, we propose the KL divergence ratio metric and analyze the relationship between the output size of monomials and their resistance against DL-SCAs. Next, in Section 5, we verify our analysis by simulated and practical experiments. Section 6 gives recommended addition chains with relatively high resistance against DL-SCAs. Finally, Section 7 concludes the paper.


## 2. Related Work

Rivain–Prouff masking scheme is the first provably secure higher-order masking for AES [31] using addition chain, as shown in Figure 1. In this way, the AES S-Box can be masked at any security order d. Later, it was extended to a generic method for higher-order masking by Carlet et al. [32]. Using the method they proposed, any n-bit S-Box can be expressed as a sequence of linear squares and nonlinear multiplications over F2n. Then from a theoretical perspective, Roy and Vivek and Coron et al. [28, 29] further reduced the complexity of several well-known S-Boxes. The best-known method for fast polynomial evaluation was proposed by Carlet et al. [33]. From an implementation perspective, Coron et al. proposed to use common shares to further improve the addition chain in parallel implementations [30]. Actually, addition chains are widely used in various masking schemes, such as Boolean masking [31], mixed additive and multiplicative masking [34], and inner product masking [35].Figure 1
The computation ofx254 used by Rivain and Prouff [31]. Monomial with border means that the computation for this monomial is a multiplication, and the number over the arrow represents the number of squares.The side-channel security of addition chain implementations has been studied by Prouff and Rivain [36] and Alexandre Duc et al. [37]. They assumed that the leakages in each operation (square or multiplication) are under the same noisy model, meanwhile sensitive information in these leakages follows the same bound related to a noise parameter. It can be seen as a simplified scenario, but the leakages from each operation are actually different and related to the function itself [38]. Then, Ming et al. [38] investigated how different operations impact the security of addition chain implementations. However, they mainly studied the resistance of addition chains against nonprofiled SCAs. For profiled attacks especially DL-SCAs, the experiments were only performed on the worst monomial computation x85 and the S-Box computation (output step) in AES. Therefore, there is still a lack of comprehensive study on the resistance of addition-chain-based implementations against DL-SCAs.


## 3. Preliminaries

### 3.1. Addition-Chain-Based Masked S-Boxes

The principle of masking is to split the sensitive variables intod+1 shares, which satisfy the following relation:(1)x=x0⊕x1…⊕xd,where x, xi, and d denote the sensitive variable, the shares, and the masking order, respectively. Usually, the d shares x1,…,xd, called masks, are assigned uniform random and independent values [25]. And the x0, called the masked value, is processed such that it satisfies (1). In this paper, we consider the exclusive-OR (XOR) operation, so we use the notation ⊕.It has been shown that anyn-bit S-Box can be represented by a polynomial S−Boxx=∑uixi over F2n [32], and the ui can be obtained from the look-up table by applying Lagrange’s Interpolation theorem. Thus, the common approach is to decompose each power function in terms of squares and nonlinear multiplications, where the nonlinear multiplications can be implemented, for example, using the ISW scheme [25]. The addition chain [39] is defined as follows:Definition 1.
(addition chain) An addition chainS for αα∈ℕ is a sequence of integers.(2)a0=1,a1,a2,…,ar=α,for every i=1,2,…,r, there exist some 0≤j,u≤i such that ai=aj+au.
In fact, the exponential computation for each monomial in an S-Box can be expressed as an addition chain. In this paper, we also useℱ to denote the whole processing required to compute an n-bit S-Box, where Fi denotes the ith intermediate monomial in ℱ. Thus, the processing in Figure 1 can be expressed as ℱ=x,x2,x3,x6,x12,…,x254.
However, the number of intermediate computations gets increased when implementing S-Boxes through addition chain, which leads to more leakages [40]. Therefore, the adversary can use much fewer traces to attack the computation of certain monomials rather than S-Box outputs [38].


### 3.2. Deep-Learning-Based Side-Channel Attacks

A profiled side-channel attack consists of two phases: an offline profiling phase (training in deep learning context) and an online attack phase (testing respectively).In profiling phase, the attacker has a device with knowledge about the secret key implemented and acquires a set ofNp side-channel traces ℒprofiling=l˜i|i=1,2,…,Np. Each trace l˜i is corresponding to xi=fmi,k in one encryption or decryption with known key k, where f· denotes the function of monomial in addition chain or AES S-Box in this work. mi denotes the plaintext or ciphertext, and xi denotes the sensitive intermediate value. Once the acquisition is done, the attacker builds suitable models and computes the estimation of probability PrL|X=x from a profiling set xi,xii=1,2,…,Np.In the attack phase, the attacker acquires a small new set of tracesℒattack=li|i=1,2,…,Np with a fixed unknown key k∗k∗, where Na denotes the number of attack traces. With the help of the established models, the attacker can easily calculate the estimated posterior probabilities dk among K guesses via the Bayes’ Theorem, then select the key that maximizes it following the Maximum Likelihood strategy.Recently, DL-SCAs have been shown to be a very efficient alternative to the state-of-the-art profiled attacks, and even outperform the traditional profiled attacks [20, 23]. Since convolutional neural networks (CNNs) have been shown to be good choices against most common countermeasures, we focus on using CNNs to attack addition chain implementations. Generally speaking, the CNNs consist of two main parts: feature extractor and classifier. Feature extractor is composed of stacked operations of convolution, pooling, and sometimes normalization layers. The classifier is composed of several fully connected layers. Each layer of the network receives the output from its immediate previous layer as its input, and passes its output as the input to the next layer, as it is called forward propagation. Higher-level features are derived from features propagated from lower-level layers and finally calculate classification probabilities in the last output layer (for a classification task, usually the output layer is activated by Softmax function as detailed by Cagli et al. [20]).In deep learning context, the purpose of the profiling phase is to train an neural network to estimate the correct label with high probability from the input traces in the following attack phase. The loss function is configured to compute the error generated by the model. During the training process, the attacker aims to minimize the loss function in order to get the best model possible. The most used loss function in the literature is the cross-entropy [41]. Let θ represent the model parameters of the neural network (e.g., the weights of a multilayer perceptron). Let Pk∗x denote true labels with the correct key, and let Qx|l;θ be the output conditional probability represented by the neural network. Then, we define the cross-entropy of a deep leaning model as follows:(3)HPk∗,Q=Ex∼Pk∗−logQx|l;θ,where E denotes the expected value.


## 3.1. Addition-Chain-Based Masked S-Boxes

The principle of masking is to split the sensitive variables intod+1 shares, which satisfy the following relation:(1)x=x0⊕x1…⊕xd,where x, xi, and d denote the sensitive variable, the shares, and the masking order, respectively. Usually, the d shares x1,…,xd, called masks, are assigned uniform random and independent values [25]. And the x0, called the masked value, is processed such that it satisfies (1). In this paper, we consider the exclusive-OR (XOR) operation, so we use the notation ⊕.It has been shown that anyn-bit S-Box can be represented by a polynomial S−Boxx=∑uixi over F2n [32], and the ui can be obtained from the look-up table by applying Lagrange’s Interpolation theorem. Thus, the common approach is to decompose each power function in terms of squares and nonlinear multiplications, where the nonlinear multiplications can be implemented, for example, using the ISW scheme [25]. The addition chain [39] is defined as follows:Definition 1.
(addition chain) An addition chainS for αα∈ℕ is a sequence of integers.(2)a0=1,a1,a2,…,ar=α,for every i=1,2,…,r, there exist some 0≤j,u≤i such that ai=aj+au.
In fact, the exponential computation for each monomial in an S-Box can be expressed as an addition chain. In this paper, we also useℱ to denote the whole processing required to compute an n-bit S-Box, where Fi denotes the ith intermediate monomial in ℱ. Thus, the processing in Figure 1 can be expressed as ℱ=x,x2,x3,x6,x12,…,x254.
However, the number of intermediate computations gets increased when implementing S-Boxes through addition chain, which leads to more leakages [40]. Therefore, the adversary can use much fewer traces to attack the computation of certain monomials rather than S-Box outputs [38].


## 3.2. Deep-Learning-Based Side-Channel Attacks

A profiled side-channel attack consists of two phases: an offline profiling phase (training in deep learning context) and an online attack phase (testing respectively).In profiling phase, the attacker has a device with knowledge about the secret key implemented and acquires a set ofNp side-channel traces ℒprofiling=l˜i|i=1,2,…,Np. Each trace l˜i is corresponding to xi=fmi,k in one encryption or decryption with known key k, where f· denotes the function of monomial in addition chain or AES S-Box in this work. mi denotes the plaintext or ciphertext, and xi denotes the sensitive intermediate value. Once the acquisition is done, the attacker builds suitable models and computes the estimation of probability PrL|X=x from a profiling set xi,xii=1,2,…,Np.In the attack phase, the attacker acquires a small new set of tracesℒattack=li|i=1,2,…,Np with a fixed unknown key k∗k∗, where Na denotes the number of attack traces. With the help of the established models, the attacker can easily calculate the estimated posterior probabilities dk among K guesses via the Bayes’ Theorem, then select the key that maximizes it following the Maximum Likelihood strategy.Recently, DL-SCAs have been shown to be a very efficient alternative to the state-of-the-art profiled attacks, and even outperform the traditional profiled attacks [20, 23]. Since convolutional neural networks (CNNs) have been shown to be good choices against most common countermeasures, we focus on using CNNs to attack addition chain implementations. Generally speaking, the CNNs consist of two main parts: feature extractor and classifier. Feature extractor is composed of stacked operations of convolution, pooling, and sometimes normalization layers. The classifier is composed of several fully connected layers. Each layer of the network receives the output from its immediate previous layer as its input, and passes its output as the input to the next layer, as it is called forward propagation. Higher-level features are derived from features propagated from lower-level layers and finally calculate classification probabilities in the last output layer (for a classification task, usually the output layer is activated by Softmax function as detailed by Cagli et al. [20]).In deep learning context, the purpose of the profiling phase is to train an neural network to estimate the correct label with high probability from the input traces in the following attack phase. The loss function is configured to compute the error generated by the model. During the training process, the attacker aims to minimize the loss function in order to get the best model possible. The most used loss function in the literature is the cross-entropy [41]. Let θ represent the model parameters of the neural network (e.g., the weights of a multilayer perceptron). Let Pk∗x denote true labels with the correct key, and let Qx|l;θ be the output conditional probability represented by the neural network. Then, we define the cross-entropy of a deep leaning model as follows:(3)HPk∗,Q=Ex∼Pk∗−logQx|l;θ,where E denotes the expected value.


## 4. Analysis on Addition-Chain-Based Boolean Masked S-Box

### 4.1. The Output Size of Monomial Functions in Addition Chain

When analyzing side-channel security of addition-chain-based masked S-Box implementations, the leakages of each monomial computation in the addition chain can be utilized to perform attacks. And the output sizes of different monomials vary significantly. Since the profiling phase of DL-SCAs can be regarded as the training process of a classifier [42], the output size (i.e. the number of categories) will affect the classification performance. Then, during the attack phase, the probability of sensitive intermediate value is mapped to the probability of each key candidate k∈K. Although the number of key candidates K (i.e. 256 in AES) is the same for monomials with different output sizes, the classification performance may still affect the attack results. Therefore, the output size of the target monomial may affect the difficulty for conducting a successful attack. In Table 1, we give the output sizes of AES S-Box and monomial functions on irreducible polynomials x8+x4+x3+x+1 over F28. The # Output denotes the output size of functions, and the # Element denotes the number of functions whose output size is equal to a certain value. It can be observed that depending on the size of the output, functions can be divided into seven classes. It is clear that the exponent numbers of monomials in the same class have the same greatest common divisor with 255. So we also give the greatest common divisor of the monomial exponent number b and 255 in the column gcdb,255. Next, we first analyze the impact of output size from an information theory point of view.Table 1
The output sizes of AES S-box and monomial functions on irreducible polynomialsx8+x4+x3+x+1 over F28.
Function# elementgcdb,255# outputAES S-box,x, x2, x4, …1291256x3, x6, x9, x12, …64386x5, x10, x20, x25, …32552x15, x30, x45, x60, …161518x17, x34, x68, x136, …81716x51, x102, x153, x2044516x85, x1702854


### 4.2. Analysis Based on Information-Theoretic Metric

Information theoretic (IT) metrics measure the total information leakage irrespective of specific side-channel attacks. Mutual information (MI), as a well-known IT metric, has been widely used in side-channel analysis [43, 44]. Therefore, we use MI to evaluate the side-channel resistance of different monomials from an IT viewpoint.As illustrated by Standaert et al. [45], the multivariate joint distribution is the most effective way to utilize the information leakage in masked implementations. Let ℒ=ℒ0,…,ℒd be the multivariate leakage, where ℒi denotes the leakage of each share. We simulate the leakages ℒ0x0,…,ℒdxd as ℒixi=HWxi+Ni in detail. Then the mutual information between the sensitive variable X and the leakage is denoted as Iℒ;X. As shown in Table 1, all monomials can be grouped into 7 classes in the sense of output size. And monomials with the same output size can be viewed as equivalent when using MI metric [38]. Considering d=1 in the first-order Boolean masking, the MI results of AES S-Box and monomial functions are depicted in Figure 2. We take the first term from each class AESS−Box,x3,x5,x15,x17,x51,x85 as representatives.Figure 2
Mutual information of different output size functions ford=1.It can be observed that basically, the smaller the output size of the function, the higher the value of MI. This indicates that the function with smaller output size is likely to be less resistant against attacks. However, the results of MI metric do not exactly match the output size of functions. For example, the output size ofx5 is larger than that of x17, but x5 leaks more under MI metric. Besides, with the increase of the output size, the difference between the MI values of different functions becomes very small. Moreover, in Ming et al.’s study [38], it was also pointed out that the MI metric fails to work when evaluating the CPA resistance of different monomials. Therefore, to further investigate the impact of output size on DL-SCAs, we propose the KL divergence ratio as an evaluation metric.


### 4.3. Analysis Based on KL Divergence Ratio

The motivation for the use of the KL divergence is to quantitatively evaluate the difficulty of DL-SCAs directly from the viewpoint of the model’s output distribution shape. Actually, the KL divergence between the probability distribution of true labels and the predicted distribution of the deep learning model is frequently used to evaluate the classification performance of neural networks [46].In the case of SCAs, that is to calculate the KL divergence between the probability distribution of labels with the correct keyPk∗x and the conditional probability distribution Qx|l;θ of a deep learning model with parameter θ, which is defined as follows:(4)DKLPk∗QEx∼Pk∗logPk∗xQx|l;θ.A lower KL divergence implies that the distribution of the deep learning model output is closer to the true label distribution. In other words, the model with smaller KL divergence has better classification performance. From (3) and (4), it can be observed that DKLPk∗Q=HPk∗,Q+−Ex∼Pk∗logPk∗x, where −Ex∼Pk∗logPk∗x is the entropy of Pk∗x. In DL-SCAs, the true label is represented with a one-hot encoding, which means the entropy of Pk∗x is equal to 0. Therefore, KL divergence is equivalent to cross-entropy in this scenario.In the attack phase, the KL divergence can be estimated as follows:(5)D^KLPk∗Q=1Na∑i=1Na∑x∈XPk∗xlogPk∗xQx|l;θ.It can be observed that equations (4) and (5) only consider the probability distribution of labels with the correct key k∗. However, an adversary in SCAs needs to distinguish the correct key from other key hypotheses. Namely, the efficiency of the attack is also influenced by D^KLPk∗Q=1/Na∑i=1Na∑x∈XPk∗xlogPk∗x/Qx|l;θ. for k≠k∗. Therefore, we propose a novel metric KL divergence ratio (denoted as DRKL) for deep learning model performance evaluation in side-channel scenario as follows:(6)DRKL=DKLPk∗QEk≠k∗DKLPk∗Q.The lower the KL divergence ratio of a deep learning model is, the more effective it is to attack the targeted function.In order to analyze the impact of output size on attacks, one can first use leakages from monomials with different output sizes to train the deep learning model, and then calculate the KL divergence ratio in the attack phase respectively. In the attack phase, the KL divergence ratio is estimated as follows:(7)DR^KL=D^KLPk∗QEk≠k∗D^KLPk∗Q.For fairly comparing the resistance of different monomials, all experimental settings (including the noise level of leakages, the number of traces used for training and attack, the network architecture, etc) should be the same except for the targeted function and its corresponding leakages.Specifically, we also take the first term from each of the seven classes of functions in Table1 as representatives, and analyze the impact of output size on their KL divergence ratio values through simulated experiments. We train CNNs and perform attacks on simulated leakages for first-order d=1 and second-order d=2 masked implementations. Let ℒ=ℒ0,…,ℒd be the multivariate leakage where ℒi are defined as in Section 4.2. For d=1, we consider three different noise levels σ=0.5, σ=1, and σ=2, where σ denotes the standard deviation of noise. For d=2, we simulate traces with the noise level σ=1. When d=1 and d=2, we use 10,000 and 30,000 traces in the profiling phase, respectively, and 50,000 traces are used to estimate the KL divergence ratio for each attack. The traces are labeled by the value of the SubByte output (e.g., 4 labels for x85 and 256 labels for S-Box) in the one-hot encoding representation. The CNN architecture and other more detailed experimental settings are given in the next section. And the experimental results are shown in Figure 3.Figure 3
The KL divergence ratio values of different output size functions.Overall, results based on the KL divergence ratio are easier to observe than those based on the MI metric, and more in line with our expectations. Broadly speaking, it can be observed that the smaller the output size of the function, the lower the value of KL divergence ratio, and vice versa. Therefore, the function with smaller output size is likely to be less resistant against DL-SCAs. We argue that a few exceptions are caused by the uncertainty of the model training or the high noise level.


## 4.1. The Output Size of Monomial Functions in Addition Chain

When analyzing side-channel security of addition-chain-based masked S-Box implementations, the leakages of each monomial computation in the addition chain can be utilized to perform attacks. And the output sizes of different monomials vary significantly. Since the profiling phase of DL-SCAs can be regarded as the training process of a classifier [42], the output size (i.e. the number of categories) will affect the classification performance. Then, during the attack phase, the probability of sensitive intermediate value is mapped to the probability of each key candidate k∈K. Although the number of key candidates K (i.e. 256 in AES) is the same for monomials with different output sizes, the classification performance may still affect the attack results. Therefore, the output size of the target monomial may affect the difficulty for conducting a successful attack. In Table 1, we give the output sizes of AES S-Box and monomial functions on irreducible polynomials x8+x4+x3+x+1 over F28. The # Output denotes the output size of functions, and the # Element denotes the number of functions whose output size is equal to a certain value. It can be observed that depending on the size of the output, functions can be divided into seven classes. It is clear that the exponent numbers of monomials in the same class have the same greatest common divisor with 255. So we also give the greatest common divisor of the monomial exponent number b and 255 in the column gcdb,255. Next, we first analyze the impact of output size from an information theory point of view.Table 1
The output sizes of AES S-box and monomial functions on irreducible polynomialsx8+x4+x3+x+1 over F28.
Function# elementgcdb,255# outputAES S-box,x, x2, x4, …1291256x3, x6, x9, x12, …64386x5, x10, x20, x25, …32552x15, x30, x45, x60, …161518x17, x34, x68, x136, …81716x51, x102, x153, x2044516x85, x1702854


## 4.2. Analysis Based on Information-Theoretic Metric

Information theoretic (IT) metrics measure the total information leakage irrespective of specific side-channel attacks. Mutual information (MI), as a well-known IT metric, has been widely used in side-channel analysis [43, 44]. Therefore, we use MI to evaluate the side-channel resistance of different monomials from an IT viewpoint.As illustrated by Standaert et al. [45], the multivariate joint distribution is the most effective way to utilize the information leakage in masked implementations. Let ℒ=ℒ0,…,ℒd be the multivariate leakage, where ℒi denotes the leakage of each share. We simulate the leakages ℒ0x0,…,ℒdxd as ℒixi=HWxi+Ni in detail. Then the mutual information between the sensitive variable X and the leakage is denoted as Iℒ;X. As shown in Table 1, all monomials can be grouped into 7 classes in the sense of output size. And monomials with the same output size can be viewed as equivalent when using MI metric [38]. Considering d=1 in the first-order Boolean masking, the MI results of AES S-Box and monomial functions are depicted in Figure 2. We take the first term from each class AESS−Box,x3,x5,x15,x17,x51,x85 as representatives.Figure 2
Mutual information of different output size functions ford=1.It can be observed that basically, the smaller the output size of the function, the higher the value of MI. This indicates that the function with smaller output size is likely to be less resistant against attacks. However, the results of MI metric do not exactly match the output size of functions. For example, the output size ofx5 is larger than that of x17, but x5 leaks more under MI metric. Besides, with the increase of the output size, the difference between the MI values of different functions becomes very small. Moreover, in Ming et al.’s study [38], it was also pointed out that the MI metric fails to work when evaluating the CPA resistance of different monomials. Therefore, to further investigate the impact of output size on DL-SCAs, we propose the KL divergence ratio as an evaluation metric.


## 4.3. Analysis Based on KL Divergence Ratio

The motivation for the use of the KL divergence is to quantitatively evaluate the difficulty of DL-SCAs directly from the viewpoint of the model’s output distribution shape. Actually, the KL divergence between the probability distribution of true labels and the predicted distribution of the deep learning model is frequently used to evaluate the classification performance of neural networks [46].In the case of SCAs, that is to calculate the KL divergence between the probability distribution of labels with the correct keyPk∗x and the conditional probability distribution Qx|l;θ of a deep learning model with parameter θ, which is defined as follows:(4)DKLPk∗QEx∼Pk∗logPk∗xQx|l;θ.A lower KL divergence implies that the distribution of the deep learning model output is closer to the true label distribution. In other words, the model with smaller KL divergence has better classification performance. From (3) and (4), it can be observed that DKLPk∗Q=HPk∗,Q+−Ex∼Pk∗logPk∗x, where −Ex∼Pk∗logPk∗x is the entropy of Pk∗x. In DL-SCAs, the true label is represented with a one-hot encoding, which means the entropy of Pk∗x is equal to 0. Therefore, KL divergence is equivalent to cross-entropy in this scenario.In the attack phase, the KL divergence can be estimated as follows:(5)D^KLPk∗Q=1Na∑i=1Na∑x∈XPk∗xlogPk∗xQx|l;θ.It can be observed that equations (4) and (5) only consider the probability distribution of labels with the correct key k∗. However, an adversary in SCAs needs to distinguish the correct key from other key hypotheses. Namely, the efficiency of the attack is also influenced by D^KLPk∗Q=1/Na∑i=1Na∑x∈XPk∗xlogPk∗x/Qx|l;θ. for k≠k∗. Therefore, we propose a novel metric KL divergence ratio (denoted as DRKL) for deep learning model performance evaluation in side-channel scenario as follows:(6)DRKL=DKLPk∗QEk≠k∗DKLPk∗Q.The lower the KL divergence ratio of a deep learning model is, the more effective it is to attack the targeted function.In order to analyze the impact of output size on attacks, one can first use leakages from monomials with different output sizes to train the deep learning model, and then calculate the KL divergence ratio in the attack phase respectively. In the attack phase, the KL divergence ratio is estimated as follows:(7)DR^KL=D^KLPk∗QEk≠k∗D^KLPk∗Q.For fairly comparing the resistance of different monomials, all experimental settings (including the noise level of leakages, the number of traces used for training and attack, the network architecture, etc) should be the same except for the targeted function and its corresponding leakages.Specifically, we also take the first term from each of the seven classes of functions in Table1 as representatives, and analyze the impact of output size on their KL divergence ratio values through simulated experiments. We train CNNs and perform attacks on simulated leakages for first-order d=1 and second-order d=2 masked implementations. Let ℒ=ℒ0,…,ℒd be the multivariate leakage where ℒi are defined as in Section 4.2. For d=1, we consider three different noise levels σ=0.5, σ=1, and σ=2, where σ denotes the standard deviation of noise. For d=2, we simulate traces with the noise level σ=1. When d=1 and d=2, we use 10,000 and 30,000 traces in the profiling phase, respectively, and 50,000 traces are used to estimate the KL divergence ratio for each attack. The traces are labeled by the value of the SubByte output (e.g., 4 labels for x85 and 256 labels for S-Box) in the one-hot encoding representation. The CNN architecture and other more detailed experimental settings are given in the next section. And the experimental results are shown in Figure 3.Figure 3
The KL divergence ratio values of different output size functions.Overall, results based on the KL divergence ratio are easier to observe than those based on the MI metric, and more in line with our expectations. Broadly speaking, it can be observed that the smaller the output size of the function, the lower the value of KL divergence ratio, and vice versa. Therefore, the function with smaller output size is likely to be less resistant against DL-SCAs. We argue that a few exceptions are caused by the uncertainty of the model training or the high noise level.


## 5. Deep-Learning-Based Profiled Attacks on Masked S-Box Implementations

In this section, we verify our analysis by simulated and practical experiments, respectively. We perform DL-SCAs on different output size monomials and AES S-Box. The overall workflow of DL-SCAs is shown in Figure4. In simulated experiments, the profiling, validation, and attack traces are generated by simulation. For each targeted implementation, we perform the following:(1)
Collect or generate traces for the profiling, validation, and attack phases, respectively(2)
Train CNN models(3)
Perform the key recovery and compute the success rate for each attackFigure 4
The overall workflow of DL-SCAs.


### 5.1. CNN Architecture

We refer to few previous works [21, 22] and use the hyperopt library [47] for designing a CNN model. The CNN is composed of five convolutional blocks followed by six fully connected layers. Each layer is activated by SeLU function and He Uniform initialization is used to improve the weight initialization. As for convolutional blocks, the kernel size is 11 and the number of kernels is 64,128,256,512,512. The outputs of a convolutional layer are fed into the batch normalization layer and average pooling layer in each convolutional block. As for fully connected layers, each layer has 20 neurons except the last one. The number of nodes in the output layer is equal to the output size of functions (e.g., 4 neurons for attacking x85 and 256 neurons for attacking AES S-Box, respectively). The output layer is activated by Softmax function. The cross-entropy is used as loss function. In order to facilitate the comparison of the resistance of different monomials, the convolutional network remains unchanged except for the last fully connected layer. As a remark, the network architectures used in this subsection are surely not optimal, as our goal is not to select the optimal parameters, but to compare different monomials in addition chains.


### 5.2. Simulated Experiments

#### 5.2.1. Experimental Setup

We perform attacks on simulated leakages for first- and second-order masked implementations, respectively. The leakages from computations of setAESS−Box,x3,x5,x15,x17,x51,x85 are simulated using the Hamming weight model as in Section 4. Table 2 shows the simulated leakage settings and data splitting sizes in each attack scenario. The #PoIs denotes the points of interest (PoIs) for each share. Since we consider an evaluation scenario of DL-SCAs for masked S-Box addition chains, we assume that the attacker can exactly select PoIs. Specifically, for d=1, each simulated leakage trace t contains 40 time samples, and the trace is generated as follows:(8)td=1i=HWx0+N0,σ,foriin1,20,HWx0+N0,σ,foriin21,40,,where td=1i denotes the ith time sample of the trace. x0 and x1 denote the two shares of the sensitive variable x. And for d=2, each simulated leakage trace t contains 45 time samples, and the trace is generated as follows:(9)td=2i=HWx0+N0,σ,foriin1,15,HWx1+N0,σ,foriin16,30,HWx2+N0,σ,foriin31,45.where x0, x1 and x2 denote the three shares of the sensitive variable x. As for d=1, we consider the different noise levels and different training trace numbers. As for d=2, we simulate traces with the noise level σ=1.Table 2
The simulated leakage settings and data splitting sizes in each attack scenario.
Attack scenarioMasking orderdNoise levelσ#PoIsTraining set sizeValidation set sizeAttack set sizeA110.5,1,220900010005000A21120900100500A3211527,0003,0005000A mini batch of 256 is employed. The learning rate is initially 0.009, and a technique called one cycle policy [48] is used to choose the right learning rate. We set 75 epochs for the training in d=1 experiments and 150 epochs in d=2 experiments. The traces are also labeled by the value of the SubByte output as in Section 4. During the training, the network kernel weights are recorded for the best validation loss. Once the training is done, we reconstruct the neuron network with the best-recorded weights. All experiments are conducted on an Intel(R) Xeon(R) CPU E5-2667 v4 @3.20 GHz 32 core machine with two NVIDIA TITAN Xp GPUs. We use the Keras library (version 2.2.2) with the TensorFlow library (version 1.10.0) as the backend for CNNs.


#### 5.2.2. Experimental Results

The success rate is used to evaluate the effectiveness of attacks. We run each attack 100 times with randomly selected subsamples of attack sets to find the average number of traces to achieve a success rate higher than80%. The process of training and attack for each monomial are performed 10 times in our experiments. We observe that the training process of CNNs is unstable to a certain extent. In other words, one or two out of 10 experiments for each monomial failed to retrieve the correct secret key. Therefore, we show the best attack results for each monomial to compare their resistance.The results of first-order masked implementations with different noise levels (corresponding toA1) are shown in Figure 5. First of all, AES S-Box is more resistant against DL-SCAs than x85, which is consistent with the results by Ming et al. [38]. Besides, we can see that the functions (including monomials and AES S-Box) with larger output size are generally more resistant against DL-SCAs than those functions with smaller output size. The results are substantially consistent with the theoretical analysis. For example, AES S-Box and x3 require more traces for successful attacks than x51 and x85. However, one may also note that when σ=0.5 and σ=1, x3 requires more traces to perform successful attacks than AES S-Box. We argue that the main reason is the noise level is so low that the difference between the two functions is not significant. Besides, there is some randomness in the training of CNNs. Therefore, it is possible that x3 requires a bit more attack traces. With the noise level increases, it is obvious that AES S-Box is much more resistant than x3.Figure 5
Attack scenarioA1: the success rate of attacks on simulated leakages with different noise levels when d=1 (a) σ = 0.5, (b) σ = 1, and (c) σ = 2.
(a)(b)(c)Moreover, the results of small training trace number (corresponding toA2) are shown in Figure 6. With the decrease in training trace number, the resistance difference of different functions becomes more obvious, and the overall trend does not change. Interestingly, for the attack on AES S-Box, the correct key cannot be successfully retrieved. We argue that the main reason is the lack of training data, while the classification problem is too complicated (256-classification).Figure 6
Attack scenarioA2: the success rate of attacks on σ=1 simulated leakages with small training trace number when d=1.Finally, Figure7 shows the results of second-order masked implementations when σ=1 (corresponding to A3). It can be observed that the results are basically in line with those of first-order masked implementations. The main reasons for the few inconsistencies are the uncertain training process of CNNs and high noise level. Overall, the results demonstrate that monomials with smaller output size are more vulnerable to DL-SCAs.Figure 7
Attack scenarioA3: the success rate of attacks on σ=1 simulated leakages when d=2.


### 5.3. Practical Experiments

We also perform attacks on practical first-order masked addition-chain-based S-Box implementation. Specifically, we target the addition chain proposed by Rivain and Prouff [31], which is the first provably secure higher-order masking for AES using addition chain. We use the open-source code given by Rivain and Prouff [31]. From Figure 1 and Table 1, it can be obtained that in x,x2,x254, 256 inputs are mapped to 256 outputs; in x3,x6,x12,x252, inputs are mapped to 86 outputs; and in x15,x30,x60,x120,x240, inputs are mapped to 18 outputs. That is to say, there are only three different output sizes of monomials in this addition chain implementation. Therefore, we perform power and electromagnetic analysis on x3, x15 and AES S-Box as typical representatives.


#### 5.3.1. Power Analysis

Our measurement setup for power analysis is shown in Figure8(a). It consists of the ChipWhisperer-Lite board, the CW308 UFO board and CW308-TM32F4 target board. The target board contains a 32-bit ARM Cortex-M4 CPU with an STM32F405 device. The sampling rate is set to 29.5 MHz. It is a relatively ideal environment with low noise for power analysis because the highest signal-to-noise ratio (SNR) is close to 100. A total of 3000 traces and 24,400 points for each trace are recorded. Among them, 2250 traces are used, and 20 PoIs of each share are selected for training CNNs. As we consider an evaluation scenario of DL-SCAs for masked S-Box addition chains, we assume that the attacker can select PoIs with the highest Pearson correlation coefficients with the sensitive intermediates. A total of 250 traces are used for validation, and 500 traces are used for attack. The CNN architecture and other experimental settings are the same as those of simulated experiments. The results are shown in Figure 9. The results are basically consistent with those of simulated attacks. Among the three target functions, it is obvious that AES S-Box is the most resistant against DL-SCAs, while x15 is the weakest one.Figure 8
Our experimental environment for collecting power and electromagnetic leakages: (a) collecting power leakages and (b) collecting electromagnetic leakages.
: (a)(b)Figure 9
The success rate of attacks on practical power leakages whend=1.


#### 5.3.2. Electromagnetic Analysis

Our experimental environment for electromagnetic analysis is shown in Figure8(b). The addition-chain-based masked implementations are running on an STM32F407, which is also a Cortex-M4-based microcontroller. Its electromagnetic consumption is measured through an electromagnetic near field probe RS H 400-1 on the surface of the microcontroller. The traces are obtained through an Agilent DSO90404A Digital Storage Oscilloscope with a high impedance adapter, and the sampling rate is set to 1 GHz. A total of 40,000 traces and 25,000 points for each trace are recorded. The collected electromagnetic traces are with a higher noise, as the highest SNR of PoIs is lower than 2. Among them, 27,000 traces are used, and 20 PoIs of each share are selected for training CNNs. A total of 3000 traces are used for validation, and 10,000 traces are used for attack. The CNN architecture and other experimental settings are the same as mentioned earlier. The results are shown in Figure 10. It can be observed that the results are consistent with those of power analysis. For the attack on AES S-Box, the correct key cannot be successfully retrieved. We argue that an important reason is the SNR of our electromagnetic measurements is much less than that of power measurements. Besides, the classification problem is too complicated.Figure 10
The success rate of attacks on practical electromagnetic leakages whend=1.


## 5.1. CNN Architecture

We refer to few previous works [21, 22] and use the hyperopt library [47] for designing a CNN model. The CNN is composed of five convolutional blocks followed by six fully connected layers. Each layer is activated by SeLU function and He Uniform initialization is used to improve the weight initialization. As for convolutional blocks, the kernel size is 11 and the number of kernels is 64,128,256,512,512. The outputs of a convolutional layer are fed into the batch normalization layer and average pooling layer in each convolutional block. As for fully connected layers, each layer has 20 neurons except the last one. The number of nodes in the output layer is equal to the output size of functions (e.g., 4 neurons for attacking x85 and 256 neurons for attacking AES S-Box, respectively). The output layer is activated by Softmax function. The cross-entropy is used as loss function. In order to facilitate the comparison of the resistance of different monomials, the convolutional network remains unchanged except for the last fully connected layer. As a remark, the network architectures used in this subsection are surely not optimal, as our goal is not to select the optimal parameters, but to compare different monomials in addition chains.


## 5.2. Simulated Experiments

### 5.2.1. Experimental Setup

We perform attacks on simulated leakages for first- and second-order masked implementations, respectively. The leakages from computations of setAESS−Box,x3,x5,x15,x17,x51,x85 are simulated using the Hamming weight model as in Section 4. Table 2 shows the simulated leakage settings and data splitting sizes in each attack scenario. The #PoIs denotes the points of interest (PoIs) for each share. Since we consider an evaluation scenario of DL-SCAs for masked S-Box addition chains, we assume that the attacker can exactly select PoIs. Specifically, for d=1, each simulated leakage trace t contains 40 time samples, and the trace is generated as follows:(8)td=1i=HWx0+N0,σ,foriin1,20,HWx0+N0,σ,foriin21,40,,where td=1i denotes the ith time sample of the trace. x0 and x1 denote the two shares of the sensitive variable x. And for d=2, each simulated leakage trace t contains 45 time samples, and the trace is generated as follows:(9)td=2i=HWx0+N0,σ,foriin1,15,HWx1+N0,σ,foriin16,30,HWx2+N0,σ,foriin31,45.where x0, x1 and x2 denote the three shares of the sensitive variable x. As for d=1, we consider the different noise levels and different training trace numbers. As for d=2, we simulate traces with the noise level σ=1.Table 2
The simulated leakage settings and data splitting sizes in each attack scenario.
Attack scenarioMasking orderdNoise levelσ#PoIsTraining set sizeValidation set sizeAttack set sizeA110.5,1,220900010005000A21120900100500A3211527,0003,0005000A mini batch of 256 is employed. The learning rate is initially 0.009, and a technique called one cycle policy [48] is used to choose the right learning rate. We set 75 epochs for the training in d=1 experiments and 150 epochs in d=2 experiments. The traces are also labeled by the value of the SubByte output as in Section 4. During the training, the network kernel weights are recorded for the best validation loss. Once the training is done, we reconstruct the neuron network with the best-recorded weights. All experiments are conducted on an Intel(R) Xeon(R) CPU E5-2667 v4 @3.20 GHz 32 core machine with two NVIDIA TITAN Xp GPUs. We use the Keras library (version 2.2.2) with the TensorFlow library (version 1.10.0) as the backend for CNNs.


### 5.2.2. Experimental Results

The success rate is used to evaluate the effectiveness of attacks. We run each attack 100 times with randomly selected subsamples of attack sets to find the average number of traces to achieve a success rate higher than80%. The process of training and attack for each monomial are performed 10 times in our experiments. We observe that the training process of CNNs is unstable to a certain extent. In other words, one or two out of 10 experiments for each monomial failed to retrieve the correct secret key. Therefore, we show the best attack results for each monomial to compare their resistance.The results of first-order masked implementations with different noise levels (corresponding toA1) are shown in Figure 5. First of all, AES S-Box is more resistant against DL-SCAs than x85, which is consistent with the results by Ming et al. [38]. Besides, we can see that the functions (including monomials and AES S-Box) with larger output size are generally more resistant against DL-SCAs than those functions with smaller output size. The results are substantially consistent with the theoretical analysis. For example, AES S-Box and x3 require more traces for successful attacks than x51 and x85. However, one may also note that when σ=0.5 and σ=1, x3 requires more traces to perform successful attacks than AES S-Box. We argue that the main reason is the noise level is so low that the difference between the two functions is not significant. Besides, there is some randomness in the training of CNNs. Therefore, it is possible that x3 requires a bit more attack traces. With the noise level increases, it is obvious that AES S-Box is much more resistant than x3.Figure 5
Attack scenarioA1: the success rate of attacks on simulated leakages with different noise levels when d=1 (a) σ = 0.5, (b) σ = 1, and (c) σ = 2.
(a)(b)(c)Moreover, the results of small training trace number (corresponding toA2) are shown in Figure 6. With the decrease in training trace number, the resistance difference of different functions becomes more obvious, and the overall trend does not change. Interestingly, for the attack on AES S-Box, the correct key cannot be successfully retrieved. We argue that the main reason is the lack of training data, while the classification problem is too complicated (256-classification).Figure 6
Attack scenarioA2: the success rate of attacks on σ=1 simulated leakages with small training trace number when d=1.Finally, Figure7 shows the results of second-order masked implementations when σ=1 (corresponding to A3). It can be observed that the results are basically in line with those of first-order masked implementations. The main reasons for the few inconsistencies are the uncertain training process of CNNs and high noise level. Overall, the results demonstrate that monomials with smaller output size are more vulnerable to DL-SCAs.Figure 7
Attack scenarioA3: the success rate of attacks on σ=1 simulated leakages when d=2.


## 5.2.1. Experimental Setup

We perform attacks on simulated leakages for first- and second-order masked implementations, respectively. The leakages from computations of setAESS−Box,x3,x5,x15,x17,x51,x85 are simulated using the Hamming weight model as in Section 4. Table 2 shows the simulated leakage settings and data splitting sizes in each attack scenario. The #PoIs denotes the points of interest (PoIs) for each share. Since we consider an evaluation scenario of DL-SCAs for masked S-Box addition chains, we assume that the attacker can exactly select PoIs. Specifically, for d=1, each simulated leakage trace t contains 40 time samples, and the trace is generated as follows:(8)td=1i=HWx0+N0,σ,foriin1,20,HWx0+N0,σ,foriin21,40,,where td=1i denotes the ith time sample of the trace. x0 and x1 denote the two shares of the sensitive variable x. And for d=2, each simulated leakage trace t contains 45 time samples, and the trace is generated as follows:(9)td=2i=HWx0+N0,σ,foriin1,15,HWx1+N0,σ,foriin16,30,HWx2+N0,σ,foriin31,45.where x0, x1 and x2 denote the three shares of the sensitive variable x. As for d=1, we consider the different noise levels and different training trace numbers. As for d=2, we simulate traces with the noise level σ=1.Table 2
The simulated leakage settings and data splitting sizes in each attack scenario.
Attack scenarioMasking orderdNoise levelσ#PoIsTraining set sizeValidation set sizeAttack set sizeA110.5,1,220900010005000A21120900100500A3211527,0003,0005000A mini batch of 256 is employed. The learning rate is initially 0.009, and a technique called one cycle policy [48] is used to choose the right learning rate. We set 75 epochs for the training in d=1 experiments and 150 epochs in d=2 experiments. The traces are also labeled by the value of the SubByte output as in Section 4. During the training, the network kernel weights are recorded for the best validation loss. Once the training is done, we reconstruct the neuron network with the best-recorded weights. All experiments are conducted on an Intel(R) Xeon(R) CPU E5-2667 v4 @3.20 GHz 32 core machine with two NVIDIA TITAN Xp GPUs. We use the Keras library (version 2.2.2) with the TensorFlow library (version 1.10.0) as the backend for CNNs.


## 5.2.2. Experimental Results

The success rate is used to evaluate the effectiveness of attacks. We run each attack 100 times with randomly selected subsamples of attack sets to find the average number of traces to achieve a success rate higher than80%. The process of training and attack for each monomial are performed 10 times in our experiments. We observe that the training process of CNNs is unstable to a certain extent. In other words, one or two out of 10 experiments for each monomial failed to retrieve the correct secret key. Therefore, we show the best attack results for each monomial to compare their resistance.The results of first-order masked implementations with different noise levels (corresponding toA1) are shown in Figure 5. First of all, AES S-Box is more resistant against DL-SCAs than x85, which is consistent with the results by Ming et al. [38]. Besides, we can see that the functions (including monomials and AES S-Box) with larger output size are generally more resistant against DL-SCAs than those functions with smaller output size. The results are substantially consistent with the theoretical analysis. For example, AES S-Box and x3 require more traces for successful attacks than x51 and x85. However, one may also note that when σ=0.5 and σ=1, x3 requires more traces to perform successful attacks than AES S-Box. We argue that the main reason is the noise level is so low that the difference between the two functions is not significant. Besides, there is some randomness in the training of CNNs. Therefore, it is possible that x3 requires a bit more attack traces. With the noise level increases, it is obvious that AES S-Box is much more resistant than x3.Figure 5
Attack scenarioA1: the success rate of attacks on simulated leakages with different noise levels when d=1 (a) σ = 0.5, (b) σ = 1, and (c) σ = 2.
(a)(b)(c)Moreover, the results of small training trace number (corresponding toA2) are shown in Figure 6. With the decrease in training trace number, the resistance difference of different functions becomes more obvious, and the overall trend does not change. Interestingly, for the attack on AES S-Box, the correct key cannot be successfully retrieved. We argue that the main reason is the lack of training data, while the classification problem is too complicated (256-classification).Figure 6
Attack scenarioA2: the success rate of attacks on σ=1 simulated leakages with small training trace number when d=1.Finally, Figure7 shows the results of second-order masked implementations when σ=1 (corresponding to A3). It can be observed that the results are basically in line with those of first-order masked implementations. The main reasons for the few inconsistencies are the uncertain training process of CNNs and high noise level. Overall, the results demonstrate that monomials with smaller output size are more vulnerable to DL-SCAs.Figure 7
Attack scenarioA3: the success rate of attacks on σ=1 simulated leakages when d=2.


## 5.3. Practical Experiments

We also perform attacks on practical first-order masked addition-chain-based S-Box implementation. Specifically, we target the addition chain proposed by Rivain and Prouff [31], which is the first provably secure higher-order masking for AES using addition chain. We use the open-source code given by Rivain and Prouff [31]. From Figure 1 and Table 1, it can be obtained that in x,x2,x254, 256 inputs are mapped to 256 outputs; in x3,x6,x12,x252, inputs are mapped to 86 outputs; and in x15,x30,x60,x120,x240, inputs are mapped to 18 outputs. That is to say, there are only three different output sizes of monomials in this addition chain implementation. Therefore, we perform power and electromagnetic analysis on x3, x15 and AES S-Box as typical representatives.


### 5.3.1. Power Analysis

Our measurement setup for power analysis is shown in Figure8(a). It consists of the ChipWhisperer-Lite board, the CW308 UFO board and CW308-TM32F4 target board. The target board contains a 32-bit ARM Cortex-M4 CPU with an STM32F405 device. The sampling rate is set to 29.5 MHz. It is a relatively ideal environment with low noise for power analysis because the highest signal-to-noise ratio (SNR) is close to 100. A total of 3000 traces and 24,400 points for each trace are recorded. Among them, 2250 traces are used, and 20 PoIs of each share are selected for training CNNs. As we consider an evaluation scenario of DL-SCAs for masked S-Box addition chains, we assume that the attacker can select PoIs with the highest Pearson correlation coefficients with the sensitive intermediates. A total of 250 traces are used for validation, and 500 traces are used for attack. The CNN architecture and other experimental settings are the same as those of simulated experiments. The results are shown in Figure 9. The results are basically consistent with those of simulated attacks. Among the three target functions, it is obvious that AES S-Box is the most resistant against DL-SCAs, while x15 is the weakest one.Figure 8
Our experimental environment for collecting power and electromagnetic leakages: (a) collecting power leakages and (b) collecting electromagnetic leakages.
: (a)(b)Figure 9
The success rate of attacks on practical power leakages whend=1.


### 5.3.2. Electromagnetic Analysis

Our experimental environment for electromagnetic analysis is shown in Figure8(b). The addition-chain-based masked implementations are running on an STM32F407, which is also a Cortex-M4-based microcontroller. Its electromagnetic consumption is measured through an electromagnetic near field probe RS H 400-1 on the surface of the microcontroller. The traces are obtained through an Agilent DSO90404A Digital Storage Oscilloscope with a high impedance adapter, and the sampling rate is set to 1 GHz. A total of 40,000 traces and 25,000 points for each trace are recorded. The collected electromagnetic traces are with a higher noise, as the highest SNR of PoIs is lower than 2. Among them, 27,000 traces are used, and 20 PoIs of each share are selected for training CNNs. A total of 3000 traces are used for validation, and 10,000 traces are used for attack. The CNN architecture and other experimental settings are the same as mentioned earlier. The results are shown in Figure 10. It can be observed that the results are consistent with those of power analysis. For the attack on AES S-Box, the correct key cannot be successfully retrieved. We argue that an important reason is the SNR of our electromagnetic measurements is much less than that of power measurements. Besides, the classification problem is too complicated.Figure 10
The success rate of attacks on practical electromagnetic leakages whend=1.


## 5.3.1. Power Analysis

Our measurement setup for power analysis is shown in Figure8(a). It consists of the ChipWhisperer-Lite board, the CW308 UFO board and CW308-TM32F4 target board. The target board contains a 32-bit ARM Cortex-M4 CPU with an STM32F405 device. The sampling rate is set to 29.5 MHz. It is a relatively ideal environment with low noise for power analysis because the highest signal-to-noise ratio (SNR) is close to 100. A total of 3000 traces and 24,400 points for each trace are recorded. Among them, 2250 traces are used, and 20 PoIs of each share are selected for training CNNs. As we consider an evaluation scenario of DL-SCAs for masked S-Box addition chains, we assume that the attacker can select PoIs with the highest Pearson correlation coefficients with the sensitive intermediates. A total of 250 traces are used for validation, and 500 traces are used for attack. The CNN architecture and other experimental settings are the same as those of simulated experiments. The results are shown in Figure 9. The results are basically consistent with those of simulated attacks. Among the three target functions, it is obvious that AES S-Box is the most resistant against DL-SCAs, while x15 is the weakest one.Figure 8
Our experimental environment for collecting power and electromagnetic leakages: (a) collecting power leakages and (b) collecting electromagnetic leakages.
: (a)(b)Figure 9
The success rate of attacks on practical power leakages whend=1.


## 5.3.2. Electromagnetic Analysis

Our experimental environment for electromagnetic analysis is shown in Figure8(b). The addition-chain-based masked implementations are running on an STM32F407, which is also a Cortex-M4-based microcontroller. Its electromagnetic consumption is measured through an electromagnetic near field probe RS H 400-1 on the surface of the microcontroller. The traces are obtained through an Agilent DSO90404A Digital Storage Oscilloscope with a high impedance adapter, and the sampling rate is set to 1 GHz. A total of 40,000 traces and 25,000 points for each trace are recorded. The collected electromagnetic traces are with a higher noise, as the highest SNR of PoIs is lower than 2. Among them, 27,000 traces are used, and 20 PoIs of each share are selected for training CNNs. A total of 3000 traces are used for validation, and 10,000 traces are used for attack. The CNN architecture and other experimental settings are the same as mentioned earlier. The results are shown in Figure 10. It can be observed that the results are consistent with those of power analysis. For the attack on AES S-Box, the correct key cannot be successfully retrieved. We argue that an important reason is the SNR of our electromagnetic measurements is much less than that of power measurements. Besides, the classification problem is too complicated.Figure 10
The success rate of attacks on practical electromagnetic leakages whend=1.


## 6. Discussion

In general, both theoretical analysis and attack experiments show that the monomial with smaller output size is less resistant against DL-SCAs. Therefore, from the designer’s point of view, in addition to efficiently implementing the addition chain, one should also choose those addition chains that avoid using small output size monomials. Actually, Carlet et at. [32] have proved that at least 7 squares and 4 multiplications are needed for an addition-chain-based AES S-Box. Ming et al. [38] recommended two strongest addition chains against CPA attacks for AES S-Box by enumerating the most efficient addition chains. As it is necessary to comprehensively consider different types of attacks when designing addition chains, we consider examining the resistance against DL-SCAs of addition chains recommended by Ming et al. [38].For AES S-Box, the first recommended addition chain isℱ=x,x2,x4,x8,x16,x18,x32,x64,x82,x86,x172,x254. It can be observed that x18 maps 256 inputs to 86 outputs, which is the monomial with the smallest output size in this chain. Except for x18, all the other monomials in this addition chain map 256 inputs to 256 outputs. And the second recommended addition chain is ℱ=x,x2,x4,x8,x9,x18,x19,x27,x54,x108,x127,x254. It can be observed that x9,x18,x27,x54, and x108 map 256 inputs to 86 outputs, which are the monomials with the smallest output size in this chain. And all the other monomials in this addition chain map 256 inputs to 256 outputs. Overall, the aforementioned two addition chains are relatively strong against DL-SCAs. However, there are five monomials in the second addition chain and only one monomial in the first chain with an output size of 86. Considering that the adversary may exploit the leakages of several monomials simultaneously, the first addition chain is the most recommended.


## 7. Conclusion

This paper investigates the performance of DL-SCAs on addition-chain-based Boolean masked S-Box implementations. We find that in addition chains, the computations of intermediate monomials with smaller output sizes decrease the resistance of implementations against DL-SCAs. First, we use MI metric to evaluate the side-channel resistance of different monomials from an IT viewpoint. Next, we further propose the KL divergence ratio metric to evaluate the impact of function output size on attacks. The measurement values show that the monomial with smaller output size is less resistant against DL-SCAs. Then we conduct simulated and practical experiments, respectively. The experimental results demonstrate that monomials with smaller output size are more vulnerable to DL-SCAs. Finally, we give some recommended guidelines on how to design addition chains with higher side-channel resistance according to the research results.Actually, except Boolean masking, various masking schemes, such as mixed additive and multiplicative masking and inner product masking, are using addition chain to implement S-Boxes. It is our future work to evaluate the security of these masking schemes based on addition chain implementations.



---

*Source: 7771621-2022-03-24.xml*