A Systematic Approach to Horizontal Clustering Analysis on Embedded RSA Implementation Sidechannel attacks are a threat to cryptographic algorithms running on embedded devices. The exponent blinding is the main countermeasure which resists the classical forms of sidechannel attacks. Horizontal sidechannel analysis is an effective method to overcome this kind of countermeasures and recover the secret key through the analysis of a single trace. However, it is very difficult to exploit leakage from a single trace in practice, because the segment borders of crucial operation are hard to find and the single execution possibly contains a lot of noise in a real application environment. In this paper, a framework for systematic approach is presented to overcome these drawbacks. Firstly, we propose a method to use the HilbertHuang transform for the segment borders detection and the noise reduction. Then, an effective clustering method is used to recover the private key. The proposed horizontal clustering approach is applied to a protected implementation on embedded devices. The results show that the success rate of the key recovery could be up to 98%. Finally, we analyze the mechanism of leakage exploration.

Stronger and Faster SideChannel Protections for CSIDH. CSIDH is a recent quantumresistant primitive based on the difficulty of finding isogeny paths between supersingular curves. Recently, two constanttime versions of CSIDH have been proposed: first by Meyer, Campos and Reith, and then by Onuki, Aikawa, Yamazaki and Takagi. While both offer protection against timing attacks and simple power consumption analysis, they are vulnerable to more powerful attacks such as fault injections. In this work, we identify and repair two oversights in these algorithms that compromised their constanttime character. By exploiting Edwards arithmetic and optimal addition chains, we produce the fastest constanttime version of CSIDH to date. We then consider the stronger attack scenario of fault injection, which is relevant for the security of CSIDH static keys in embedded hardware. We propose and evaluate a dummyfree CSIDH algorithm. While these CSIDH variants are slower, their performance is still within a small constant factor of lessprotected variants. Finally, we discuss derandomized CSIDH algorithms.