Side-Channel Distinguishers

Abstract

A distinguisher is a statistical tool whose purpose is to determine the most probable key among a set of keys. Several distinguishers are introduced in the literature. Hereafter, we present the most used ones. 3.1 SCA Distinguishers Classification Several classifications of distinguishers can be considered. One can split them into two classes, monovariate and multivariate distinguisher, according to the number of the considered (time) samples during the distinguisher computation. Some authors split the distinguishers in several classes according to the type of targeted leakage (time, power consumption, electromagnetic emanation, …). Another way to classify is to separate between distinguishers according to the assumption that the adversary owns a copy of the target device before the attack or not (profiled and non-profiled attacks, respectively). In fact, if the adversary has an equivalent device to the target one, then she can profile the leakage before the attack phase. The profiling phase often consists in estimating the leakage probability distribution, namely, by estimating different statistical moments (Means, (co)variance, …). Whereas the attack phase consist in computing some "distance" between the distribution of the actual leakage and the estimated leakage distribution. Different "distances" are possible such as the square norm of the difference (as in LRA) and notably the maximum of the likelihood. Finally, still other classifications of side-channel attacks are possible as explored in [1]. In this book, the distinguishers are classified into two main classes. The first one contains all the distinguishers that target the non-protected implementations, especially non-masked ones. It is called the class of first-order distinguishers. The second class contains the attacks that target the protected implementations by masking. It is called the class of higher order distinguishers.