Redefining the transparency order

In this paper, we consider the multi-bit Differential Power Analysis (DPA) in the Hamming weight model. In this regard, we revisit the definition of Transparency Order (\(\mathsf {TO}\)) from the work of Prouff (FSE 2005) and find that the definition has certain limitations. Although this work has been quite well referred in the literature, surprisingly, these limitations remained unexplored for almost a decade. We analyse the definition from scratch, modify it and finally provide a definition with better insight that can theoretically capture DPA in Hamming weight model for hardware implementation with precharge logic. At the end, we confront the notion of (revised) transparency order with attack simulations in order to study to what extent the low transparency order of an s-box impacts the efficiency of a side channel attack against its processing. To the best of our knowledge, this is the first time that such a critical analysis is conducted (even considering the original notion of Prouff). It practically confirms that the transparency order is indeed related to the resistance of the s-box against side-channel attacks, but it also shows that it is not sufficient alone to directly achieve a satisfying level of security. Regarding this point, our conclusion is that the (revised) transparency order is a valuable criterion to consider when designing a cryptographic algorithm, and even if it does not preclude to also use classical countermeasures like masking or shuffling, it enables to improve their effectiveness.

1. Such a model is used in CPA, together with the key hypothesis K, to compute the predictions that are correlated to each point of the traces \({\varvec{T}}_x\) (see [4] for a detailed presentation of the CPA).

2. This should correspond to a maximum level of security.

3. We recall that the correlation coefficient between two random variables U and V can be soundly estimated from respectively N observations \((u_i)_i\) and \((v_i)_i\) of U and V by \(\rho (U,V) \simeq (N\sum _i u_iv_i - \sum _i u_iv_i) / (\sqrt{N\sum _i u_i^2 - (\sum _i u_i)^2}\sqrt{N\sum _i v_i^2 - (\sum _i v_i)^2})\).

4. Those s-boxes correspond to the two opposite extrema in terms of \(\mathsf {TO}\).

5. These standard deviations correspond to j % of the mean \(\mathsf {H}(y)\) when y ranges uniformly over \({\mathbb {F}}_2^4\) and \(j\in \{0,10,20,30,40,50\}\).

6. The number of repetitions is 1000.

Authors and Affiliations

1. SECRET Team, INRIA, Paris, France

   Kaushik Chakraborty

2. TCS Innovation Labs, Hyderabad, India

   Sumanta Sarkar

3. Indian Statistical Institute, Kolkata, India

   Subhamoy Maitra

4. Indian Institute of Technology, Kharagpur, India

   Bodhisatwa Mazumdar & Debdeep Mukhopadhyay

5. Sorbonne Universiteés, UPMC Univ Paris 06, CNRS, INRIA, Laboratoire d’Informatique de Paris 6 (LIP6), Équipe PolSys, 4 place Jussieu, 75252, Paris Cedex 05, France

   Emmanuel Prouff

Corresponding author

Correspondence to Sumanta Sarkar.

This is one of several papers published in Designs, Codes and Cryptography comprising the “Special Issue on Coding and Cryptography”.

Appendix 1: Analysis for the s-boxes in context of PRINCE

Eight \(4 \times 4\) s-boxes are referred in [3]. In Table 2 we show the maximum and minimum values of \(\mathsf {TO}(F,\beta )\) for each of the s-boxes.

Appendix 2: Impact of an transparency order when model error is considered

In this section, we study the impact of an erroneous modelling on the CPA resistance of an s-box, by performing CPA attack simulations against the fourth and the seventh PRINCE s-boxes^{Footnote 4} under the assumption that the information is not leaking in the Hamming distance model but in an erroneous version of it. Namely, for a fixed model error standard deviation \(\sigma _{er}\) chosen^{Footnote 5} in \(\{0,0.2,0.4,0.6,0.8,1.0\}\), we simulated the leakage \(L(X\oplus \dot{K})\) such that:

where \(\varphi \) is a function defined for every \(y\in \mathbb {F}_{2}^4\) by \(\varphi (y) = \mathrm {HW}(y)+ \varepsilon \) with \(\varepsilon \) randomly generated according to a normal distribution with mean 0 and standard deviation \(\sigma _{er}\). The variable B still refers to an independent Gaussian noise with 0 mean and standard deviation \(\sigma \). For the processing of the predictions, we kept the Hamming weight model (the adversary is not assumed to know the erroneous leakage model). The results of our CPA attack simulations are reported in Fig. 4 (bars in dark blue correspond to s-box 4 whereas those in light blue correspond to s-box 7, for each standard deviation \(\sigma \)—in x-axis—there is one bar for each \(\sigma _{er}\) in \(\{0.0,0.2,0.4,0.6,0.8,1.0\}\)).

It may be checked that the fourth s-box, which has minimum \(\mathsf {TO}\), stays more resistant than the seventh s-box for any error in the modelling and the noise standard deviation. More interestingly, our simulations show that the difficulty of attacking s-box 4 increases more quickly with the \(\sigma _{er}\) than for s-box 7. Actually, for a \(\sigma _{er}\) greater than or equal to 0.8, a 90 % success rate^{Footnote 6} was achieved against s-box 4 only when the noise standard deviation was equal to 1. For greater noise standard deviations (and for \(\sigma _{er}\ge 0.8\)), this success rate was never achieved by CPA attacks with less than 500,000 traces.

CPA in the presence of errors \(\sigma _{er}\in \{0.0,0.2,0.4,0.6,0.8,1.0\}\) and \(\sigma \in \{1, \ldots , 5\}\) (both on x-axis). For each pair \((\sigma ,\sigma _{er})\) there is one dark blue bar for s-box 4 and one light-blue bar for s-box 7 of PRINCE. The pairs \((\sigma ,\sigma _{er})\) for which there is no dark blue bar corresponds to situations where the number of traces to achieve 0.9 success probability is at least 500,000 (Color figure online)

Full size image

Appendix 3: A lower bound of \(\mathsf {TO}(F)\) using Walsh spectrum only

We present a lower bound of \(\mathsf {TO}(F)\) for a given \(F = (F_1, \ldots , F_m)\). The following result will be used to derive the bound.

Lemma 1

Suppose e, f, g, h are Boolean functions of n-variables. Then

Proof

Suppose \({\mathbb {F}}_2^n = \{a_0, \ldots , a_{2^n-1}\}\). It is known that

where \(\mathcal {H}_n\) is the Hadamard matrix of order \(2^n \times 2^n\). Take the product

Since, \(\mathcal {H}_n \mathcal {H}_n^T = 2^n I_{2^n\times 2^n}\), where \(I_{2^n\times 2^n}\) is the identity matrix of order \(2^n\times 2^n\), then from the product, we have

\(\square \)

Theorem 3

For \(F = (F_1, \ldots , F_m): {\mathbb {F}}_2^n \rightarrow {\mathbb {F}}_2^m\), the value of \(\mathsf {TO}(F)\) has the following lower bound

Proof

It is clear that \(\mathsf {TO}(F) \ge \mathsf {TO}(F,0)\). So we calculate a lower bound of \(\mathsf {TO}(F,0)\). From (14) we get

Applying Cauchy–Schwarz inequality we get

Note that

Then applying Lemma 1,

Replacing this value of \(\sum _{a \in F_2^{n}} \Big (\sum _{i=1}^m {\mathcal {C}}_{F_i,F_j} (a) \Big )^2\) in (17), an upper bound of \(\sum _{a \in F_2 ^{n^*}} |\sum _{i=1}^m {\mathcal {C}}_{F_i,F_j} (a)|\) is obtained. Then using this upper bound in (17), we get a lower bound of \(\mathsf {TO}(F,0)\) as follows

Note that \(\mathsf {TO}(F,\beta )\) assumes that all the coordinate functions are balanced, therefore the above bound can be written as

This serves as a lower bound of \(\mathsf {TO}(F)\). \(\square \)

Reprints and permissions