11institutetext: Digital Security Group, Radboud University, Nijmegen, The
Netherlands 11email<EMAIL_ADDRESS>22institutetext:
Ikerlan Technological Research Centre, Arrasate-Mondragón, Gipuzkoa, Spain
22email<EMAIL_ADDRESS>
# Keep It Unbiased: A Comparison Between Estimation of Distribution Algorithms
and Deep Learning for Human Interaction-Free Side-Channel Analysis

Unai Rioja 1122 Lejla Batina 11 Igor Armendariz 22 Jose Luis Flores 22

###### Abstract

Evaluating side-channel analysis (SCA) security is a complex process,
involving applying several techniques whose success depends on human
engineering. Therefore, it is crucial to avoid a false sense of confidence
provided by non-optimal (failing) attacks. Different alternatives have emerged
lately trying to mitigate human dependency, among which deep learning (DL)
attacks are the most studied today. DL promise to simplify the procedure by
e.g. evading the need for point of interest selection or the capability of
bypassing noise and desynchronization, among other shortcuts. However,
including DL in the equation comes at a price, since working with neural
networks is not straightforward in this context. Recently, an alternative has
appeared with the potential to mitigate this dependence without adding extra
complexity: Estimation of Distribution Algorithm-based SCA. In this paper, we
compare these two relevant methods, supporting our findings by experiments on
various datasets.

###### Keywords:

Hardware security Side-channel analysis Machine learning Estimation of
distribution algorithms Artificial Intelligence Evaluation

##  1 Introduction

These days we are surrounded by IoT devices that handle sensitive information,
not only in industrial applications but also in our daily lives. This requires
from designers and product developers to use cryptography to protect embedded
devices, but cryptography is only one of the components ensuring the security
of systems. As Kocher et al. demonstrated in 1999 [21], the security of a
device depends not only on the mathematical characteristics of its
cryptographic operations but also on its physical implementation. In other
words, the physical nature of these devices can be exploited in order to break
their security in several ways. Whereas some approaches are passive and rely
on simply observing certain physical properties to retrieve information (Side-
channel analysis, SCA), other procedures try to stress the system to alter its
natural behaviour (Fault Injection, FI). Physical attacks are truly powerful,
as they can bypass hardware and software security measures that the
manufacturer has included in the design.

The problem is that the inclusion and validation of countermeasures against
this kind of attacks is not simple, especially in the SCA case. Current
certification schemes require attacking the device under test (DUT) with a
battery of known SCA attacks to prove its security [2]. Unfortunately, this
approach is prohibitive in terms of time and resources. The ever-growing
number of attack techniques, which in turn involve knowledge of very diverse
subjects (e.g., signal processing, electronic design, cryptography,
statistics, machine learning, etc.), make it difficult to master and correctly
apply all of them. Moreover, the outcome of such attacks depends to a large
extent on the experience of the person performing them. Therefore, a process
so dependent on human interaction can lead to a biased result if the tests are
not properly executed.

One of the most prominent techniques in SCA research today is Deep Learning
(DL)-based SCA [20, 26, 7, 4, 38, 48], part of the so-called profiling attacks
(the strongest SCA technique nowadays). This method aims to overcome some
drawbacks of classical SCA, such as the need for pre-processing or point of
interest (POI) selection, promising a relaxation of the evaluator interaction.
Conversely, working with DL is complex, especially considering the large
number of possible architectures and hyper-parameters to adjust. Besides,
although some attempts have been made [20, 52, 48], the SCA community has not
yet agreed on how models should be constructed and evaluated. In addition,
there is no generalized solution: when attacking new datasets, devices or
cryptographic implementations, sometimes it is necessary to completely
readjust the neural network. Consequently, while some of the more common
difficulties are alleviated, new DL-related complications emerge.

Recently, an option that promises to lessen this human dependency without
increasing the overall complexity has emerged: Estimation of Distribution
Algorithm-based Profiling Attacks (EDA-based PAs) [40, 39]. This concept
comprises applying randomized optimization heuristics to the POI selection
issue, allowing an automated boosting of the whole attack (POI selection,
leakage profiling and key recovery). This method can produce state-of-the-art
results straightforwardly, even in noisy environments [39]. Although they
provide a simple alternative to DL, to the best of our knowledge, both
approaches have never been directly compared. Therefore, in this paper, a
comparison between the two methods is driven.

Thus, the contributions of this work are the following:

  * •

A comparative analysis of both approaches has been driven, in terms of
complexity and performance, to highlight the strengths and weaknesses of each
method.

  * •

Our findings are based on repeatable experimental evidence. Some experiments
have been carried out especially for this paper, while for others we have
relied on related works to provide a comprehensive and impartial comparison.

  * •

We also study the performance of several SCA-oriented DL architectures in
unfavourable conditions (no mask leakage during the targeted window) to
determine whether the same conclusions as in [39] using EDAs hold.

The paper is organized as follows: In Sect. 2 we summarize relevant background
on profiling attacks. We describes the related work that is closest to ours in
Sect. 3. We present the comparison of the two techniques (EDAs and DL-based)
in Sect. 4. In Sect. 5 we discuss the comparison and elaborate on our
findings. Sect. 6 concludes the paper.

##  2 Background on profiling attacks

Profiling Attacks (PAs) have become the prevailing type of SCA attack in
recent years [10, 4, 54, 52, 39]. The original idea comprises generating a
model of the power consumption of a device to be deployed for the secret key
recovery. These attacks involve two phases (See Fig. 1): a phase in which the
model is generated using a typically big number of traces (profiling phase),
and the phase in which this model is compared with the actual power
consumption of the device to recover sensitive information (attack phase).

Depending on the method used to generate the model, there exist different
types of profiling attacks. Whereas the first publications employed gaussian
classification (Template Attacks, TAs) [8], other approaches use linear
regression (Stochastic Models approach [42]) or even Machine Learning (ML)
techniques such as Support Vector Machine (SVM) [18, 22, 16], Random Forest
(RF) [23] or recently introduced Deep Learning (DL) [26, 7, 36]. In this paper
we focus on TAs and DL as they are the most widely used options in practice
[54, 24].

Figure 1:  Scheme of a generic Profiling Attack

###  2.1 Template Attacks

Template attacks are the first type of profiling attacks introduced and they
involve building a multivariate model of the probability distribution of the
leakage. The practice is to use an extensive set of power traces taken from
the DUT when it is manipulating some intermediate value $v=f(p,k)$. As long as
$v$ is related to a known variable (usually plaintext $p$ or ciphertext $c$)
and the secret key $k$, guessing $v$ allows the attacker to disclose the
secret key.

First, in the profiling phase, the attacker employs a set of $n_{p}$ profiling
traces ($\mathbf{T}_{p}$) to build a Gaussian multivariate model, for each
possible $v$, creating the so-called templates (pairs of mean vectors and a
covariance matrices $(\mathbf{m},\mathbf{C})$). Note that, as each $v$ depend
on $d$ and $k$, each key hypothesis suggests a template. Finally, a
discriminant score $D\left(k\mid\mathbf{t}_{i}\right)$ is computed for each
key hypothesis $k_{j}$ and all key hypothesis are graded in decreasing order
of probability, creating a key guessing vector. In SCA, it is common to work
with a metric called Guessing Entropy ($ge$) [45], which is the average rank
of the correct candidate $k^{*}$ after several attacks.

In practice, TAs pose several limitations such as complexity issues or the
need for dimensionality reduction [10]. The latter is often fixed by choosing
just a few time samples of the power traces (POIs selection [37]), or
employing a more complex technique like Principal Component Analysis (PCA) [1,
44] or Fisher’s Linear Discriminant Analysis (LDA) [19, 12]). Note that, with
EDA-based PA, the POI selection is performed automatically by the algorithm
[40].

###  2.2 DL-based SCA

In recent times, multiple papers related to DL-based SCA have been published.
The approach is the same as for template attacks, but the model building and
classification are performed using neural networks. Most of these works rely
on two typical deep learning architectures: Multilayer Perceptron (MLP) and
Convolutional Neural Networks (CNN). The early architecture used in DL-SCA for
its simplicity was MLP. The first proposal was applying regression to
characterize leakage [51] but the approach rapidly evolved to use MLP as a
classifier for intermediate values of the traces [26, 29, 30]. After this,
CNNs also began to be used because its spatial invariance property provides
robustness against data distortions like environmental noise,
desynchronization and countermeasures [30, 26, 7, 15, 4, 36]. Other studies
have examined the performance of various PAs [54, 36, 4, 52].

As stated above, one of the major drawbacks of classical SCA is the need for
pre-processing and POI selection, as this part is strongly dependent on human
engineering. DL-SCA claims to overcome those struggles, since the features are
selected automatically from traces by the neural network. In any case, note
that although this part of the problem may be mitigated, working with neural
networks is a complex process that also requires human interaction for
architecture selection, tuning and training of the neural networks to operate
correctly.

###  2.3 Masking protected implementations

SCA countermeasures try to obfuscate the dependency between the power
consumption of the DUT and the intermediate values of the implemented
cryptographic algorithm. One of the most popular ones is masking [27]. Masking
(also known as secret sharing) comprise concealing each intermediate value $v$
with a random value $m$ (mask), which is different for each execution and
unknown by the attacker, such as $v_{m}=v*m$. If correctly implemented, this
ensures pairwise independence between masked values, unmasked values and the
masks. Consequently, a classical (first-order) Differential Power Analysis
(DPA [21]) attack would fail.

Although theoretically sound, implementing masking incorrectly can be fatal
for a device’s security. Close manipulation of the shares can provoke
unintended interactions between values in the microcontroller, principally
caused by transitional effects [3] and glitches [9, 28]. These phenomena can
halve the security order, making the first order masking (with two shares or
mask and masked intermediate value) vulnerable even to first-order attacks
[3]. This is important since this is the most widely used scheme in practice,
because of the complexities involved in higher-order masking [43].

##  3 Related Work

###  3.1 EDA-based SCA

The usage of Estimation of Distribution Algorithms (EDAs) in the SCA context
was introduced in [40] as an alternative to adjust the POI selection and
perform template attacks over embedded devices in an automated way. EDAs are a
class of population based optimization heuristics that explore potential
results by forming explicit probabilistic models of promising candidates. The
approach is to seek in the space shaped for all groupings of POIs for the best
ones. Instead of an exhaustive enumeration of all possible combinations, this
method performs a search based on a quality measure combined with EDAs.

In a nutshell, in the first place, an initial population of $R$ individuals
(POI selection candidates) is generated. This population can be generated at
random or according to some criterion (i.e., assigning a higher probability to
samples that present a stronger correlation with the processed intermediate
values [40]). After this, $R$ attacks are performed with the $R$ candidates
and the candidates are rated according to their performance. Then, the best
$N$ candidates are chosen ($N<R$) and the probability distribution
$p(\mathbf{x})$ of potential candidates is estimated from them. The process is
repeated until a stop condition is reached (see [40] for more details).

Although they present several advantages against DL, the authors of [40, 39]
have contrasted it with other classical (manual) POI selection techniques but
have never compared it directly with DL-based attacks. Thus, in this paper, we
compare both techniques on various datasets, in terms of performance and
complexity.

###  3.2 Profiling Attacks on Masking

On the one hand, although PAs are a derivative of DPA attacks, many papers
claim that (first-order) DL-based SCA attacks can deal with masking
countermeasures [14, 26, 4, 47]. The claim is that, in these attacks, the
network is trained without mask information (the traces are labelled with the
unmasked intermediate value $v$). Despite this, as deep neural networks can
implement highly complex functions, they might be able to guess the correct
key without needing this information, and consequently, bypassing masking
[35].

This is remarkable since, with classical TAs, when the mask value is unknown
to the attacker during the profiling step, the leakages associated with a key
follow a multimodal distribution. This leads to assumption errors whether the
adversary exploits Gaussian template attacks, as confirmed in [24]. For this
reason, some previous works apply TAs combined with second-order techniques
and template-based DPA attacks with extra calculation considering the masks to
succeed [32]. When the attacker has such strong capabilities (i.e., knows the
key and the masks during profiling), it is considered a worst-case scenario
[2, 6, 5].

Nonetheless, as mentioned above, if masking is not properly implemented the
implementation can be vulnerable to first-order attacks: It is important to
ensure that the two parts of the same secret (mask and masked intermediate
value) are not handled too closely [43]. For instance, authors in [54] claim
that when the mask leakage is included in the observation time window, (first-
order) TAs can relate the dependence between the mask and the masked variable
leakage. Many other related works perform TAs over masked implementation
without mask information [20, 4, 40, 39]. This allows for a more “realistic”
(real-world) attack.

To the best of our knowledge, most of the results obtained with DL perform the
attack in a weak setting (mask leakage in the attacked window and/or
unintended interactions). This is partly because most of the results on DL-
based SCAs are based on the ASCAD [4] dataset, in which there exist mask
leakage in the targeted window, indicating possible unintended interactions.
Thus, it is not clear that state-of-the-art CNNs have any advantage over TAs
in these conditions, since both can circumvent masking. It is also unclear
whether the attack works because of the presence of mask leakage or unintended
interactions.

In any case, the authors of [39], published a dataset containing traces from
masking implementations with and without mask leakage, but they only use EDA-
based attacks. In this paper, we perform DL-based attacks on that dataset
trying to determine whether DL-based attacks can bypass masking on both
conditions or, on the contrary, current CNNs do not have any advantage in this
scenario111Note that a second-order attack (combining the leakage of two bytes
of the key at a time to remove the mask) is feasible in both situations [39]..

##  4 Experimental Comparison

In this section, we compare the performance of EDAs and DL-based attacks on
two open datasets: ASCAD [4] and AES_RA [39].

###  4.1 ASCAD Random Keys

ASCAD [4] was the early open database for DL-SCA, and has become a standard
for experimentation with DL in SCA, with many papers using it appearing every
year [52, 48, 39, 38, 31, 50, 17, 53]. The DUT in this data set is an 8-Bit
AVR microcontroller (ATmega8515), and includes EM emanation traces of the
device implementing a masked AES-128 cipher [11, 27]. The dataset is divided
into two parts, fixed key and variable key. Although many works employ the
fixed key version because it is an easier problem, for this comparison, we
focus on the variable key subset because it is a more challenging and
realistic experiment. The traces represent a window of 1400 relevant samples
per trace, corresponding to the third byte of the first round masked S-Box
operation. As the sensitive intermediate value it is common to use an S-box
output: $Y^{(i)}(k^{*})=Sbox[P_{3}^{(i)}\oplus k^{*}]$. For a deeper
explanation of the ASCAD dataset, we refer to [4].

For this dataset there exist published papers using both DL [34, 49, 38] and
EDAs [39]. Thus, we have focused on these works without performing additional
experiments, allowing an objective and unbiased view. Table 1 summarizes the
best published attacks against ASCAD, in terms of trainable parameters and
$ge$. As usual in the field, for $ge$ we utilize $\bar{Q}_{t_{ge}}$, or the
average number of traces needed to obtain a $ge$ of 0.

ASCAD Random |  [34] Best CNN |  [49] Best CNN |  [38] Best CNN |  [38] Best CNN (RS) |  [39] Best EDA
---|---|---|---|---|---
Trainable Param. | N/A | 2 076 744 | 70 492 | 3 298 | 1 400
$\mathbf{\bar{Q}_{t_{ge}}}$ | 105 | 1 568 | 490 | 1 018 | 150

Table 1: Top results with PAs on ASCAD random

Overall, we can see how despite being easier to execute, EDA-based PAs are
able to provide better results (smaller $\bar{Q}_{t_{ge}}$) of than most CNNs
on ASCAD (random key), being a more practical and simpler option for
evaluators.

In terms of trainable parameters, the EDA-Based TA is also less demanding (one
per time sample). Note that apart from the number of trainable parameters,
with DL there is a huge number of possible architectures and hence hyper-
parameters to select and adjust. Conversely, the EDA-based approach has a far
narrower number of parameters to tune (# iterations, population size and
evaluation function). Finally, the complexity of the “training” itself is
again lighter in an EDA-based attack: The time complexity of the EDA (UMDA) is
$O(n)$ [40] whereas the time complexity of a backpropagation algorithm is much
larger ($O(n^{5})$ according to [13]).

###  4.2 AES_RA

AES_RA was introduced in [39] and contains traces from two distinct embedded
systems which use microcontrollers from the same family (Piñata training board
from Riscure [41] and STM32F411E-DISCO development board [46]). With each
device, authors acquire traces from three AES implementations: an unprotected
software AES implementation and two masking schemes, resulting in six
different setups. Thus, this dataset is divided into two parts: power
consumption traces from the Piñata board and capacitor EM power traces from
the STM32F411E-Discovery Board. Whereas power traces correspond to clean
(noise-free) measurements, EM traces represent a more challenging problem (due
to noise). Regarding the implementation, the authors show how masked scheme 1
(MS1 from now on) is completely weak against (first-order) PAs, as the mask
leaks in the same time window as the masked intermediate value (SBox output).
Conversely, masked scheme 2 (MS2) contains only intermediate value leakage in
the targeted time window, and hence, this implementation is robust against
(first-order) PAs. For more details, we refer to the original paper [39].

In this work, we perform DL-based experiments on the dataset, confirming that
the same conclusions are obtained as in [39] with EDAs on the different
masking schemes and configurations.

####  4.2.1 Experimental configuration

We have performed several DL-based attacks on each protected implementation
using some (pre-defined) CNN architectures. These architectures were not
created for this specific dataset, and hence, good outcomes are not
guaranteed. Nevertheless, all were designed for ASCAD, which represents a
problem analogous to MS1 (mask leakage on the targeted window). Thus, some
CNNs shall succeed, especially considering that MS1 is particularly weak on
Piñata (secret key can be recovered with about 5 traces using TAs). This also
gives us a clue about how difficult it is to attack a similar dataset with a
pre-defined architecture. Regarding trainable parameters, we have selected
complex and simple CNNs in order to have a wide range of results (see Table
2).

More precisely, we have used the architecture for ASCAD random key suggested
in the original paper [4], four CNNs from [38], the architecture from [52] for
ASCAD fixed key and an improved version introduced in [33]:

  * •

CNN1: From the original paper [4].

  * •

CNN2: From [52], for ASCAD Fixed.

  * •

CNN3: From [33], for ASCAD Fixed.

  * •

CNN4: From [38], ASCAD Random (HW)

  * •

CNN5: From [38], ASCAD Random RS (HW)

  * •

CNN6: From [38], ASCAD Fixed (HW)

  * •

CNN7: From [38], ASCAD Fixed RS (HW)

For all of them, we have used the hyper-parameters as in the original
articles, except for the number of epochs. We have repeated the experiments
with 50 and 75 epochs to ensure that poor results are not obtained because of
underfitting/overfitting.

####  4.2.2 Experimental results

Figures 2, 3, 4 and 5 show the averaged $ge$ of the correct key byte for all
CNNs and setups (for 50 and 75 epochs respectively), and also the results
using EDA-based PAs. This averaged $ge$ represents the average of 10 attacks
using the same model, cross-validated to avoid bias. Also, Table 2 shows the
number of trainable parameters of each architecture, and the
$\bar{Q}_{t_{ge}}$ of successful attacks. Note that although MS1 is especially
weak on Piñata, some neural networks could not disclose the key.

AES_RA |  CNN1 |  CNN2 |  CNN3 |  CNN4 |  CNN5 |  CNN6 |  CNN7 |  EDA
---|---|---|---|---|---|---|---|---
Trainable Param. |  70 846 848 |  32 960 |  33 070 |  78 172 |  3 418 |  3 471 |  1 394 |  1 500
$\mathbf{\bar{Q}_{t_{ge}}}$(Piñata-MS1) |  27 |  8 |  6 |  113 |  34 |  - |  - |  5
$\mathbf{\bar{Q}_{t_{ge}}}$(STM32-MS1) |  - |  1 867 |  1 222 |  - |  - |  - |  - |  850

Table 2: Top results with PAs on AES_RA

In addition, the results with DL-based SCA are more variable in general. To
show this, Figures 2, 3, 4 and 5 also include Box Plots. These plots represent
the variation of the final $ge$ values of each one of the 10 attacks (for each
model). In them, the dispersion and the median of the final values can be
easily identified, besides clearly distinguishing whether there are outliers.
This helps us to determine how precise is the model.

(a)  (b)

(c)  (d)

Figure 2:  Experimental results (Averaged $ge$ and Box Plot of final $ge$
values) on AES_RA - Piñata [50 Epochs]

(a)  (b)

(c)  (d)

Figure 3:  Experimental results (Averaged $ge$ and Box Plot of final $ge$
values) on AES_RA - STM32F4 [50 Epochs]

(a)  (b)

(c)  (d)

Figure 4:  Experimental results (Averaged $ge$ and Box Plot of final $ge$
values) on AES_RA - Piñata [75 Epochs]

(a)  (b)

(c)  (d)

Figure 5:  Experimental results (Averaged $ge$ and Box Plot of final $ge$
values) on AES_RA - STM32F4 [75 Epochs]

##  5 Discussion

In terms of $ge$, similar outcomes can be achieved with both methods.
Nevertheless, it should be noticed that we have only been able to achieve the
results reached with EDAs with some CNNs. In addition, as the Box Plots show,
the outcomes are in general more variable when using CNNs in our experiments.
Also note that although these CNNs were designed for a similar dataset, they
usually require human engineering to succeed.

Our comparison shows that EDA-based attacks have some advantages over the DL
approach:

  * •

Simplicity: fewer parameters to tune (i.e., hyperparameters), trainable
parameters, and lighter algorithmic complexity.

  * •

Generalized solution: no need to re-tune the hyper-parameters when targeting
new devices, implementations, datasets, etc.

  * •

Greater control: we can give information about which time samples are expected
to be relevant (i.e., which ones have a stronger correlation with the
intermediate values).

  * •

Search (i.e., “Training”) based on the outcome of realistic key recovery
attacks, and not on minimizing a loss function.

  * •

The expressiveness and transparency of the probabilistic model that guides the
search [40].

On the other hand, we have also seen how a well trained DL model can usually
approach, or even beat, EDA-based TAs. In addition, training a neural network
today is a highly optimized process that can be performed relatively quickly
(thanks to the use of parallelization using GPUs) while EDA-based attacks have
a long way to go to reach these levels of optimization. However, EDA-based PAs
are far less complex than DL in terms of algorithmic complexity. This,
together with the fact that several ways of optimizing them have already been
identified [40] (e.g., attack parallelization, attack computation
optimization, etc.), means that they could become as efficient or even more
efficient than DL. Conversely, TAs work with a Gaussian assumption, whereas ML
models do not assume the probability density function of the data [25].
Nevertheless, note that ML models could also be employed with the EDA
approach, although authors chose TA for demonstrating their approach in [40].

##  6 Conclusions and Future work

From this analysis, we draw the same conclusions about MS1 and MS2 as in [39]:
we recovered the secret key on MS1 using several predefined CNN architectures
but not on MS2. This shows that both TAs and DL can circumvent masking in
schemes like ASCAD or MS1, as some previous works have also shown [20, 4, 54].
However, determining whether more complex CNNs or (EDA-based) PAs can actually
bypass masking under unfavourable conditions (no mask leakage in the attacked
window and/or no unintended interactions) is beyond the scope of this paper,
we believe it is an interesting research question for future work.

Concluding, as we intend to show in this paper, both alternatives can provide
similar results, with EDA-based attacks being a simpler and more
straightforward alternative that can represent a very efficient and
interpretable shortcut for evaluators.

## References

  * [1] Archambeau, C., Peeters, E., Standaert, F.X., Quisquater, J.J.: Template attacks in principal subspaces. In: Cryptographic Hardware and Embedded Systems - CHES 2006. vol. 4249, pp. 1–14. Springer (October 2006)
  * [2] Azouaoui, M., Bellizia, D., Buhan, I., Debande, N., Duval, S., Giraud, C., Jaulmes, E., Koeune, F., Oswald, E., Standaert, F.X., Whitnall, C.: A systematic appraisal of side channel evaluation strategies. IACR Cryptol. ePrint Arch. (2020)
  * [3] Balasch, J., Gierlichs, B., Grosso, V., Reparaz, O., Standaert, F.X.: On the cost of lazy engineering for masked software implementations. vol. 8968, pp. 64–81. Joye, Marc, Springer-Verlag (2014)
  * [4] Benadjila, R., Prouff, E., Strullu, R., Cagli, E., Dumas, C.: Deep learning for side-channel analysis and introduction to ASCAD database. Journal of Cryptographic Engineering 10 (06 2020)
  * [5] Bronchain, O., Cassiers, G., Standaert, F.X.: Give me 5 minutes: Attacking ascad with a single side-channel trace. IACR Cryptol. ePrint Arch. (2021)
  * [6] Bronchain, O., Standaert, F.X.: Breaking masked implementations with many shares on 32-bit software platforms: or when the security order does not matter. IACR Transactions on Cryptographic Hardware and Embedded Systems 2021(3), 202–234 (Jul 2021)
  * [7] Cagli, E., Dumas, C., Prouff, E.: Convolutional neural networks with data augmentation against jitter-based countermeasures. In: Fischer, W., Homma, N. (eds.) CHES 2017. pp. 45–68. Springer (2017)
  * [8] Chari, S., Rao, J.R., Rohatgi, P.: Template Attacks. In: Cryptographic Hardware and Embedded Systems - CHES 2002. pp. 13–28. Springer (2002)
  * [9] Chen, Z., Haider, S., Schaumont, P.: Side-channel leakage in masked circuits caused by higher-order circuit effects. In: Park, J.H., Chen, H.H., Atiquzzaman, M., Lee, C., Kim, T.h., Yeo, S.S. (eds.) Advances in Information Security and Assurance. pp. 327–336. Springer Berlin Heidelberg, Berlin, Heidelberg (2009)
  * [10] Choudary, M.O., Kuhn, M.G.: Efficient, Portable Template Attacks. IEEE Transactions on Information Forensics and Security 13(2), 490–501 (Feb 2018)
  * [11] Federal Information Processing Standard: FIPS 197: Announcing the Advanced Encryption Standard (AES) (November 2001). https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf (2001)
  * [12] Fisher, R.: The statistical utilization of multiple measurements. Annals of Eugenics (Cambridge) 8, 376–386 (November 1935)
  * [13] Fred, K.: Computational complexity of neural networks. https://kasperfred.com/series/introduction-to-neural-networks/computational-complexity-of-neural-networks (2020)
  * [14] Gilmore, R., Hanley, N., O’Neill, M.: Neural network based attack on a masked implementation of aes. Proceedings of the 2015 IEEE International Symposium on Hardware-Oriented Security and Trust, HOST 2015 pp. 106–111 (06 2015)
  * [15] Hettwer, B., Gehrer, S., Güneysu, T.: Profiled power analysis attacks using convolutional neural networks with domain knowledge. In: Selected Areas in Cryptography - SAC 2018 - 25th International Conference, Calgary, AB, Canada, August 15-17, 2018. pp. 479–498 (2018)
  * [16] Heuser, A., Zohner, M.: Intelligent machine homicide. In: Constructive Side-Channel Analysis and Secure Design. pp. 249–264. Springer, Heidelberg (2012)
  * [17] Hoang, A.T., Hanley, N., O’Neill, M.: Plaintext: A missing feature for enhancing the power of deep learning in side-channel analysis? breaking multiple layers of side-channel countermeasures. IACR Transactions on Cryptographic Hardware and Embedded Systems 2020(4), 49–85 (Aug 2020)
  * [18] Hospodar, G., Gierlichs, B., De Mulder, E., Verbauwhede, I., Vandewalle, J.: Machine learning in side-channel analysis: a first study. J. Cryptographic Engineering 1, 293–302 (Oct 2011)
  * [19] Johnson, R., Wichern, D.: Applied multivariate statistical analysis. Springer, Berlin, Heidelberg, Upper Saddle River, NJ, 5 edn. (2015)
  * [20] Kim, J., Picek, S., Heuser, A., Bhasin, S., Hanjalic, A.: Make some noise. unleashing the power of convolutional neural networks for profiled side-channel analysis. IACR Transactions on Cryptographic Hardware and Embedded Systems 2019(3), 148–179 (May 2019)
  * [21] Kocher, P., Jaffe, J., Jun, B.: Differential power analysis. In: Wiener, M. (ed.) Advances in Cryptology — CRYPTO’ 99. pp. 388–397. Springer Berlin Heidelberg, Berlin, Heidelberg (1999)
  * [22] Lerman, L., Bontempi, G., Markowitch, O.: Side channel attack : an approach based on machine learning. In: Constructive Side-Channel Analysis and Secure Design, COSADE. pp. 29–41 (2011)
  * [23] Lerman, L., Bontempi, G., Markowitch, O.: A machine learning approach against a masked aes. Journal of Cryptographic Engineering 5(2), 123–139 (Jun 2015)
  * [24] Lerman, L., Poussier, R., Markowitch, O., Standaert, F.X.: Template attacks versus machine learning revisited and the curse of dimensionality in side-channel analysis: extended version. Journal of Cryptographic Engineering 8 (11 2018)
  * [25] Maghrebi, H.: Deep learning based side-channel attack: a new profiling methodology based on multi-label classification. IACR Cryptol. ePrint Arch. (2020)
  * [26] Maghrebi, H., Portigliatti, T., Prouff, E.: Breaking cryptographic implementations using deep learning techniques. In: SPACE 2016 (December 2016)
  * [27] Mangard, S., Oswald, E., Popp, T.: Power Analysis Attacks: Revealing the Secrets of Smart Cards (Advances in Information Security). Springer-Verlag, Berlin, Heidelberg (2007)
  * [28] Mangard, S., Popp, T., Gammel, B.M.: Side-channel leakage of masked cmos gates. In: Menezes, A. (ed.) Topics in Cryptology – CT-RSA 2005. pp. 351–365. Springer Berlin Heidelberg, Berlin, Heidelberg (2005)
  * [29] Martinasek, Z., Malina, L.: Comparison of profiling power analysis attacks using templates and multi-layer perceptron network (01 2014)
  * [30] Martinasek, Z., Malina, L., Trasy, K.: Profiling power analysis attack based on multi-layer perceptron network. In: Computational Problems in Science and Engineering, pp. 317–339. Springer (2015)
  * [31] Masure, L., Dumas, C., Prouff, E.: A comprehensive study of deep learning for side-channel analysis. Transactions on Cryptographic Hardware and Embedded Systems 2020 (11 2019)
  * [32] Oswald, E., Mangard, S.: Template attacks on masking—resistance is futile. In: CT-RSA 2007: Topics in Cryptology. vol. 4377, pp. 243–256 (02 2007)
  * [33] Paguada, S., Rioja, U., Armendariz, I.: Controlling the deep learning-based side-channel analysis: A way to leverage from heuristics. In: ACNS Workshops (2020)
  * [34] Perin, G., Chmielewski, L., Picek, S.: Strength in numbers: Improving generalization with ensembles in machine learning-based profiled side-channel analysis. IACR Transactions on Cryptographic Hardware and Embedded Systems 2020(4), 337–364 (Aug 2020)
  * [35] Perin, G., Ege, B.: Lowering the bar: Deep learning for side-channel analysis ( whitepaper ). In: Proc. BlackHat. pp. 1–15 (2018)
  * [36] Picek, S., Samiotis, I.P., Kim, J., Heuser, A., Bhasin, S., Legay, A.: On the performance of convolutional neural networks for side-channel analysis. In: Chattopadhyay, A., Rebeiro, C., Yarom, Y. (eds.) Security, Privacy, and Applied Cryptography Engineering. pp. 157–176. Springer International Publishing, Cham (2018)
  * [37] Rechberger, C., Oswald, E.: Practical template attacks. In: Lim, C.H., Yung, M. (eds.) Information Security Applications. pp. 440–456. Springer Berlin Heidelberg, Berlin, Heidelberg (2005)
  * [38] Rijsdijk, J., Wu, L., Perin, G., Picek, S.: Reinforcement learning for hyperparameter tuning in deep learning-based side-channel analysis. IACR Transactions on Cryptographic Hardware and Embedded Systems 2021(3), 677–707 (Jul 2021)
  * [39] Rioja, U., Batina, L., Armendariz, I., Flores, J.L.: Towards human dependency elimination: Ai approach to sca robustness assessment. IACR Cryptol. ePrint Arch., Report 2021/1316 (2021), https://ia.cr/2021/1316
  * [40] Rioja, U., Batina, L., Flores, J.L., Armendariz, I.: Auto-tune pois: Estimation of distribution algorithms for efficient side-channel analysis. Computer Networks 198, 108405 (2021)
  * [41] Riscure: Piñata board brochure. https://www.riscure.com/uploads/2017/07/pi%C3%B1ata_board_brochure.pdf
  * [42] Schindler, W., Lemke, K., Paar, C.: A stochastic model for differential side channel cryptanalysis. In: CHES 2005. pp. 30–46. Springer (2005)
  * [43] Shelton, M., Samwel, N., Batina, L., Regazzoni, F., Wagner, M., Yarom, Y.: Rosita: Towards automatic elimination of power-analysis leakage in ciphers. In: NDSS Symposium (01 2021)
  * [44] Standaert, F.X., Archambeau, C.: Using subspace-based template attacks to compare and combine power and electromagnetic information leakages. In: Oswald, E., Rohatgi, P. (eds.) Cryptographic Hardware and Embedded Systems - CHES 2008. pp. 411–425. Springer, Heidelberg (2008)
  * [45] Standaert, F.X., Malkin, T.G., Yung, M.: A Unified Framework for the Analysis of Side-Channel Key Recovery Attacks. In: Advances in Cryptology - EUROCRYPT 2009\. pp. 443–461. Springer Berlin Heidelberg (2009)
  * [46] STMicroelectronics: STM32F411VET6 datasheet. https://www.alldatasheet.com/datasheet-pdf/pdf/929991/STMICROELECTRONICS/STM32F411VET6.html (Dec 2016)
  * [47] Timon, B.: Non-profiled deep learning-based side-channel attacks with sensitivity analysis. IACR Trans. Cryptogr. Hardw. Embed. Syst. 2019(2), 107–131 (2019)
  * [48] Wouters, L., Arribas, V., Gierlichs, B., Preneel, B.: Revisiting a methodology for efficient cnn architectures in profiling attacks. IACR Transactions on Cryptographic Hardware and Embedded Systems 2020(3), 147–168 (Jun 2020)
  * [49] Wu, L., Perin, G., Picek, S.: I choose you: Automated hyperparameter tuning for deep learning-based side-channel analysis. IACR Cryptol. ePrint Arch. p. 1293 (2020)
  * [50] Wu, L., Picek, S.: Remove some noise: On pre-processing of side-channel measurements with autoencoders. IACR Transactions on Cryptographic Hardware and Embedded Systems 2020(4), 389–415 (Aug 2020)
  * [51] Yang, S., Zhou, Y., Liu, J., Chen, D.: Back propagation neural network based leakage characterization for practical security analysis of cryptographic implementations. pp. 169–185 (11 2011)
  * [52] Zaid, G., Bossuet, L., Habrard, A., Venelli, A.: Methodology for Efficient CNN Architectures in Profiling Attacks. IACR Transactions on Cryptographic Hardware and Embedded Systems Volume 2020 (2019)
  * [53] Zhang, J., Zheng, M., Nan, J., Hu, H., Yu, N.: A novel evaluation metric for deep learning-based side channel analysis and its extended application to imbalanced data. IACR Transactions on Cryptographic Hardware and Embedded Systems 2020(3), 73–96 (Jun 2020)
  * [54] Zotkin, Y., Olivier, F., Bourbao, E.: Deep learning vs template attacks in front of fundamental targets: experimental study. IACR Cryptol. ePrint Arch. p. 1213 (2018)