Hardware Security Day 3 – Side-Channel Analysis and HW3

Week 5 and HW3 flashcards covering simple power analysis (SPA), differential power analysis (DPA), timing leakage, and electromagnetic (EM) leakage. Practice calculating a difference of means, interpreting the HW3 CPU power trace, and distinguishing side channels from covert channels.

Power side channel

Power consumption can reveal what a device is doing because different operations and data values can cause different switching activity.

Power trace

A series of power measurements over time. Sustained changes can reveal when a workload starts or stops.

Dynamic power

Power associated with circuit switching. It generally rises with switching activity and depends on voltage and clock frequency.

Hamming weight

The number of 1 bits in a value. The Hamming weight of 1111 is 4.

Hamming distance

The number of bit positions that differ between two values. The Hamming distance from 1010 to 1111 is 2.

Leakage model

A prediction of how an internal value or transition affects a measurable signal. Hamming weight and Hamming distance are two common models.

Simple power analysis (SPA)

Examining visible patterns in one or a few power traces to identify operations or differences in execution.

SPA and square-and-multiply

If a multiply occurs only for certain secret exponent bits and has a distinct power signature then the operation pattern can reveal information about those bits.

Differential power analysis (DPA)

A statistical method that compares groups of power traces based on predicted intermediate values for a candidate subkey.

SPA vs. DPA

SPA looks for visible operation patterns. DPA combines many traces to detect smaller differences linked to predicted data values.

Intermediate value

A value computed partway through an algorithm. Some intermediates depend on both known input or output data and a portion of the key.

DPA selection bit

A predicted bit of an intermediate value used to split traces into two groups for a candidate subkey.

DPA difference of means

At each time sample subtract the mean of the predicted-bit-0 group from the mean of the predicted-bit-1 group.

DPA practice calculation

If the bit-1 samples are 10 and 12 and the bit-0 samples are 6 and 8 then the difference of means is 11 − 7 = 4.

DPA peak interpretation

A repeatable peak near the relevant operation supports a key guess. Compare competing guesses because noise can also produce peaks.

Divide-and-conquer in power analysis

Analyze an intermediate that depends on only part of the key so each subkey chunk can be tested separately.

DES S-box subkey example

A single DES S-box takes six key-dependent input bits. That gives 2^6 = 64 possible guesses for that subkey chunk.

Trace alignment

Matching corresponding operations across traces so averaging preserves a consistent signal instead of spreading it across time samples.

Correlation power analysis (CPA)

A method that compares numerical leakage predictions for each key guess with measured trace samples using correlation.

DPA vs. CPA

Classic difference-of-means DPA splits traces using a predicted bit. CPA measures how closely numerical leakage predictions track observed samples.

Timing leakage

Information revealed when the time an operation takes depends on sensitive data.

Sources of timing leakage

Secret-dependent branches or memory accesses or arithmetic operations can change how long a computation takes.

Constant-time implementation

Code designed to avoid secret-dependent execution time and memory access patterns.

Electromagnetic leakage

Information carried by electromagnetic emissions generated as a device operates.

Electromagnetic analysis (EMA)

Studying measured electromagnetic emissions to infer device activity. Probe placement can help distinguish activity in different regions of a chip.

Power measurement vs. EM measurement

Package power reflects aggregate activity. A localized EM measurement can emphasize activity near the probe.

Masking

Randomizing how sensitive intermediate values are represented so individual measurements reveal less about the secret.

Blinding

Randomizing inputs or related arithmetic while preserving the correct final result to reduce predictable leakage.

Noise and jitter as defenses

Noise can obscure signal amplitude and jitter can shift operations in time. More traces or better alignment can reduce their effect.

EM shielding

A physical defense that reduces electromagnetic emissions available to an external observer.

HW3 idle power

The report visually estimated average idle CPU package power at about 35 W.

HW3 workload power

The report visually estimated average busy CPU package power at about 63 W. Power briefly reached about 70 W near workload onset.

HW3 power increase

The estimated average increase was about 28 W because 63 W − 35 W = 28 W.

HW3 workload timing

Power rose near 20 seconds and dropped back near idle around 40 seconds.

HW3 sources of power variation

Background processes and automatic changes in CPU voltage and clock frequency can make package power vary within a phase.

HW3 side-channel interpretation

An observer can use a sustained rise and fall in package power to infer when a workload ran.

HW3 covert-channel interpretation

A sender deliberately runs a busy workload for a 1 and stays mostly idle for a 0 during agreed time slots.

Power threshold decoding

Average the power within each time slot and compare it with the agreed threshold. With above 50 W meaning 1 the sequence 62 W → 35 W → 64 W decodes to 101.

Side channel vs. covert channel in HW3

Inferring workload activity from power is a side channel. Intentionally changing activity to send bits through power is a covert channel.