Week 3: Reading a power trace

Differential power analysis, and why a device's current draw is close to a printout of the arithmetic it is doing

8 March 2027

A single measurement can be unreadable while ten thousand of the same measurement are decisive: statistics, not sensitivity, makes a channel practical.

Open the slides

A transistor draws a different amount of current depending on whether it switches from 0 to 1, from 1 to 0, or not at all, and a chip performing arithmetic is switching enormous numbers of transistors in a pattern that depends on the data it holds. Kocher, Jaffe and Jun’s 1999 paper “Differential Power Analysis” showed that this dependence survives measurement: recording a smart card’s power draw across many operations on known and unknown data, then statistically correlating the recordings against hypotheses about a secret key, recovers the key without ever touching the card’s logic directly.

The technique’s importance is less the specific key it recovered than the method: a single trace is close to unreadable by eye once the device is doing real work, but the statistical correlation across thousands of traces turns noise into signal in a way no single measurement could. This week’s deck walks through one trace slowly enough to see the shape a single squaring operation and a single multiply produce, before the Bench and the Trace Analysis Lab ask you to do the harder version — many traces, added together — yourself.

If the attack is statistical, the defence has to attack the statistics rather than the measurement. Chari, Jutla, Rao and Rohatgi presented that argument at the same 1999 conference as Kocher: split every secret intermediate value into several shares that are individually uniform and only jointly meaningful, so that no single point in the trace depends on the secret and the correlation has nothing stable to find. What they proved is a bound, not immunity — the number of traces an attacker needs grows exponentially in the number of shares — and that is the shape every countermeasure in this course takes. Not “the leak is gone” but “the leak now costs this much.”

The cost of masking is paid in silicon. Each share is another copy of the datapath and another demand on a random-number source that has to stay independent under load, which is why Mangard, Oswald and Popp’s 2007 textbook pairs its chapter on masking with a chapter on attacking masked implementations: glitches in combinational logic, shares that recombine early in a shared register, randomness too weak to keep them apart. A masked chip is a claim about area, throughput and a random source, and it is falsifiable by measurement. Week 11 asks the harder version of the same question — what is left when the hardware is already fabricated and the only thing you can change is the code.

Outline#

• what a power trace looks like for a single, known operation, and the point at which a real workload stops being readable by eye
• the step from simple power analysis to differential: what the correlation is computed over, and why the number of traces is the attacker’s real budget
• masking and blinding — randomising the intermediate values so that the correlation has nothing stable to find — and what that randomisation costs in silicon area and throughput

Readings

1. Paul Kocher, Joshua Jaffe and Benjamin Jun (1999). Differential Power Analysis. CRYPTO '99, LNCS 1666, 388-397.
2. Suresh Chari, Charanjit S. Jutla, Josyula R. Rao and Pankaj Rohatgi (1999). Towards Sound Approaches to Counteract Power-Analysis Attacks. CRYPTO '99, LNCS 1666, 398-412.
3. Stefan Mangard, Elisabeth Oswald and Thomas Popp (2007). Power Analysis Attacks: Revealing the Secrets of Smart Cards. Springer, chapters 6-9 on countermeasures.