Using Second-Order Power Analysis to Attack DPA Resistant Software

Under a simple power leakage model based on Hamming weight, a software implementation of a data-whitening routine is shown to be vulnerable to a first-order Differential Power Analysis (DPA) attack. This routine is modified to resist the first-order DPA attack, but is subsequently shown to be vulnerable to a second-order DPA attack. A second-order DPA attack that is optimal under certain assumptions is also proposed. Experimental results in an ST16 smartcard confirm the practicality of the first and second-order DPA attacks.

• Type: Conference
• Year: 2000
• Where: CHES
• Authors: Thomas S. Messerges
• Keywords: CHES 2000, Cryptology, First-order Dpa Attack, Second-order Dpa Attacks, Simple Power Leakage