A High-Resolution Phase-Based Waveform Matching and Its Application to Side-Channel Attacks

Transcription

1 IEICE TRANS. FUNDAMENTALS, VOL.Exx??, NO.xx XXXX 2x PAPER Special Sectio o Cryptography ad Iformatio Security A High-Resolutio Phase-Based Waveform Matchig ad Its Applicatio to Side-Chael Attacks Naofumi HOMMA a), Member, SeiNAGASHIMA, Takeshi SUGAWARA, Nomembers, Takafumi AOKI, ad Akashi SATOH, Members SUMMARY This paper presets a ehaced side-chael attack usig a phase-based waveform matchig techique. Covetioally, side chael attacks such as Simple Power Aalysis (SPA) ad Differetial Power Aalysis (DPA) capture sigal waveforms (e.g., power traces) with a trigger sigal or a system clock, ad use a statistical aalysis of the waveforms to reduce oise ad to retrieve secret iformatio. However, the waveform data ofte icludes displacemet errors, ad this degrades the accuracy of the statistical aalysis. The use of a Phase-Oly Correlatio (POC) techique eables to estimate the displacemets betwee the sigal waveforms with higher resolutio tha the samplig resolutio. The accuracy of side-chael attacks ca be ehaced usig the POC-based matchig method. Also, a popular DPA coutermeasure creatig distorted waveforms with radom delays ca be defeated by our method. I this paper, we demostrate the advatages of the proposed method i compariso with covetioal approaches through experimetal DPA ad Differetial ElectroMagetic Aalysis (DEMA) agaist DES software ad hardware implemetatios. key words: side-chael attacks, DPA, DEMA, cryptographic module, waveform matchig, phase-oly correlatio.. Itroductio Cryptaalysis based o side-chael iformatio is of major cocer for desigers of smartcards ad other embedded cryptosystems. Whe a cryptographic module performs ecryptio or decryptio, secret parameters correlated to the itermediate data beig processed would leak via power dissipatio [], [2], electromagetic radiatio [3], or operatig times as sidechael iformatio. These are ow essetial issues for the evaluatio of tamper-resistace devices. Amog them, power aalysis attacks such as Differetial Power Aalysis (DPA) [2] are attractig much attetio due to their powerful properties. I geeral, a side-chael attack requires a statistical aalysis of waveforms (e.g., power traces) to reduce oise ad to retrieve secret iformatio. The importat Mauscript received Jauary, 23. Mauscript revised Jauary, 23. Fial mauscript received Jauary, 23. The authors are with the Departmet of Computer ad Mathematical Scieces, Graduate School of Iformatio Scieces, Tohoku Uiversity, 6-6-5, Aramaki Aza Aoba, Sedai, Japa. The author is with IBM Research, Tokyo Research Laboratory, IBM Japa, Ltd Shimo-tsuruma, Yamatoshi, Kaagawa, 2-852, Japa a) homma@aoki.ecei.tohoku.ac.jp assumptio here is that each waveform is captured by a digital measurig device at the exact momet as the correspodig cryptographic computatio. However, it is almost impossible to time exactly whe the data was captured for cryptographic modules i actual applicatios because there is o trigger sigal precisely sychroized with the cryptographic computatio. Eve if a trigger sigal is available, it ofte cotais jitterrelated deviatios from the true timig of the ecryptio process. Also, some coutermeasures creatig distorted waveforms with radom delays, dummy cycles, or ustable clockig are beig proposed for reducig the impact of statistical aalysis [4][5]. As a result, the measured waveforms always iclude displacemet errors. The displacemet errors would cause sigificat loss of the secret iformatio whe the waveforms are averaged together for the statistical aalysis. Some approaches dealig with the displacemets i waveforms were proposed [6], [7]. I a theoretical model, Differetial Power Aalysis (DPA) with the fast Fourier trasform of the power waveforms is itroduced to correct the displacemet errors [6]. Referece [7], o the other had, demostrated a practical approach to aalyze Rijdael ad ECC o a Java-based wireless PDA. The reported methods were performed i the frequecy domai, ad thus it would be very difficult to use them i collaboratio with other side-chael attacks i the time domai. Addressig the displacemet problem, we propose a high-resolutio waveform matchig method usig a Phase-Oly Correlatio (POC) fuctio. POC techiques have bee successfully applied to high-accuracy image matchig tasks [8]-[]. The POC fuctio employs phase compoets i the discrete Fourier trasforms of waveforms, ad makes it possible to determie displacemet errors betwee sigal waveforms with high oise tolerace by usig the locatio of the correlatio peak. By fittig the aalytical model of the correlatio peak to the actual umerical data, we ca evaluate the displacemet errors with a higher resolutio tha the samplig resolutio [2]. This paper presets a high-resolutio side-chael attack usig POC-based waveform matchig. The essece of the proposed method is to use the POCbased waveform matchig as a preprocessig step followed by stadard aalysis. We demostrate its adva-

2 2 IEICE TRANS. FUNDAMENTALS, VOL.Exx??, NO.xx XXXX 2x f ( ) (c) g ( ) (d) Fig. Displacemet estimatio usig POC fuctio: Origial waveform, Displaced versio of the origial waveform, (c) POC fuctio, ad (d) Fuctio fittig for estimatig peak positio. tages over covetioal methods through experimetal aalysis of DPA ad Differetial ElectroMagetic Aalysis (DEMA) agaist DES software ad hardware implemetatios. I this experimet, the POC-based matchig successfully improves the DPA ad DEMA eve if the measure waveforms iclude the oise compoets of -5 db sigal-to-oise ratio. I additio, our method ca defeat a popular coutermeasure creatig distorted waveform with radom delays. 2. High-resolutio waveform matchig usig Phase-Oly Correlatio 2. Phase-based waveform matchig Cosider two sigal waveforms, f() adg(), where we assume that the idex rage is = M,,M for mathematical simplicity, ad hece the legth of waveforms N =2M +. Let F (k) adg(k) deotethe Discrete Fourier Trasforms (DFTs) of the two waveforms. F (k) adg(k) aregiveby F (k) = G(k) = M = M M = M f()w k N = A F (k)e jθf (k), () g()w k N = A G(k)e jθg(k), (2) where W N = e j 2π N, A F (k) ada G (k) are amplitude compoets, ad e jθf (k) ad e jθg(k) are phase compoets. The cross-phase spectrum (or ormalized cross spectrum) R(k) is defied as R(k) = F (k)g(k) = e jθ(k), (3) F (k)g(k) where G(k) deotes the complex cojugate of G(k) ad θ(k) =θ F (k) θ G (k). The POC fuctio r() isthe Iverse Discrete Fourier Trasform (IDFT) of R(k)ad is give by r() = N M k= M R(k)W k N. (4) If there is a similarity betwee two waveforms, the POC fuctio gives a distict sharp peak. (Whe f() = g(), the POC fuctio becomes the Kroecker delta fuctio.) If ot, the peak drops sigificatly. The height of the peak ca be used as a good similarity measure for waveform matchig, ad the locatio of the peak shows the traslatioal displacemet betwee the two waveforms. Fig. shows a example of the POC fuctio, where ad are a example waveform ad a displaced versio of the waveform, respectively. Fig. (c) is the correspodig POC fuctio. Now cosider f c (t) as a waveform defied i cotiuous space with a real umber idex t. Let δ represets a displacemet of f c (t). So, the displaced waveform ca be represeted as f c (t δ). Assume that f() adg() are spatially sampled waveforms of f c (t) adf c (t δ), ad are defied as f() =f c (t) t=t, (5) g() =f c (t δ) t=t, (6) where T is the samplig iterval ad the idex rage is give by = M,,M. For simplicity, we assume T =. The cross-phase spectrum R(k) adthepoc

3 HOMMA et al.: A HIGH-RESOLUTION PHASE-BASED WAVEFORM MATCHING AND ITS APPLICATION TO SIDE-CHANNEL ATTACKS 3 fuctio r() betwee f() ad g() will be give by R(k) = r() = N F (k)g(k) e j 2π N kδ, (7) F (k)g(k) M k= M R(k)W k N α si {π ( + δ)} N si { π (8) N ( + δ)}, where α =. The above Eq. (8) represets the shape of the peak for the POC fuctio betwee the same waveforms that are slightly displaced with each other. This equatio gives a distict sharp peak. The peak positio δ of the POC fuctio correspods to the displacemet betwee the two waveforms. We ca prove that the peak value α decreases (without chagig the shape of the fuctio itself), whe small oise compoets are added to the origial waveforms. Hece, we assume α i practice. For the waveform matchig task, we evaluate the similarity betwee the two waveforms by the peak value α, ad estimate the displacemet by the peak positio δ. By calculatig the POC fuctio for two waveforms f()adg(), we ca obtai a umerical value of r() for each discrete idex, where = M,,M. Fig. (d) shows the POC fuctio aroud the correlatio peak, where the black dots idicate the discrete data values from r(). We use Eq. (8) (the closed-form peak model of the POC fuctio) directly to estimate the peak positio by fuctio fittig. The solid lie i Fig. (d) represets the estimated shape of the POC fuctio. Thus, it is possible to fid the locatio of the peak that may exist betwee samplig itervals by fittig the peak model to the calculated data aroud the correlatio peak, where α ad δ are fittig parameters. Note here that we ca use other types of fuctios, such as a Gaussia fuctio or a quadratic fuctio, for the fuctio fittig. I additio to the fuctio fittig, we employ advaced techiques for high-accuracy estimatio of displacemet: (i) widowig to reduce boudary effects, ad (ii) spectral weightig to reduce aliasig ad oise effects [2]. 2.2 Prelimiary evaluatio Cosider two waveforms f() adg(), ad a estimated displacemet δ. The waveform matchig fially calculates g () byshiftigg() byaamoutcorrespodig to δ. For example, this waveform shiftig is doe by the phase rotatio of the waveform i the frequecy domai. Let G (k) deotes the DFT of g (). G (k) will be give by G (k) G(k)e j 2π N kδ. (9) Sampled poit Sampled poit Fig. 2 Example of POC-based waveform matchig: iput waveforms f() adg(), f() ad displacemet-ormalized waveform g (). Therefore, g () isgiveby g () = N M k= M G (k)w k N. () We ca also implemet the waveform shiftig with various iterpolatio techiques, such as bicubic iterpolatio. Fig. 2 shows a example of the POC-based waveform matchig, where the two waveforms are power traces from a microprocessor captured by usig a trigger sigal at the times of the same computatio. Due to the trigger jitter, there is a displacemet error betwee these waveforms as show i Fig. 2. Usig the POC-based waveform matchig, we ca obtai the displacemet δ = Fig. 2 shows two waveforms after the waveform shiftig. Thus, the proposed method ca be used to match waveform positios with higher resolutio tha the samplig resolutio. Fig. 3 shows examples of the POC fuctios, where we use the two waveforms show i Fig. 2. For compariso, the waveforms iclude additive Gaussia oise compoets. The sigal-to-oise ratio (S/N) = -db whe the oise eergy is about 3.2 times larger tha the sigal eergy. We observe that the POC fuctio provides a sharp peak eve if the oise level icreases. This suggests that the POC fuctio exhibits much higher discrimiatio tha the ordiary correlatio fuctio. Ideally, we ca detect the peak positio eve at the -2 db settig. x

4 4 IEICE TRANS. FUNDAMENTALS, VOL.Exx??, NO.xx XXXX 2x (c) Fig. 3 POC fuctios with Gaussia oise compoets: S/N = db, S/N = db, (c) S/N = -db, ad (d) S/N = -2dB (d) 3. Side-chael attacks with POC-based waveform matchig 3. Basic cocept Measured waveforms The proposed waveform matchig is used as a preprocessig step followed by stadard aalysis. The overview of our proposed DPA with the POC-based waveform matchig described i Sectio 2 is show i Fig. 4. We first collect a umber of power traces by repeatig ecryptio or decryptio with differet plaitexts for each iteratio. The we use the POCbased matchig for the precise aligmet betwee the waveforms. For the matchig, we select ay oe of the waveforms as a referece, ad the evaluate ad adjust the displacemet errors betwee this referece ad the other waveforms. Fially, we resample each waveform accordig to the evaluated displacemet. After the waveform matchig, the stadard aalysis is performed. We first guess at some of the secret key, ad calculate a bit value for each waveform by usig a selectio fuctio. The we divide the waveforms ito two groups accordig to the selectio bit value ad, average each group, ad subtract oe averaged waveform from the other. If a peak appears i the averaged waveform, the guess about the secret key is correct. If there is o obvious peak sigal, aother cadidate key is tested. I the followig experimet, we used a trigger sigal as i the covetioal DPAs for simplicity, ad the measured waveforms are iitially aliged at the trigger. Note here that the proposed method ca get the same aligmet of the waveforms without usig a trigger sigal. At ay rate, the waveforms always cotai jitterrelated deviatios from the true timig of the cryptographic computatio. 3.2 Experimetal coditios We applied the POC-based matchig techique to DPAs agaist a DES software implemetatio o a Zilog Z8 processor (8 MHz). For the selectio fuctios, we focus o the S-box computatio i the - th (fial) roud. DES has eight 6-bit-iput ad 4-bit- Phase-based waveform matchig Wrog guess Classificatio based o a key block guess Averagig Differece calculatio Correct guess Fig. 4 Proposed differetial aalysis with POC-based waveform matchig. output S-boxes, ad thus 4 8 = selectio fuctios usig the S-box output ca be formed. For each selectio fuctio, we have 2 6 = 64 key cadidates derived from the 6-bit S-box iput. Fig. 5 shows the INSTAC-8 evaluatio board [3] desiged for the side-chael attack experimet, ad the measuremet poit o the board. The power cosumptio of the processor was moitored as the voltage drop caused by a resistor iserted betwee the Z8 groud pi ad the groud plae of the board. We used a trigger sigal sychroized with the begiig of roud 5, ad obtaied four sets of waveforms at samplig rates of MSa/s (millios of samples per secod), 2 MSa/s, 4 MSa/s, ad GSa/s. Fig. 6 is the measured waveform at 4 MSa/s. The capture rage of waveforms is from 4.22 ms to 4. ms after the trigger sigal, which cotais all of the operatios of S-box S to S-box S 8. A set of, waveforms was measured durig ecryptio of, radom plaitexts with a fixed key. The subkey values from S to S 8 at

5 HOMMA et al.: A HIGH-RESOLUTION PHASE-BASED WAVEFORM MATCHING AND ITS APPLICATION TO SIDE-CHANNEL ATTACKS 5 Measurig poit CPU Displacemet Correlatio peak Waveform idex Waveform idex Fig. 7 Displacemet values. Fig. 8 Correlatio peak values. Fig. 5 Evaluatio board (INSTAC-8)..2.2 Samplig rate: 2MSa/s Roud 5 Roud.. Vertical axis: V/div Fig. 6 Capture rage Horizotal axis: 2ms/div Example of measured waveform. the roud were fixed as 2,, 3, 35, 9, 5, 5, ad 48 i decimal, respectively. 3.3 Experimetal results Fig. 7 shows the evaluated displacemets for the, waveforms sampled at 2 MHz (5 s/poit), where the horizotal ad vertical axes idicate the waveform idex ad the displacemet value, respectively. The waveforms cotai relatively large displacemet errors eve though they were captured by usig a trigger sigal sychroized to the system clock, which was geerated by the board. Fig. 8 shows the correlatio peaks betwee each waveform ad a referece. The peak betwee two waveforms was about.2 due to the differet plaitexts ad oise. (The peak betwee idetical waveforms is.) However, we ca idetify the peak positio clearly sice the POC fuctio gives a distict sharp peak as show i Fig. 9. Fig. 8 also shows that there are some small peaks amog the waveforms. Fig. 9 shows oe of the correspodig POC fuctios. We foud that the waveforms at a low peak value were quite differet i shape from the referece waveform. The proposed POC-based aalysis ca easily detect this kid of iaccurately measured waveform, ad thus adverse effects o the statistical aalysis ca be preveted by removig them i a averagig process. Fig. illustrates the results of the covetioal DPA ad the proposed DPA, where both DPAs have x 4 x 4 Fig. 9 POC fuctios: for the case α.2, for the case α False peaks 5 5 True peak Sampled poit x 4 Sampled poit x 4 Fig. Example of DPAs usig, waveforms sampled at 2 MHz: covetioal DPA, proposed DPA. used the same set of waveforms sampled at 2 MHz. These results were obtaied by evaluatig 64 possible keys with oe out of the four selectio fuctios of S- box. Whe the DPA succeeds, the highest peak appears i the averaged waveform idicatig the correct key, but the covetioal DPA i Fig. gives may high false peaks for icorrect keys. I cotrast, the proposed DPA clearly idicates the true peak with the correct key as show i Fig.. I this experimet, we cofirmed that the proposed DPA cosistetly icreased the peak sigal ad reduced the oise at all four of the samplig rates. Fig. compares the error rates of the covetioal DPA ad those of the proposed DPA for differet umbers of waveforms, where the vertical axis idicates the umber of error bits. I other words, Fig. shows the umber of selectio fuctios that could ot distiguish a correct key from the icorrect keys by ivestigatig the highest peak. If o secret key bit was obtaied, the umber of errors is bits. The sam-

6 6 IEICE TRANS. FUNDAMENTALS, VOL.Exx??, NO.xx XXXX 2x MSa/s 8 2MSa/s 4MSa/s GSa/s Fig. DPA. MSa/s 8 2MSa/s 4MSa/s GSa/s Error rates for various samplig rates: covetioal DPA, proposed Table DPA results at 2 MSa/s Covetioal DPA S S 2 S 3 S 4 S 5 S 6 S 7 S Proposed DPA S S 2 S 3 S 4 S 5 S 6 S 7 S Table 2 DPA results at 4 MSa/s Covetioal DPA S S 2 S 3 S 4 S 5 S 6 S 7 S Proposed DPA S S 2 S 3 S 4 S 5 S 6 S 7 S plig rate of GSa/s is high eough to attack the slow 8-MHz processor by usig covetioal DPA, but the proposed method has clear computatioal advatages at the samplig rates of 2 MSa/s ad 4 MSa/s as show i Figs.. Tables ad 2 show the DPA results usig, waveforms at 2 MSa/s ad 4 MSa/s, respectively. The 4-bit output from each S-box S i was used for four selectio fuctios, ad thus four estimatios were made for each 6-bit subkey that was XORed to 6 bits of S-box iput data. Therefore, four 6-bit possible keys were obtaied for each S-box i the tables, ad the shaded boxes idicate the correctly guessed keys. If two or more of the values i a S-box colum are the same, the there is a very high probability that we ca obtai the correct subkey by majority vote. As show i Table, the proposed DPA foud five out of eight subkeys at 2 MSa/s while the covetioal approach foud oe. I the 4 MSa/s measuremets, the proposed DPA determied all of the subkeys, as show i Table 2. It is importat to ote that both DPAs used exactly the same waveform data, ad the POC preprocess is simply applied to the captured waveforms before statistical aalysis. Electromagetic probe Fig. 2 CPU 4. Further studies Electromagetic probig. The proposed matchig method i the above sectio ca be easily applied to other types of side-chael iformatio ad differet implemetatio, such as electromagetic radiatio ad a FPGA hardware implemetatio. Also, our method ca be used for practical DPAs eve whe cryptographic modules iclude some popular coutermeasures based o radom delay or oise jammig. This sectio examies these advatages through further experimets.

7 HOMMA et al.: A HIGH-RESOLUTION PHASE-BASED WAVEFORM MATCHING AND ITS APPLICATION TO SIDE-CHANNEL ATTACKS 7 8 MSa/s 2MSa/s 4MSa/s GSa/s 8 MSa/s 2MSa/s 4MSa/s GSa/s Fig. 3 DEMA Error rates for various samplig rates: covetioal DEMA, proposed FPGA Measurig poit 8 Covetioal DPA Proposed DPA Fig. 4 Evaluatio board (INSTAC-). Fig. 5 Error rates o DES hardware. 4. DEMA o DES software The POC-based method was applied to DEMA agaist the same DES software as described i Sectio 3. The electromagetic radiatio was moitored over the Z8 processor as illustrated i Fig. 2. The experimetal coditio was the same as i the DPA described i the previous sectio. Fig. 3 shows the error rate comparisos betwee the covetioal ad proposed DEMA. The proposed method shows lower error rates at the samplig rates of MSa/s ad 2 MSa/s. For example, the proposed DEMA at 2 MSa/s requires less tha half the umber of waveforms used by the covetioal method to achieve the 5 % error rate. 4.2 DPA o DES hardware I additio to DES software, we also implemeted DES hardware o a Xilix Virtex-II ad applied our method to it. The DES hardware has a loop architecture where oe roud fuctio block is iteratively repeated [4]. Fig. 4 shows the experimetal FPGA board INSTAC- [3], ad the measuremet poit where a register is iserted betwee the FPGA groud pi ad the groud plae of the board. The power traces were moitored with a oscilloscope (Agilet MSO 64A) as voltage drops caused by the resistor, ad the samplig rate of the oscilloscope was GSa/s. The DES operatios were performed at a 2-MHz operatig frequecy (.5-μs clock cycle). For simplicity, we used a positive edge trigger at the begiig of roud. Fig. 5 shows the error rate comparisos betwee the covetioal ad proposed DPA. This result clearly shows that the proposed method is also very effective for the FPGA implemetatio. For other samplig rates, such as MSa/s, 2 MSa/s, ad 4 MSa/s, we would have almost the same results as GSa/s i this coditio. 4.3 DPA o DES software with radom delay We implemeted a DES software with a radom-delay coutermeasure isertig NOPs (No OPeratios) at radom after the trigger sigal [4]. The umber of NOPs was ormally distributed with mea 3 ad variace. The radom umber was geerated i advace. A sigle NOP operatio takes.2 msec, ad the maximum delay time is about. msec. As a result, the covetioal DPA ever gives ay true peak for all the samplig rates ( MSa/s, 2 MSa/s, 4 MSa/s ad GSa/s) by, waveforms. Fig. shows error rates for the proposed method

8 8 IEICE TRANS. FUNDAMENTALS, VOL.Exx??, NO.xx XXXX 2x MSa/s 8 2MSa/s 4MSa/s GSa/s Fig. delays. MSa/s 8 2MSa/s 4MSa/s GSa/s Error rate of proposed DPA: Covetioal DES, ad DES with radom Table 3 Proposed DPAs at 4 MSa/s Covetioal DES S S 2 S 3 S 4 S 5 S 6 S 7 S DESwithradomdelays S S 2 S 3 S 4 S 5 S 6 S 7 S dB Origial Sampled poit x 4 Fig. 7 Experimetal waveforms (origial waveform ad oisy waveform at -5dB S/N ratio). applied to DES software without ad with the radom-delay coutermeasure for various samplig rate ad umber of waveforms. The error rates betwee two graphs are almost the same, which meas our proposed DPA ca completely defeat the radom-delay coutermeasure. Table 3 shows the DPA results usig, waveforms at 4 MSa/s. Eve though some estimatio errors occurred, correct keys could be obtaied by majority decisios. The result shows that all the correct keys were obtaied with about 5 waveforms at 4 MSa/s regardless of whether coutermeasures were used or ot. 4.4 DPA o DES software with oise ijectio We evaluated the oise tolerace of the proposed matchig usig waveforms with Gaussia oise compoets. Assumig that the measured waveforms i the above experimet do ot have ay oise compoet, we geerated three sets of, waveforms for sigal-tooise (S/N) ratios of 5dB, db, ad -5dB. The oise compoets were added o Matlab software. Fig. 7 shows a example of the waveforms at -5dB S/N ratio. Fig. 8 shows a part of the evaluated displacemets for the waveforms sampled at 4 MHz, where the horizotal ad vertical axes idicate the waveform idex ad the displacemet value, respectively. The Displacemet.5.5 Origial 5dB db 5dB Waveform idex Fig. 8 Displacemet errors for oisy waveforms. result shows that the POC-based matchig ca be useful for aligig the waveforms eve at -5dB S/N ratios. Fig. 9 shows the results of DPA for both the covetioal ad the proposed method at 4 MSa/s agaist theoisywaveforms. TheproposedDPAcareduce the error rate clearly for all of the waveform sets. 5. Coclusios I this paper we proposed a POC-based waveform matchig method ad its applicatio to side-chael attacks. The proposed matchig method makes it possible to evaluate the displacemet betwee sigal wave-

9 HOMMA et al.: A HIGH-RESOLUTION PHASE-BASED WAVEFORM MATCHING AND ITS APPLICATION TO SIDE-CHANNEL ATTACKS 9 5dB 8 db 5dB Origial dB 8 db 5dB Origial Fig. 9 Error rates for various oise levels: covetioal DPA, proposed DPA. forms with higher resolutio tha the samplig resolutio. I additio to the waveform aligmet, we ca remove iaccurately measured waveforms by detectig sigificat drops of correlatio peaks, elimiatig their adverse effects o the statistical aalysis. The advatage of proposed method over the covetioal methods was demostrated by experimetal DPAs ad DEMAs agaist DES software ad hardware implemetatio. The results showed that the proposed method ca ehace the effectiveess of the side-chael attacks. A high success rate of fidig correct subkeys was obtaied eve at a low samplig rate while the covetioal attacks failed. At higher samplig rates, the proposed aalysis requires fewer plaitexts to obtai the same error rate as the covetioal aalysis. As a result, we cofirmed that the POC-based waveform matchig ca be used efficietly for both DPA ad DEMA without ay drawbacks. I the experimets with INSTAC-8/ boards, we used a trigger sigal sychroized with the cryptographic operatios for simplicity, but the POC-based matchig does ot require this for aligig a umber of power traces. Therefore, we are very cofidet that our approach is efficiet for attackig cryptographic modules i actual applicatios, where o trigger sigal or o iteral clock ca be observed. The uique feature of the proposed method is its capability to ehace ay side-chael aalysis idepedetly of the cryptographic algorithms, implemetatios (software or hardware), ad kid (power or electromagetic) of side-chael iformatio. I additio, the proposed method ca defeat the coutermeasures creatig distorted waveforms with radom delays, dummy cycles, or ustable clockig. The proposed waveform matchig clearly defeated a radomdelay coutermeasure that iterferes with the timigsychroizatio by isertig NOP operatios. We are ow coductig research to develop advaced matchig techiques ad to ivestigate their utility i attacks agaist other waveform-distortio coutermeasures. Refereces [] P. Kocher, J. Jaffe, ad B. Ju, Itroductio to differetial power aalysis ad related attacks, IEEE Tras. electro devices, vol.5, o.2, pp , Feb [2] P. Kocher, J. Jaffe, ad B. Ju, Differetial power aalysis, CRYPTO 999, Lecture Notes i Computer Sciece, vol.66, pp , Aug [3] K. Gadolfi, C. Mourtel, ad F. Olivier, Electromagetic aalysis: Cocrete results, CHES 2, LNCS, vol.22, pp.25 26, May 2. [4] C. Clavier, J. Coro, ad N. DabbousGoubi, Differetial power aalysis i the presece of hardware coutermeasures, CHES 2, Lecture Notes i Computer Sciece, vol.965, pp , Aug. 2. [5] O. Kommerlig ad M.G. Kuh, Desig priciples for tamper-resistat smartcard processors, Proc. of the USENIX Workshop o Smartcard Techology, Chicago, pp.9 2, May 999. [6] J. Waddle ad D. Wager, Towards efficiet secod-order power aalysis, CHES, LNCS, vol.356, pp. 5, Aug.. [7] H.C. Gebotys, S. Ho, ad C.C. Tiu, EM aalysis of Rijdael ad ECC o a wireless Java-based PDA, CHES 25, LNCS, vol.3659, pp , Aug. 25. [8] Q. Che, M. Defrise, ad F. Decoick, Symmetric phaseoly matched filterig of Fourier-Melli trasforms for image registratio ad recogitio, IEEE Tras. Patter Aalysis & Machie Itelligece, vol., o.2, pp.56 8, Dec [9] K. Takita, T. Aoki, Y. Sasaki, T. Higuchi, ad K. Kobayashi, High-accuracy subpixel image registratio based o phase-oly correlatio, IEICE Tras. o Fudametals, vol.e86-a, o.8, pp , Aug. 23. [] K. Ito, H. Nakajima, K. Kobayashi, T. Aoki, ad T. Higuchi, A figerprit matchig algorithm usig phaseoly correlatio, IEICE Tras. o Fudametals, vol.e87- A, o.3, pp , Mar.. [] K. Takita, A.M. Muquit, T. Aoki, ad T. Higuchi, A subpixel correspodece search techique for computer visio applicatios, IEICE Tras. o Fudametals, vol.e87-a, o.8, pp , Aug.. [2] N. Homma, S. Nagashima, Y. Imai, T. Aoki, ad A. Satoh, High-resolutio side-chael attack usig phase-based waveform matchig, CHES 26, LNCS, vol.49, pp.87 2, May 26. [3] T. Matsumoto, S. Kawamura, K. Fujisaki, N. Torii, S. Ishida, Y. Tsuoo, M. Saeki, ad A. Yamagishi,

10 IEICE TRANS. FUNDAMENTALS, VOL.Exx??, NO.xx XXXX 2x Tamper-resistace stadardizatio research committee report, The 26 Symposium o Cryptography ad Iformatio Security, o.25, pp. 6, Ja. 26. [4] Cryptographic Hardware Project. [5] A.M. Muquit, T. Shibahara, ad T. Aoki, A high-accuracy passive 3D measuremet system usig phase-based image matchig, IEICE Tras. o Fudametals, vol.e89-a, o.3, pp , Mar. 26.