A hybrid side-channel attack method for affine mask protection scheme

Abstract

The present invention discloses a hybrid side channel attack method for an affine mask protection scheme, comprising the following steps: (1) energy trace data acquisition; (2) data labeling of the training set energy trace; (3) establishing and training a dense convolutional neural network model; (4) restoring the multiplication mask bytes based on the dense convolutional neural network; (5) restoring the key based on the Scatter method. The method of the present invention combines deep learning with the Scatter attack method to first reduce the second-order power consumption attack on the mask-protected cryptographic algorithm to a first-order power consumption attack, and then uses the Scatter method to complete the attack, so that the attack complexity of the method of the present invention on the mask-protected cryptographic algorithm is greatly reduced, and the attack difficulty is reduced, the success rate of the attack is improved, and the attack on the cryptographic algorithm with the affine mask protection scheme added can be effectively completed.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a hybrid side channel attack method for an affine mask protection scheme. Background Art

[0002] Side channel attacks collect side information (such as time information, energy information, and electromagnetic information) leaked during the actual encryption process of the device, and analyze the collected side information to recover the key information. Classic side channel attack methods include differential power analysis (DPA), correlated power analysis (CPA), template attack (TA), etc. In order to improve the efficiency of side channel attacks, deep learning has also been introduced into side channel attacks.

[0003] In order to resist side channel attacks, hiding and masking techniques have been proposed. Masking technology uses random numbers to randomize intermediate results for protection. The main masking techniques include: ISW masking, Boolean masking, threshold masking and affine masking. Affine masking is a masking scheme that is easy to implement in software. It can effectively resist first-order side channel attacks when combined with other techniques. Implementing cryptographic algorithms for mask protection usually requires implementing more advanced side channel attacks.

[0004] secAES is the result of the REASSURE project of the French National Cybersecurity Agency (ANSSI). It is a masking scheme proposed by Benadjila et al. in 2020 for the AES algorithm that combines multiple side channel protection technologies. The scheme is mainly implemented by affine transformation and scrambling technology. [1] , it is necessary to first locate the 16 leakage points generated when the multiplication mask byte is multiplied with the plaintext, and use the template attack under the Hamming weight model to recover the 2 random bytes that generate the multiplication mask byte; then locate the leakage point where the multiplication mask byte is multiplied with the key to recover the key. This method has problems such as high computational complexity and difficulty in locating leakage points. In particular, it needs to locate 16 leakage points in each energy trace, which puts high technical requirements on the attacker; at the same time, if the device has clock jitter or other problems, it will cause the 16 leakage points in each energy trace to be not in a fixed position, and the operation of locating the leakage point will become extremely difficult.

[0005] In view of the protection scheme of this affine mask, in order to reduce the difficulty of attack and improve the success rate of attack, the present invention proposes a hybrid side channel attack method, which first uses deep learning to recover the multiplication mask used for each group of plaintext encryption, and then uses the Scatter method to recover the key when the multiplication mask has been recovered.

[0006] References[1]Balli F,Caforio A,Banik S. Some Applications of HammingWeight Correlations[EB / OL]. Cryptology ePrint Archive, 2021. Summary of the invention

[0007] The purpose of the present invention is to propose a hybrid side channel attack method for the affine mask protection scheme for the cryptographic algorithm that implements affine mask protection. Through deep learning combined with the leakage generated when the plaintext is multiplied in the affine mask, the multiplication mask bytes used for each plaintext group are restored, and the second-order power consumption attack is reduced to a first-order power consumption attack; in view of the disorder problem in the protection scheme, the Scatter method is used to attack in combination with the restored multiplication mask bytes to complete the key recovery.

[0008] The technical solution for achieving the purpose of the present invention is:

[0009] A hybrid side channel attack method for an affine mask protection scheme comprises the following steps:

[0010] (1) Energy trace data acquisition;

[0011] Obtain energy trace data of the cryptographic algorithm that implements the affine mask protection scheme during device operation, and divide the data into a training set and a test set. The training set is used to train the network model, and the test set is used to recover the multiplication mask and key.

[0012] (2) Data labeling of the energy traces of the training set;

[0013] The mask byte used when encrypting each plaintext block in the training set is calculated according to the affine mask scheme, and the mask byte is used as the label of the energy trace generated when the plaintext block is encrypted, so as to complete the labeling of all energy traces in the training set;

[0014] (3) Build and train a dense convolutional neural network model;

[0015] Build a dense convolutional neural network model, select appropriate hyperparameters, and use the training set to train the model;

[0016] (4) Recover the multiplication mask bytes based on dense convolutional neural network;

[0017] Use the trained dense convolutional neural network model to classify each energy trace in the test set and recover the multiplication mask bytes corresponding to each energy trace in the test set;

[0018] (5) Recovering the key based on the Scatter method;

[0019] After recovering the multiplication mask bytes used by each energy trace in the test set, the Scatter attack method is used to attack the output value of the S-box as the target, and the Hamming weight leakage model is used to perform a key recovery attack.

[0020] Furthermore, the energy trace data acquisition in step (1) is specifically performed as follows:

[0021] (1.1) Implementing an affine mask protected block cipher algorithm on the modeling device, generating multiple groups of random plaintext groups, and sending the plaintext groups to the modeling device for encryption operation;

[0022] (1.2) Using a collection device to collect the leakage of the multiplication mask byte and all plaintext during the initial multiplication operation of each group in the modeling device, i.e., energy trace data, and record each plaintext group, encryption result, and random group used by the masking scheme together, and these data together constitute a training set;

[0023] (1.3) running the same block cipher algorithm with affine mask protection scheme on the target device to generate multiple groups of random plaintext blocks, and sending the plaintext blocks to the target device for encryption operation;

[0024] (1.4) Use a collection device to collect the leakage of the multiplication mask byte and all plaintext during the initial multiplication operation and the first S-box operation during the encryption of each group by the target device, i.e., energy trace data, and record each plaintext group and encryption result together. These data together constitute a test set;

[0025] (1.5) The part of each energy trace of the test set where the multiplication mask byte is multiplied with all plaintexts for the first time is intercepted as the mask byte test set; the part of the energy trace where the first S-box operation is performed is intercepted as the key attack test set.

[0026] Furthermore, the step (2) of labeling the training set energy traces is specifically performed as follows:

[0027] (2.1) Take the random group corresponding to each energy trace in the training set, and use the random group to generate the multiplication mask byte corresponding to each energy trace according to the generation method of the multiplication mask in the affine mask scheme;

[0028] (2.2) The label of each energy trace in the training set is set to the multiplication mask byte calculated by the random grouping corresponding to the energy trace, completing the labeling of all energy traces in the training set.

[0029] Furthermore, the dense convolutional neural network model is established and trained in step (3), and the specific steps are as follows:

[0030] (3.1) Build a dense convolutional neural network model DenseNet-121:

[0031] From input to output, it includes input layer, convolution layer, maximum pooling layer, 4 standard dense blocks, 3 transition layers between dense blocks, and output layer.

[0032] The input layer does not process the data in any way and is only responsible for importing the data into the model.

[0033] The convolution kernel size of the convolution layer is 7×7 and the stride is 2;

[0034] The window size of the maximum pooling layer is 3×3 and the stride is 2;

[0035] In the four dense blocks, each dense block has different numbers and sizes of BN-ReLU-Conv structures, namely batch normalization units (BN), rectified linear units (ReLU) and convolution (Conv) units;

[0036] The transition layer between dense blocks consists of a BN-ReLU-Conv structure and a pooling layer with a stride of 2;

[0037] The output layer includes a flatten layer, a dropout layer with a rate of 0.5, two fully connected layers with 4096 nodes, and a normalized exponential (softmax) layer;

[0038] (3.2) Since the learning rate is very sensitive to the data set, it is necessary to search for the learning rate in a larger range and select a better learning rate. Here, the selected range is set to [0.00001, 0.001];

[0039] (3.3) For other training parameters of the model, set the epoch to 40, the batch size to 64, use RMSprop as the optimizer, and use cross entropy as the loss function; cross entropy is mainly used to measure the difference information between two probability distributions. The formula of cross entropy H(·) is:

[0040]

[0041] Among them, x i is a discrete variable, k is a discrete variable x i The length of p and q is x i The probability distribution of p represents the distribution of the true label, and q represents the predicted label distribution of the trained model. The cross entropy is used as the loss function to measure the similarity between p and q.

[0042] (3.4) Because the DenseNet convolutional network is designed for image classification, in order to make the energy trace data conform to the model characteristics and better use the convolution operation to extract the characteristic information of the energy trace, it is necessary to change the shape of all the energy trace data of the one-dimensional structure in the training set and convert them into three-dimensional image data, such as converting the energy trace with 10,000 points into three-dimensional data of size 100×100×1;

[0043] (3.5) In order to reduce the training cost, no validation set is used for hyperparameter adjustment in neural network training. The training is terminated when the network training reaches the maximum number of iterations, that is, the set number of epochs.

[0044] Furthermore, the step (4) of restoring the multiplication mask bytes based on the dense convolutional neural network comprises the following specific steps:

[0045] (4.1) After the network model training is completed, the trained network model is used to classify each energy trace in the mask byte test set. The network model will calculate the probability of all label types for each energy trace;

[0046] (4.2) For the classification result of each energy trace in the mask byte test set, take the label result with the highest probability among all label types as the multiplication mask byte used by the energy trace, that is, restore the mask byte.

[0047] Furthermore, the key recovery based on the Scatter method in step (5) is specifically performed as follows:

[0048] (5.1) Read in all energy traces and plaintext, preprocess the data, and obtain the data set S:

[0049] Assume that the number of energy traces in the key attack test set is n, and denote the i-th energy trace as S i , 0≤i<n, perform absolute value processing on the key attack test set, convert all negative values ​​into positive values, mark the preprocessed test set as S, and let U be the sample space of all leakage points in S;

[0050] (5.2) Statistical leakage point distribution, obtain data set D:

[0051] Traverse all energy traces in S, count the number of times all points in each energy trace appear, and the statistical result of each energy trace is a distribution; the statistical result distribution of the j-th energy trace is expressed as D j , 0≤j<n, then after counting all the energy traces of S, the distribution set of all energy traces is D;

[0052] (5.3) Select the key corresponding to the target S-box:

[0053] Assume that the cryptographic algorithm has y S-boxes. First, attack the key corresponding to one of the S-boxes in the algorithm. Assume that the size of the S-box is m bits. Then the size of the guessing space G for the m-bit key is 2 m , the size of the Hamming weight space H is m+1; let the intermediate value calculation formula be f(z, v, g), where z is the plaintext or ciphertext information, v is the recovered multiplication mask byte, and guess the key g∈G;

[0054] (5.4) Calculate the intermediate value based on the plaintext and the guessed key g:

[0055] Traverse each distribution D in distribution D j , under the Hamming weight leakage model, using D j The corresponding plaintext z, the multiplication mask byte v used in the group of plaintexts recovered in step (4), and the guessed key g are used to calculate the Hamming weight of the intermediate value h = HW (f (z, v, g)), and D j With g and h as horizontal and vertical subscripts, the energy trace is accumulated into the accumulator Acc with G×H distributions. The calculation formula for the accumulation of the energy trace is:

[0056] Acc(g)(h)[u] += D j [u], u∈U (2)

[0057] (5.5) Calculate the probability density pdf:

[0058] Traverse all distributions in Acc and calculate the probability density pdf of each distribution. The calculation formula is:

[0059]

[0060] (5.6) Calculate the chi-square coefficient:

[0061] Use Pearson chi-squared χ for the pdf 2 As a distinguisher for Scatter attack, the chi-square coefficient calculation formula is:

[0062]

[0063] (5.7) After completing the Pearson chi-square calculation, use the maximum likelihood estimation to obtain the guessed key g with the highest probability, and complete the recovery of an S-box m-bit key. The maximum likelihood estimation calculation formula is:

[0064]

[0065] (5.8) Repeat steps (5.3) to (5.7) to complete the Scatter attack on the remaining y-1 S-box keys and complete key recovery.

[0066] The beneficial effects of the present invention are:

[0067] (1) The method of the present invention combines deep learning with the Scatter attack method to first reduce the second-order power consumption attack on the mask-protected cryptographic algorithm to a first-order power consumption attack, and then uses the Scatter method to complete the attack, so that the attack complexity of the method of the present invention on the mask-protected cryptographic algorithm is greatly reduced, and the attack difficulty is reduced, thereby improving the success rate of the attack;

[0068] (2) The attack method of the present invention can effectively attack the cryptographic algorithm with the affine mask protection scheme added. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 A flow chart of a hybrid side channel attack method according to an embodiment;

[0070] Figure 2 It is a DenseNet-121 network structure diagram in the embodiment method;

[0071] Figure 3 This is a flow chart of the Scatter attack method in the embodiment method. DETAILED DESCRIPTION

[0072] The present invention is further described below with reference to the embodiments and drawings, but is not intended to limit the present invention.

[0073] Example

[0074] A hybrid side channel attack method for affine mask protection scheme, taking secAES as an example, realizes a hybrid side channel attack on the affine mask scheme of secAES, such as Figure 1 As shown, the following steps are included:

[0075] (1) Energy trace data acquisition;

[0076] Obtain energy trace data of secAES that implements the affine mask protection scheme during device operation, and divide the data into a training set and a test set. The training set is used to train the network model, and the test set is used to recover the multiplication mask and key.

[0077] (2) Data labeling of the energy traces of the training set;

[0078] The mask byte used when encrypting each plaintext block in the training set is calculated according to the secAES affine mask scheme, and the mask byte is used as the label of the energy trace generated when the plaintext block is encrypted, so as to complete the labeling of all energy traces in the training set;

[0079] (3) Build and train a dense convolutional neural network model;

[0080] Build a dense convolutional neural network model, select appropriate hyperparameters, and use the training set to train the model;

[0081] (4) Recover the multiplication mask bytes based on dense convolutional neural network;

[0082] Use the trained dense convolutional neural network model to classify each energy trace in the test set and recover the multiplication mask bytes corresponding to each energy trace in the test set;

[0083] (5) Recovering the key based on the Scatter method;

[0084] After recovering the multiplication mask bytes used by each energy trace in the test set, the Scatter attack method is used to attack the output value of the S-box as the target, and the Hamming weight leakage model is used to perform a key recovery attack on secAES.

[0085] Furthermore, the dense convolutional neural network model is established and trained in step (3), and the specific steps are as follows:

[0086] (3.1) Build a dense convolutional neural network model DenseNet-121, such as Figure 2 As shown:

[0087] From input to output, it includes input layer, convolution layer, maximum pooling layer, 4 standard dense blocks, 3 transition layers between dense blocks, and output layer.

[0088] The input layer does not process the data in any way and is only responsible for importing the data into the model.

[0089] The convolution kernel size of the convolution layer is 7×7 and the stride is 2;

[0090] The window size of the maximum pooling layer is 3×3 and the stride is 2;

[0091] In the four dense blocks, each dense block has different numbers and sizes of BN-ReLU-Conv structures, namely batch normalization units (BN), rectified linear units (ReLU) and convolution (Conv) units;

[0092] The transition layer between dense blocks consists of a BN-ReLU-Conv structure and a pooling layer with a stride of 2;

[0093] The output layer includes a flatten layer, a dropout layer with a rate of 0.5, two fully connected layers with 4096 nodes, and a normalized exponential (softmax) layer;

[0094] (3.2) Since the learning rate is very sensitive to the data set, it is necessary to search for the learning rate in a larger range and select a better learning rate. Here, the selected range is set to [0.00001, 0.001];

[0095] (3.3) For other training parameters of the model, set the epoch to 40, the batch size to 64, use RMSprop as the optimizer, and use cross entropy as the loss function; cross entropy is mainly used to measure the difference information between two probability distributions. The formula of cross entropy H(·) is:

[0096]

[0097] Among them, x i is a discrete variable, k is a discrete variable x i The length of p and q is x i The probability distribution of p represents the distribution of the true label, and q represents the predicted label distribution of the trained model. The cross entropy is used as the loss function to measure the similarity between p and q.

[0098] (3.4) Because the DenseNet convolutional network is designed for image classification, in order to make the energy trace data conform to the model characteristics and better use the convolution operation to extract the characteristic information of the energy trace, it is necessary to change the shape of all the energy trace data of the one-dimensional structure in the training set and convert them into three-dimensional image data, such as converting the energy trace with 10,000 points into three-dimensional data of size 100×100×1;

[0099] (3.5) In order to reduce the training cost, no validation set is used for hyperparameter adjustment in neural network training. The training is terminated when the network training reaches the maximum number of iterations, that is, the set number of epochs.

[0100] Reference Figure 3 , the key is recovered based on the Scatter attack method in step (5), and the specific steps are as follows:

[0101] (5.1) Read in all energy traces and plaintext, preprocess the data, and obtain the data set S: Assume that the number of energy traces in the key attack test set is n, and denote the i-th energy trace as S i , 0≤i<n, perform absolute value processing on the key attack test set, convert all negative values ​​into positive values, mark the preprocessed test set as S, and let U be the sample space of all leakage points in S;

[0102] (5.2) Count the distribution of leakage points and obtain the data set D: Traverse all energy traces in S and count the number of times all points appear in each energy trace. The statistical result of each energy trace is a distribution. The statistical result distribution of the j-th energy trace is expressed as D j , 0≤j<n, then after counting all the energy traces of S, the distribution set of all energy traces is D;

[0103] (5.3) Select the key corresponding to the target S-box: secAES has 16 8-bit S-boxes. First attack the key corresponding to a certain S-box in the algorithm. The size of the key guessing space G is 2 8 , the size of the Hamming weight space H is 9; let the intermediate value calculation formula be f(z, v, g), where z is the plaintext or ciphertext information, v is the recovered multiplication mask byte, and guess the key g∈G;

[0104] (5.4) Calculate the intermediate value based on the plaintext and the guessed key g: traverse each distribution D in distribution D j , under the Hamming weight leakage model, using D j The corresponding plaintext z, the multiplication mask byte v used in the group of plaintexts recovered in step (4), and the guessed key g are used to calculate the Hamming weight of the intermediate value h = HW (f (z, v, g)), and D j With g and h as horizontal and vertical subscripts, the energy trace is accumulated into the accumulator Acc with G×H distributions. The calculation formula for the accumulation of the energy trace is:

[0105] Acc(g)(h)[u] += Dj[u],u∈U (2)

[0106] (5.5) Calculate the probability density pdf: Traverse all distributions in Acc and calculate the probability density pdf of each distribution. The calculation formula is:

[0107]

[0108] (5.6) Calculate the chi-square coefficient: Use Pearson chi-square χ for pdf 2 As a distinguisher for Scatter attack, the chi-square coefficient calculation formula is:

[0109]

[0110] (5.7) After completing the Pearson chi-square calculation, use the maximum likelihood estimation to obtain the guessed key g with the highest probability, and complete the recovery of an S-box 8-bit key. The maximum likelihood estimation calculation formula is:

[0111]

[0112] (5.8) Repeat steps (5.3) to (5.7) to complete the Scatter attack on the remaining 15 S-box keys and complete the key recovery of secAES.

[0113] The method of the present invention adopts the Scatter method to attack after completing the recovery of the secAES mask bytes. It does not need to locate the leakage point for problems such as jitter delay, is simpler to implement, and requires less energy trace to complete key recovery. The method of the present invention adopts the DenseNet-121 network for mask recovery, which has a significant effect. Under a suitable learning rate, the success rate of the attack is as high as 97.1%.

Claims

1. A hybrid side channel attack method for an affine mask protection scheme, characterized in that: The following steps are involved: (1) Energy trace data acquisition; Obtain energy trace data of the cryptographic algorithm that implements the affine mask protection scheme during device operation, and divide the data into a training set and a test set. The training set is used to train the network model, and the test set is used to recover the multiplication mask and key. (2) Data labeling of the energy traces of the training set; The mask byte used when encrypting each plaintext block in the training set is calculated according to the affine mask scheme, and the mask byte is used as the label of the energy trace generated when the plaintext block is encrypted, so as to complete the labeling of all energy traces in the training set; (3) Build and train a dense convolutional neural network model; Build a dense convolutional neural network model, select hyperparameters, and use the training set to train the model; (4) Recover the multiplication mask bytes based on dense convolutional neural network; Use the trained dense convolutional neural network model to classify each energy trace in the test set and recover the multiplication mask bytes corresponding to each energy trace in the test set; The specific steps are as follows: (4.1) After the network model training is completed, the trained network model is used to classify each energy trace in the mask byte test set. The network model will calculate the probability of all label types for each energy trace; (4.2) For the classification result of each energy trace in the mask byte test set, take the label result with the highest probability among all label types as the multiplication mask byte used by the energy trace, that is, restore the mask byte; (5) Recovering the key based on the Scatter method; After recovering the multiplication mask bytes used by each energy trace in the test set, the Scatter attack method is used to attack the output value of the S-box as the target, and the Hamming weight leakage model is used to perform a key recovery attack.

2. The hybrid side channel attack method according to claim 1, characterized in that: The energy trace data acquisition in step (1) is specifically performed as follows: (1.1) Implementing an affine mask protected block cipher algorithm on the modeling device, generating multiple groups of random plaintext groups, and sending the plaintext groups to the modeling device for encryption operation; (1.2) Using a collection device to collect the leakage of the multiplication mask byte and all plaintext during the initial multiplication operation of each group in the modeling device, i.e., energy trace data, and record each plaintext group, encryption result, and random group used by the masking scheme together, and these data together constitute a training set; (1.3) running the same block cipher algorithm with affine mask protection scheme on the target device to generate multiple groups of random plaintext blocks, and sending the plaintext blocks to the target device for encryption operation; (1.4) Use a collection device to collect the leakage of the multiplication mask byte and all plaintext during the initial multiplication operation and the first S-box operation during the encryption of each group by the target device, i.e., energy trace data, and record each plaintext group and encryption result together. These data together constitute a test set; (1.5) The part of each energy trace of the test set where the multiplication mask byte is multiplied with all plaintexts for the first time is intercepted as the mask byte test set; the part of the energy trace where the first S-box operation is performed is intercepted as the key attack test set.

3. The hybrid side channel attack method according to claim 1, characterized in that: Step (2) of data labeling the energy traces of the training set is as follows: (2.1) Take the random group corresponding to each energy trace in the training set, and use the random group to generate the multiplication mask byte corresponding to each energy trace according to the generation method of the multiplication mask in the affine mask scheme; (2.2) The label of each energy trace in the training set is set to the multiplication mask byte calculated by the random grouping corresponding to the energy trace, completing the labeling of all energy traces in the training set.

4. The hybrid side channel attack method according to claim 1, characterized in that: Step (3) is to establish and train a dense convolutional neural network model, and the specific steps are as follows: (3.1) Build a dense convolutional neural network model DenseNet-121: From input to output, it includes input layer, convolution layer, maximum pooling layer, 4 standard dense blocks, 3 transition layers between dense blocks, and output layer. The input layer does not process the data in any way and is only responsible for importing the data into the model. The convolution kernel size of the convolution layer is 7×7 and the stride is 2; The window size of the maximum pooling layer is 3×3 and the stride is 2; In each of the four dense blocks, there are different numbers and sizes of BN-ReLU-Conv structures, namely batch normalization units, rectified linear units, and convolutional units; The transition layer between dense blocks consists of a BN-ReLU-Conv structure and a pooling layer with a stride of 2; the output layer includes a flattening layer, a random dropout layer with a rate of 0.5, two fully connected layers with 4096 nodes, and a normalized exponential layer; (3.2) Search for a learning rate and select a learning rate, setting the range to [0.00001, 0.001]; (3.3) For other training parameters of the model, set the epoch to 40, the batch size to 64, use RMSprop as the optimizer, and use cross entropy as the loss function; cross entropy is mainly used to measure the difference information between two probability distributions. The formula of cross entropy H(·) is: Among them, x i is a discrete variable, k is a discrete variable x i The length of p and q is x i The probability distribution of p represents the distribution of the true label, and q represents the predicted label distribution of the trained model. The cross entropy is used as the loss function to measure the similarity between p and q. (3.4) All energy trace data of the one-dimensional structure in the training set are transformed into three-dimensional image data, and the energy trace with 10,000 points is converted into three-dimensional data of size 100×100×1; (3.5) When the network training reaches the maximum number of iterations, that is, the set number of epochs, the training is terminated.

5. The hybrid side channel attack method according to claim 1, characterized in that: The specific steps of recovering the key based on the Scatter method in step (5) are as follows: (5.1) Read in all energy traces and plaintext, preprocess the data, and obtain the data set S: Assume that the number of energy traces in the key attack test set is n, and denote the i-th energy trace as S i , 0≤i<n, perform absolute value processing on the key attack test set, convert all negative values ​​into positive values, mark the preprocessed test set as S, and let U be the sample space of all leakage points in S; (5.2) Statistical leakage point distribution, obtain data set D: Traverse all energy traces in S, count the number of times all points in each energy trace appear, and the statistical result of each energy trace is a distribution; The statistical distribution of the j-th energy trace is expressed as D j , 0≤j<n, then after counting all the energy traces of S, the distribution set of all energy traces is D; (5.3) Select the key corresponding to the target S-box: Assume that the cryptographic algorithm has y S-boxes. First, attack the key corresponding to one of the S-boxes in the algorithm. Assume that the S-box is m bits in size. Then the size of the guessing space G for the m-bit key is 2 m , the size of the Hamming weight space H is m+1; let the intermediate value calculation formula be f(z, v, g), where z is the plaintext or ciphertext information, v is the recovered multiplication mask byte, and guess the key g∈G; (5.4) Calculate the intermediate value based on the plaintext and the guessed key g: Traverse each distribution D in distribution D j , under the Hamming weight leakage model, using D j The corresponding plaintext z, the multiplication mask byte v used in the group of plaintexts recovered in step (4), and the guessed key g are used to calculate the Hamming weight of the intermediate value h = HW (f (z, v, g)), and D j With g and h as horizontal and vertical subscripts, the energy trace is accumulated into the accumulator Acc with G×H distributions. The calculation formula for the accumulation of the energy trace is: Acc(g)(h)[u] +=D j [u],u∈U (2) (5.5) Calculate the probability density pdf: Traverse all distributions in Acc and calculate the probability density pdf of each distribution. The calculation formula is: (5.6) Calculate the chi-square coefficient: Using Pearson Chi-square on pdf As a distinguisher for Scatter attack, the Pearson Chi-square calculation formula is: (5.7) After completing the Pearson chi-square calculation, use the maximum likelihood estimation to obtain the guessed key g with the highest probability, and complete the recovery of an S-box m-bit key. The maximum likelihood estimation calculation formula is: (5.8) Repeat steps (5.3) to (5.7) to complete the Scatter attack on the remaining y-1 S-box keys and complete key recovery.

Images