A Second Look at the ASCAD Databases

Abstract

The ASCAD databases marked the starting point for a large amount of research regarding deep learning-based (SCA). While most work focuses on the analysis of different architectures, little attention has been paid to the datasets used for training and evaluation. In this paper, we provide a detailed analysis of the ASCAD datasets that examines all 16 bytes of the targeted AES implementation and reveals leakage from intermediate values of interest for attribution of Machine Learning (ML)-based SCA. We show that some bytes exhibit first-order or univariate second-order leakage that is unexpected for a protected implementation. Subsequently, we investigate how training on the fixed key we provide a detailed analysis of the ASCAD database is an easier task for (CNNs) based on two different hyperparameter architectures. Our findings suggest that results based on the we provide a detailed analysis of the ASCAD fix dataset should be revisited and that the more recent ASCAD variable dataset with variable key training should be used in future work. Finally, we investigate the attack success for all bytes. Performance differences with the same network architecture for different bytes highlight that even traces of identical operations on the same dataset pose challenges to CNNs. This highlights the possibility to use different bytes of the ASCAD dataset in order to evaluate the robustness of ML approaches in future work.

A Appendix

1.1 A.1 Sample Ranges for Different Bytes

See Table 4.

Table 4. Sample indices for the alignment on CPOI values.

1.2 A.2 Multivariate Second-Order Attack - Sample Combinations

The resulting correlation results for all sample combinations are shown in Fig. 8. Note that for visualization, we used a convolution filter as due to the low amount of combination points they were barely visible. Furthermore, correlations of less than $4/\sqrt{10000}$ are depicted in white [12]. We limit our evaluation to key bytes with different leakage characteristics as shown in Fig. 3. For all these key bytes it can be concluded that samples corresponding to $r_{out}$ (around 70) and $r_{i}$ (200) can be combined with their corresponding masked S-Box value (1000 and 1100). For $k_{15}$ the additional leakage of $\mathrm {S}(k_{15} \oplus ptxt_{15}) \oplus r_{out}$ allows for an additional combination with samples around index 200. Further, key bytes that are vulnerable against first-order CPA ($k_{4}$, $k_{5}$) show possible additional combinations.

Fig. 8.

Second-order attack results for $k_2$, $k_3$, $k_4$, $k_5$, $k_6$ and $k_{15}$ of ASCAD variable. The resulting correlation value for the different sample combinations of the correct key hypothesis is shown.