Laurent Lafleche

Samir Salem

FRACTIONAL KELLER-SEGEL EQUATION: GLOBAL WELL-POSEDNESS AND FINITE TIME BLOW-UP

Keywords: 1991 Mathematics Subject Classification. 35R11, 35A01, 35A02, 35B44, 35B40 fractional diffusion with drift, fractional Laplacian, aggregation diffusion, mean field equation

This article studies the aggregation diffusion equation

where ∆ α 2 denotes the fractional Laplacian and K = x |x| a is an attractive kernel. This equation is a generalization of the classical Keller-Segel equation, which arises in the modeling of the motion of cells. In the diffusion dominated case a < α we prove global well-posedness for an L 1 k initial condition, and in the fair competition case a = α for an L 1 k ∩ L ln L initial condition. In the aggregation dominated case a > α, we prove global or local well posedness for an L p initial condition, depending on some smallness condition on the L p norm of the initial condition. We also prove that finite time blow-up of even solutions occurs, under some initial mass concentration criteria.

The models arising in the context of the chemotaxis of cells have been thoroughly studied in recent years. Among those, the (parabolic-elliptic) Keller-Segel equation models the competition between the aggregation and diffusion of cells (see [START_REF] Blanchet | Two-dimensional Keller-Segel Model: Optimal Critical Mass and Qualitative Properties of the Solutions[END_REF] and references therein for a proper biological and mathematical introduction on the topic). In this paper we consider a variant of this classical model where the diffusion is modeled with a fractional laplacian. Such a choice is biologically motivated (see for instance [START_REF] Escudero | The fractional Keller-Segel model[END_REF][START_REF] Bournaveas | The one-dimensional Keller-Segel model with fractional diffusion of cells[END_REF] and references therein). From a mathematical point of view, it is then interesting to study how such a diffusion competes with an aggregation field which singularity is up to the Newtonian one.

More precisely for some (α, a) ∈ R 2 + , we consider the fractional Keller-Segel equation (FKS)

∂ t ρ = ∆ α 2 ρ + λ div((K * ρ)ρ),
where λ > 0 is a parameter encoding the chemosensitivity, or the intensity of the aggregation. The interaction kernel is given by Particular cases of equation (FKS) have been studied by numerous authors recently. The classical case corresponds to the choice α = a = d = 2 and has been thoroughly studied in the past years. In [START_REF] Blanchet | Two-dimensional Keller-Segel Model: Optimal Critical Mass and Qualitative Properties of the Solutions[END_REF], the authors show the global wellposedness when the initial mass M 0 is smaller than the critical one M c = 4π λ . Above this mass, a finite time blow-up is shown to appear. In [START_REF] Carrillo | Uniqueness for Keller-Segel-type chemotaxis models[END_REF] is also established the well posedness for an L ∞ initial condition. This assumption is sufficient to enjoy the Log-Lipschitz regularity of the nonlinear drift K * ρ, as in this case K is the Newtonian kernel (see for instance [START_REF] Loeper | Uniqueness of the solution to the Vlasov-Poisson system with bounded density[END_REF]). It is possible to relax this assumption to L ln L initial data [START_REF] Fernández | Uniqueness and Long Time Asymptotic for the Keller-Segel Equation: the Parabolic-Elliptic Case[END_REF] or even measure initial data [START_REF] Bedrossian | Existence, Uniqueness and Lipschitz Dependence for Patlak-Keller-Segel and Navier-Stokes in R2 with Measure-valued Initial Data[END_REF]. Large time behavior is also studied in [START_REF] Blanchet | Two-dimensional Keller-Segel Model: Optimal Critical Mass and Qualitative Properties of the Solutions[END_REF][START_REF] Serrano | Asymptotic estimates for the parabolic-elliptic Keller-Segel model in the plane[END_REF][START_REF] Fernández | Uniqueness and Long Time Asymptotic for the Keller-Segel Equation: the Parabolic-Elliptic Case[END_REF]. In higher dimension, the variant case α = 2, a = d = 3 is studied in [START_REF] Corrias | Global Solutions of Some Chemotaxis and Angiogenesis Systems in High Space Dimensions[END_REF], where a finite time blow-up is obtained under a concentration of initial mass condition.

K(x) := x |x|
The literature on the fractional case α < 2, is also large and growing. In a significant part of it, the kernel K is the Newtonian one (a = d). In the one dimensional case, [START_REF] Bournaveas | The one-dimensional Keller-Segel model with fractional diffusion of cells[END_REF] provides a well posedness result for an L p initial condition with p > 1 α when α ∈ (0, 1) and p > 1 when a ∈ (0, 1), as well as a finite time blow-up of even solutions under some concentration of initial mass criteria. In the case d ≥ 2, [START_REF] Biler | Morrey spaces norms and criteria for blowup in chemotaxis models[END_REF] also provides some concentration of initial mass criteria leading to a blow-up of even solutions when α ∈ [1, 2) and non even when α ∈ (0, 2). Still in the Newtonian case, [START_REF] Li | Exploding solutions for a nonlocal quadratic evolution problem[END_REF] provides similar results in the range α ∈ (0, 2). See also on the limiting case α = 0, [START_REF] Bertozzi | Blow-up in multidimensional aggregation equations with mildly singular interaction kernels[END_REF] for a ∈ [0, 1), [START_REF] Bertozzi | Finite-time blow-up of solutions of an aggregation equation in R^n[END_REF] for a = 1, and [START_REF] Li | Global wellposedness and blowup of solutions to a nonlocal evolution problem with singular kernels[END_REF] for a ∈ (1, 2). For α = 2 and a ∈ (0, 2), see [START_REF] Karch | Blow-up versus global existence of solutions to aggregation equations[END_REF] and [START_REF] Godinho | Propagation of chaos for a subcritical Keller-Segel model[END_REF], and for a = 1 and α ∈ (0, 1), see [START_REF] Li | Finite-Time Singularities of an Aggregation Equation in R^n with Fractional Dissipation[END_REF][START_REF] Li | Refined blowup criteria and nonsymmetric blowup of an aggregation equation[END_REF] and [START_REF] Biler | Blowup of solutions to a diffusive aggregation model[END_REF]. For a wider than segment range of results see [START_REF] Salem | Propagation of chaos for Some 2 Dimensional Fractional Keller Segel Equations in Diffusion Dominated and Fair Competition Cases[END_REF] of the second author, and [START_REF] Biler | Global and exploding solutions for nonlocal quadratic evolution problems[END_REF][START_REF] Biler | Blowup of solutions to a diffusive aggregation model[END_REF] which results are summarized in Figure 1 Existing results of (FKS).

Main Results

We will work on weighted spaces defined by

M k := {ρ ∈ M, x k ρ ∈ M} L p k := {ρ ∈ L p , x k ρ ∈ L p },
where x = 1 + |x| 2 , L p = L p (R d ) and M = M(R d ) denote the space of bounded measures. We also define the space of functions with finite entropy by

L ln L := {ρ ∈ L 1 , ρ ln(ρ) ∈ L 1 }. (2)
For s ∈ (0, 1), we will denote by C S d,s the best Sobolev's constant such that for any

f ∈ H s C S d,s f 2 L 2d d-2s ≤ |f | 2 H s ,
and for a ∈ (0, d) and p, q > 1 satisfying 2 -a d = 1 p + 1 q , we will denote by C HLS d,a,p the best Hardy-Littlewood-Sobolev's constant such that for any

f ∈ L p , g ∈ L q , (3)
R 2d |x -y| -a f (x)g(y) dx dy ≤ C HLS d,a,p f L p g L q .
Finally for s ∈ [0, d) and r = 2d d-s , we denote C GNS d,s

the best Gagliardo-Nirenberg-Sobolev's constant such that it holds

C GNS d,s f 2 L r ≤ f L 2 |f | H s .
For a given given couple (a, α) we define the following exponents for the L p spaces which will characterize the integrability of the density

p a,α := d d + α -a (4) p a := p a,0 = d d -a . ( 5
)
Taking K = x |x| a let appear two main difficulties. The first one is the singularity at x = 0 and the second is the behavior when x → ∞. We will therefore write

K = K 0 + K c = χK + (1 -χ)K, where χ ∈ C ∞ c verifies 1 B1 ≤ χ ≤ 1 B2
. Several parts of our analysis could be easily generalized to more general kernels with similar behavior. Definition 2.1. For any T > 0, we say that ρ is a weak solution to the (FKS)

equation on (0, T ) with initial condition ρ in ∈ M if it satisfies ρ ∈ C 0 [0, T ), M (1-a)+ if a ∈ (0, 2] ρ ∈ C 0 ([0, T ), M) ∩ L 1 loc ((0, T ), L pa,2 ) if a ∈ (2, d + 2),
and for any ϕ

∈ C 2 c R d ρ(t) -ρ in ϕ = t 0 R d ρ(s) (I(ϕ) -K c * (ρ(s) • ∇ϕ)) (6) + R 2d K 0 (x -y)(∇ϕ(x) -∇ϕ(y))ρ(s, dx)ρ(s, dy) ds.
We say that this solution is global if we can take T = +∞.

The definition makes sense since it is easy to notice that

K c * (ρ∇ϕ) ∈ C 0 ∩ L ∞ ( x a-1 ) K 0 (x -y)(∇ϕ(x) -∇ϕ(y)) ∈ C 0 ∩ L ∞ (R 2d ) if a ∈ (0, 2).
Moreover, if a ∈ (2, d + 2), the last term in Definition 2.1 is bounded thanks to Hardy-Littlewood-Sobolev inequality. Remark that at least formally, this equation conserves the mass which we will denote by

M 0 := R d ρ in .
First we obtain a global or local well-posedness result, depending on the regime, given in the

Theorem 1. Let (α, a) ∈ [0, 2) × [0, d) be such that a + α > 1 and k ∈ [(1 -a) + , α). • When a < α and ρ in ∈ L 1
k , there exists a unique and global weak solution to the (FKS) equation.

• When a = α, if ρ in ∈ L 1 k ∩ L ln L satisfies (7) λM 0 < C a,d = 4(2π) a (d -a) ω 2d ω d ω d-a ω 2d-a max ω d-a ω d+a , ω 2 d-a/2 ω 2 d+a/2
, then there exists a unique and global weak solution to the (FKS) equation.

• When a > α and ρ in ∈ L 1 k ∩ L p with p ∈ (p a,α , p a ), there exists a time T > 0 such that there is a unique solution to the (FKS) equation on (0, T ). Moreover there is a constant C λ,p (M 0 ) such that if

(8) ρ in L p ≤ C λ,p (M 0 ), then the solution is global.
Remark 2.1. The constraint a + α > 1 comes from the necessity to propagate moments, which is necessary for our notion of solution and gives us compactness. Remark that it is only due to the behaviour at infinity of the interaction kernel, which we denoted by K c , and not to the singularity. Therefore, our Theorem would hold also for example for the following kernel

K(x) = x |x| a χ(x) + x |x| β (1 -χ(x)),
for any β > 1-α and which relaxes the condition a+α > 1. As it can be seen in the proof, this condition can also be removed by assuming ρ even. It is interesting also to notice that formula [START_REF] Karch | Blow-up versus global existence of solutions to aggregation equations[END_REF] could also provide an alternative definition of solution which does not need moments. However, it is not clear whether it is sufficient to provide compactness.

Remark 2.2. The explicit value of C HLS

d,a,p for a ∈ (0, d) and p = q in (3) and C S d,s for s ∈ (0, 1) are known, see for instance [START_REF] Lieb | Sharp Constants in the Hardy-Littlewood-Sobolev and Related Inequalities[END_REF][START_REF] Lieb | Analysis[END_REF]. Remarking that the HLS conjugate as defined in (3) of p a/2 is itself, it holds

C HLS d,a,p a/2 = π a 2 Γ d-a 2 Γ d -a 2 Γ d 2 Γ(d) -1+ a d = ω 2d-a ω d-a ω 2d ω d a-d d C S d,s = 2 2s π s Γ d+2s 2 Γ d-2s 2 Γ d 2 Γ(d) 2s d = (2π) 2s ω d-2s ω d+2s ω 2d ω d 2s d
, where we recall that

ω d = 2π d/2 Γ(d/2
) . In the case a ≤ α, this theorem enlarges the existing result by Biler et al. [START_REF] Biler | Global and exploding solutions for nonlocal quadratic evolution problems[END_REF], where global existence is proved for d = 2, 3 in the case α ≤ d 2 , and is a novelty in higher dimension. Also it is provided with larger class of initial condition, and a uniqueness result. Note that the case α = a is only the object of some remark in [START_REF] Biler | Global and exploding solutions for nonlocal quadratic evolution problems[END_REF]Remark 3.2]. As for the case α < α < 2, it seems it has not been treated yet to the best of the authors' knowledges. See also [START_REF] Biler | Morrey spaces norms and criteria for blowup in chemotaxis models[END_REF] and [START_REF] Li | Exploding solutions for a nonlocal quadratic evolution problem[END_REF] for the case a = 2.

Let us briefly sketch the proof of this theorem in the case of an L ln L initial condition. Formally differentiating the Boltzmann's entropy along (FKS) (see for instance ([8, Section 2.2]) provides a control of the L 1 ([0, T ), L p ) for p ∈ [1, p α ] by fractional Sobolev's embedding, for any initial mass in the diffusion dominated case and for small initial mass in the fair competition case. Then a slight modification of standard coupling argument enables to obtain stability in this space when p ∈ [1, p a ) and uniqueness when p = p a . The other assumption on the initial condition are meant to control the L 1 ([0, T ), L pa ) norm of the solution in the different regimes.

When global existence holds, we also retrieve some additional properties as a quantitative rate of convergence to 0 in the aggregation dominated case and a gain of local integrability in the diffusion dominated case. Theorem 2. Let (α, a) ∈ [0, 2) × [0, d) and ρ be a solution of the (FKS) equation as given by Theorem 1.

• When a < α, the gain of integrability is given for any p ∈ (1, p a ) by

ρ(t) L p ≤ CM 0 t -d αq + C λ (M 0 ).
• When α < a and for a given p ∈ (p a,α , p a ), ρ in L p < C λ,p (M 0 ) defined by [START_REF] Blanchet | Two-dimensional Keller-Segel Model: Optimal Critical Mass and Qualitative Properties of the Solutions[END_REF], then there exists a constant C = C a,α,p (ρ in ) > 0 such that

ρ L p ≤ CM 0 t -d αq .
• When a = α, the condition becomes

λM 0 < C a,d,p = 4C S d,a/2 p(d -a)C HLS d,a,r , 1 r := p p + 1 1 p + 1 p + 1 1 p a ,
which gives both a gain of integrabilty and an asymptotic behavior for any p ∈ (1, p a )

λM 0 ≤ C a,d,p =⇒ ρ L p ≤ CM 0 t -d αq , ( 9
)
where C depends only on M 0 , d, p, a and α. Remark 2.3. If ρ is a weak solution to the (FKS) equation as given by definition 2.1 with a = α and λM 0 < C d,a,p for a given p > 1, we are not able to assert the uniqueness unless we assume that ρ in ∈ L ln L.

Finally we obtain a finite time blow-up for even solutions to (FKS) under some concentration of mass condition stated in the

Theorem 3. Let (α, a) ∈ [0, 2) × [0, d) be such that a > α and ρ ∈ C 0 (R + , L 1
k ) be an even weak solution to the (FKS) equation with initial condition

ρ in ∈ L 1 k verifying (10) R d ρ in x k ≤ C * λ k 2(a-k) M 2a-k 2(a-k) 0 ,
for a given universal constant C * depending only on a, α, k and d. Then the solution ceases to be in L 1 in finite time.

The proof of this theorem relies on the time differentiation of an adequate moment, which is adapted to the fractional diffusion and not Newtonian aggregation case, and which leads to a contradiction. We summarize our results in the following figure One of the strength of the result of Theorem 3, even if it deals only with even solutions, is that it applies to weakly singular interactions, i.e. a < 2. Indeed it seems that so far most of finite time blow-up results for aggregation fractional diffusion equation dealt with the case of a Newtonian interaction at the exception of [5, Theorem 2.2], which deals with interactions of the from x |x| near the origin. Considering a less singular kernel than the Newtonian erases some algebraic facilities and requires a thinner estimation of the competing terms. We emphasize that it also covers the purely aggregative case α = 0, giving stronger results than [START_REF] Bertozzi | Finite-time blow-up of solutions of an aggregation equation in R^n[END_REF][START_REF] Li | Global wellposedness and blowup of solutions to a nonlocal evolution problem with singular kernels[END_REF] for the case a ≥ 2. For a ≤ 2, the blow-up was already proved in [START_REF] Bertozzi | Blow-up in multidimensional aggregation equations with mildly singular interaction kernels[END_REF] using a Lagrangian point of view.

Finally, let us comment about the disjunction of the different global existence and finite time blow-up conditions. Condition (8) in Theorem 1 is heuristically in contradiction with the assumption of Theorem 3. First remark that if we require that ρ in is concentrated around zero, for instance with a condition of the type ρ in L 1 k < CM 0 for a given constant C which does not depend on ρ in , then the condition of blow-up ( 10) is equivalent to

λM 0 ≥ C ,
where C is a positive constant that depends only on a, α, k and d. Moreover, in a more general setting, for k > 0,

q = p ∈ (1, ∞) and ρ ∈ L 1 k ∩ L p , the following inequality ρ ≤ C ρ x k d d+kq ρ kq d+kq L p ,
holds with C depending only on d, k and q. With fixed M 0 , this inequality is enough to exclude a priori ( 8) from [START_REF] Serrano | Asymptotic estimates for the parabolic-elliptic Keller-Segel model in the plane[END_REF], at least in the range of arbitrarily large (or small) ρ in L p or ρ in x k . When this is not the case, we expect that no other behavior appear in the remaining cases.

We bound ourselves to check that in the simple case α = a = 2 < d, the global well-posedness condition ( 7) is coherent with the classical large mass blowup criteria. Indeed take a solution to (FKS) in that case, it is possible to consider initial condition ρ in ∈ L 1 2 and then classically

d dt ρ|x| 2 = R d ρ∆(|x| 2 ) -λ R 2d K(x -y) • (x -y)ρ(dx)ρ(dy) = 2dM 0 -λM 2 0 = 2dM 0 1 - λM 0 2d ,
so that the condition λM 0 > 2d yields to final time blow-up. And since

ω a+2 = 2π a ω a , it holds C 2,d = 4(2π) 2 (d -2) ω 2d ω d ω d-2 ω 2d-2 max ω d-2 ω d+2 , ω 2 d-1 ω 2 d+1 = 4(2π) 2 (d -2) d -2 2d -2 max d(d -2) (2π) 2 , (d -1) 2 (2π) 2 = 2(d -1) < 2d,
so that the two conditions can not be realized simultaneously.

ρ in ∈ L 1 k . Then ρ ∈ L ∞ loc (R + , L 1 k ). Proof. Let m = x k and M k = ρ L 1 k . When k ≥ 1, the convexity of m leads to dM k dt = R d ρ I (m) -λ R 2d h m (x, y)ρ(dx)ρ(dy) (11) ≤ R d ρ I (m), where h m (x, y) = (∇m(x)-∇m(y))•(x-y) |x-y| a ≥ 0. From [4, Remark 4.2]
and [21, Proposition 2.2], we know that for any k ∈ (0, α),

(12) I (m) ≤ C α,k m(x) x -α .
Since m(x) x -α ≤ 1, the following inequality holds

dM k dt ≤ C α,k M 0 . When k ∈ [1 -a, α ∧ 1), there exists R > 0 such that m is strictly convex on B R .
Therefore, a part of the second term in ( 11) is still nonpositive

- |x-y|≤R h m (x, y)ρ(dx)ρ(dy) ≤ - |x-y|≤R |x -y| 2-a ρ(dx)ρ(dy).
The other part can be controlled as follows

- |x-y|>R h m (x, y)ρ(dx)ρ(dy) ≤ k |x-y|>R (x • y)( x k-2 + y k-2 ) |x -y| a ρ(dx)ρ(dy) ≤ 2k |x-y|>R (x • y) x k-2 |x -y| a ρ(dx)ρ(dy) ≤ 4k |x-y|>R,|x|>|y| |x||y| x k-2 |x -y| a ρ(dx)ρ(dy) ≤ 4k(I 1 + I 2 ),
where

I 1 = |x-y|>R,2|x|<|y| |y| x k-1 |x -y| a ρ(dx)ρ(dy) I 2 = |x-y|>R,|x|<|y|<2|x| |y| x k-1 |x -y| a ρ(dx)ρ(dy). Since |x -y| > ||y| -|x|| > |y||1 -|x|/|y|| > |y|/2 when |y| > 2|x|, we get I 1 ≤ 2 a |x-y|>R,2|x|<|y| |y| 1-a x k-1 ρ(dx)ρ(dy) ≤ 2 a M 1-a M 0 .
For I 2 , we use the fact that |y| < 2 x to obtain

I 2 ≤ 2 R a |x-y|>R,|x|<|y|<2|x|
x k ρ(dx)ρ(dy)

≤ 2 R a M k M 0 .
Combining these three inequalities with [START_REF] Carrillo | The derivation of swarming models: Mean-field limit and Wasserstein distances[END_REF] and [START_REF] Carrillo | Local well-posedness of the generalized Cucker-Smale model with singular kernels[END_REF], we obtain

dM k dt ≤ C α,k M k-α + λM 0 2 1-a M 1-a + 2 R a M k .
In particular, since 1 -a ≤ k and k -α < 0, we get

dM k dt M k ≤ M 0 C α,k + λ 2 1-a + 2 R a M k .
By Gronwall's Lemma, this leads to

M k ≤ M in k + C α,k λC a,R e λC a,R M0t ,
which proves the result.

The second type of estimates are a priori bounds of integrability. Let us first briefly emphasize that the quantities we estimate will take the form

R d Φ(u(x)) dx,
where u ≥ 0 and Φ : R + → R + is a non-decreasing convex mapping such that Φ(0) = 0 and u → u Φ (u) ∈ L 1 loc . Then we can define

Ψ(u) := u 0 v Φ (v) dv (13) ψ(u) := 1 2 u 0 √ Φ . ( 14
)
For p = q > 1 and u ≥ 0, we recover Lebesgue norms and Boltzmann's entropy as follow

Φ p (u) := 1 p-1 u p =⇒ Ψ p (u) = u p ψ p (u) = 2 √ p u p/2 Φ 1 (u) := u ln(u) =⇒ Ψ(u) = u ψ 1 (u) = 2u 1/2 . Lemma 3.1 (General estimate). Assume that (α, a) ∈ (0, 2] × (0, d) (with α = 2 if d = 2
) and let ρ be a smooth solution to the (FKS) equation, Φ be a non-decreasing convex mapping, Ψ and ψ be defined respectively by [START_REF] Carrillo | Propagation of chaos for the VPFP equation with a polynomial cut-off[END_REF] and ( 14) and b ∈ (1, p a ).

Then there holds d dt

R d Φ(ρ) ≤ λ(d -a)C HLS d,a,b ρ L s Ψ(ρ) L b -|ψ(ρ)| 2 H α 2 , (15) ≤ λ(d -a)C HLS d,a,b ρ L s Ψ(ρ) L b -C S d,α/2 ψ(ρ) 2 L b , ( 16
)
where 1 s = 2 - a d - 1 b , 2 b = 1 - α d .
Proof. We define the "Carré du Champs" and the Φ-dissipation by [START_REF] Godinho | Propagation of chaos for a subcritical Keller-Segel model[END_REF] where c d,α is defined in [START_REF] Bedrossian | Existence, Uniqueness and Lipschitz Dependence for Patlak-Keller-Segel and Navier-Stokes in R2 with Measure-valued Initial Data[END_REF]. With these definitions, we have

Γ(u, v) := c d,α 2 R d (u(y) -u(x))(v(y) -v(x)) |x -y| d+α dy dx (17) D Φ (u) := Γ(u, Φ (u)),
R d I (u)v = R d u I (v) = - R d Γ(u, v).
In particular, since Φ is convex,

R d I (u)Φ (u) = - R d D Φ (u) ≤ 0. We remark that |ψ(u) -ψ(v)| 2 = v u √ Φ 2 ≤ v u ds v u Φ ≤ (u -v)(Φ (u) -Φ (v)),
which by definition (17) leads to

Γ(ψ(u), ψ(u)) ≤ Γ(u, Φ (u)). Therefore (19) |ψ(u)| 2 H α 2 = R d Γ(ψ(u), ψ(u)) ≤ R d Γ(u, Φ (u)) = R d D Φ (u).
Let ρ be a nonegative solution to the (FKS) equation. Then formally

d dt R d Φ(ρ) = R d Φ (ρ) I (ρ) -λΦ (ρ)∇ρ • (K * ρ)ρ = - R d D Φ (ρ) - R d λ∇(Ψ(ρ)) • (K * ρ) = - R d D Φ (ρ) + λ R d Ψ(ρ)(div(K) * ρ) = - R d D Φ (ρ) + λ(d -a) R d 1 |x| a * ρ . ( 20
)
We remark that by Hardy-Littlewood-Sobolev inequality, we have

(d -a) R d 1 |x| a * ρ Ψ(ρ) ≤ (d -a)C HLS d,a,b ρ L s Ψ(ρ) L b ,
and by [START_REF] Hauray | Wasserstein distances for vortices approximation of euler-type equations[END_REF] and Sobolev embeddings, we have

- R d D Φ (ρ) ≤ -|ψ(ρ)| 2 H α 2 ≤ -C S d,α/2 ψ(ρ) 2 L b ,
which ends the proof.

R d ρ ln(ρ) + 4C -1 a,d (λM 0 -C a,d ) t 0 | √ ρ| 2 H a 2 ≤ R d ρ in ln(ρ in ),
with ρ = ρ(t, •) and

C a,d = 4(C GNS d,a/2 ) 2 (d -a)C HLS d,a,p a/2 . Moreover if λM 0 < C a,d and for some T, k > 0, ρ ∈ L ∞ ((0, T ), L 1 k ), then (21) ρ ∈ L 1 ((0, T ), L pa ).
Remark 3.1. The explicit value for C GNS d,a/2 does not seem to be known, however the following lower bound holds

(22) C GNS d,s ≥ max C S d,s/2 , (C S d,s ) 1/2 .

Indeed, a first way to get the Gagliardo-Nirenberg-Sobolev inequality is to first use Sobolev's inequality and then interpolation between

H s spaces C S d,s/2 f 2 L r ≤ |f | 2 H s 2 ≤ f L 2 |f | H s .

A second way is to first interpolate between Lebesgue spaces and then to use Sobolev's inequality

(C S d,s ) 1/2 f 2 L r ≤ (C S d,s ) 1/2 f L 2 f L r 2 ≤ f L 2 f H s , where r 2 := 2d d-2s .
Proof. We use inequality [START_REF] Corrias | Global Solutions of Some Chemotaxis and Angiogenesis Systems in High Space Dimensions[END_REF] for

Φ = Φ 1 , ψ 1 (u) = 2u 1/2 and b = s = p a/2 to obtain d dt R d ρ ln(ρ) ≤ λ(d -a)C HLS d,a,b ρ 2 L b -|ψ 1 (ρ)| 2 H a 2 .
Then, by Gagliardo-Nirenberg-Sobolev's inequality, we have

(C GNS d,a/2 ) 2 ρ 2 L b = (C GNS d,a/2 ) 2 ρ 1/2 4 L 2b ≤ ρ 1/2 2 L 2 |ρ 1/2 | 2 H a 2 = M 0 |ρ 1/2 | 2 H a 2 . Hence, since ψ 1 (u) = 2u 1/2 , we have 4(C GNS d,a/2 ) 2 ρ 2 L b ≤ M 0 |ψ 1 (ρ)| 2 H a 2 . This yields d dt R d ρ ln(ρ) ≤ C -1 a,d (λM 0 -C a,d ) |ψ 1 (ρ)| 2 H a 2
, which proves the first assertion. Formula (21) comes form the fact for k > 0, defining

λ k > 0 such that R d e -λ k x k dx = 1, with h(u) = u ln u -u + 1 ≥ 0 it holds R d ρ log ρ = R d h ρe λ k x k e -λ k x k + R d ρ ln(e -λ k x k ) ≥ -λ k R d ρ x k .
Combined with the following Sobolev's inequality

4C S d,a/2 ρ L pa = C S d,a/2 ψ 1 (ρ) 2 L 2pa ≤ |ψ 1 (ρ)| 2 H a 2 , it yields 0 ≤ R d ρ ln(ρ) + λ k x k ρ + 4C S d,a/2 C -1 a,d (C a,d -λM 0 ) t 0 ρ L pa ≤ R d ρ in ln(ρ in ) + λ k ρ L ∞ (0,T ;L 1 k )
, and the conclusion follows.

Proposition 3.3 (L p estimates). Let (α, a) ∈ [0, 2) × [0, d).
Then, when a < α and p = q ∈ (1, p a ), we get a gain of integrability from L 1 to L p and a global in time propagation of the L p norm

(23) ρ(t) L p ≤ CM 0 max t -d αq , M d q(α-a) 0 ,
where C > 0 is a constant depending on d, a, α, p and λ. When a > α, then for any p ∈ (p a,α , p a ), there exists two constants

C = C a,α,p > 0 and C in = C a,α,p ( ρ in L p ) such that ρ in L p < CM 0 (λM 0 ) -d (a-α)q =⇒ ρ L p ≤ C in M 0 t -d αq ( 24
)
ρ in L p > CM 0 (λM 0 ) -d (a-α)q =⇒ ρ ∈ L ∞ ((0, T ), L p ) (25) ρ in L p = CM 0 (λM 0 ) -d (a-α)q =⇒ ρ ∈ L ∞ (R + , L p ), ( 26
)
where

T < C a,α,p (λ, M 0 ) ρ in -pb L p with b = α p(α -a) + d(p -1)
.

When a = α, then there exists a constant

C a,d,p = 4C S d,α/2 (d -a)C HLS d,a,r
, such that for any p ∈ (1, p a ),

λM 0 ≤ C a,d,p =⇒ ρ L p ≤ M 0 (C in b) -1 b t -d αq ( 27
)
λM 0 ≥ C a,d,p =⇒ ρ ∈ L ∞ ((0, T ), L p ), ( 28
)
where C in is a nonnegative constant depending on the initial data and

T > 1 bC in M 0 ρ in L p αq d . Remark 3.2.
The critical mass is clearly not optimal since we could use optimal constants in the Gagliardo-Nirenberg type embeddings, as it is done in the L ln L estimate, instead of using Sobolev's embeddings and interpolation between Lebesgue spaces.

Proof. We will separate the proof into severals steps.

Step 1. Differential inequality for the L p norm. We recall that

1 r = p p + 1 1 p + 1 p + 1 1 p a .
Since p < p a , it implies that r ∈ (p, p a ) and in particular r/p > 1. Therefore, by taking Φ = Φ p , r = s and b = r/p in inequality [START_REF] Fernández | Uniqueness and Long Time Asymptotic for the Keller-Segel Equation: the Parabolic-Elliptic Case[END_REF] and defining r = p b 2 , we obtain

d dt R d Φ p (ρ) ≤ λC a,r ρ p+1 L r -Cα p ρ p L r , ( 29
)
where

C a,r = (d -a)C HLS d,a,r , C α = 4C S d,α/2 and p + 1 r = 2 - a d (30) p r = 1 - α d . ( 31
)
We also remark that

r ≤ r ⇔ 1 p 1 -α d ≤ 1 p+1 2 -a d ⇔ 1 + 1 p (d -α) ≤ (2d -a) ⇔ p ≥ d -α d + α -a .
Since p ≥ p a,α ≥ d-α d+α-a , we deduce that r ≤ r. We will now use interpolation between Lebesgue spaces to express the left hand side of [START_REF] Loeper | Uniqueness of the solution to the Vlasov-Poisson system with bounded density[END_REF] in terms of M 0 and the L p norm only. Let ε ∈ (0, 1) to be choosen later and

b 0 := a -α(1 -ε) εd(p -1) = α d(p -1) + a -α εd(p -1) (32) θ 1 := εp p + 1 (1 + b 0 ) (33) θ 2 := (1 -ε)p p + 1 (34) θ 0 := 1 -θ 1 -θ 2 . ( 35
)
Since p > 1 and ε ∈ (0, 1), we deduce that θ 2 ∈ [0, 1). Moreover, using the respective definitions [START_REF] Salem | Propagation of chaos for Some 2 Dimensional Fractional Keller Segel Equations in Diffusion Dominated and Fair Competition Cases[END_REF] and (31) of r and r, we have

θ 1 p + θ 2 r + θ 0 = ε(1 + b 0 )p p + 1 1 p -1 + (1 -ε)p p + 1 1 r -1 + 1 = 1 p + 1 ε(1 -p)(1 + b 0 ) + (1 -ε) 1 - α d -p + p + 1 = 1 p + 1 ε(1 -p) - a -α(1 -ε) d + 2 - α d -ε (1 -p) + ε α d = 1 p + 1 2 - a d = 1 r .
Therefore, if we can choose ε ∈ (0, 1) such that (θ 0 , θ 1 ) ∈ [0, 1] 2 , we obtain by interpolation

ρ p+1 L r ≤ M θ0(p+1) 0 ρ pε(1+b0) L p ρ p(1-ε) L r = A ε B 1-ε .
Then, by using the standard Young's inequality a ε b 1-ε ≤ εa + (1 -ε)b, for any ε 0 > 0, we have

A ε B 1-ε = 1 -ε ε 0 1-ε ε A ε ε 0 B 1 -ε 1-ε ≤ C ε,ε0 A + ε 0 B, with C ε,ε0 = ε 1-ε ε0 1-ε ε . Coming back to (29), it yields d dt R d Φ p (ρ) ≤ (λC a,r ) 1/ε C ε,ε0 M θ0(p+1)/ε 0 ρ p(1+b0) L p + ε 0 -Cα p ρ p L r , ( 36
)
where we take ε 0 smaller than C α /p. Since 1 ≤ p ≤ r, again by interpolation, we get

ρ p(1+b1) L p ≤ M pb1 0 ρ p L r , with b 1 = α d(p -1)
.

Thus, inequality (36) becomes

d dt ρ p L p ≤ C 1 M θ0(p+1)/ε 0 ρ p(1+b0) L p -C 2 M -pb1 0 ρ p(1+b1) L p , ( 37
)
where

C 1 = (p -1)(λC a,r ) 1/ε C ε,ε0 and C 2 = (p -1) Cα p -ε 0 .
Step 2. Conditions on ε. We still have to verify that we can choose ε so that (θ 0 , θ 1 ) ∈ [0, 1] 2 . By definition (33) of θ 1 , we get

θ 1 ≥ 0 ⇔ b 0 ≥ -1 ⇔ a -α + αε > -εd(p -1) ⇔ ε ≥ α -a α + d(p -1) = ε m .
Moreover, by definition (35) of θ 0

θ 0 ≥ 0 ⇔ θ 1 + θ 2 ≤ 1 ⇔ p p + 1 (1 + εb 0 ) ≤ 1 ⇔ εb 0 ≤ 1 p ⇔ a -α(1 -ε) d(p -1) ≤ 1 p ⇔ ε ≤ 1 - 1 α a - d q = ε M . Since p < p a , ε M < 1.
Let us check that it is nonnegative. We have

ε M ≥ 0 ⇔ a - d q ≤ α ⇔ 1 q ≥ a -α d .
Since q = p ≥ 1, this is always verified when a ≤ α. When a > α, it is verified by hypothesis since we can also read previous formula as

ε M ≥ 0 ⇔ p ≥ d d + α -a = p a,α .
When a < α, we also have to verify that ε m ≤ ε M . We have, indeed

ε M ε m = (p(α -a) + d(p -1))(α + d(p -1)) pα(α -a) = pα(α -a) + d(p(p -1)(α -a) + α(p -1) + d(p -1) 2 ) pα(α -a) = 1 + d(p -1) p(α -a) + α + d(p -1) pα(α -a) > 1.
Therefore, since θ 2 ≥ 0 and

θ 0 + θ 1 + θ 2 = 1, we proved that for any ε ∈ [max(ε m , 0), min(ε M , 1)], (θ 0 , θ 1 , θ 2 ) ∈ [0, 1] 3
. By looking at (37), we want to take ε which minimizes b 0 . Hence, we take

ε = ε m when a < α, ε = ε M when a > α.
Step 3. Case a < α. In this case, we have ε = ε m , which yields b 0 = -1. Moreover, since θ 0 (p + 1) = p + 1 -(1 -ε)p = 1 + εp, by (37), we obtain

d dt ρ p L p ≤ C 1 M p+1/ε 0 -C 2 M -pb1 0 ρ p(1+b1) L p . Then, either (38) C 2 M -pb1 0 ρ p(1+b1) L p ≤ 2C 1 M p+1/ε 0 , or (39) d dt ρ p L p ≤ -1 2 C 2 M -pb1 0 ρ p(1+b1) L p .
Inequality (38) is equivalent to

ρ p L p ≤ 2C 1 C 2 1 1+b 1 M p+ 1 ε(1+b 1 ) 0 =: C(M 0 ),
and by Gronwall's inequality, (39) leads to

ρ p L p ≤ 1 2 C 2 M -pb1 0 b 1 t -1/b1 = M p 0 b1 2 C 2 t -1/b1
Step 4. Case a > α. In this case, we have

ε = ε M = p(α -a) + d(p -1) αp = 1 pb ,
which by definition (32) leads to

b 0 = 1 d(p -1) α + a -α ε = α d(p -1) p(α -a) + d(p -1) + p(a -α) p(α -a) + d(p -1) = α p(α -a) + d(p -1) = b,
and by inequality (37), to d dt

ρ p L p ≤ C 1 M θ0(p+1)/ε 0 ρ p(1+b) L p -C 2 M -pb1 0 ρ p(1+b1) L p .
As remarked previously, ε = ε M ≥ 0. Therefore, since a > α,

(40) b = b 1 + a -α εd(p -1) ≥ b 1 .
The estimate on the L p norm is then obtained by analyzing the corresponding ODE which is of the form y (t) = Ay(t) 1+b -By(t) 1+b1 , with A and B nonnegative. It has a fixed point at y = 0 and at

y = B A 1 b-b 1 ≥ 0.
Therefore, when y(0) ∈ [0, y ), it yields y(t) ∈ [0, y ) for any t > 0, and since y ≤ 0 in this interval, it implies the existence of a constant C = C(y(0) in ) < 1 such that Ay 1+b ≤ CBy 1+b1 .

It implies that

y ≤ -(1 -C)By 1+b1 , which, by Gronwall's inequality, leads to

∀t ∈ R + , y ≤ 1 (y(0) -b1 + b 1 (1 -C)Bt) 1 b 1 ≤ M p 0 (b 1 (1 -C)C 2 t) 1 b 1 .
When y(0) > y , we can still write that y ≤ Ay 1+b .

It implies that the solution is bounded in [0, T ] for some T > 0 and

∀t ∈ [0, T ], y(t) ≤ 1 (y(0) -b -bAt) 1 b T < 1 bAy(0) b .
We deduce the corresponding results for the L p norm of ρ by Gronwall's inequality. When y = y , all we get that y is constant and therefore that ρ p L p ≤ y for any t > 0. We can compute more precisely

y = C 2 M -pb1 0 C 1 M θ0(p+1)/ε 0 1 b-b 1 = C 2 C 1 1 b-b 1 M -θ0(p+1)/ε-pb1 0 1 b-b 1 .
Now by the definitions of C 1 and C 2 in step 1, by (40) and the definition (35) of θ 0 , we have

θ 0 (p + 1) = 1 -εpb = 0 (b -b 1 )ε = a -α d(p -1) C 1 = (p -1)(λC a,r ) 1/ε C ε,ε0 C 2 = (p -1) Cα p -ε 0 .
This leads to

y = C α -ε 0 p (λC a,r ) 1/ε C ε,ε0 p 1 b-b 1 M p(b-b1)-1/ε 0 1 b-b 1 = C p a,α,p M p- d(p-1) a-α 0 λ d(p-1)
a-α .

Step 5. Case a = α. When a = α, by definition (32), b 0 does not depend on ε and

b = b 0 = b 1 = α d(p -1) θ 0 (p + 1) = 1 -εpb.
Moreover, we can take any ε ∈ (ε m , ε M ] = (0, d/(αq)]. Thus, by inequality (37), we get

d dt ρ p L p ≤ C 1 M (1-εpb)/ε 0 ρ p(1+b) L p -C 2 M -pb 0 ρ p(1+b) L p ≤ ρ p(1+b) L p M -pb 0 C 1 M 1/ε 0 -C 2 .
The left hand side will be negative when

(41) M 0 ≤ C 2 C 1 ε = (C α /p -ε 0 ) ε λC a,r ε 0 1 -ε 1-ε ε -ε = u ε (ε 0 ).
Taking ε 0 maximizing the right hand side, we get

ε 0 = (1 -ε)C α /p u ε (ε 0 ) = C α pλC a,r = C a,d,p λ .
When this is the case, then

C in := |C 1 M 1/ε 0 -C 2 | > 0 and by Gronwall's inequality ∀t ∈ R + , ρ p L p ≤ 1 ( ρ in -pb L p + bM -pb 0 C in t) 1 b ≤ M p 0 (bC in t) 1 b
, which proves [START_REF] Lieb | Sharp Constants in the Hardy-Littlewood-Sobolev and Related Inequalities[END_REF]. When M 0 > M * 0 we only get the existence of T > 0 such that

∀t ∈ [0, T ], ρ p L p ≤ 1 ( ρ in -pb L p -bM -pb 0 C in t) 1 b
.

Moreover, T verifies T > 1 bC in M 0 ρ in L p pb ,
which proves [START_REF] Lieb | Analysis[END_REF]. 43) is a consequence of (36), which by integrating in time leads to

ρ p L p (t) + C 2 t 0 ρ(s) p L r ds ≤ ρ in p L p + C 1 M θ0(p+1)/ε 0 t 0 ρ(s) p(1+b0) L p ds. If ρ ∈ L ∞ ([0, T ], L p ), then we deduce that C 2 t 0 ρ(s) p L r ds ≤ ρ in p L p + C 1 M θ0(p+1)/ε 0 T ρ p(1+b0) L ∞ ([0,T ],L p ) ,
and we conclude by using ( 24) or (25).

Tightness and coupling.

For the rest of the section we consider some given stochastic basis (Ω, F, (F t ) t≥0 , P). The expectation with respect to P will be denoted E. We frist provide a generalization of [START_REF] Carrillo | Propagation of chaos for the VPFP equation with a polynomial cut-off[END_REF]Proposition 3.1]

(i) E |X -Y | k-1 K(X -X) -K(Y -Ȳ ) ≤ CC ρ1,ρ2 E k ,
and when p = p a ,

(ii) E |X -Y | k-1 K(X -X) -K(Y -Ȳ ) ≤ CC ρ1,ρ2 E k 1 + ln -(E k ) k ,
where

C ρ1,ρ2 = 1 + ρ 1 L p + ρ 2 L p and E k = E [X -Y | k .
Remark 3.3. The point (i) of this Lemma has been extensively used in the literature (See for instance [START_REF] Carrillo | Local well-posedness of the generalized Cucker-Smale model with singular kernels[END_REF][START_REF] Carrillo | The derivation of swarming models: Mean-field limit and Wasserstein distances[END_REF][START_REF] Godinho | Propagation of chaos for a subcritical Keller-Segel model[END_REF][START_REF] Salem | Propagation of chaos for Some 2 Dimensional Fractional Keller Segel Equations in Diffusion Dominated and Fair Competition Cases[END_REF]). So has the point (ii) in the Newtonian case a = d and thus p a = ∞ (see for instance [START_REF] Loeper | Uniqueness of the solution to the Vlasov-Poisson system with bounded density[END_REF][START_REF] Hauray | Wasserstein distances for vortices approximation of euler-type equations[END_REF][START_REF] Carrillo | Propagation of chaos for the VPFP equation with a polynomial cut-off[END_REF]). However to the best of the authors' knowledge, its generalization to a general Riesz interaction kernel a ∈ (0, d) is a novelty. A similar technique can be found in [START_REF] Lafleche | Propagation of Moments and Semiclassical Limit from Hartree to Vlasov Equation[END_REF]. Since this observation is crucial with respect to the competition between diffusion and aggregation, we detail the proof.

Proof. We start with the classical inequality (see [19, (3.9)], [18, Lemma 2.5], [11, (3.26)], [12, (3.5)]) which holds for any (x, y)

∈ (R d ) 2 |K(x) -K(y)| ≤ (|∇K(x)| + |∇K(y)|) |x -y|. Then denote π = L(X, Y ) = L( X, Ȳ ) ∈ P(R 2d ).
Step 1. Proof of (i). We assume here that p > p a . Then we have

E |X -Y | k-1 K(X -X) -K(Y -Ȳ ) ≤ E |X -Y | k-1 (|X -Y | + X -Ȳ ) |∇K(X -X)| + |∇K(Y -Ȳ )| := I 1 + I 2 .
We first estimate I 1 . Since X and X are independent we get

I 1 = E |X -Y | k E |∇K(X -X)| + |∇K(Y -Ȳ )| |X, Y = E |X -Y | k R 2d (|∇K(X -x)| + |∇K(Y -y)|) π(dx, dy) = E |X -Y | k R d |∇K(X -x)|ρ 1 (x) dx + R d |∇K(Y -y)|ρ 2 (y) dy . But since |∇K| ≤ C a |x| -a with C a = max(1 -a, a), we obtain C -1 a R d |∇K(X -x)|ρ 1 (x) dx ≤ R d |X -x| -a ρ 1 (x) dx ≤ |X-x|≤r |X -x| -a ρ 1 (x) dx + r -a ρ 1 L 1 ≤ ρ 1 L p |x|<r |x| -aq dx 1/q + r -a ρ 1 L 1 ,
where q = p and r > 0. Since p > p a , we get aq < d so that |x| -aq is locally integrable and we obtain

C -1 a R d |∇K(X -x)|ρ 1 (x) dx ≤ C K r d/q ρ 1 L p + r -a ρ 1 L 1 ,
where

C K = ω d d-aq 1/q .
Step 2. Proof of (ii). Note that for any (x, y) ∈ (R d ) 2 and r > 0, it holds

|K(x) -K(y)| ≤ |K(x)| + |K(y)| if |x| ∧ |y| ≤ r (|∇K(x)| + |∇K(y)|) |x -y| else. So that E |X -Y | k-1 K(X -X) -K(Y -Ȳ ) ≤ E |X -Y | k-1 |K(X -X)| + |K(Y -Ȳ )| 1 |X-X|∧|Y -Ȳ |≤r + E[|X -Y | k-1 (|X -Y | + X -Ȳ ) |∇K(X -X)| + |∇K(Y -Ȳ )| 1 |X-X|∧|Y -Ȳ |>r ] =: I 1 + I 2 .
To estimate I 1 , we write

I 1 = I 1 1 + I 2 1 + I 3 1 := E |X -Y | k-1 |K(X -X)| + |K(Y -Ȳ )| 1 |X-X|∨|Y -Ȳ |≤r + E |X -Y | k-1 |K(X -X)| + |K(Y -Ȳ )| 1 |X-X|>r≥|Y -Y | + E |X -Y | k-1 |K(X -X)| + |K(Y -Ȳ )| 1 |X-X|≤r<|Y -Y | .
Then, for the estimate of I 1 1 , we get by independence of X and X (resp. Ȳ and Y )

I 1 1 = E E |K(X -X)| + |K(Y -Ȳ )| 1 |X-X|∨|Y -Y |≤r |X, Y |X -Y | k-1 ≤ E |X-x|≤r ρ 1 (x) |X -x| a-1 dx + |Y -y|≤r ρ 2 (y) |Y -y| a-1 dy |X -Y | k-1 ≤ ( ρ 1 L pa + ρ 2 L pa ) |z|≤r |z| -(a-1) d a dz a d E |X -Y | k-1 . Since |z|≤r |z| -(a-1) d a dz = ω d r 0 u d-1-(a-1) d a ds = aω d d r d a =: (C d,a r) d a ,
we get

I 1 1 ≤ C d,a r ( ρ 1 L pa + ρ 2 L pa ) E |X -Y | k-1 .
For I 2 1 , we have

I 2 1 ≤ E 2 |Y -Y | a-1 1 |Y -Y |≤r |X -Y | k-1 = 2 E |Y -y|≤r ρ 2 (y) |Y -y| a-1 dy |X -Y | k-1 ≤ 2C d,a r ρ 2 L pa E |X -Y | k-1 .
We then estimate I 3 1 similarly. Combining the above estimates, we obtain

I 1 ≤ 3C d,a r ( ρ 1 L pa + ρ 2 L pa ) E |X -Y | k-1 ≤ 3C d,a r ( ρ 1 L pa + ρ 2 L pa ) E |X -Y | k (k-1)/k .
Next, we estimate I 2 by writing

I 2 = C a (I 1 2 + I 2 2 ) := C a E |X -Y | k 1 |X -X| a + 1 |Y -Y | a 1 |X-X|∧|Y -Y |>r + C a E |X -Y | k-1 |X -Y | 1 |X -X| a + 1 |Y -Y | a 1 |X-X|∧|Y -Y |>r .
First we easily obtain since 1 a∧b≥r = 1 a≥r 1 b≥r

I 1 2 = E |X -Y | k E 1 |X -X| a + 1 |Y -Y | a 1 |X-X|∧|Y -Y |>r |X, Y ≤ E |X -Y | k |X-x|≥r ρ 1 (x) |X -x| a dx + |Y -y|≥r ρ 2 (y) |Y -y| a dy .
We then consider two cases: r > 1 and 0 < r ≤ 1. For r ≤ 1, we get

|X-x|≥r ρ 1 (x) |X -x| a dx = |X-x|>1 ρ 1 (x) |X -x| a dx + |X-x|∈[r,1] ρ 1 (x) |X -x| a dx ≤ ρ 1 L 1 + ρ 1 L pa |X-x|∈[r,1] 1 |X -x| d dx a d ≤ ρ 1 L 1 + ω d ρ 1 L pa ln -(r) a d ≤ C d ( ρ 1 L pa + ρ 1 L 1 ) (1 + ln -r) .
For the case r > 1, it is clear to obtain

|X-x|≥r ρ 1 (x) |X -x| a dx ≤ ρ 1 L 1 .

This yields

I 1 2 ≤ C d ( ρ 1 L pa + ρ 2 L pa + 2) E |X -Y | k (1 + ln -r) .
On the other hand, by Hölder's inequality

I 2 2 ≤ E |X -Y | k 1 |X -X| a + 1 |Y -Y | a 1 |X-X|∧|Y -Y |>r 1/k × E |X -Y | k 1 |X -X| a + 1 |Y -Y | a 1 |X-X|∧|Y -Y |>r 1-1/k .
The second term of the product is some power of ther term I 1 2 which has already been dealt with, and so is the second term by symmetry of the roles of (X, Y ) and (X, Y ). So that

I 2 ≤ C d,a ( ρ 1 L pa + ρ 2 L pa + 2) E |X -Y | k (1 + ln -r) .
Putting all these estimates together yields for any r > 0

E[|X -Y | k-1 K(X -X) -K(Y -Ȳ ) ] ≤ C d,a ( ρ 1 L pa + ρ 2 L pa ) r E |X -Y | k 1-1/k + C d,a ( ρ 1 L pa + ρ 2 L pa + 2) E |X -Y | k (1 + ln -r) . Choosing r = E |X -Y | k 1/k yields the desired result.
Proof of Theorem 1. Let ρ in be such as the assumptions of Theorem 1. For ε > 0 define

K ε (x) = K(x) if |x| ≥ ε ε -a x else,
and consider the following nonlinear PDE with smooth coefficient (44)

∂ t ρ ε = I (ρ ε ) + λ div((K ε * ρ ε )ρ ε )
with the initial condition ρ in ε = ρ in . Since the kernel K ε is (ε -a )-Lipschitz, the difficulty for the well posedness of (44) does not come from the quadratic nonlinear term. Existence and uniqueness of solution for this nonlinear problem is straightforward in the case a ∈ (1, 2). Indeed it is sufficient to apply a standard fix point in C([0, T ], P k ) technique using Wasserstein metric, since in this case the solution a priori enjoys some k ∈ (1, a) moment. In the case a ∈ (0, 1], it is no more possible to use the completeness of C([0, T ], P κ ), κ > 1, and we have to proceed by compactness (see [START_REF] Salem | Propagation of chaos for Some 2 Dimensional Fractional Keller Segel Equations in Diffusion Dominated and Fair Competition Cases[END_REF]Appendix B]).

Then due to Proposition 3.2 (if α = a), Corollary 3.1 (if a = α), and Proposition 3.1,

ρ ε ∈ L 1 ([0, T ], L p ) ∩ L ∞ ([0, T ], L 1
k ) for some p ≥ p a and T > 0 depending or not on ρ in , uniformly w.r.t. ε > 0.

Step 1. Tightness. Let X 0 be a random variable on R d of law M -1 0 ρ in and (Z α t ) t≥0 be an α-stable Lévy process independent of X 0 . We denote by (X ε t ) t≥0 (respectively (X ε t ) t≥0 ) the solution to the following SDE

X ε t = X 0 -λ t 0 R d K ε (X ε s -x)ρ ε (dx) ds + Z α t .
Note that (µ ε (t)) t≥0 := (L(X ε t )) t≥0 solves the linear PDE

∂ t µ ε = I(µ ε ) + λ div((K ε * ρ ε )µ ε ), with initial condition µ in ε = M -1 0 ρ in . Therefore L(X ε t ) = M -1 0 ρ ε (t)
by uniqueness of solution to this linear PDE with smooth coefficient.

Assume first 0 < 1 -a < α. It is direct to obtain in this case for any β > 1

K β ε := R 2d |K ε (x -y)| β ρ ε (dx)ρ ε (dy) ≤ C a,β R 2d (|x -y| ∨ ε) β(1-a) ρ ε (dx)ρ ε (dy) ≤ C a,β R d |x| (1-a)β + ε (1-a)β ρ ε (dx).
Then choose β = k 1-a > 1 and use the symmetry between x and y to get

sup 0<ε<1 T 0 K β ε (t) dt ≤ sup 0<ε<1 T 0 R 2d C a,β |x| (1-a)β + ε (1-a)β ρ ε (dx)ρ ε (dy) dt ≤ C a,β,T sup ε>0 ρ ε L ∞ ((0,T ),L 1 k ) + 1 < ∞.
Assume now that a > 1. First note that Hardy-Littlewood-Sobolev inequality yields for any ε > 0 and β > 1 to be fixed later

K β ε ≤ R 2d |x -y| -(a-1)β ρ ε (dx)ρ ε (dy) ≤ C ρ ε 2 L d d+β(1-a)/2
. By interpolation between Lebesgue spaces, if β < 2(p-1)d a-1 , then

ρ ε L d d+β(1-a)/2 ≤ ρ ε θ L p ρ ε 1-θ L 1 ,
where θ = β (a-1)q 2d with q = p . Therefore

sup ε>0 T 0 K β ε (t) dt ≤ sup ε>0 T 0 ρ ε 2 L d d+β(1-a)/2 dt ≤ sup ε>0 T 0 ρ ε β (a-1)q d L p dt < ∞,
provided that β ∈ 1, d (a-1)q . Then in both cases, denote the stochastic process

J ε t = -λ t 0 R d K ε (X ε s -x)ρ ε (dx) ds,
and observe that for any 0 ≤ s < t ≤ T , it holds by Holder's inequalitiy

|J ε t -J ε s | ≤ t s R d K ε (X ε u -x)ρ ε (dx) du ≤ t s R d |K ε (X ε u -x)| ρ ε (dx) du ≤ |t -s| 1/β T 0 R d |K ε (X ε u -x)| β ρ ε (dx) 1/β
du, so that by the estimates carried out in the beginning of this step and Jensen's inequality

sup 0<ε<1 E sup 0≤s<t≤T |J ε t -J ε s | |t -s| 1/β ≤ T 0 E R d |K ε (X ε u -x)| β ρ ε (dx) 1/β du ≤ T 0 E R d |K ε (X ε u -x)| β ρ ε (dx) 1/β du ≤ T 1/β T 0 K β ε (t) dt 1/β < ∞.
We then deduce that the family of law of the processes (J ε t ) t∈[0,T ] is tight in P(C([0, T ], R d )). Indeed let us denote

K R := f ∈ C([0, T ], R d ), f (0) = 0, sup 0≤s<t≤T |f (t) -f (s)| |t -s| 1/β ≤ R ,
which is compact due to Ascoli-Azerla's Theorem. By Markov's inequality we get for any ε > 0

P ((J ε t ) 0≤t≤T / ∈ K R ) = P sup 0≤s<t≤T |J ε t -J ε s | |t -s| 1/β > R ≤ R -1 sup 1>ε>0 E sup 0≤s<t≤T |J ε t -J ε s | |t -s| 1/β .
Hence the family of law of the processes

L ε = L ((X ε t = X 0 + J ε t + Z α t ) 0≤t≤T ) ∈ P(D([0, T ], R d ))
is tight. Thus, we can find a sequence ε n going to 0 such that L εn goes weakly to some π ∈ P(D([0, T ], R d )). For any t ∈ [0, T ], we define

e t : γ ∈ D([0, T ], R d ) → γ(t) ∈ R d and
ρ ∈ L 1 ([0, T ], L p ) ∩ L ∞ ([0, T ], L 1 k ). We now show that ρ satisfies (6). Indeed for ϕ ∈ C 2 c denote F(ρ, t) = R d ρ(t) -ρ in ϕ - t 0 R d ρ(s) (I(ϕ) -K c * (ρ(s) • ∇ϕ)) ds - t 0 R 2d
K 0 (x -y)(∇ϕ(x) -∇ϕ(y))ρ(s, dx)ρ(s, dy) ds.

Since ρ ε solves (44), it holds for any t > 0

F ε (ρ ε , t) = 0,
where F ε is the same functional as F with K replaced with K ε . So that for any

t ∈ [0, T ] |F(ρ, t)| ≤ |F(ρ, t) -F η (ρ, t)| + |F η (ρ, t) -F η (ρ ε , t)| + |F η (ρ ε , t) -F ε (ρ ε , t)| . But note that for η > ε ≥ 0 |K ε (x) -K η (x)| ≤ 1 ε≤|x|≤η |x| 1-a ≤ η|x| -a .
We deduce that for any ∈ L 1 ([0, T ]; L pa ), by (3), it holds

|F η ( , t) -F ε ( , t)| ≤ η t 0 |x -y| -a s ( dx) s ( dy) ds ≤ η C HLS d,a,p a/2 t 0 2 L 2d 2d-a ds ≤ η C HLS d,a,p a/2 t 0 L pa ds. So that |F(ρ, t)| ≤ η C HLS d,a,p a/2 t 0 ρ L pa ds + sup 0<ε<1 t 0 ρ ε L pa ds + | F η (ρ, t) -F η (ρ ε , t)|.
Letting first ε go to 0 makes the second term in the r.h.s. vanishes, since for fixed η > 0, F η is a smooth function on L 1 ([0, T ]; L pa ) and ρ ε goes weakly to ρ as ε goes to 0, then letting η go to 0 yields F(ρ, t) = 0, and ρ is a solution to (FKS) in the sense of Definition 2.1.

Step 3. Uniqueness of the limiting point. We now show that there exists at most one such solution. Let ρ, ρ ∈ L 1 ([0, T ], L p ) ∩ L ∞ ([0, T ], L 1 k ) for some p ≥ p a and T > 0 be two solutions to the (FKS) equation with initial condition ρ in . We argue by a coupling argument. Define

X t := X 0 -λ t 0 R d K(X s -y)ρ(dy) ds + Z α t Y t := X 0 -λ t 0 R d K(Y s -y)ρ(dy) ds + Z α t .
Due to the L p regularity of ρ and ρ and Lemma 3.

∂ t µ = I (µ) + λ div ((K * ρ)µ) ,
for the initial condition µ(0) = M -1 0 ρ in . By uniqueness of solution to this linear PDE with Lipschitz or log-Lipschitz coefficient, L(

X t ) = M -1 0 ρ(t) (respectively L(Y t ) = M -1 0 ρ(t)). Denoting Z s = X s -Y s , and π s = L(X s , Y s ) yields |Z t | 2 = -2λ t 0 R 2d Z s • (K(X s -x) -K(Y s -y))π s (dx, dy) ds.
Introducing Xs i.i.d. from X s (resp. Ȳs i.i.d. from Y s ) and taking the expectation yields

E |Z t | 2 ≤ 2λ t 0 E |Z s ||K(X s -Xs ) -K(Y s -Ȳs )| ds ≤    C t 0 ( ρ L p + ρ L p + 2) E |Z s | 2 ds, if p > p a C t 0 ( ρ L pa + ρ L pa + 2) E |Z s | 2 1 + ln -(E[|Zs| 2 ]) 2 ds else.
where we used Lemma 3.2. By Gronwall's inequality, we get

∀t ∈ [0, T ], E |Z t | 2 = 0, i.e. ∀t ∈ [0, T ], ρ(t) = ρ(t),
which yields the desired results. Then since ϕ a ∈ W a,∞ , we obtain that h α,a (y) ≤ C|x -y| -d+a-α , which, since a > α, implies that h α,a ∈ L 1 loc . Moreover, when |y| > r, then

h α,a (y) ≤ C ϕ r α (|y| -r) d+α ∈ L 1 (B c r ).
Therefore, h α,a ∈ L 1 uniformly in x ∈ B r . Hence I (ϕ a ) ∈ L ∞ (B r ), which, combined with (46), leads to the expected result. Combining (49), ( 50) and (51), we obtain d dt

R d ρm ≤ C 1 R d ρ x k-α -C 2 λ R 2d
x k-a y k-a ρ(dx)ρ(dy)

≤ C 1 M k-α -C 2 λM 2 k-a , ( 52
)
where M k = R d ρ x k . We define

Y := M 0 + R d ρm = R d ρ(1 + m).
Remarking that

1 2 (1 + m) ≤ x k ≤ 2 k/2 (1 + m),
we obtain that Y can always be compared to M k up to a constant depending on k. Therefore, Hölder's inequality yield

M 0 ≤ M k a k-a M 1-k a k ≤ CM k a k-a Y 1-k a .
Thus, using the fact that M k-α < M 0 because k -α < 0 and the conservation of the mass M 0 , we obtain dY dt

≤ C 1 M 0 -C 2 λM 2a k 0 Y 2(1-a k ) .
By assumption (48) for the appropriate C * ,

ε := C 2 1 - C 1 Y 2( a k -1) (0) C 2 λM 2a k -1 0 > 0.
Then for any t ≥ 0, dY dt ≤ 0 and

Y 2( a k -1) (t) ≤ Y 2( a k -1) (0) = C 2 -ε C 1 λM 2a k -1 0 , and dY dt ≤ -ελM 2a k 0 Y 2(1-a k ) .
By Gronwall's inequality, we deduce

Y (t) ≤ Y (0) 2a k -1 -ελ 2a k -1 M 2a k 0 t k 2a-k .
Since Y is positive and the above inequality goes to 0 in finite time, we deduce that the solution ceases to be well defined in L 1 in a finite time T * verifying

T * < kY (0) 2a k -1 ελ(2a -k)M 2a k 0 = k 2a -k Y (0) 2a k -1 C 2 λM 2a k 0 -C 1 Y 2( a k -1) (0)M 0 .

  a , and I := ∆ α 2 denotes the fractional Laplacian defined by (1)I (u) = ∆ α 2 u := c d,α R d u(y) -u(x) |x -y| d+α dy.The constant c d,α can be writtenc d,α = -(2π) α ω-α ω d+α > 0 where ω d = 2π d/2 Γ(d/2) is the size of the unit sphere in R d when d ∈ N * .

Figure 1 .

 1 Figure 1. Existing results of (FKS).

Figure 2 .

 2 Figure 2. Range of application of Theorems 1 and 3. We emphasize that for d > 2 the results extend to the segment (α, a) ∈ {2} × (0, d).

Figure 3 . 3 . 3 . 1 (

 3331 Figure 3. Lower bound of the threshold of condition (7) for d = 2, 3, 4 and a ∈ (0, 2). For the case a ≤ 1 2 see Remark 2.1.

Proposition 3 . 2 (

 32 L ln L estimate). Let a = α and ρ be a smooth function satisfying the (FKS) equation with initial condition ρ in ∈ L ln L. Then it holds

Corollary 3 . 1 .

 31 When a < α and ρ in ∈ L 1 , then for any p < p α (42) ρ ∈ L 1 loc (R + , L p ), which holds in particular if p = p a . When a > α and ρ in ∈ L p for a given p ∈ (p a,α , p a ), then there exists T > 0 such that (43) ρ ∈ L p ((0, T ), L r ), where r = pp α ≥ p a . Moreover, if (24) is verified, ρ ∈ L p loc (R + , L r ). Proof of Corollary 3.1. Equation (42) comes from inequality (23) by remarking that p < p α implies d/(αq) ≤ 1 and integrating in time. Equation (

4. Proof of Theorem 3 4. 1 .Proposition 4 . 1 .

 3141 Fractional Laplacian of truncated polynomials. Let ϕ ∈ C ∞ c be such that R d ϕ = 1. Then for any a > α (45) |I (|x| a ϕ)| ≤ C x -(d+α) . Proof. Let ϕ a := |x| a ϕ and R > 0 be such that supp(ϕ) ⊂ B R . For any x ∈ B c R , we get (46) I (ϕ a )(x) = B R ϕ a (y) dy |x -y| d+α ∈ m ϕa (|x| + R) d+α , m ϕa (|x| -R) d+α .Now, assume x ∈ B r for a given r > R. Then we write the fractional Laplacian asI (ϕ a ) = R dh α,a (y) dy, where h α,a (y) = ϕ a (y) -ϕ a (x) |x -y| d+α when α ∈ (0, 1) h α,a (y) = ϕ a (y) -ϕ a (x) -(y -x) • ∇ϕ a (x) |x -y| d+α when α ∈ [1, 2).

Proposition 4 . 2 . 4 . 2 .Proposition 4 . 3 .,

 424243 Let ϕ ∈ C ∞ c be such that R d ϕ = 1 and 1 Br ≤ ϕ ≤ 1 B2r . Then for any k ∈ (0, α)(47) I (|x| k ϕ c ) ≤ C x k-α ,where ϕ c = 1 -ϕ.Proof. The proof is similar to[START_REF] Biler | Blowup of solutions to generalized Keller-Segel model[END_REF] Remark 4.2] for k > 1 and [21, Proposition 2.2] for k < 1. Blow-up for even solutions. Assume 0 < k < α < a and let ρ ∈ L ∞ ((0, T ), L 1 (1-a)+ ) be an even solution of the (FKS) equation with initial condition ρ in and verifying for a universal constant C * depending only on d, a, α and k. Then the solution ceases to exist in finite time.Proof. Let ϕ ∈ C ∞ c (R) even and nonincreasing be such that R ϕ = 1 and 1 Br ≤ ϕ ≤ 1 B2r for a given r ∈ (0, 1/2) and ϕ c = 1 -ϕ. We definem(x) := ϕ(|x|)|x| a + ϕ c (|x|)|x| k .By (45) and (47), we get (49)I (m) ≤ C x k-α . Assuming the existence of ρ ∈ L ∞ ((0, T ), L 1 k ) to the (FKS) equation, we get d dt R d ρm = R d ρ I (m) -λ R 2d (∇m(x) -∇m(y)) • (x -y) |x -y| a ρ(dx)ρ(dy) = R d ρ I (m) -λ R 2d g(x, y) -h(x, y)x • y |x -y| a ρ(dx)ρ(dy),wherem (|x|) = ∇m(x) • x |x| and g(x, y) = m (|x|)|x| + m (|y|)|y| h(x, y) = m (|x|)|x| -1 + m (|y|)|y| -1 .Since |x -y| a ≤ 2 a (|x| a + |y| a ), h is symmetric and ρ is even, we getR 2d g(x, y) |x -y| a (1 -h(x, y)x • y) ρ(dx)ρ(dy) ≥ R 2d g(x, y) -h(x, y)x • y 2 a (|x| a + |y| a ) ρ(dx)ρ(dy) ≥ R 2d g(x, y) 2 a (|x| a + |y| a ) ρ(dx)ρ(dy). (50) We remark that if (x, y) ∈ B 2 r , g(x, y) 2 a (|x| a + |y| a ) = a 2 a . If (x, y) ∈ (B c 2r ) 2 , g(x, y) 2 a (|x| a + |y| a ) = k(|x| k + |y| k ) 2 a (|x| a + |y| a ) ≥ k(2r) a-k 2 a (|x||y|) a-k . If (x, y) ∈ B r × B c 2r , g(x, y) 2 a (|x| a + |y| a ) = a|x| a + k|y| k 2 a (|x| a + |y| a ) ≥ k|y| k 2 a (r + |y| a ).Moreover, when x ∈ B 2r \B r , m (|x|)|x| = ϕ (|x|)(|x| a+1 -|x| k+1 ) + aϕ(|x|)|x| a + kϕ c (|x|)|x| k .Remarking that we can take ϕ decreasing and r < 1/2, which implies that |x| ≤ 1 and m (|x|)|x| ≥ aϕ(|x|)|x| a + kϕ c (|x|)|x| k ≥ k|x| a , it allows us to do the same kind of estimates for the remaining (x, y) ∈ R 2d and obtain (51) g(x, y) 2 a (|x| a + |y| a ) ≥ C x k-a y k-a .

Table of Contents

 of

	1. Introduction	1
	2. Main Results	3
	3. Proof of Theorem 1 and Theorem 2	9
	3.1. A Priori estimates	9
	3.2. Tightness and coupling	19
	4. Proof of Theorem 3	26
	4.1. Fractional Laplacian of truncated polynomials	26
	4.2. Blow-up for even solutions 27 1. Introduction

Step 2. A priori properties of the limit point.

  ρ(t) := (e t )#π ∈ P the push-forward of ρ by e t . Since for any t ∈ [0, T ], (e t )#L ε = ρ ε (t), ρ εn (t) goes weakly to ρ(t) in P k , By lower semi continuity of • L p and • L 1 k with respect to the weak convergence of measures and Fatou's Lemma, it holds

References 29

Acknowledgements

The second author was supported by the Fondation des Sciences Mathématiques de Paris and Paris Sciences & Lettres Université.


Sebanjila Kevin Bukasa

Ronan Lashermes

Hélène Le Bouder
email: helene.lebouder@imt-atlantique.fr

Jean-Louis Lanet

Axel Legay

How TrustZone could be bypassed: Side-Channel Attacks on a modern System-on-Chip

Keywords: ARM TrustZone, Side-Channel Analysis (SCA), Raspberry Pi 2

Side-channel attacks (SCA) exploit the reification of a computation through its physical dimensions (current consumption, EM emission, . . . ). Focusing on Elecromagnetic analyses (EMA), such analyses have mostly been considered on low-end devices: smartcards and microcontrollers. In the wake of recent works, we propose to analyze the effects of a modern microarchitecture on the efficiency of EMA (here Correlation Power Analysis and template attacks). We show that despite the difficulty to synchronize the measurements, the speed of the targeted core and the activity of other cores on the same chip can still be accommodated. Finally, we confirm that enabling the secure mode of TrustZone (a hardware-assisted software countermeasure) has no effect whatsoever on the EMA efficiency. Therefore, critical applications in TrustZone are not more secure than in the normal world with respect to EMA, in accordance with the fact that it is not a countermeasure against physical attacks. For the best of our knowledge this is the first application of EMA against TrustZone.

Introduction

Embedded devices have never been so pervasive in our everyday life. Smartphones are already widespread and will continue to be present all around the world. Internet-of-Things (IoT) devices are poised to become ubiquitous. In parallel, more diverse and more critical applications are accessed with these devices: credit cards or other payment methods such as Apple Pay [START_REF] Betters | Apple pay: How it works[END_REF][START_REF] Nguyen | Samsung pay: How it works[END_REF], password managers [START_REF] Corpuz | Mobile password managers[END_REF] or two factors authentication (2FA) are some examples.

Considering the information security, these devices offer a new set of possible threats: the attacker can have physical access to the device. Think of a stolen smartphone or a set-top box allowing access to pay-TV whose user would prefer the TV without having to pay.

These problems have already been faced by the smartcard industry in the past [START_REF] Koeune | A Tutorial on Physical Security and Side-Channel Attacks[END_REF].

Yet apart from embedded secure elements (eSE, which are basically smartcard IPs in a chip), modern System-on-Chip (SoC) fail to implement countermeasures against physical attacks. The reasons may be the highly competitive market for these chips that do not play well with the prudent pace needed to obtain secure devices. The fact that the sensitivity of these modern SoCs to physical attacks is not well known does not support a much needed consideration for these attacks.

Modern chips are increasingly complex, including several peripherals, working at high clock speed, including several memory levels, numerous cores, and security extensions such as TrustZone (defined in section 2), the influence of all this activity on a SoC is of particular interest when it comes to physical attacks. This is what we want to verify in this paper by experimentally setup physical attacks.

Motivations: Our main objective is to expose the risks faced by users using embedded devices for critical operations when they are not protected against physical attacks. Most physical attacks are performed on low-end devices (microcontrollers and smartcards) and we investigate if they can be transposed easily to high-end devices. We verify that the TrustZone implementation does not offer any protection against side-channels leakages (TrustZone is only advertised as a software security solution by ARM, not hardware), and even multicore computations has no influence on these leakages. Contribution: Two different attacks have been experimentally realized on a device representing a modern smartphone. We will use two use-cases for that purpose: the secret-key cryptography key recovery, and a Personal Identification Number (PIN) recovery.

These attacks have been realized while monitoring the impact of different features of the device.

Organization of this paper: The paper is organized as follows. Trusted Environment Execution and TrustZone specific implementation are presented in section 2. In section 3, Side-channel attacks (SCA) are presented and our two use cases are detailed. Our setup and experimental results are given in section 4. Finally, the conclusion is drawn in section 5.

Trusted Execution Environment and TrustZone

Trusted Execution Environment (TEE)

Trusted Execution Environment Protection Profile (TEE PP) is a profile specified by GlobalPlatform in 2014 [START_REF]TEE Protection Profile[END_REF]. This TEE PP has been made specifically for mobile devices, the goal was to deal with new threats in the mobile world and to allow customers to have confidence in the TEE in order to deliver mobile wallets, or secure mobility solutions.

A TEE is an execution environment that respect the TEE PP, meaning that it can be trusted by users. A Trusted Application (TA) is an application running in the TEE, it provides security related functions, and its assets include code, program data, cryptographic keys, etc. A TEE is designed to provide isolated execution, integrity of TA but also integrity and confidentiality of TA assets.

In order to provide a secure environment, a TEE might be working alongside a Rich Execution Environment (REE). A TEE is in fact another execution environment with its own Operating System (OS), the Trusted OS (TOS) and its own applications, TAs, executing over it. The OSes are isolated and the Rich OS (ROS) has just one entry point to the TOS.

There are several implementations of TEEs. The most notable are ARM TrustZone, detailed in this paper and Intel SGX [START_REF] Costan | Intel sgx explained[END_REF].

TrustZone

TrustZone (TZ) is a specific implementation of a TEE proposed by ARM. This proposition is based on a few hardware-specific parts only. Security functions are mainly performed by software implementations or by optional pieces of hardware that can be added by each integrator. It respects GlobalPlatform specifications, and goes into TEE PP.

TrustZone hardware architecture leads to specific software implementations, a ROS, a TOS and the entry point (managing accesses to the secure world).

It consists in separating hardware resources into two worlds, Secure and Normal (Non-Secure) worlds. This is achieved by adding a security-related bit on the system bus (and therefore all bus accesses are impacted), and by adding new privilege levels. In that way each peripheral, each data or code section are separated between the two worlds and a core can only handle them if it is in the right privilege mode.

Typically, a non-secure ARMv7 core has three privilege modes:

-PL0 or user mode is the least privileged and is the mode where user application are executed in. -PL1 or kernel mode is an intermediary privileged level and is typically where the kernel (of the ROS) is executed. -PL2 or hypervisor mode is the highest level and is where the hypervisor (if any) is executed. Now the TZ adds new modes. In addition to the previously defined non-secure PL0, PL1 and PL2, the new modes are:

-Secure PL0, the secure user mode is where trusted applications are executed.

-Secure PL1, the secure kernel mode is the mode for the secure kernel execution for the TOS. -Monitor mode is a new mode that must be used to transition between the non-secure and the secure worlds.

When the core is in a secure state, the non-secure (NS) bit on the bus is set to 0. As a consequence, the systems on the bus can adapt to the security state (e.g. a peripheral may forbid the access when NS is 0).

3 Side Channel Attacks

Definition

When discussing about the security of an algorithm, numerous mathematical tools allow developers to prove its security. Unfortunately those tools cannot consider the interaction of the computing unit with its physical environment. Physical attacks are a real threat, even for algorithms proved secure mathematically. Side-channel analyses (SCA) are physical attacks based on the observation of the circuit behavior during a computation. They exploit the fact that some physical quantities depend on intermediary values of the computation in the device. This is the so-called leakage of information. The most classic leakages are timing [START_REF] Foo Kune | Timing attacks on pin input devices[END_REF][START_REF] Kocher | Timing attacks on implementations of Diffie-Hellman, RSA, DSS, and other systems[END_REF], power consumption [START_REF] Mangard | Power analysis attacks: Revealing the secrets of smart cards[END_REF] and electromagnetic emissions (EM) [START_REF] Quisquater | Electromagnetic analysis (EMA): Measures and counter-measures for smart cards[END_REF]. In this paper we will focus on Electromagnetic analyses (EMA).

Side-channel analyses can be split in three families.

-The Simple Power Analysis (SPA) [START_REF] Mangard | A simple power-analysis (spa) attack on implementations of the aes key expansion[END_REF] uses directly the leakage to obtain the secret information.

-More complex attacks that need a mathematical model for the leakage and a statistic tool called a distinguisher. These attacks have generally a divideand-conquer approach. The first ones were the Differential Power Analysis (DPA) [START_REF] Kocher | Differential Power Analysis[END_REF] and Correlation Power Analysis (CPA) [START_REF] Brier | Correlation Power Analysis with a Leakage Model[END_REF]. That is why this family of Side-Channel Attack (SCA) is often called the "DPA/CPA attacks". The differences between attacks of this family generally come from the choice of the model and the distinguisher. -Template attacks are based on a statistical classification which replaces the mathematical model for the leakage in a DPA. To implement a template attack, a pair of identical devices is needed. One is called the profiling device, the attacker has full control of it, and is used to learn the leakage characteristics. The other is the targeted device on which the attack is carried. Template attacks were introduced as the strongest possible side-channel attacks from an information theoretic point of view [START_REF] Chari | Template attacks[END_REF]. They have been used in many attacks, such as [START_REF] Archambeau | Template attacks in principal subspaces[END_REF][START_REF] Bouder | A template attack against VERIFY PIN algorithms[END_REF] since.

SCA are threats for all standard cryptosystems as Data Encryption Standard (DES) [START_REF] Brier | Correlation Power Analysis with a Leakage Model[END_REF][START_REF] Kocher | Differential Power Analysis[END_REF], Advanced Encryption Standard (AES) [START_REF] Gierlichs | Mutual information analysis[END_REF][START_REF] Mangard | A simple power-analysis (spa) attack on implementations of the aes key expansion[END_REF], RSA cryptosystem [START_REF] Genkin | Stealing keys from pcs using a radio: Cheap electromagnetic attacks on windowed exponentiation[END_REF], Elliptic Curve Cryptography (ECC) [START_REF] Oswald | Enhancing simple power-analysis attacks on elliptic curve cryptosystems[END_REF] and for critical applications not using cryptography, e.g. PIN verification [START_REF] Bouder | A template attack against VERIFY PIN algorithms[END_REF]. SCA can also be used to reverse engineer algorithms [START_REF] Clavier | An improved SCARE cryptanalysis against a secret A3/A8 GSM algorithm[END_REF].

Previous works

Historically, the targeted devices were mostly smartcards, microcontrollers or cryptographic coprocessors [START_REF] Koeune | A Tutorial on Physical Security and Side-Channel Attacks[END_REF] since they were the only embedded devices with critical information on it (for credit cards and pay-TV notably). These devices are relatively slow (under 10MHz) and have simple architectures: a simple cache architecture if any, shallow pipeline, ... Features that make SCA easier. As a consequence, the smartcard industry developed strong countermeasures against physical attacks. However, today the same applications are more and more executed on smartphones, and they do not build upon the knowledge from the smartcard industry in terms of SCA. The chips used in these devices are full featured processors running at high speed (1GHz+, > 100X faster than a smartcard), with complex architectures (multiple cache levels, deep pipelines). SCA are therefore more complex. Measurement equipments have to be adapted to accept much higher frequencies. Jitter (temporal variance) is more important due to the caches, making synchronization harder. Yet SCAs on smartphones have already been performed. In [START_REF] Aboulkassimi | Electromagnetic analysis (ema) of software aes on java mobile phones[END_REF], the authors have developed an EMA on an Android phone (running at 400MHz). They targeted the secret key of an AES implementation in the Android BouncyCastle library. They show a key recovery in 250 traces with their special techniques designed to take into account the desynchronization added by the java virtual machine behavior.

How to do EMA on fast modern systems has been described in [START_REF] Balasch | DPA, Bitslicing and Masking at 1 GHz[END_REF][START_REF] Longo | SoC It to EM: Electro-Magnetic Side-Channel Attacks on a Complex System-on-Chip[END_REF]. They both target a Beaglebone Black board running at 1GHz. They had to filter out traces that where not properly synchronized due to interrupts and other operating system operations. Resynchronization and filtering are necessary to obtain clean traces. In [START_REF] Balasch | DPA, Bitslicing and Masking at 1 GHz[END_REF], the authors attacked their own optimized AES implementation and show that their countermeasures are effective. In [START_REF] Longo | SoC It to EM: Electro-Magnetic Side-Channel Attacks on a Complex System-on-Chip[END_REF], the authors compared the leakage of an AES on the ARM core with respect to the NEON coprocessor.

From these papers, we can see that transposing EMA on high end processors requires a lot more experimental work. In particular, synchronization can be a problem because of a virtual machine (in [START_REF] Aboulkassimi | Electromagnetic analysis (ema) of software aes on java mobile phones[END_REF]) or because of the operating system (in [START_REF] Balasch | DPA, Bitslicing and Masking at 1 GHz[END_REF][START_REF] Longo | SoC It to EM: Electro-Magnetic Side-Channel Attacks on a Complex System-on-Chip[END_REF]). That in why in our case, we work in a bare-metal environment (i.e. without an operating system) to focus on the microarchitecture influence on the efficiency of EMA.

A second category of EMA on smartphone has been performed targeting public-key cryptography (RSA [START_REF] Genkin | Stealing keys from pcs using a radio: Cheap electromagnetic attacks on windowed exponentiation[END_REF][START_REF] Uno | Chosen-message electromagnetic analysis against cryptographic software on embedded os[END_REF] or ECC [START_REF] Genkin | Ecdsa key extraction from mobile devices via nonintrusive physical side channels[END_REF]). Synthetically, these attacks have the same leakage principle. Public-key cryptography deals with big numbers (3072-bit for RSA, 256-bit for ECC at the 128-bit security level). Handling these big numbers in software requires to split them in words whose size is determined by the chip architecture (32-bit or 64-bit in most architectures).

As an example, a multiplication of two big numbers requires looping over the words constituting the operands. The sequence of operation in each iteration has a leakage signature that can be identified in the frequency domain (since the iteration is repeated several times). Interestingly, the leakage in the frequency domain occurs at a relatively low frequency compared to the clock frequency (it corresponds to several instructions). Thereby, the attacker can identify the leakage signature of a big numbers multiplication versus squaring (for RSA) or point addition versus point doubling (for ECC). From this leakage, the authors devised methods to recover the secret.

Timing attacks are possible on high-end devices, in particular [START_REF] Lipp | Armageddon: Cache attacks on mobile devices[END_REF][START_REF] Zhang | Truspy: Cache side-channel information leakage from the secure world on arm devices[END_REF] highlighted that cache timing attacks can be performed in order to retrieve some informations on mobile devices, even from TrustZone.

Use cases

To test the possibility to attack a modern SoC with EMA, two representative use-cases have been chosen: a CPA on the AES and a template attack on a Verify PIN algorithm.

CPA on AES The first use-case is the well established CPA [START_REF] Brier | Correlation Power Analysis with a Leakage Model[END_REF] applied to the AES.

Targeted algorithm

The Advanced Encryption Standard is a standard established by the NIST [START_REF]NIST: Specification for the Advanced Encryption Standard[END_REF] for symmetric key cryptography. It is a block-cipher, the encryption first consists in mapping the plaintext T of 128 bits into a twodimensional array of 4 • 4 = 16 bytes called the State (4 rows and 4 columns). Then, after a preliminary xor (noted ⊕) between the input and the key K 0 , the AES executes 10 times a round-function that operates on the State. The operations used during these rounds are: The attack In this attack the target is the key of the first round K 0 . To have a divide-and-conquer approach, K 0 is attacked byte per byte. There are only 256 possible values for each byte. The leakage is the EM emission measured at the S-boxes output. It depends on known plaintexts T and the secret key K 0 .

So for each text T , and each guess k in [[0, 255]] a prediction P can be computed.

P (T, k) = SB(T ⊕ k)
In particular it can be noted that the leakage is "value-based" and not, as usually the case, the Hamming Weight (HW) of the value (no leakage is observed in the HW model experimentally).

These predictions are confronted to the traces collected with a Pearson correlation that shows a linear relation between measurements and predictions.

Template attack on a Verify PIN algorithm

The attack summarized here is the attack of Le Bouder et al. presented in [START_REF] Bouder | A template attack against VERIFY PIN algorithms[END_REF].

The target: Verify PIN algorithm In many devices, a Personal Identification Number (PIN) is used to authenticate the user. The main protection in the use of a PIN comes from the fact that the user has a limited number of trials. A PIN is an array of m digits. A True PIN is embedded in the device; and a Candidate PIN is proposed by the user. The different values taken by the PIN are defined in [[0, 9]] m . The Verify PIN is the algorithm which tests if the Candidate PIN is correct or not. A good countermeasure against fault attacks is to compare the correct and Candidate PIN twice. The algorithm for the PIN comparison in constant time, from [START_REF] Riviere | Sécurité des implémentations logicielles face aux attaques par injection de faute sur systemes embarqués[END_REF], is shown in algorithm 1. The attack The goal of this attack is to retrieve the true PIN even if the the number of trials is limited. That is why a template attack is used. It is supposed that an attacker has a profiling device and she can:

Algorithm 1 Comparison between candidate PIN and true PIN

change the true PIN in her profiling device; obtain many traces on her profiling device.

The attack starts with a measurement campaign on the profiling device. Template attacks use a divide-and-conquer approach, the digits of the true PIN are attacked separately. For each value of the pairs, candidate PIN and true PIN (one digit each), (v, k) in [[0, 9]] 2 , traces are collected. M v,k = xk (i,j) , i for trace, j for time.

For effective computations, both for proper floating point arithmetic and to limit the amount of data to handle, a principal component (PCA) preprocessing is used on the data and the matrix M v,k is only considered here after this preprocessing step. After the PCA, our traces have always 10k points each.

The covariance matrix S v,k = sk (j,j ) is computed.

sk (j,j ) = 1 n -1 • xk j -xk j t xk j -xk j .
On the targeted device, a first trace T v = {x j } is collected, where all the candidate PIN digits are equals to v = 0. For each digit the attacker confronts the trace T v to the template matrix S v,k , with the general formula in template attacks (Mahalanobis distance):

F v T v |S v,k , xk ∝ • exp - 1 2 • T v -xk • S -1 v,k • T v -xk t .
The attack returns the guess k v for which F v is maximal for a given T v , or ranks the guesses k according to the value of F v (T v , k).

Experiments

Targeted device

A chip which is representative of what can be found in modern smartphones is targeted. Unfortunately, the public documentation on modern SoC is often sparse. To ease our bare-metal development process, we chose a relatively open platform with some documentation (mostly thanks to the community around it): the Raspberry Pi 2 (RPi2). This board possesses a BCM2836 SoC from Broadcom and features:

a quad-core Cortex-A7 processor (ARMv7) running at 900MHz, a VideoCore IV GPU running at 250MHz, -1GB of LPDDR2 RAM memory running at 400MHz (or 450MHz in Turbo mode), -TrustZone is available.

The processor uses 2 levels of cache: L1 : 32KB, 4-way associative, separate data and instructions, L2 : 512 KB, 8-way associative, unified data and instructions, shared between GPU and CPU.

The RPi2 board features GPIOs allowing to send electric signals directly from our code. In particular, a GPIO has been used to obtain a trigger when our targeted code is executed. This signal is used by the oscilloscope to know when to measure the leakage.

Software implementation

Since we want to measure the impact of the micro-architecture on the sidechannel leakage, our targeted applications run on bare-metal (without OS). Therefore there is no context switching due to the processes scheduling or any other interruptions during the measured computation.

Our custom kernel is an aggregation of different functions, it contains two applications. First AES is a simple naive AES implementation without any countermeasures. Plaintexts are sent to the board through the UART and ciphertexts are returned. PIN is the other application, implementing a secure verify pin algorithm (from [START_REF] Riviere | Sécurité des implémentations logicielles face aux attaques par injection de faute sur systemes embarqués[END_REF]). PIN candidates are sent to the board through the UART which answers if it is correct or not (for experimental purposes, an unlimited number of tries could be done without the secret destruction).

Both applications are always present in the final binary and one is selected at start-up with a proper command sent on the UART. Additionally, a configuration can be chosen at this step to enable or disable several features, namely the TrustZone activation, and the multicore execution. The following configurations have been tested:

1. Default (D): the applications are run in non-secure kernel mode on a single core. The other cores are trapped in an empty infinite loop. Data and instruction caches are enabled but not the MMU. 2. Multicore (M): same as default but now the other cores are active. They generate two pseudo random numbers (using the xorshift [START_REF] Marsaglia | Xorshift rngs[END_REF] algorithm) and compute their GCD in an infinite loop. This simulates an intense computation on all cores (asynchronously from our targeted applications). 3. Secure (S): same as default but the application is executed in secure kernel mode. The other core are inactive. 4. Secure and Multicore (S+M): this configuration executes our application in secure kernel mode while the other cores are active, computing GCD in non-secure kernel mode.

Test Bench

Our EM measurement test bench includes the following devices:

-An EM probe from Langer either a RF-R 0.3-3 or a RF-R 400-1 both with a 30MHz to 3GHz bandwidth (see below), a Langer PA 303 preamplifier (3GHz bandwidth) to amplify the signal from the probe, a DSOS404A oscilloscope from Keysight with a 4GHz bandwidth able to capture up to 20 GSamples per second.

A control computer (Xeon E5-1603v3 @ 2.80GHz, 4 cores, 40GB RAM) is used to orchestrate the measurements and perform the analysis with home-made tools.

In particular, special care was needed when developing our tools to achieve a nice measurement speed, and be able to manage the vast quantity of data that resulted from the experiments. Around 7 hours and 100GB of free disk space are necessary to capture the needed traces for the template on our test bench, and 70 hours to perform an attack.

Preliminary experiments

Now that the applications and the test bench have been described, preliminary experiments need to be done in order to find information leakage. Where should the EM probe be located, what can we see at this location?

For this part, a RF-R 0.3-3 probe from Langer was used (bandwidth from 30MHz to 3GHz). The probe is moved over the board (not only the chip since leakage can occur at other locations) and on both sides of the board.

Then data is measured for 250ns both during a real sbox computation and when no computation at all is performed (idle state). Fig. 1: A trace measured during an s-box computation. A pattern which may be a memory access is stressed out.

A measured trace is shown on figure 1 corresponding to an s-box computation. Patterns can clearly be seen but do not seem synchronized with our computation. A spectrum measurement shows that this pattern main frequency is 400MHz which corresponds to the RAM memory frequency.

Yet even in the presence of these patterns, no leakage was detected with the small RF-R 0.3-3 probe.

Using the big RF-R 400-1 probe instead, the same patterns are present but a leakage can now be detected.

Finally, after a trial-and-error phase, we settle to use the big RF-R 400-1 probe on the back side of the board since this configuration was the best for us to detect a leakage with a CPA. We cannot guarantee that there is no location were the leakage is more spatially concentrated in the absence of a systematic spatial characterization of the leakage (requiring additional apparatus).

Experimental results

CPA The first attacks are CPA on the first round of an AES encryption. Since we are mostly interested in the leakage, we focus on the recovery of one key byte only, yet the attack can easily be generalized to retrieve the full key. The S-boxes are implemented using a look-up table (C array) and no countermeasures are used.

What does not work To perform the attack, various tries (probe, synchronization points, models) have to be done to find a leakage on the default (D) configuration.

We do not find any leakage with the small RF-R 0.3-3 probe, whatever the location (which does not mean that a leaking location for this probe does not exists). The RF-R 400-1 probe is used instead and allows to find a leakage.

The classic Hamming Weight model (meaning that the EM leakage is linearly dependant on the Hamming Weight of the value of interest) does not work. We find the EM leakage is directly linked to the value instead. This was not expected and may hint that new leakage models must be developed for modern SoC.

Finally, the synchronization is the most difficult part of an experimental SCA. In our case, our application runs on bare-metal and no synchronization issue can be caused by an operating system or a virtual machine. Nonetheless, S-boxes are implemented with look-up tables. Meaning that desynchronization can be caused by the memory hierarchy fetching the s-box result. Indeed, when measuring the duration of an s-box with a GPIO raised and fallen before and after the s-box, we observe an important jitter (which can also be attributed to the GPIO subsystem). In order to properly synchronize trigger signal on the first s-box result, a GPIO is raised just before the second s-box execution. Since this second execution is done as soon as the first result is obtained we are synchronous with the first s-box result.

CPA leakage analysis

The CPA results can give information on the leakage characteristics. A CPA is carried on 200k traces of 5k points under 20 minutes: 18 minutes to acquire the data and 2 minutes to compute the CPA results.

The highest positive correlation peak lasts around 20 samples, i.e. 1ns. By comparison, the core clock has a 900MHz frequency, i.e. a clock cycle lasts 1.1ns. In particular, it means that our measurement jitter is low enough to detect a leakage that lasts 1ns. Additionally it explains why synchronization is so hard on high end devices: a 2ns jitter can add a significant noise over a 1ns signal (by comparison, light can travel only around 30cm in 1ns). Smaller correlation Fig. 2: CPA result for the Default (D) configuration, 200k traces and 20GS/s (smallest features take 7 samples as per the maximum bandwidth (3GHz)). Black is for the good key value, grey for all others. peaks can be observed: one is 12ns before the main peak, a second is 41ns after the same main peak (timing measured for positive peak).

All positive peaks are followed by a negative one, this common feature in CPA is usually explained by a value-dependent temporal shift, i.e. in the Hamming Weight model, a 1 or a 0 on a wire have different associated capacitance and as a consequence different speed. However in our settings, the Hamming Weight model is not correct and therefore this explanation does not hold. Yet we did not found a proper explanation for this phenomenon.

We cannot have any certitude to explain these peaks without further information on the chip microarchitecture. Yet the timings suggest a fast memory access (cache): we may be visualizing the data transiting in the memory hierarchy.

CPA results for the different configurations In this paragraph, the influence of the different configurations is tested on the CPA results.

The correlation values as shown on table 1 around 3%, is low in all cases. The leakage signal is hidden behind the noise generated by the numerous SoC subsystems. Yet the power of the CPA means that the secret can be found even in noisy cases. The results shown here required 200k traces acquired in 18 minutes.

The leakage peaks appeared nearly at the same sample for all configurations, simply meaning that the S and M configurations do not impact the timing of the leakage (no cache/memory interference). Template attacks The second attack is a template attack on a Verify PIN algorithm. At first, the small RF-R 0.3-3 probe has been used. Attacks where successful but results were not reproducible: any small variation in our setup (probe position in particular) gave different results.

Since we are interested in the variation of the efficiency of the attack with or without some microarchitecture features enabled, the big RF-R 400-1 probe was preferred (giving reproducible results).

Finally, we use the same RF-R 400-1 probe for both attacks. The results of these attacks are presented in the table 2. One attack (one row of table 2) requires 7 hours of measurements and 70 hours of computation split as follows:

-1 hours to perform the PCA learning step (create the transformation matrix), -3 hours to apply the PCA transformation over all acquired traces, -10 hours to compute the template classes, -50-60 hours to perform the attack on the 150k test traces.

The template attack [START_REF] Bouder | A template attack against VERIFY PIN algorithms[END_REF] is particularly efficient to detect whether the secret PIN digit is equal to the candidate or not. Here, the success metric used is the ratio of successful detection that the secret PIN digit is equal to the candidate (for 10 digit values, a purely random method would have a 10% success rate).

For the 10 secret digit values (for 1 candidate value only), template classes where created from the measurement of 200k traces. In other words, for each secret value, 200k traces where measured and used to characterize the signal corresponding to this secret (forming one template class). This is the learning dataset.

Then 15k additional traces where measured, here again for each secret value. This is the test dataset. Our success rate is measured by trying to match these 10 • 15k = 150k traces to each one of the 10 template classes.

Let r be the actual, true, success rate and p the measured success rate. We can define the maximum error as a value E guaranteeing |p -r| < E. Let σ be our confidence level, i.e. σ = 3 means that we have a 3 standard deviations confidence (≈ 99.7%).

We can link our maximum error and our confidence in this error with the equation 1.

E = σ • p • (1 -p) n ( 1
)
where n is the number of measurements (normal approximation method of the binomial confidence interval).

For p = 0.5, n = 15000 and σ = 3, we obtain E = 1.22% (E is maximized for p = 0.5). In the following result tables, the success rate is given with a confidence of 3 standard deviations (99.7%) that the error is below 1.22%. First, we observe on table 2 that with a 10GS/s sampling rates, the attacks success rate is approximately 37.3% independently of the configuration (all results are in our error interval of 1.22%). The TrustZone and the activity of other cores have no effect on the attack success rate.

It can be observed on the last two rows of table 2 that using a bigger sampling rate can decrease the success rate, below our error interval. We attribute this paradoxical effect to our principal component analysis (PCA) preprocessing that select the dimensions maximizing the variance. Since at the end of the PCA 10kpts traces are obtained whatever the size of the input traces (20kpts or 50kpts), it is possible that the preprocessing reduces our success rate by maximizing variance not linked with the secret, such as variance generated by the activity of other cores.

Therefore, the preprocessing is able to efficiently compress the template data (traces size divided by 5), but at the cost of a reduced success rate. Template attacks may be less sensitive to bad synchronization but they require much bigger computing resources and one has to be careful with the preprocessing (as table 2 shows).

Conclusion

The difficulty of adapting side-channel attacks to high-end devices has often been supposed. We have seen that the true difficulty arises from the need for a more precise synchronization with the leakage.

If the attacker is able to synchronize, simple attacks (CPA) have been shown to be successful. The activity of other cores and the utilization of TrustZone have no effect on the attacks efficiency. As expected the TrustZone, a hardwareassisted software protection mechanism, offers no SCA protection. It may be a problem when most TrustZone capable devices are embedded systems that may endure physical attacks. Yet if synchronization is not possible, there are some attacks (e.g. template attacks) that are able to exploit the time dimension as any other dimension. We hint that such techniques may be more common in the future to overcome the true difficulty with high-end devices: dealing with time precision (problem even worse with an OS or a virtual machine). Here again TrustZone or the activity of other cores have no incidence. But with these attacks, managing the big amount of data generated by our measures may prove to be the limiting factor, requiring better computing resources.

Even if side-channel attacks techniques have to be adapted to the new challenges created by high-end devices, there is no reasons that they will not be as successful as on smartcards. The smartphone industry in particular should rapidly move to SCA-proof technologies before the development of these attacks.

-

  SubBytes, composed by non-linear transformations: 16 S-boxes noted SB, working independently on individual bytes of the State. In the targeted implementation, the S-boxes use a lookup table. -ShiftRows noted SR, a byte-shifting operation on each row of the State. -MixColumns noted M C, a linear matrix multiplication on GF (2 8 ), working on each column of the State. -AddRoundKey a xor between the State and the round-key K r , r ∈ [[0, 10]].

Table 1 :

 1 For 5000 samples, 200k traces and a total duration of 250ns (20GS/s)

	Configuration Maximum correlation Peak sample value
	D	3.1%	2745
	S	3.4%	2746
	M	3.7%	2746
	S+M	3.6%	2747

Table 2 :

 2 Success rates of the template attacks.

	Setup Sampling rate Measure duration Success rate
	D 10 Gsamples/s 2µs (20kpts)	37.84%
	S 10 Gsamples/s 2µs (20kpts)	38.3%
	M 10 Gsamples/s 2µs (20kpts)	37.88%
	S+M 10 Gsamples/s 2µs (20kpts)	36.40%
	D 20 Gsamples/s 2.5µs (50kpts)	35.19%
	S 20 Gsamples/s 2.5µs (50kpts)	32.85%
	M 20 Gsamples/s 2.5µs (50kpts)	18.45%
	S+M 20 Gsamples/s 2.5µs (50kpts)	17.81%