L Franzoni

Advanced modelling for design helping of heterogeneous CLT panels in bending

Keywords: Cross Laminated Timber, bending, modelling, heterogeneities, bending tests, innovative floors

Introduction

Cross Laminated Timber panels are gaining importance in timber construction, due to their advantages coming from their crosswise lay-up. However the heterogeneities affecting their bending behaviour still require advanced tools for being taken into account.

In the first part of the present paper the "low" heterogeneities are mainly represented by gaps between narrow boards of each layer and CLT transverse shear weakness. The suggested equivalent-layer model at the layer scale combined with the 3D exact structure solution [START_REF] Pagano | Exact solutions for rectangular bidirectional composites and sandwich plates[END_REF][START_REF] Pagano | Influence of shear coupling in cylindrical bending of anisotropic laminates[END_REF] and a failure criterion for wood [START_REF] Van Der Put | A general failure criterion for wood[END_REF] provide a good comparison with a reference test (Hochreiner, 2013). Then, parameter studies are performed with the validated model in order to quantify shear effects and the influence of varying layers' number and orientation.

The second part of this paper deals with stronger CLT heterogeneities, namely regularly spaced voids within the panel. The results of an experimental campaign are presented. The experimental behaviour is therefore compared with the behaviour predicted with the equivalent-layer model and design methods for CLT (Eurocode 5, 2004[START_REF] Kreuzinger | Platten, Scheiben und Schalen. Ein Berechnungsmodell fur gangige Statikprogramme (German)[END_REF]. The input mechanical properties are reduced by wood volume fractions. The results of this comparison shows the need of a more accurate modelling which is currently in development. The first results of such a new modelling procedure are presented as well.

INTER / 48 -12 -3 2 Low heterogeneities A previous study (Franzoni et al, 2015) identified the gaps between lateral boards of each layer and CLT transverse shear weakness as the main "low heterogeneities" affecting their bending behaviour. In the following, the modelling procedure and main results are briefly summarized.

2.1

Modelling CLT heterogeneities are taken into account with a combined equivalent layer-based mechanical model at the layer scale (Fig. 1) and the exact 3D solution at the structure scale [START_REF] Pagano | Exact solutions for rectangular bidirectional composites and sandwich plates[END_REF][START_REF] Pagano | Influence of shear coupling in cylindrical bending of anisotropic laminates[END_REF]. The equivalent layer model takes into account the edge-gluing or not of lateral boards by means of simplified hypotheses on layer's mechanical behaviour (Tab. 1). A failure criterion for wood (van der Put, 1982) is implemented in order to include a failure analysis. The reference bending behaviour (Hochreiner, 2013) documents well the elastic and failure response of CLT, highlighting the edge-gluing detachment as a firs failure mode. The comparison is made in terms of panel's global stiffness and failure stages within the apparent elastic regime.

Results

Comparison / edge-gluing. Each equivalent-layer model turns out to fit well the reference behaviour within the corresponding edge-gluing regime. It appears that edge-glued layers increase CLT panel's stiffness of about 8% but introduces also an additional failure mode. Indeed, the edge-gluing detachment is one of the first failure modes, and therefore the discontinuous model gives a better prediction of Elasticity [START_REF] Keunecke | Three-dimensional elastic behaviour of common yew and Norway spruce[END_REF] E Shear effects. The slope variation of failure load trend as a function of panel's slenderness ratio (Fig. 1a) clearly separates the bending failure regime and the rollingshear one. This leads to the identification of a transition slenderness of 15 for a 5-ply CLT and 19 for a 3-ply. The normalized difference between the predicted mid-span deflection and the one using the thin-plates theory quantifies the shear part in deflection as a function of slenderness ratio (Fig. 1b). Figure 2 shows that, from a deterministic point of view, increasing layers' number for a fixed CLT total thickness yields lower failure load (Fig. 2a) and higher mid-span deflection (Fig. 2b). Both cases when the panel is thick and slender are presented. The oscillations in shear failure load trend (blue line in Fig. 2a) derive from the position of shear-compliant cross layers, which change with the lay-up.

L E N E Z G LZ G LN G ZN ν LZ ν LN ν

Strong heterogeneities

Cross Laminated Timber panels having periodic spacing within each layer are already in production. The challenge is to assess the bending efficiency of these lighter and more acoustically efficient floors. Since they are innovative products and the knowledge about them is limited, an experimental campaign has been carried out. A modelling procedure in order to predict their bending behaviour, and especially transverse shear effects, is in development. In this section, the main results of the experiments and the first results of the modelling are presented and discussed.

Experimental campaign

Four-points bending tests on classical and innovative timber floors

The experimental campaign was based on four-points bending tests on classic and aerated CLT floors. The distance between the supports and the loading points was L/3 (where L is the span). The spaced floors had the same regular spacing between boards along both direction and for all layers. The voids were filled with an insulating material (glass wool), having no mechanical properties. The wood species was Norway spruce of strength class S10 (DIN 4074) for the CLT panels and C24 (EN 338) for the spaced floors. Figure 5 and Table 2 present the geometry of the tested specimens as well as the main results. Failure modes: RS = rolling shear; CL = longitudinal compressive; TL = longitudinal tensile

Figure 5 and Table 2 Geometry of the tested panels in four-points bending and main results

Configuration

The measuring system was mainly based on linear variable differential transformers (LVDTs) for displacement measurement. For all specimens the global mid-span deflection (U) and the bending deflection (u) were measured. For some specimen, the absolute rotation (φ) of the plate's cross section was also measured. Then, the effective plate bending stiffness can be computed using the following equations:

( ) = • • 48 • (1) ( ) = • • 18 ( 2
)
where F is the load and L b is the distance between the LVDTs used to measure the bending deflection u. Once the bending stiffness is determined, panel's shear stiff-INTER / 48 -12 -3 ness and shear contribution to deflection can be estimated by means of equations ( 3) and ( 4):

= • ( ) • 216 • 1296 • ( ) -23 • • (3) ℎ!"# $!%&!'()*+ ,!+$)+-$!%&!'()*+ = 216 • ( ) 23 • • (4)
Additionally, the panel's failure load and failure mode were monitored. Table 2 shows the main results of the bending tests Due to its high slenderness, the classical CLT floor failed in bending, with several ductile compressive cracks appearing in the upper layer before the brittle tensile failure of bottom layer. Both specimens of Panel-2 failed in rolling shear, with a significant rotation of transverse boards (Fig. 6), while the other configuration of spaced floors failed in tension in the bottom layer.

Small-scale tests on clear raw timber

In order to mitigate the uncertainity on the mechanical properties for the subsequent modelling procedure, tests for the identification of elastic and strength properties of the raw timber are currently in progress. Axial-parallel to the grain (E L , f L,t , f L,c ) and rolling shear (G ZN , f ZN ) tests have been carried out. The previous study (Franzoni et al, 2015) identified such mechanical properties as the dominant ones when dealing with bending behaviour of crosslams. Moreover, the mechanical properties of clear spruce have been found to be adequate to reproduce CLT bending response. Fig. 7-Table 4 and Fig. 8-Table 5 show the axial and shear tests on clear specimens of timber. The remaining elastic and strength properties for the

3.2

Advanced modelling and existing design methods The bending tests on CLT panels allowed a further validation of the previously described equivalent-layer model. The deflections predicted at the same points of LVDTs lead to the identification of structure's elastic moduli using equations ( 1), ( 3) . Two existing design methods for CLT which allow the direct estimation of the bending stiffness are applied: the gamma-method (Eurocode 5, 2004) and the shear analogy method [START_REF] Kreuzinger | Platten, Scheiben und Schalen. Ein Berechnungsmodell fur gangige Statikprogramme (German)[END_REF]. Both of them are implemented following the instructions found in Gagnon & Pirvu, 2013. Table 6 shows the relative difference between the actual and predicted bending behaviour f CLT panels. From Table 6 it is clear how both the suggested advanced model of equivalent-layer and design methods can reproduce well CLT bending response.

A starting point for analysing more heterogeneous CLT floors could be using the methods presented above and reducing wood mechanical properties by the wood volume fractions. This approach has been already used in Blass & Gorelacher, 2000 for the rolling shear modulus and is common in engineering practice.

A more accurate model for periodically spaced CLT panels is currently in development. This model is based on a homogenization scheme handled by a high-order plate theory [START_REF] Lebée | Homogenization of thick periodic plates: application of the Bending-Gradient plate theory to a folded core sandwich panel[END_REF]. Basically it enforces membrane, bending and shear strains on an elementary unit cell of the spaced crosslam panel (Fig. 9) and equalizes the elastic energy of such an unit cell to the elastic energy of the whole panel. This homogenization approach leads to the identification of panel's bending and shear moduli, which will be used by the plate theory for computing the stresses and displacements. At present, only the membrane-bending step was conducted and therefore only the effective bending stiffness can be computed. Tables 7 and8 present the distances between the actual and predicted behaviour of spaced floors. The equivalent-layer model predicts plate's moduli by means of equations ( 1), ( 3) and ( 4) using the predicted deflections, while the shear analogy method and the homogenization scheme compute directly the plate bending and shear stiffnesses. Due to the significant distance from the reference and from the other models, the gamma method is not presented and it is replaced by the periodic homogenization model.

Conclusion and outlooks

Low heterogeneities. The developed equivalent-layer model turned out to be appropriate to reproduce elastic and strength bending response of CLT panels. The edgegluing of lateral boards does not contribute very much to the bending performance,

INTER / 48 -12 -3

introducing an additional failure mode. The discontinuous layer model gives a better prediction of CLT load-carrying capacity than the continuous layer. Moreover, mechanical properties of clear wood lead to a good comparison with a reference specimen having knots. This suggests the "system effect" when assembling lumber boards in a CLT configuration, which effect is to regularize the presence of knots and increase boards stiffness and strength. The parameter studies performed with the validated model quantified shear effects in CLT in bending and showed the loss and low gains while enlarging the number of layers or the orientation of transverse layers.

Stronger heterogeneities. Reducing wood mechanical properties by wood volume fractions is not sufficient for a reliable design of spaced timber floors, especially with respect to transverse shear effects. This means that such a simplified approach cannot take into account the complexity of stress and strains distribution within these strongly heterogeneous panels. Therefore a more accurate model based on a homogenization scheme is currently in development. First results show that such an advanced model can precisely predict the bending stiffness of spaced floors. Therefore the following steps of this advanced modelling are the prediction of the panel's shear modulus, deflection and failure load/mode. The final aim is to develop a simplified calculation tool for the design of heterogeneous CLT floors in order to encourage their safe application in timber construction.

Blass, H. Gorlacher, R. (2000) Rolling shear in structural bonded timber elements. International conference on wood and wood fiber composites, Stuttgart, Germany. Dahl, K. ( 2009

Figure 1

 1 Figure 1 Schematic representation of continuous (a) and discontinuous (b) equivalent layer with the layer's reference frame

Figure 2

 2 Figure 2 Shear effects on CLT in bending. Failure load trend (a) and shear contribution to mid-span deflection (b) as a function of panel's slenderness ratio

Figure 3

 3 Figure 3 Decreasing CLT bending performance while enlarging the number of layers. Failure load (a) and normalized mid-span deflection (b)

Figure 4

 4 Figure 4 Mid-span deflection (a) and failure load (b) as a function of the varying orientation of transverse layers

Figure 6

 6 Figure 6 Rolling shear failure of transverse boards of spaced timber floors (Panel-2) in bending

Figure 9

 9 Figure 9 Unit cell of spaced CLT floors and imposed membrane (e), bending (χ) and shear (γ) strains

  ) Mechanical properties of clear wood from Norway spruce. PhD thesis, Norwegian University of science and technology DIN 4074-1:2012-06 Sortierung von Holz nach der Tragfahigkeit, Nadelschnittholz. EN 338:2010 Structural timber-strength classes Eurocode 5 (2004): Design of timber structures -Part 1-1: General and rules for buildings, CEN (EN 1995-1-1) Franzoni, L. Lebée A., Lyon, F. Foret, G. (2015) Cross Laminated Timber panels in bending: an equivalent-layer approach (submitted) Gagnon, S. Pirvu, C. (2013) CLT handbook: Cross Laminated Timber. FPInnovations, Quebec, Canada Hochreiner, G. Fussl, J. Eberhardsteiner, J. (2013) Cross Laminated Timber plates subjected to concentrated loading. Experimental identification of failure mechanisms. Strain, 50(1):68-71 INTER / 48 -12 -3

Rolling Shear Tests (ZN)

  Figure 7 and Table4Geometry and results of the axial tests on clear wood. Dimensions in mm Figure8and Table5Geometry and results of the shear tests on clear wood. Dimensions in mm

			INTER / 48 -12 -3
	Axial Tests -Parallel to grain (L)	n	.̅ (MPa)	COV (%)
	Spaced floors-Norway spruce C24 (EN 338)
	E L (tension + compression)	21	12700	17.2
	f L,t	10	85	17.3
	f L,c	8	51	6.4
	CLT floors-Norway spruce S10 (DIN 4074)
	E L (tension + compression)	17	9850	11.8
	f L,t	7	77	13.7
	f L,c	8	38	4.1
		n	.̅ (MPa)	COV (%)
	Spaced floors-Norway spruce C24 (EN 338)
	G ZN	10	110	25
	f ZN	12	1.6	18
	CLT floors-Norway spruce S10 (DIN 4074)
	G ZN	8	70	25
	f ZN	8	1.3	9

modelling are taken from Table

1

. Classic crosslam floors and spaced ones have been supplied from two different producers; hence all results on the respective lumber boards are presented separately.

Table 6

 6 Relative distances between the actual and predicted bending behaviour of CLT

	Comparison -CLT	Gamma	Shear Analogy Equivalent layer -
		Method		discontinuous
	Failure load	-	-	+5%
	Failure mode	-	-	CL
	Global stiffness	-5%	-4%	-4%
	Bending stiffness	-8%	-4.5%	-4.5%
	Shear / bending deflection	-8.5%	+8%	-5.5%

Table 7

 7 Relative distances between the actual and predicted bending behaviour of Panel-1

	Comparison -Panel-1: wood	Shear Analogy* Equivalent layer	Periodic homog-
	volume = 40%		-discontinuous*	enization
	Failure load	-	+40%	in progress
	Failure mode	-	RS	in progress
	Global stiffness	+25%	+23%	in progress
	Bending stiffness	+18%	+16%	-9.5%
	Shear / bending deflection	-73%	-60%	in progress

* Mechanical properties reduced by wood volume fraction

Table 8

 8 Relative distances between actual and predicted bending behaviour of Panel-2

	Comparison -Panel-2: wood	Shear Analogy* Equivalent layer	Periodic homog-
	volume = 25%		-discontinuous*	enization
	Failure load	-	+34%	in progress
	Failure mode	-	RS	in progress
	Global stiffness	+32%	+28%	in progress
	Bending stiffness	+31%	+28%	+2%
	Shear / bending deflection	-84%	-76%	in progress

* Mechanical properties reduced by wood volume fraction

Table 7

 7 and 8 shows that the wood volume fractions approach fails the more the panel becomes heterogeneous. The equivalent-layer model returns less margin of error than the design method. The advanced model based on periodic homogenization gives a good prediction of the effective bending stiffness of strongly heterogeneous panels.


Bruno Robisson

Hélène Le Bouder

Jean-Max Dutertre
email: dutertre@emse.fr

Assia Tria
email: assia.tria@cea.frlebouder

A unified formalism for side-channel and fault attacks on cryptographic circuits

Keywords: Differential Power Analysis, Differential Fault Analysis, Differential Behavioral Analysis, Template Attacks, Fault Sensitivity Analysis, AES 128

Security is a key component for information technologies and communication. Security is a very large research area involved in the whole information technology, related to both hardware and software. This paper focuses on hardware security, and more specifically on hardware cryptanalysis whose aim is to extract confidential information (such as encryption keys) from cryptographic circuits. Many physical cryptanalysis techniques have been proposed in the last ten years but they always belong to one of those very distinct categories: fault and side channel attacks. In this article, a formal link between these two categories is proposed. To the best of our knowledge, this is the first time that a wide class of attacks is described in such a generic manner.

INTRODUCTION

Security is a key component for information technologies and communication. Among the security threats, a very important one is certainly due to vulnerabilities of the integrated circuits that implement cryptographic algorithms to ensure confidentiality, authentication or data integrity (such as smartcards). With the access to one of these circuits, the attacker tries either to reconstruct the functionality of the circuit (reverse engineering) or to recover cryptographic materials when the cryptographic algorithm is known (physical or hardware cryptanalysis). Both threats share a set of techniques. The first one, called side channel attacks, consists in observing some physical characteristics which are modified during the circuit's computation. The second technique, called fault attacks, consists in disrupting the circuit's behavior. The third one consists in getting information about the chip design by direct inspection of its structure. This inspection may be performed by using any kind of imaging techniques or by using destructive means such as abrasion, chemical etching or focused ion beam. Many protections have been proposed to improve security against those types of attacks. But every protection against physical cryptanalysis usually lacks of genericity and is usually very specific to one precise type of attack.

Even if physical cryptanalysis methods seem very different at first sight, several works has been proposed to described them with a commun formalism [START_REF] Micali | Physically Observable Cryptography[END_REF], [START_REF] Mangard | One for All -All for One: Unifying Standard DPA Attacks[END_REF]. But these works only cover side channel attacks. This paper describes a formalism which is commun to both fault and side channel attacks. The short-term aim of this work is to define "new" attacks as new combinations of these concepts and algorithms. Then, we plan to provide efficient and modular implementation of these attacks. The long-term aim of this work is to merge the advantages of attack-specific protections to enable a more generic set of countermeasures.

In the first part of this article, we shortly describe side channel and fault attacks and give an informal explanation of the principles which are common in these two types of attack. The cryptographic algorithm used as example, AES 128 is also described. In the second part of the paper, we present a small set of definitions and the algorithms we use to extract information from physical attacks. Finally, we show that our proposed formalism easily fits with several representative examples.

I. SCOPE OF THE WORK

A. Physical cryptography

This paper deals with physical cryptanalysis of both software or hardware implementation of cryptographic algorithms (such as AES 128 described in I-C). These algorithms encrypt a plaintext with a key to obtain a ciphertext. Physical cryptanalysis is mainly based on the two following techniques:

1) Side channel: Side channel analysis exploits the fact that some physical values or "side channels" (such as power consumption, electromagnetic radiation or computation time) of a circuit depend on the key value [START_REF] Kocher | Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS and Other Systems[END_REF], [START_REF] Paul | Differential Power Analysis[END_REF], [START_REF] Oswald | Power Analysis Attacks -Revealing the Secrets of Smart Cards[END_REF]. A more rough technique consists in measuring directly some key-related internal computations by using micro-probing techniques. There are two subcategories of key recovering techniques based on side channel measurements. The first one, called DPA-like, consists in building a set of mathematical models (i.e. mathematical formulae) from a priori knowledge about the circuit. Each model is associated with an hypothesis on the value of the key. Then, the models are compared with measurements. The model which matches the best with measurements is generally associated with the right key hypothesis. The second kind of side channel attacks needs a profiling step on another circuit. This circuit is supposed to be identical to the target and the attacker is supposed to be able to set the key value. In this case, the profiling step is used either to improve the model a priori (stochastic attacks) or to build a statistical model only based on measurements (template attacks).

2) Faults: Fault attacks consist in disrupting the circuit's behavior. Their aim is to alter the correct progress of the algorithm. Faults are injected into the device using various means such as laser, clock glitches, spikes on the voltage supply or electromagnetic perturbations. A more rough technique consists in modifying the circuit's operation by modifying internal computation through micro-probes, or even modifying the circuit itself by using focused ion beam. There are three subcategories of key recovering techniques that use the results of faults attacks. Algorithm modifications consist either in reducing the ciphering complexity of the cryptographic algorithm [START_REF] Choukri | Round Reduction Using Faults[END_REF] or in bypassing hardware or software protections. Differential Fault Attack (DFA), originally described in [START_REF] Boneh | On the importance of checking cryptographic protocols for faults[END_REF], [START_REF] Biham | Differential fault analysis of secret key cryptosystems[END_REF] and in enhanced in [START_REF] Piret | A differential fault attack technique against SPN structures, with application to the AES and Khazad[END_REF], [START_REF] Moradi | A Generalized Method of Differential Fault Attack Against AES Cryptosystem[END_REF], [START_REF] Mukhopadhyay | An Improved Fault Based Attack of the Advanced Encryption Standard[END_REF], [START_REF] Tunstall | Differential Fault Analysis of the Advanced Encryption Standard Using a Single Fault[END_REF], [START_REF] Giraud | DFA on AES[END_REF], [START_REF] Roche | Combined Fault and Side-Channel Attack on Protected Implementations of AES[END_REF], consists in retrieving the key by comparing the correct ciphertexts with faulty ones. A detailed comparison of DFA schemes against AES, for example, is given in [START_REF] Sakiyama | Information-Theoretic Approach to Optimal Differential Fault Analysis. Information Forensics and Security[END_REF]. To perform the third kind of fault attacks, called safe-error attacks [START_REF] Yen | Checking before output may not be enough against fault-based cryptanalysis[END_REF], [START_REF] Robisson | Differential Behavioral Analysis[END_REF], [LSG + 10], the attacker does not necessarily need pairs of correct and faulty ciphertexts but only some information about the chip's behavior.

B. Principle of the considered class of physical attacks

This paper does not deal yet with attacks which aim to modify the algorithms (by using fault or circuit modifications). It focuses on the different kinds of side channel attacks (DPAlike, stochastic or template), DFA and safe-error attacks.

For such attacks, physical access to the circuit gives information about the internal computations of the cryptographic algorithm. Thanks to these pieces of information, the attacker is able to apply a divide and conquer approach. Instead of retrieving the whole key in one step (typically constituted of one hundred to one thousand bits), the attacker performs the same elementary attack step several times. Every elementary attack enables him to retrieve a small part of the key, called a partial key (typically 8 bits for AES 128 ). At the end, the attacker is able to rebuild the whole key. We claim that the elementary steps of the attacks share the following method:

• Launch cryptographic operations on the target. Each launch is called an experiment. Different kinds of experimental data such as power, electromagnetic emission (EM), inputs or outputs, detailed in II-A, are recorded during these experiments. • Make sure that some of these measurements are related to some others through the partial key. A more formal definition of "relations" between measurements and the key is provided in II-B. • Build models that explain the relationship between these measurements. These models are parametrized with one value of partial key. These models are mathematical formulae determined either by a priori knowledge on the chip or by using additional measurements. Examples of models used for attacks are described precisely in II-C. • Compare the models to the measurements, by using the algorithms described in II-D. The best-fitted models with the measurements are generally models associated with the partial key.

To illustrate our formalism, we use as main example the AES crypto-algorithm shortly described above.

C. Example of cryptographic algorithm : AES 128

AES is a standard established by the NIST [START_REF] Preneel | Specification for the Advanced Encryption Standard[END_REF] for symmetric key cryptography. In this paper, we focus on the 128-bit-key version of the AES (represented in Figure 1). This algorithm ciphers a 128-bit long data (called plaintext or input) by using a 128-bit long key to obtain a 128-bit long data (called ciphertext or output). The encryption consists first in transforming the input data into a two-dimensional array of bytes, called the state. Then, after a preliminary XOR between the input and the key, AES 128 executes 10 times a function (called round) that operates on the state. The operations used during these rounds are the following ones:

•

II. PROPOSED FRAMEWORK

A. Attacker's environnement 1) Observable data: As explained above, physical attacks are based on experiments, i.e. the launches of cryptographic operations on the target with or without modifying its behavior. During these experiments, the attacker is able to directly collect data such as digital values or analog ones. This set of values are further called observable data, or observables. Some observables, called stimuli, are used to launch the cryptographic operations and generally change at each experiment: plaintexts, whether there are perturbations or not, etc. Some observables also define the experimental setup and generally do not change during the experiments: kind of probes, gain and bandwidth of the amplifier, oscilloscope type, key value, etc. At last, some observables are the reactions or responses of the circuit according to the stimuli and the experimental setup. There are numerous reactions which can be recorded by the attacker:

• the EM, power traces or the signal provided by a microprobe.

• the ciphertexts obtained without or with perturbations (faulty ciphertexts). • the behavior (i.e. the normal or abnormal working) of the circuit in case of fault. This behavior may be determined, for example, by comparing the correct and faulty ciphering, by detecting the start of an alarm or not, the raise time of the alarm or by detecting a more or less premature stop in computation. • the computation time. One way to measure this computation time consists in reducing the clock period step by step (on a specific clock cycle) and analyzing the circuit's behavior. The step in which the behavior of the circuit switches from normal to abnormal is considered as an indicator for the computation time. This particular step is called "fault intensity" in [LSG + 10].

Note that we also consider that any combination of observables or any observable obtained by applying any signal processing technique (filtering, temporal to frequency transformation, etc.) is also considered as an observable.

2) Hidden data: At the opposite of observables, the execution of a cryptographic algorithm involves data that cannot be directly measured by the attacker. This piece of data is called hidden data or internal data in the following paragraphs.

3) "Border" between observables and hidden data: The border between observables and hidden data depends on the target and the attacker's means (i.e. laboratory equipment and threat scenario). In the following paragraphs, without loss of generality, the hidden data are the internal variables as defined in the standard (from round [1].start included to round[10].s row and every variable computed in the key schedule).

4) Dimension of observables:

The measurements of observables may naturally be grouped in vectors or matrices of several dimensions. The power consumption, recorded with an oscilloscope, varies with the time. A power record (or trace) is thus a set of measurements which is grouped in a vector (dimension 1). An EM record, recorded with a EM probe moving in a plan above the chip, is naturally grouped in a 3-dimension matrix (time and X-Y location of the probe). For the sake of simplicity, we consider that a reaction is a scalar value (its dimension is equal to zero).

B. Relationships between variables

As they are computed by or emanate from the same circuit, hidden data and observables are physically related to each others. These relationships can be described by a mathematical expression (for example between the plaintext, the key and the ciphertext in a nominal environment), some others cannot (for example between the plaintext, the key and the power consumption). But even if there is no mathematical expression for these relationships, the authors in [START_REF] Micali | Physically Observable Cryptography[END_REF], [START_REF] Mangard | One for All -All for One: Unifying Standard DPA Attacks[END_REF] have introduced the notion of leakage function for side channel attacks. These functions formalize the relationship between some internal data (which are generally binary values) and some analog signals (such as power, EM, etc.). To extend this notion to fault attacks, we also consider "error leakage" functions. These functions formalize the modification by a fault of an internal data. As the internal data considered in physical attacks are generally for AES 8-bit values, each endomorphism of a set of 8 bits can be considered as a possible error function.

An exploitable relationship is a relationship between observables. This kind of relationship can be used to perform an attack by using a divide and conquer approach. Thus, such a relationship needs to involve only a partial key. Note that a relationship may be exploitable even without a mathematical expression. Examples of widely used exploitable relationships are reported in Table I. The relations only involves each byte of the state but for clarity are written, in this Table, for the whole state. In the following paragraphs, we note p = R(F, k, O) the relation that links the reactions p and a set of observables O according to the value k of the key and a set of leakage functions F .

C. Relationship models

In the exploitable relationships described above, there is at least one unknown value: the partial key (or guess). So, the attacker has to create as many models as there distinct values of the guess key (i.e. 256 possibilities for an 8-bit guess key). For some relationships, other hidden data and one or several leakage functions also have to be guessed. It is impossible to test every possible leakage function because of their tremendous (even infinite in the case of side channel functions) number. The heuristics commonly used to choose one leakage function or a set of leakage functions are based on measurements or on a priori knowledge about the circuit and the measurement setup. Only the last case which concerns DPA-like, DFA and safe-error attacks, is described here. In this case, the models are built on the following small set of functions but other constructions are proposed for example in [START_REF] Doget | Univariate Side Channel Attacks and Leakage Modeling[END_REF]. b) Weighted sum: Let B be a set of N bits and Ω be a set of N integer, real or binary numbers. The function Ω is the sum

1) Elementary functions:

Ω (B) = b N * ω N + b N -1 * ω N -1 + . . . + b 1 * ω 1 + b 0 * ω 0 c) Select subset (or restriction) of bits: Let B (resp. Ω) be a set bits b i (resp. omega i ). The set of bits b i of B such that ω i of Ω is equal to "1", is noted R Ω (B).
Example: if Ω = {0, 0, 1, 0, 0, 1, 0, 0}, we have Ω d = 36 and the restriction of B by R 36 is the set of bits {b 5 , b 2 } of B. Note that if B is constituted of N values, there are 2 N -1 possible restrictions. A restriction is said monobit when only one bit of the byte is considered. So, the monobit restrictions are R 1 , R 2 , R 4 , . . . , R 128 .

d) Subset of bits equal to: Let Ω and B be two sets of N bits. Let M be the number of bits of the restriction of R Ω (B) and α a set of M bits. We note R Ω (B) == α the function that returns 1 when, for any bit i of R Ω (B) and α, we have R Ω (B) i == α i and returns 0 otherwise.

2) Side channel functions: The simplest model proposed for power consumption consists in considering the value of a single bit. In this case, the leakage function is R i with i ∈ {1, 2, 4, . . . , 128}. But more generally, side channel functions are chosen as a combination of selections and weighted sums. For example, the number of 1 values in a binary number B is called Hamming weight and is noted HW (B) = 1 (B). A variation consists in considering the number of transitions between two binary values. This function, called Hamming distance, is noted HD(B, Ω) = HW (B ⊕ Ω). c) Behavior: When a fault sets a set of bits R Ω (B) of B to some value α, the circuit behavior is normal only when the perturbed result is expected to be equal to α and is abnormal otherwise. Such a behavior may be described by using the function R i (B) == α.

d) Setup time violation: When the faults are created by violating the setup time of latches, these faults may impact first the bytes which have the higher Hamming weight or may impact first only one bit. In the first case, chip's behavior may be described by a Hamming weight and in the second case by the function that selects one bit R i with i ∈ {1, 2, 4, . . . , 128}.

D. Key retrieving algorithm

In this part, we explain how to deal with exploitable relationships and measurements in order to discover a partial key. The first input of the algorithm 1 is a relationship between a set of observables and reactions. The models of this relationship is parameterized by the set of all the possible partial keys K and a set of models F . This set of models formalizes the knowledge of the attacker about the circuit and the measurement setup. Two cases arise: in the first case, the attacker considers that one of these models is more probable than the others but he doesn't known which one is the good one (case "dist(F)=one"). In the second case, he considers that all the models are possible and are equiprobable (case "dist(F)=several"). The second input of the algorithm is the method to select the good or the bad key from a comparison between the prediction and the measurements. The different comparison methods are described in the algorithm 2. Roughly, when predictions and measurements are both discrete variables and when the "noise" in the measurements is considered negligible (it is typically the case for DFA), a sieve algorithm can be used. But when taking noise into account or when either predictions or measurements are continuous variables, some statistical distinguishers are preferred (a counting algorithm or a statistical similarity measurement). Mutual information (MIA) [START_REF] Gierlichs | Mutual Information Analysis -A Universal Differential Side-Channel Attack[END_REF], Pearson correlation [START_REF] Brier | Optimal Statistical Power Analysis[END_REF], distance of means (DoM) [START_REF] Paul | Differential Power Analysis[END_REF] plan to define "new" attacks as new combinations of these concepts and algorithms. It will also enable to provide efficient and modular implementations of these attacks. Further works will consist in including in the proposed formalism template attacks, collision or algebraic attacks. Another future work will consist in integrating in our scheme the higher-order attacks.

  A byte B is a set of 8 bits noted {b 7 , b 6 , b 5 , b 4 , b 3 , b 2 , b 1 , b 0 }. The set with every bit set to one (resp. zero) is noted 1 (resp. 0). We match it with B the binary value B b = b 7 b 6 b 5 b 4 b 3 b 2 b 1 b 0 but for the sake of simplicity, B and B b will be used indifferently. The decimal value associated with B is noted B d (for this conversion, b 0 is the less significant bit). O = f (round[1].start) O=micro-probing,EM, with round[1].start = SubBytes(AddRoundKey(P, k sch[0]) power, behavior R 2 P=plaintext k sch[0] O = f (round[1].start), IN IT ) O=Power,EM INIT with round[1].start = SubBytes(AddRoundKey(P, k sch[0]) R 3 C=ciphertext k sch[10] O = f (round[10].start) O=Micro-probing,EM, with round[10].start = SubBytes -1 (Shif tRow -1 (AddRoundKey(C, k sch[10]))) power, behavior R 4 C=ciphertext k sch[10] O = AddRoundKey(Shif tRow(SubBytes(f (round[10].start))), k sch[10]) O=faulted ciphertext with round[10].start = SubBytes -1 (Shif tRow -1 (AddRoundKey(C, k sch[10]))) R 5 C=ciphertext k sch[10] C ′ = h(AddRoundKey(round[10].s row ′ , f (k sch[10]))) O=faulted ciphertext round[9].s row with : or power round[10].s row ′ = Shif tRow(SubBytes(AddRoundKey(k sch[9] ′ , round[9].s row))) k sch[9] ′ = g(AddRoundKey(round[10].start, round[9].s row)) round[10].start = SubBytes -1 (Shif tRow -1 (AddRoundKey(C, k sch[10]))) TABLE I WIDELY USED RELATIONSHIPS a) Bit level functions: The logical operations AND (symbol &), OR (symbol |) and XOR (symbol ⊕) defined on a byte are considered bitwise.

3 )

 3 Error functions: a) Bit flip: A fault may invert a set of bits. The function which models the bit flip is the bitwise XOR between B and Ω with Ω d ∈ [1, . . . , 255]. When all the bits of the bitflip Ω are equal to 1 (resp. 0), all the bits are inverted (resp. unchanged). b) Set and reset: A fault may set a set of bits to specific values. The function which models the reset (resp. set) is the bitwise AND (resp. OR) between B and Ω with Ω d ∈ [1, . . . , 255]. A reset with Ω d = 0 returns a set of 0. A set with Ω d = 255 returns a set of 1.

  The rounds are identical, except for the last one in which the Mixcolumns operation is skipped. At the end of the ciphering operations, the state is copied to the output as depicted in Figure1.

		M
		(plaintext)
	Round 0	AddRoundKey
			K0
			(global key)
		SubBytes
		ShiftRows
	Round i
	1..9	MixColumns
		AddRoundKey
		K1..K9
		(round key 1..9)
	State Mi
		SubBytes
	Round 10	ShiftRows
		AddRoundKey
			K10
		Ciphertext C	(round key 10)

SubBytes is a non-linear transform working independently on individual bytes of the State. The result of this operation at round i is noted round[i].s box • ShiftRows is a rotation operation on each row of the State. The result of this operation at round i is noted round[i].s row • MixColumns is a linear matrix multiplication working on each column of the State. The result of this operation at round i is noted round[i].m col • AddRoundKey is a byte-wise XOR between the State and a value k sch[i], computed from the key (according to a transform called Key Expansion which is not detailed in this paper). The result of this operation is the start of the next round noted Round[i + 1].start.

Fig. 1. AES 128 encryption algorithm.

  or principal component (PCA)[SNG + 10] are possible examples of such statistical similarity measurement tools.Once these parameters are chosen, the measurements are processed in an incremental way, i.e the attacker tries to

	Attack	Relationship	Leakage functions	Similarity
			and parameters	and statistical
			and probablitity	tool
	Probing	R1	f (x) = RΩ(x) with	All
		P=Plaintext	Ω ∈ {1, 2, 4, . . . , 128}	All
		O=Probe value	and dist(F ) = one
	DPA	R3	f (x) = RΩ(x) with	CORR with
	[KJJ99]	C=Ciphertext	Ω ∈ {1, 2, 4, . . . , 128}	DoM
		O=Power	and dist(F ) = one
	CPA	R2	f (x) = HW (x ⊕ Ω) with	CORR with
	[BCO03]	P=Plaintext	Ω ∈ [[1, 255]]	Pearson
		O=Power	and dist(F ) = one
	MIA	R1	f (x) = HW (x)	CORR with
	[GBT07]	P=Plaintext		Mutual
		O=Power		Information
	FSA	R3	f (x) = HW (x)	CORR with
	[LSG + 10]	C=Ciphertext	or	Pearson
		O=Intensity	f (x) = RΩ(x) with
			Ω ∈ {1, 2, 4, . . . , 128}
			and dist(F ) = one
	DBA	R1	f (x) = (RΩ(x) == 0) with	CORR with
	[RM07]	P=Plaintext	Ω ∈ [[1, 255]]	Pearson
		O=Behavior	and dist(F ) = one
	DFA	R4	f (x) = x ⊕ Ω with	SIEVE
	[Gir05]	C=Ciphertext	Ω ∈ [[1, 255]]
		O=Faulted	and dist(F ) = several
		Ciphertext
	DFA	R5	h(x) = x and	COUNT
	[RLK11]		g(x, Ω) = x ⊕ Ω with
		C=Ciphertext	Ω ∈ [[1, 255]]
		O=Faulted	and dist(G) = one
		Ciphertext	f (y, Γ) = y ⊕ Γ with
			Γ ∈ [[1, 255]]
			and dist(F ) = one
	Combined	R5	h(x) = HW (x)	CORR with
	[RLK11]	C=Ciphertext	f and g as	Pearson
		O=Power	defined above

TABLE II EXAMPLES

 II OF APPLICATION OF THE FORMALISM

recover this partial key with a reduced set of measurements. If no partial key can be distinguished, then the attack is performed with other measurements. He proceeds in this way until the partial key is recovered.

Algorithm 1 Algorithm to distinguish the key (and the model) from the relationship R Require: p = R(K, F, O) : A relationship with:

III. APPLICATIONS

In order to show that our formalism covers a wide class of attacks, the relationships (described in II-B) and the parameters for the algorithms (described in II-D) are reported in II for different attacks proposed in the literature. A simple but new attack is also proposed. It consists in probing the signal on one wire of a 8-bit data bus where the outputs of the Sboxes are supposed to pass through. Each leakage model corresponds to one bit of these outputs. If the attacker is able to temporally distinguish between the outputs of all the Sboxes, every method described above used to compute the similarity works. Otherwise, a method based on correlation is preferred. The attack scheme shows that the attacker may retrieve every bit of the key by probing only one single wire.

CONCLUSION

This paper presents a formalism which is common for a wide class of physical attacks. It highlights that, despite their differences in term of experimental setup, all these attacks share the main underlying set of concepts and algorithms. This paper also shows that this set is relatively small. It enable to


Bruno Robisson
email: bruno.robisson@cea.fr

Hélène Le Bouder

Physical functions: the common factor of side-channel and fault attacks?

Keywords: Differential power analysis, differential fault analysis, differential behavioral analysis, template attacks, fault sensitivity analysis, AES 128

Physical attacks on cryptographic circuits were first identified in the late 1990s. These types of attacks, which are still considered very powerful, are generally classified into two main categories: "fault attacks" and "side-channel attacks." To secure circuits against such attacks, it is crucial to develop appropriate methods and tools that enable accurate estimates of the protection mechanism's effectiveness. Numerous studies have described such methods and tools but, to the best of our knowledge, these previous investigations have considered side-channel attacks or fault attacks but not the combination of the two types. The present article proposes a combined investigation of both main types of attack by describing them with the same terminology and the same algorithm. This approach is made possible by introducing the concept of "physical functions" as an extension of the concept of "leakage functions," which are widely used in the side-channel community. The paper represents a first step toward applying the strong theoretical background developed for side-channel attacks to the investigation of fault attacks. Besides, the proposed approach could potentially make it easier to combine side-channel attacks with fault attacks, which could certainly facilitate the discovery of new attack paths.

Introduction

Integrated circuits (ICs), which are used in a wide variety of electronic devices, play a key role in securing information and communications technologies. Because certain types of ICs (such as smart cards) may easily fall into the hands of people with malicious intentions, such devices are particularly vulnerable to "physical attacks." In general, the distinctive feature of these attacks is the use of experimental techniques. The first such technique, called "side-channel analysis," is based on observing certain physical characteristics of the targeted device (such as power consumption, electromagnetic radiation, response time, etc.) that vary during the circuit's computation. The second technique, called "fault analysis," is based on disturbing the circuit's behavior through laser beams, voltage or clock glitches, electromagnetic pulses, etc. An attacker can use these techniques to bypass security functions, retrieve design details, or obtain and manipulate data (cryptographic material, PIN codes, personal data, etc.). Techniques in which the attacker targets exclusively cryptographic material are often referred to as "physical cryptanalysis" or "key recovery" algorithms. Various physical cryptanalysis methods have been proposed: for example, differential power analysis [START_REF] Paul | Differential power analysis[END_REF][START_REF] Oswald | Power Analysis Attacks -Revealing the Secrets of Smart Cards[END_REF], stochastic attacks [START_REF] Schindler | A stochastic model for differential side channel cryptanalysis[END_REF], template attacks [START_REF] Chari | Template attacks[END_REF][START_REF] Standaert | Using subspace-based template attacks to compare and combine power and electromagnetic information leakages[END_REF], collision attacks [START_REF] Blömer | Fault based collision attacks on AES[END_REF][START_REF] Moradi | Statistical tools flavor side-channel collision attacks[END_REF], differential fault attacks [START_REF] Boneh | On the importance of checking cryptographic protocols for faults[END_REF][START_REF] Biham | Differential fault analysis of secret key cryptosystems[END_REF][START_REF] Ali | Differential fault analysis of aes: towards reaching its limits[END_REF][START_REF] Barthe | Synthesis of fault attacks on cryptographic implementations[END_REF], and safe-error attacks [START_REF] Yen | Checking before output may not be enough against fault-based cryptanalysis[END_REF][START_REF] Robisson | Differential behavioral analysis[END_REF][START_REF] Li | Fault sensitivity analysis[END_REF]. Although these methods may seem initially unrelated because they require different experimental methods and different algorithms, several studies have investigated a common framework to describe side-channel attacks [START_REF] Micali | Physically observable cryptography[END_REF][START_REF] Standaert | A unified framework for the analysis of side-channel key recovery attacks[END_REF][START_REF] Durvaux | How to certify the leakage of a chip?[END_REF]. In addition, a recent article has proposed another framework to describe all differential fault-attack schemes [START_REF] Guo | Security analysis of concurrent error detection against differential fault analysis[END_REF]. By providing a strong theoretical basis, such frameworks aim to enable the development of practical tools that make it possible to estimate the amount of information leaked by circuits, thereby increasing the level of trust in such devices. This paper describes concepts and algorithms that are common to a wide set of key recovery methods, regardless of whether they are based on using fault or side-channel experimental setups. The AES 128 cryptographic algorithm is used to demonstrate these concepts and algorithms [START_REF] Johansson | Announcing the Advanced Encryption Standard (AES)[END_REF].

The paper first describes a general model for the functioning of integrated circuits in the context of physical attacks. "Physical functions" that formalize the relationships between data computed inside the circuit (and considered secret) and certain variables that may be measured externally by the attacker seem to be at the core of such attacks. Several examples of such functions are provided in Section 2. The principles of fault and side-channel attacks that are based on physical functions are described in Section 3. Several illustrations, extracted from the literature, are included.

2 Model of the integrated circuit

Observables versus internal variables

Physical attacks are based on experiments involving cryptographic operations that act on the circuit with or without a modification of its behavior. During these experiments, the attacker is able to directly measure data (also called "observables") such as -Electromagnetic emissions (EM), power consumption traces (power), or signals provided by particular sensors called µ-probes. -Plaintext or ciphertext obtained without or with perturbations (called "faulty" ciphertext). -The circuit behavior (i.e., normal or abnormal functioning) in case of fault. This behavior may be determined, for example, by comparing correct and faulty ciphering, by detecting an alarm signal, or by detecting a more or less premature stop in computation. -The time needed to execute the cryptographic operations. One way, among others, to measure this computation time is to reduce the clock period step by step (on a specific clock cycle) and analyze the circuit's behavior. The step in which the behavior of the circuit switches from normal to abnormal is considered an indicator of the computation time. This particular step is also referred to as "fault intensity" in [START_REF] Li | Fault sensitivity analysis[END_REF].

Note that the term "observable" may refer to any combination of observables or any observable obtained by applying a signal processing technique or a mathematical transformation (such as filtering, temporal to frequency transformation, etc.).

In contrast to the observables, the execution of a cryptographic algorithm involves data that cannot be measured directly by the attacker. In the following paragraphs, the terms "internal" or "intermediate" are used interchangeably to refer to this type of data. The attacker looks for certain such internal variables that are called "target" or "secret" data.

Relationships

Variables are related to each other because they are computed by, or originate from, the same circuit (i.e., internal data and observables). Hardware and/or software descriptions generally define the links that exist between pieces of internal data during the normal functioning of the circuit (i.e., without perturbations created by the attacker). These links are also known as "algorithmic" relationships. The possible connections between internal data and observables are referred to as "physical" relationships.

Algorithmic relationships

The present investigation used the 128-bit version of the AES standard (denoted by AES 128 ), which is a specification for symmetric key cryptography established by the U.S. NIST [START_REF] Johansson | Announcing the Advanced Encryption Standard (AES)[END_REF]. It ciphers a 128-bit piece of data called "plaintext" (or "input") by using a 128-bit key, producing a 128-bit piece of data called "ciphertext" (or "output"). The encryption process consists in first transforming the input data into a two-dimensional array of bytes, known as a "state." Then, following a preliminary bitwise XOR operation between the input and the key, AES 128 executes 10 instances (also called "rounds") of a function that operates on the state. The following operations are used during these rounds:

-SubBytes (SB) is a non-linear transformation that works independently of the individual bytes of a state. AES rounds are identical, except for the final round, which skips the MixColumns operation. At the end of the ciphering operations, the state is copied to the output.

Physical relations

For side-channel attacks, the connection between internal data and observables is referred to as a"leakage function" [START_REF] Standaert | A unified framework for the analysis of side-channel key recovery attacks[END_REF]. To extend this notion to fault attacks, the present investigation also considered "error functions," which are used to model the effect of a fault injection on a piece of internal data. Leakage and error functions are referred to as "physical functions" because they are both at the heart of any physical attack. These functions are detailed in the following section.

Models of physical functions

Models of physical functions proposed in the literature can be divided into 1)"real" functions (i.e., each input corresponds to exactly one output) and 2) functions in which inputs and outputs are considered random variables; these two categories are respectively known as "deterministic" and "probabilistic" physical functions.

A nonexhaustive list of typical physical functions is proposed in the following.

Bit level functions

The logical operators AND (symbol ∧), OR (symbol ∨), and XOR (symbol ⊕) defined for a byte are considered bitwise.

Subsets of bits

Let B be a set of N bits {b N -1 , .

Subset of bits equal to

Let Ω and B be two sets of N bits. Let M be the number of bits of the subset R Ω (B) and α be a set of M bits. The function denoted by R Ω (B) == α d returns 1 when, for all bits i ∈ {0, . . . , M -1} in R Ω (B) and in α, we have R Ω (B) i == α i and returns 0 otherwise. For example, as explained above, R 36 (B) contains two bits which may take on four different values. R 36 (B) == 0 is equal to 1 for any B such that B = {b

Deterministic physical functions

Deterministic leakage functions

The simplest model proposed for power consumption is based on considering the value of a single bit. In this case, the leakage function is R i with i ∈ {1, 2, . . . , 128}.

In general, side-channel functions are typically chosen as a combination of subsets and weighted sums. For example, the number of 1's in a binary number B is called the Hamming weight and is denoted by HW (B). A variation considers the number of transitions between two binary values B and C. This function, called the Hamming distance, is denoted by HD(B, C) = HW (B ⊕C).

Deterministic error functions

Bit flip A fault may invert a set of bits. The function that models the bit flip is the bitwise XOR between B and Ω with Ω d ∈ [0, . . . , 255]. If all bits in Ω are equal to 1, then all bits are inverted; if all bits in Ω are equal to 0, then all bits remain unchanged.

Set and reset A fault that forces bits to take on the value 0 is generally called a reset. The function that models such a reset is the bitwise AND between B and Behavior In a generalization of the set and reset models, a fault may force a set of bits R Ω (B) in B to take on some value α. In such a case, the circuit behavior is normal only when the perturbed result is expected to be equal to α and is abnormal otherwise. This behavior can be described by using the function R Ω (B) == α.

Ω with Ω d ∈ [0, . . . , 255

Running time (or 'fault intensity')

Faults that are produced by violating the latch setup times may either affect only one bit or affect initially bytes with a higher Hamming weight [START_REF] Michel Agoyan | When clocks fail: On critical paths and clock faults[END_REF][START_REF] Li | Fault sensitivity analysis[END_REF]. In the first case, the chip's behavior can be described according to the function that selects one bit R i with i ∈ {1, 2, 4, . . . , 128}; in the second case it is described according to the Hamming weight.

Probabilistic physical functions

In the probabilistic case, the input X and output Y of the physical functions are considered discrete random variables. X and Y have sample spaces of S X = {0; 2 M -1} and S Y = {0; 2 N -1}, respectively. In accordance with [START_REF] Moradi | Statistical tools flavor side-channel collision attacks[END_REF][START_REF] Li | Exploring the relations between fault sensitivity and power consumption[END_REF], the probabilistic relationship is modeled with a joint probability mass function (joint pmf ). The joint pmf of the discrete variables X and Y (used to model a physical function f with domain X and co-domain

Y ) is denoted by f X,Y (x, y) = P r(X = x, Y = y), irrespective of x ∈ S X and y ∈ S Y .
Examples of joint pmf are described in the following sections.

Probabilistic leakage functions

Consider a physical relationship that links the integer values of an 8-bit piece of data to the measured current consumed by the circuit handling these values. A classic probabilistic leakage function considers that the current consumption of the data x is the sum of the Hamming weight of x and a Gaussian noise [START_REF] Chari | Template attacks[END_REF]. This assumption holds, for example, when the data switches from the all-zero value to the value x. This switch occurs, for example, during the transfer of data between the memory and the pipeline of a microprocessor on a pre-charged bus. In such a case, we have f (x) = a * HW (x) + e, where e models the "noise" as a normal random variable with a mean 0 and a given standard deviation. Figure 1 (left) describes the corresponding pmf (the values of a = 6 and a noise with a standard deviation of 2 were chosen arbitrarily to illustrate the example). Integer values for 8-bit data are reported in abscissa; the corresponding current consumption is given in ordinates. The grayscale illustration (Fig. 1, left) represents probabilities: the darker the shade, the higher the probability that the circuit consumes a current of value y when the manipulated data has the value x (shorter x "consumes" y). Figure 1 (right) illustrates the same pmf measured for a real component. Measurements were obtained with a 32-bit software implementation of AES 128 running on a 32-bit unsecured up-to-date microcontroller. This particular case shows a remarkably good fit of the theoretical and practical relationships.

Probabilistic error functions

Consider a physical relationship that, for an 8-bit register, links the integer values to the values that were modified through some type of fault injection. One widely used model is based on the assumption that any one of the register's 8 bits will flip, with equal probabilities for each of these bit flips (i.e., equal likelihood hypothesis). Here, this model, denoted by f (x) = x ⊕ Ω with Ω ∈ {1, 2, 4, . . . , 128} in decimal value and (P r(Ω) = 1/8)∀Ω, is referred to as the "random monobit fault model." This type of theoretical model was, for example, used in [START_REF] Giraud | DFA on AES[END_REF]. Figure 2 (left) illustrates the corresponding pmf. The integer values of the 8-bit register are reported in abscissa; the corresponding faulted value is given in ordinates. The grayscale illustration (Fig. 2, left) represents probabilities: the darker the shade, the higher the probability that x is changed into y. Figure 2 (right) shows the same pmf measured experimentally, obtained with a hardware implementation of the AES 128 , which was faulted by reducing the clock period that feeds the circuit (in accordance with [START_REF] Michel Agoyan | When clocks fail: On critical paths and clock faults[END_REF]). To avoid creating faults on several bits instead of on only one bit, this clock period was deliberately reduced by only a small amount. The faulted bit was dependent on the plaintext value.

In this example, there is a clear distinction between the theoretical and the experimental pmf. In fact, although monobit faults are identifiable in the experimental setup, some bits seem to be more easily modifiable than others. In this case, the equal likelihood hypothesis does not hold.

Physical functions for physical cryptanalysis

The scenario of a physical cryptanalysis (i.e., targeting cryptographic material only) is exemplified by numerous attacks that have been proposed in the literature: µ-probing attacks, differential power analysis (with or without a profiling phase), differential fault analysis, and safe-error attacks (e.g., differential behavioral analysis and fault sensitivity analysis). The key retrieval algorithm described in the following applies to all of these physical attacks.

Definition

An attack path is a relationship between observables that involves the secret (or only part of the secret) and that enables the recovery of information about it. In the following paragraphs, P = REL(C, F, O) denotes the attack path that links the observables O to P according to the (unknown) value of the internal variables C (among them, the secret) and according to a set of (un-known) physical functions F . Although the relationship between P and O is not necessarily causal, the observables O are also known as "stimuli" and the observables P are referred to as "reactions" or "responses".

Examples of attack paths

The attack path used in [START_REF] Paul | Differential power analysis[END_REF] and denoted by REL power links the j th plaintext byte (denoted by plain j ) to the j th byte of the first round key (denoted by k sch[0] j ) and to the power consumption that is measured dur-ing the computation of the j th SubBytes of the first round. The algorithmic functions involved in this relationship are the SubBytes and the bitwise XOR of the AES 128 . The physical functions involved in this relationship create a link between the value of the output of the j th SubByte in the first round and the power consumption of the circuit when this value is computed. The associated physical function, denoted by f power , has no analytical expression. The secret variable here is {k sch[0] j }. With -O = {plain j }, -P = {power}, -C = {k sch[0] j }, and -F = {f power }, the relationship REL power may be written as power = f power (SB(ARK(plain j , k sch[0] j )).

Several variants of this relationship may be used interchangeably for either side-channel or fault attacks. In the first case, the attacker might take measurements of the electromagnetic radiation or of a signal recovered by a µ-probe. In the second case, the observables, such as the behavior or the running time, are obtained by modifying the circuit's functioning. In either case, to obtain the corresponding relationship, it is sufficient to replace the physical function f power with either f EM , f µ-probe , f behaviour , or f time .

This relation and other examples of relations that are commonly used to break the AES 128 with physical attacks are reported in Table 1. In these relations, k denotes the index of a byte of the AES 128 state (thus, 0 ≤ k < 16) before the Shif tRow operation, and j is the index of the same byte after this operation (thus, 0 ≤ j < 16). According to the notation used in the standard, k = r + 4 * c, with 0 ≤ r < 4, 0 ≤ c < 4, and j = r + 4 * c ′ , where c ′ = (r -c)M odulo(4). In these relations, the functions f , g, and h are leakage or error functions.

In Table 1, REL 2 is identical to REL 1 (described above) except it pertains to the end of the AES execution. The relation links two measured observables to perform, for example, a differential behavioral analysis [START_REF] Robisson | Differential behavioral analysis[END_REF]: the first observable (denoted by O) is the value of the ciphertext obtained without error; the second observable (denoted by P ) is the behavior of the chip measured when the state is disturbed by means of a fault injection at the beginning of the final round. In this case, the relation involves the value of the key of the final round as well as an error function that models the impact of the fault injection on the state at the beginning of the final round. Several variants of this relation have been used. For example, one variant measures the sensitivity of the fault instead of the behavior of the circuit to perform a fault sensitivity analysis [START_REF] Li | Fault sensitivity analysis[END_REF].

REL 3 links two observables measured with a differential fault analysis [START_REF] Giraud | DFA on AES[END_REF]: the first observable (denoted by O) is the value of the ciphertext obtained without any perturbation; the second observable (denoted by P ) is the value of the ciphertext obtained with perturbations. This relation involves the value of the key of the final round as well as an error function. This error function models the impact of the fault setup on the state at the beginning of the final round.

REL 4 links two observables measured to mount, for example, a combined attack, as proposed by Roche et al. in [START_REF] Roche | Combined fault and side-channel attack on protected implementations of AES[END_REF]. The first observable (denoted by O) is the ciphertext value obtained without any perturbation; the second observable (denoted by P ) is the power consumption of the ciphertext value that contains an error. This relation involves the value of the key of the final round, two error functions, and a leakage function. The first error function models the impact of the fault setup on the last round key. The second error function models the impact of the fault setup on the second to last round key. The leakage function models the power consumption of the ciphertext containing an error. Some of the attacks that use these relations are detailed in Section 4.3.

Key retrieval algorithm

Step 0: Notations Let A be a set of n variables denoted by {a 1 , a 2 , . . . , a n }. Assume that each variable a i is discrete and has its own finite set of definitions, denoted by A i with cardinal |A i |. If a variable a i takes a particular value, denoted by a i (j), with 0 ≤ j < |A i |, then this variable is considered "instantiated." By extension, Ã denotes the set of all possible values of A. Thus, there are

| Ã| = |A 1 | * |A 2 | * . . . * |A n | distinct possible instances.
Each of these instances is denoted by Ã(j).

Step 1: Choosing the attack path Among the different relationships described in Table 1 and depending on the experimental setup, the attacker chooses a relation P = REL(C, F, O), for which C and F are unknown and O and P are known to the attacker.

Step 2: Defining the search space The attacker chooses hypotheses for the values of C and F . The set of hypotheses for the physical functions is denoted by F ; the set of hypotheses for the internal variables is denoted by C. The set C * F is called the search space and has | C| * | F | elements. These sets are chosen such that C contains C and such that at least one physical function of F "approximates" the function F . Because it is impossible to test all possible physical functions (the set [START_REF] Michel Agoyan | When clocks fail: On critical paths and clock faults[END_REF].start j ) with rnd [START_REF] Michel Agoyan | When clocks fail: On critical paths and clock faults[END_REF].start j = SB(ARK(plain j , k sch[0] j )) Var.

REL 0 O = {plain} P = {cipher} C = {k sch[0]} cipher = AES(plain, f (k sch[0])) REL 1 O = {plain j } P = {power} C = {k sch[0] j } power = f (rnd
P = {EM } or P = {µ probe} or P = {behaviour} or P = {time} REL 2 O = {cipher j } P = {power} C = {k sch[10] j } power = f (rnd [START_REF] Durvaux | How to certify the leakage of a chip?[END_REF].start k ) with rnd [START_REF] Durvaux | How to certify the leakage of a chip?[END_REF]. [START_REF] Chari | Template attacks[END_REF].m col j } f aulted j = h(ARK(rnd [START_REF] Durvaux | How to certify the leakage of a chip?[END_REF].s row j ′ , f (k sch[10] j ))) with rnd [START_REF] Durvaux | How to certify the leakage of a chip?[END_REF].s row j ′ = SR(SB(ARK(k sch [START_REF] Chari | Template attacks[END_REF] k ′ , rnd [START_REF] Chari | Template attacks[END_REF].m col k ))) k sch [START_REF] Chari | Template attacks[END_REF] k ′ = g(ARK(rnd [START_REF] Durvaux | How to certify the leakage of a chip?[END_REF].start k , rnd [START_REF] Chari | Template attacks[END_REF].m col k )) rnd [START_REF] Durvaux | How to certify the leakage of a chip?[END_REF].start k = SB -1 (SR -1 (ARK(cipher j , k sch[10] j ))) Var.

start k = SB -1 (SR -1 (ARK(cipher j , k sch[10] j ))) Var. P = {EM } or P = {µ probe} or P = {behaviour} or P = {time} REL 3 O = {cipher j } P = {f aulted j } C = {k sch[10] j } f aulted j = ARK(SR(SB(f (rnd[10].start k ))), k sch[10] j ) with rnd[10].start k = SB -1 (SR -1 (ARK(cipher j , k sch[10] j ))) REL 4 O = {cipher j } P = {f aulted j } C = {k sch[10] j , rnd

P = {power}

Table 1 Relationships used to break the AES 128 with physical cryptanalysis of leakage functions is infinite, and the set of all error functions for an octet is composed of 256 256 = 2 2048 elements), heuristics must be used. These heuristics are based on the attacker's knowledge of the circuit and on the chosen experimental setup. However, in some scenarios, the attacker may take advantage of a "profiling" phase on a circuit identical to the circuit under attack.

During such an optional phase, the attacker is then able to estimate the leakage functions (and thus to refine the hypotheses). In all other cases, the attacker models the physical functions with the functions described in Section 3.

Step 3: Experiments The attacker performs a set of experiments to measure and record the circuit's reactions P to different stimuli O. The stimulus used for the experiment e is denoted by O(e); the measured reaction for this experiment is denoted by P (e). Based on the set of all measurements, the attacker is able to compute P r(P, O).

Step 4: Predictions The attacker builds a set of relationship hypotheses by replacing all elements of C in REL with the values C(i) ∈ C of the internal variables and replacing all elements of F with the physical functions F (j) ∈ F . Each element in this set of relationships is called a "model" parametrized by C(i) and F (j) and denoted by M od(i, j). Thus, depending on the type of physical function chosen (deterministic or probabilistic), two cases are possible:

-The deterministic case: For all models and for each experiment e performed during the previous step, the attacker predicts the reactions denoted by

P ′ Mod(i,j) (e) = REL( C(i), F (j), O(e)).
-The probabilistic case: For all models, the attacker estimates the reaction probability and the stimuli P r(P ′ Mod(i,j) , O) from the set of all experiments. Note that the joint probability P r(P ′ Mod(i,j) , O) may also be calculated in the first case (i.e., when the physical functions are deterministic). Further note that in the second case, the stimuli used to compute the joint probability do not have to be strictly identical to those used during the measurement step. They are merely required to have the same probability distribution.

Step 5: Comparing predictions with measurements The attacker then compares the predictions with the measurements. Depending on the values of the hypothesis, two cases are possible if the relation REL has certain "good" statistical properties (which is the case for the relations reported in Table 1).

1. Correct hypothesis: If a fair approximation of the physical function F can be obtained through a function in F , then there exists an index j 0 such that F (j 0 ) ≃ F . In this case, for i = i 0 , where i 0 is the index of C in C, the predicted reactions are "quasiidentical" to the measured reactions for all experiments. Thus, we have P ′ Mod(i0,j0) (e) ≃ P (e)∀e for deterministic physical functions and P r(P ′ Mod(i0,j0) , O) ≃ P r(P, O) for probabilistic physical functions. In this case, the model parametrized by the key C(i 0 ) and the function F (j 0 ) "explains the data". 2. Incorrect hypothesis: In contrast, if either i = i 0 or j = j 0 , then P (e) and P ′ Mod(i,j) (e) are not identical for all experiments in the deterministic case, and P r(P ′ Mod(i0,j0) , O) and P r(P, O) are distinct in the probabilistic case.

Other algorithms may be used to implement the comparator ≃ cited above (also called a "distinguisher"). For the deterministic case, ad-hoc algorithms, such as the following three examples, have been proposed:

-The "sieve" algorithm returns a binary value equal to 1 if and only if P ′ Mod(i,j) (e) = P (e) for all experiments. The model explains the data if and only if the return value is 1.

-The "count" algorithm returns the number of times that P ′ Mod(i,j) (e) = P (e). The higher this number, the better the model M od(i, j) explains the data.

-For predictions whose possible values are restricted to the set {0, 1}, Kocher et al. calculated the difference of means (DoM) for the set of measurements corresponding to a prediction of 1 and the mean of the set of measurements corresponding to a prediction of 0 [START_REF] Paul | Differential power analysis[END_REF].

The higher the difference of means, the better the model M od(i, j) explains the data.

Additionally, more general algorithms based on information theory or on statistical operators have been proposed. For deterministic cases, testing the statement P ′ Mod(i0,j0) (e) ≃ P (e)∀e is equivalent to comparing the pmf of P r(P ′ Mod(i0,j0) ) and P r(P ). For probabilistic cases, determining whether the joint pmf P r(P ′ Mod(i0,j0) , O) and P r(P, O) are identical is equivalent to comparing the pmf of P ′ Mod(i0,j0) and P r(P ). Thus, the two cases (i.e., probabilistic and deterministic) collapse. For comparison, a survey of operators available in [START_REF] Cha | Comprehensive survey on distance/similarity measures between probability density functions[END_REF]. Two of these operators are described below.

-Based on the expected similarity of predictions and measurements, the Pearson coefficient is used to test the linearity between P ′ Mod(i,j) and P . This coefficient returns a value between 1 and -1. The higher this absolute value, the better the model explains the data.

-Because predictions and measurements are expected to have information in common, a method based on mutual information (MI) between the random variables P ′ Mod(i,j) and P has also been proposed. The MI returns a value between 0 and 1. The higher the value, the better the model explains the data.

Note that, when cases of correct and incorrect hypotheses are distinguishable, the attacker obtains information concerning internal data (value of C) as well as concerning the physical functions associated with the circuit and with the experimental setup. Examples of key retrieval algorithms, extracted from the literature, are described in the following section.

Illustrations

Table 2 presents the various parameters defined in the framework proposed above for some well-known attacks on the AES. For the 128-bit version of this algorithm, the attacker must perform an elementary attack 16 times (enabling the attacker to retrieve the octet j of the key).

Semi-exhaustive This rather theoretical attack is based on using any means of fault injection to force 15 bytes of the key to 0 while leaving the value of the byte j unchanged. The attacker records a plaintext and a ciphertext obtained under such conditions. In the prediction step, the attacker generates the set of 256 keys such that all the bytes of these keys are equal to 0, except the j th byte, which takes on a value of i in {0, . . . , 255}. Using the AES algorithm, the attacker computes the ciphertext obtained for each value of this set of key hypotheses. Only one of these values, for example i 0 , explains the ciphertext through the plaintext. The attacker concludes that the byte j of the key is equal to i 0 . µ-probing Suppose, for example, that the attacker targets a software implementation of the AES on an 8-bit microcontroller, knowing exactly when the S-Box output of the first round for one byte of the state is moved from the processor to memory. Further suppose that the attacker is able to measure the signal of one (and only one) wire of the data bus, but that the index of the corresponding bit is unknown. As a result, the attacker must test 8 different physical functions, each of them a monobit subset that corresponds to an index of the bit in the byte. Various kinds of distinguishers could be used to retrieve the value of the key hypothesis.

DPA In DPA (differential power analysis), the physical function used to model the power consumption is a monobit subset. Thus, the attacker must test 8 possible physical functions (one for each bit) for each of the 256 values of the key hypothesis. The attacker could use either the difference of means or the Pearson correlation coefficient to discriminate between the correct key and the false key.

CPA In CPA (correlation power analysis), the attacker assumes that the power consumption depends on the SubByte output and on an additional value (which could be the previous value in the register that stores the Sub-Byte outputs). Because this value is unknown, it may be considered a parameter of the leakage function. Thus, the attacker must test all 256 values of the secret key for each of the 256 leakage functions. In CPA, the Pearson correlation coefficient is the distinguisher.

(x) = x if x is the j th octet Determ. Sieve exhaustive O = {plain} (on octet j) P = {cipher} else f (x) = 0 C = {k sch[0]} µ-probing R 1 f (x) = R Ω (x) with Determ. All O = {plain j } Ω ∈ {1, 2, 4, . . . , 128} P = {µ -probe} C = {k sch[0] j } DPA [13] R 2 f (x) = R Ω (x) with Determ. DoM O = {cipher j } Ω ∈ {1, 2, 4, . . . , 128} or P = {P ower} Pearson C = {k sch[10] j } correlation CPA [7] R 1 f (x) = HW (x ⊕ Ω) Determ. Pearson O = {plain j } with Ω ∈ [[1, 255]] correlation P = {power} C = {k sch[0] j } MIA [28] R 1 f (x) = HW (x) + N with Probab. Mutual O = {plain j } N a Gaussian noise information P = {power} C = {k sch[0] j } DFA1 [11] R 3 f (x) = x ⊕ Ω with Probab. Sieve O = {cipher j } Ω ∈ {1, 2, 4, . . . , 128} P = {f aulted j } and (P r(Ω) = 1/8) ∀Ω C = {k sch[10] j } DFA2 [23] R 4 h(x) = x and g(x, Ω) = x ⊕ Ω Determ. Count O = {cipher j } with Ω ∈ [[1, 255]] P = {f aulted j } f (y, Γ ) = y ⊕ Γ with C = {k sch[10] j , Γ ∈ [[1, 255]] rnd[9].m col j } DFA3 [23] R 4 h(x) = HW (x) Determ. Pearson O = {cipher j }
f and g as above correlation P = {power} C = {k sch[10] j , rnd [START_REF] Chari | Template attacks[END_REF].m col j } DBA

[22] R 1 f (x) = (R Ω (x) == 0) with Determ. Pearson O = {plain j } Ω ∈ [[1, 255]] correlation P = {behavior} C = {k sch[0] j } FSA [17] R 2 f (x) = HW (x) or Determ. Pearson O = {cipher j } f (x) = R Ω (x) with correlation P = {intensity j } Ω ∈ {1, 2, 4, . . . , 128} C = {k sch[10] j } Table 2
Examples of physical attacks and their corresponding parameters MIA In MIA (mutual information analysis), the attacker assumes that the power consumption depends on the SubByte output and on an additive Gaussian noise (the model is thus probabilistic). In MIA, mutual information is the distinguisher.

DFA1

The DFA (differential fault analysis) proposed in [START_REF] Giraud | DFA on AES[END_REF] used the monobit fault model described in Section 3.3.2. The distinguisher is a sieve algorithm.

DFA2

The DFA proposed in [START_REF] Roche | Combined fault and side-channel attack on protected implementations of AES[END_REF] used constant errors (or at least errors that offer "good repeatability") distributed across the key schedule. These errors create a fault on the last round key and a fault on the second to last round key; the values of these faults are unknown to the attacker. The attacker must test all possible values of these faults (in addition to testing all possible values of the key) in order to find the model that explains the data. The distinguisher used is a count algorithm.

DFA3

The third DFA is based on the DFA2 but takes advantage of side-channel leakage. In such an attack, three physical functions are used: the two error functions of DFA2 and the leakage function of the faulted ciphertext. The chosen distinguisher is the Pearson coefficient.

DBA DBA (differential behavioral analysis) explains a behavior (i.e., the circuit either functions correctly or malfunctions) based on a model that is parametrized by the value of the key and a constant (but unknown) fault model (e.g., the set or the reset of some bits of the SubByte outputs). The distinguisher is a Pearson correlation. This attack is particularly effective for circuits with embedded protections against DFA.

FSA FSA (fault sensitivity analysis) explains a fault sensitivity (i.e., the reaction of the circuit to a fault injection whose intensity is variable) based on a model parametrized by the value of the key and a constant (but unknown) fault model (e.g., a Hamming weight or set/reset of a particular bit of the SubByte input). The distinguisher is a Pearson coefficient.

Discussion

The use of physical functions for physical cryptography raises multiple questions:

-How can the error between the model and the actual physical functions be estimated? This question has been investigated for side-channel attacks in several articles such as in [START_REF] Durvaux | How to certify the leakage of a chip?[END_REF]. However, previous findings will likely have to be updated to take into account the pmf of the error functions, which, in fact, have very different statistical properties than the pmf of the leakage functions. -Do some physical functions leak more information than others? As suggested in [START_REF] Lashermes | A DFA on AES based on the entropy of error distributions[END_REF][START_REF] Li | Yet another fault-based leakage in nonuniform faulty ciphertexts[END_REF][START_REF] Guo | Security analysis of concurrent error detection against differential fault analysis[END_REF], fewer risks certainly exist if the pmf of a physical function is a uniformly random distribution than if the pmf of the function corresponds to one of those described in Section 3.3.2. It may be of interest to find mathematical criteria (likely based on the measure of randomness of the pmf ) to evaluate the intrinsic leakage of physical functions. -Following from the first two questions, how can the physical functions that leak the most be identified?

The present investigation considered that the physical functions take only one argument. Yet, theoretically, each observable is dependent on all other variables. For example, an error function could be dependent either on X, on the previous value of X, or on other observables such as the voltage, the temperature, and even (perhaps, due to cross-talk) on many other internal variables. Thus, there seems to be a tremendous number of possible physical functions. It is impossible to enumerate all of them, even for a very small circuit. It will be up to the community to define heuristics to find the most critical physical functions. However, searching for answers in such a nonexhaustive manner could result in potential undetected leakage.

Conclusion

In this article, we have shown that most side-channel and fault attacks share the same principles. This merging of shared characteristics was accomplished by extending the concept of leakage functions to the concept of error functions and by using probability mass functions to model both functions. Numerous possibilities for further research exist: First, we plan to use the presented framework to describe a wider set of attacks. In particular, it could be of interest to extend the proposed approach to asymmetrical cryptography and to include other attacks such as those described in [START_REF] Moradi | Statistical tools flavor side-channel collision attacks[END_REF][START_REF] Ali | Differential fault analysis of aes: towards reaching its limits[END_REF][START_REF] Barthe | Synthesis of fault attacks on cryptographic implementations[END_REF][START_REF] Perin | Attacking randomized exponentiations using unsupervised learning[END_REF].

Second, for a given set of models of physical functions, the attack paths could be studied formally, enabling the automatic generation of new attack paths. Third, this work may be regarded as a basis to aggregate the advantages of attack-specific protections, thereby providing a more generic set of countermeasures.

3. 1

 1 Preliminary definitions 3.1.1 Data representation A byte B is a set of 8 bits denoted by {b 7 , . . . , b 0 } and B is matched with the binary value B b = b 7 b 6 b 5 b 4 b 3 b 2 b 1 b 0 ; to simplify, B and B b are used interchangeably. The decimal value associated with B is denoted by B d (for this conversion, b 0 is the less significant bit).

7 , b 6 ,

 76 0, b 4 , b 3 , 0, b 1 , b 0 }, irrespective of the values of b 7 ,b 6 ,b 4 ,b 3 ,b 1 and b 0 . Similarly, R 36 (B) == 1 is equal to 1 for any B such that B = {b 7 , b 6 , 0, b 4 , b 3 , 1, b 1 , b 0 }, irrespective of the values of b 7 ,b 6 ,b 4 ,b 3 ,b 1 and b 0 .

  ]. Conversely, a fault that forces bits to take on the value 1 is generally called a set. The function that models such a set is the bitwise OR between B and Ω with Ω d ∈ [0, . . . , 255]. A reset with Ω d = 0 returns a set of 0. A set with Ω d = 255 returns a set of 1.

Fig. 1 Fig. 2

 12 Fig. 1 Joint pmf of the leakage functions: theoretical (left) and experimental (right)

  . . , b 0 }. Let Ω be a set of N bits {ω N -1 , . . . , ω 0 }. The set of bits b i in B, such that ω i in Ω is equal to 1, is denoted by R Ω d (B). , R 2 , R 4 , R 8 , R 16 , R 32 , R 64 , R 128 .

	Note that, if B is composed of N values, there are
	2 N -1 possible subsets. Example with N = 8: let
	Ω = {0, 0, 1, 0, 0, 1, 0, 0} and B = {b 7 , . . . , b 0 } be two
	bytes. In this case, the bits ω 2 and ω 5 are equal to 1
	and the decimal value of Ω is Ω d = 2 5 + 2 2 = 36. Thus,
	the subset R 36 (B) is the set of bits {b 5 , b 2 } in B. In
	the following, a subset is referred to as monobit when
	it contains only 1 bit. The 8 monobit subsets of a byte
	B are denoted by R 1

Acknowledgements The authors would like to thank the members of the Secure Architectures and Systems Laboratory for their contributions to this work. We would also like to thank the anonymous reviewers and Ph. Maurine and K. Adbellatif for their valuable comments and suggestions. This research was supported in part by the French government through the HOMERE+ and the PANDORE (ANR-14-CE28-0027) projects.