Bruno Robisson
email: bruno.robisson@cea.fr

Hélène Le Bouder

Physical functions : the common factor of side-channel and fault attacks ?

Keywords: Differential Power Analysis, Differential Fault Analysis, Differential Behavioural Analysis, Template Attacks, Fault Sensitivity Analysis, AES 128

Security is a key component for information technologies and communication. Among the security threats, a very important one is certainly due to vulnerabilities of the integrated circuits that implement cryptographic algorithms. These electronic devices (such as smartcards) could fall into the hands of malicious people and then could be subject to "physical attacks". These attacks are generally classified into two categories : fault and side-channel attacks. One of the main challenges to secure circuits against such attacks is to propose methods and tools to estimate as soundly as possible, the efficiency of protections. Numerous works attend to provide tools based on sound statistical techniques but, to our knowledge, only address side-channel attacks. In this article, a formal link between fault and side-channel attacks is presented. The common factor between them is what we called the 'physical' function which is an extension of the concept of 'leakage function' widely used in side-channel community. We think that our work could make possible the re-use (certainly modulo some adjustments) for fault attacks of the strong theoretical background developed for side-channel attacks. This work could also make easier the combination of side-channel and fault attacks and thus, certainly could facilitate the discovery of new attack paths. But more importantly, the notion of physical functions opens from now new challenges about estimating the protection of circuits.

Introduction

Security is a key component for information technologies and communication. Among the security threats, a very important one is certainly due to vulnerabilities of the integrated circuits that implement cryptographic algorithms to ensure confidentiality, authentication or data integrity. These electronic devices (such as smartcards) could fall into the hands of malicious people and then could be subject to "physical attacks". These attacks are generally classified into two categories, fault and side-channel attacks and aim at bypassing the security functions, or at retrieving the details of their design, or at finding out the manipulated data (cryptographic materials, PIN code, personal data, etc.). In the latter case and when the attacker targets cryptographic material only, we often speak of 'physical cryptanalysis' or 'key recovering' techniques. These techniques seem very different at first sight because they require different experimental methods and different algorithms. But several works have been proposed to described them in a common framework [START_REF] Micali | Physically observable cryptography[END_REF][START_REF] Standaert | A unified framework for the analysis of sidechannel key recovery attacks[END_REF][START_REF] Durvaux | How to certify the leakage of a chip?[END_REF]. The aim of such frameworks is to provide strong theoretical basis but practical tools to fairly estimate the information leakage of circuits and thus increase the level of trust in such devices. But these works only cover side channel attacks. This paper describes concepts and algorithms which are common to key recovery techniques which use fault or side channel experimental set-ups. These concepts and algorithms are illustrated on the AES 128 cryptographic algorithm [START_REF]NIST: Announcing the Advanced Encryption Standard (AES)[END_REF].

In the first part of this article, we describe a model of circuits on which most of the attacks on AES 128 are based. It appears that this model uses deterministic and probabilistic functions to model the information leakage. A focus on such critical functions is provided in the second part of the article. Then, the principles of fault and side channel attacks based on this model are proposed and some illustrations are given.

2 Model of the cryptographic circuits

Observables versus internal variables

The physical attacks are based on experiments, i.e. the launches of cryptographic operations on the target with or without modifying its behaviour. During these experiments, the attacker is able to directly measure data, further called 'observables'. These kinds of data are numerous :

the electromagnetic emissions (noted EM ), current consumption (or 'power' for short) traces (noted power ) or the signal provided by a µ-probe. the plaintexts or the ciphertexts obtained without or with perturbations (faulty ciphertexts). the behaviour (i.e. the normal or abnormal working) of the circuit in case of fault. This behaviour may be determined, for example, by comparing the correct and faulty ciphering, by detecting the start of an alarm or not, the rise time of the alarm or by detecting a more or less premature stop in computation.

the running time. One way to measure this computation time consists in reducing the clock period step by step (on a specific clock cycle) and analysing the circuit's behaviour. The step in which the behaviour of the circuit switches from normal to abnormal is considered as an indicator of the computation time. This particular step is called "fault intensity" in [START_REF] Li | Fault sensitivity analysis[END_REF].

It should be noticed that we consider that any combination of observables or any observable obtained by applying any signal processing technique or any mathematical transformation (such as filtering, temporal to frequency transformation, etc.) is considered as an observable.

Opposite to the observables, the execution of a cryptographic algorithm involves data that cannot be directly measured by the attacker. This piece of data is called internal data in the following paragraphs. Some of these internal data are searched by the attacker and are further called 'target' or 'secret'.

Relationships

As they are computed by, or emanate from the same circuit, variables (i.e. hidden data and observables) are related to each others. Some relationships are known by the attacker and some are not. In the physical cryptanalysis scenario (i.e. only the cryptographic materials are searched), the known relationships are generally described by an algorithm (such as a cryptographic standard) and so will further be called 'algorithmic' relationships. In this scenario, unknown relationships are generally those which link some internal data and possibly some observables together and then will further be called 'physical' relationships.

Known (or algorithmic) relationships

In this paper, we focus on the 128bit version of the AES standard (noted AES 128 ). This is a standard established by the NIST [START_REF]NIST: Announcing the Advanced Encryption Standard (AES)[END_REF] for symmetric key cryptography. The algorithmic relationships involved in the AES 128 are now described. This algorithm ciphers a 128-bit long data (called plaintext or input) by using a 128-bit long key to obtain a 128-bit long data (called ciphertext or output). The encryption consists first in transforming the input data into a two-dimensional array of bytes, called the State. Then, after a preliminary bitwise XOR between the input and the key, AES 128 executes 10 times a function (called round ) that operates on the State. The operations used during these rounds are the following ones:

-SubBytes (SB for short) is a non-linear transform working independently on individual bytes of the State. The rounds are identical, except for the last one in which the MixColumns operation is skipped. At the end of the ciphering operations, the State is copied to the output.

Unknown (or physical) relationships

The relationships which link some internal data and eventually some observables together have been called leakage functions in [START_REF] Standaert | A unified framework for the analysis of sidechannel key recovery attacks[END_REF] for side channel attacks. To extend this notion to fault attacks, we also consider "error leakage" functions (or "error functions" for short) which formalize the relationships between some internal data and the same internal data but in the presence of perturbations. Leakage and error functions will further indifferently be called 'physical functions or 'physical relationships'. These functions deeply depend of the circuit under attack and of the experimental setup. As they are at the heart of the physical attacks, they are detailed in the following section.

Models of physical functions

Except for very particular cases (such as a direct probing of an internal data), physical functions have no analytical expressions. To deal with this issue, models of these relationships have been proposed and fall into two categories. Some are 'real functions' in the mathematical mean of the term, and some consider inputs and outputs as random variables. These two cases are respectively further be called 'deterministic' and 'probabilistic' physical functions. In these two cases, the models are built on the following small set of functions but note that even the more complex ones are only a model and so do not perfectly describe the real behaviour of the circuit. Bit level functions The logical operations AND (symbol &), OR (symbol |) and XOR (symbol ⊕) defined on a byte are considered bitwise.

Select subset (or restriction) of bits Let B (resp. Ω) be a set of bits b i (resp.

ω i ). The set of bits b i of B such that ω i of Ω is equal to "1", is noted R Ω (B). Example: if Ω = {0, 0, 1, 0, 0,

Subset of bits equal to

Let Ω and B be two sets of N bits. Let M be the number of bits of the restriction of R Ω (B) and α a set of M bits. We note R Ω (B) == α the function that returns 1 when, for any bit i of R Ω (B) and α, we have R Ω (B) i == α i and returns 0 otherwise. For example, R 36 (B) == {0, 1} returns 1 if b 5 == 0 and b 2 == 1 and return 0 in all the other cases.

Deterministic physical functions

Deterministic leakage functions The simplest model proposed for power consumption consists in considering the value of a single bit. In this case, the leakage function is R i with i ∈ {1, 2, 4, . . . , 128}. But more generally, side channel functions are chosen as a combination of restrictions and weighted sums. For example, the number of 1 values in a binary number B is called Hamming Weight and is noted HW (B). A variation consists in considering the number of transitions between two binary values. This function, called Hamming Distance, is noted HD(B, Ω) = HW (B ⊕ Ω).

Deterministic error functions

Bit flip A fault may invert a set of bits. The function which models the bit flip is the bitwise XOR between B and Ω with Ω d ∈ [1, . . . , 255]. When all the bits of the Ω are equal to 1 (resp. 0), all the bits are inverted (resp. unchanged).

Set and reset A fault which forces bits to '0' (resp. '1') is generally called a reset (resp. set). The function which models such a reset (resp. set) is the bitwise AND (resp. OR) between B and Ω with

Ω d ∈ [1, . . . , 255]. A reset with Ω d = 0 returns a set of 0. A set with Ω d = 255 returns a set of 1.
Behaviour As a generalization of the set and reset models, a fault may force the bits R Ω (B) of B to some value α. In such a case, the circuit behaviour is normal only when the perturbed result is expected to be equal to α and is abnormal otherwise. Such a behaviour may be described by using the function R Ω (B) == α.

Running time (or 'fault intensity') When the faults are created by violating the set-up time of latches, these faults may impact first the bytes which have the higher Hamming Weight or may impact first only one bit. In the first case, chip's behaviour may be described by a Hamming Weight and in the second case by the function that selects one bit R i with i ∈ {1, 2, 4, . . . , 128}.

Probabilistic physical functions

In this case, the input X and output Y of the physical functions are considered as two discrete random variables. As observables are measured with digital equipments (such as a digital oscilloscope) and as internal data are also generally organized into finite set of bits (called registers), without loss of generality, we consider that observables and internal data are discrete data. So, X and Y have respectively sample spaces S X = {0; 2 M -1} (with M being, for example, the size of a register) and S Y = {0; 2 N -1} (with N being, for example, the number of bits fixed by the vertical resolution of the oscilloscope). The AES 128 algorithm, considered in this article, is generally attacked thanks to a divide and conquer approach. As this method enables to recover the key byte per byte, M is further supposed to be equal to 8. Furthermore, as most of oscilloscopes have an 8-bit vertical resolution, N is further supposed to be equal to 8. As suggested in [START_REF] Li | Exploring the relations between fault sensitivity and power consumption[END_REF], we propose to model a probabilistic relationship with a joint probability mass function (or joint pmf ). The joint pmf of the discrete variables X and Y (used to model a physical function f with domain X and co-domain Y) is noted f X,Y (x, y) = P r(X = x, Y = y) whatever x ∈ S X and y ∈ S Y . Examples of such pmf are described in the next sections.

Probabilistic leakage functions Let's consider a physical relationship which links the integer values of an 8-bit data and the current consumption measured on the circuit when it handles these values. One classical probabilistic leakage function is to consider that the current consumption of the data x is the sum of the Hamming weight of x and a Gaussian noise [START_REF] Chari | Template attacks[END_REF]. This assumption holds for example when the data switches from the all-zero value to the value x. It occurs, for example, during the transfer of this data on a precharged bus between the memory and the pipeline of a microprocessor. In such a case, we have f (x) = HW (x) + e with e being a normal random variable with mean 0 and a given standard deviation. The left part of the figure above describes the associated pmf (with a standard deviation of 4/10, chosen arbitrarily as an illustration). The integer values of the 8-bit data is reported in abscissa and the associated current consumption in ordinates. The darker in the Figure, the higher the probability that the circuit consumes the current of value y when the manipulated data has the value x is (shorter x 'consumes' y). The right part of the figure is the same pmf but measured on a real component (a 32-bit unsecured up-to-date micro-controller). One can see in this very particular case that the theoretical and practical relationships fit particularly well. . The theoretical and experimental pmf are in this example rather distinct. In fact, in the experimental set-up, we can distinguish monobit faults but some bits appear much more easy to modify than another. In this case, the equal likelihood hypothesis is not validated.

Application to physical cryptanalysis

The physical cryptanalysis scenario (i.e. only the cryptographic materials are targeted) corresponds to numerous attacks proposed in the literature : µ-probing attacks, differential power analysis (with or without profiling), template attacks, differential fault analysis and safe-error attacks (among them differential behavioural analysis and fault sensitivity analysis). All these physical attacks share the following key retrieving algorithm.

Attack path

Definition An attack path is a relationship between observables that involves the secret and that enables to recover information about it. As such attacks use a divide and conquer approach, a relationship needs to involve only a partial key (i.e. a small piece of the key). In the following paragraphs, we note

P = REL(C, F, O)
the attack path that links together the observables O and P according to the (unknown) value of the internal variables C (among them is the secret) and to a set of (unknown) physical functions F . Even if there is not always a causality relation between P and O, the observables O are further called 'stimuli' and the observables P are called 'reactions' or 'response'.

Examples of attack paths

The attack path used in [START_REF] Kocher | Differential power analysis[END_REF] and noted REL power links the j th byte of the plain text (noted plain j ), the j th byte of the first round key (noted k sch[0] j ) and the power consumption measured when the computation of the j th SubBytes of the first round is performed. The algorithmic functions involved in this relationship are the SubBytes and the bitwise XOR of the AES 128 . The physical relationship involved links the value at the output of j th SubByte of the first round and the power consumption of the circuit when this value is computed. The associated physical function, noted f , has no analytical expression. The secret variable here is {k sch[0] j }. With

-O = {plain j }, -P = {power}, -C = {k sch[0] j },
-F = {f }, the relationship REL power may be written :

power = f power (SB(ARK(plain j , k sch[0] j ))

Variants of this relationship are indifferently used in side-channel and fault attacks. In the first case, the measure performed in by the attacker may be an electromagnetic radiation or a signal recovered by a µ-probe. In the second case, the observables such as the behaviour or the running time are obtained by modifying the circuit's functioning. Nevertheless, to obtain the associated relationship, the physical function f power has only to be replaced, respectively by f EM , f µ-probe , f behaviour or f time .

Other examples of relations widely used to break the AES 128 with physical attacks are reported in the Figure 4.1. In these relations, k is the index of a byte of the State of the AES 128 (so 0 ≤ k < 16) before the Shif tRow and j is the index of the same byte after this operation (so 0 ≤ j < 16). According to the notation used in the standard, k = r + 4 * c with 0 ≤ r < 4 et 0 ≤ c < 4 and j = r + 4 * c with c = (r -c)M odulo(4). In these relations, the functions f , g or h are leakage or error functions. Some of them will be detailed in 4.3. Variants of these relations are also proposed. They are obtained by changing the kind of the reactions. [START_REF] Agoyan | When clocks fail: On critical paths and clock faults[END_REF].start j ) with round [START_REF] Agoyan | When clocks fail: On critical paths and clock faults[END_REF].start j = SB(ARK(plain j , k sch[0] j )) Variants P = {EM } or P = {µ -probe} or P = {behaviour} or P = {time} REL2 O = {cipher j } P = {power} C = {k sch[10] j } power = f (round [START_REF] Li | Exploring the relations between fault sensitivity and power consumption[END_REF].start k ) with round [START_REF] Li | Exploring the relations between fault sensitivity and power consumption[END_REF].start k = SB -1 (SR -1 (ARK(cipher j , k sch[10] j ))) Variants P = {EM } or P = {µ -probe} or P = {behaviour} or P = {time} REL3 O = {cipher j } P = {f aulted j } C = {k sch[10] j } f aulted j = ARK(SR(SB(f (round [START_REF] Li | Exploring the relations between fault sensitivity and power consumption[END_REF].start k ))), k sch[10] j ) with round [START_REF] Li | Exploring the relations between fault sensitivity and power consumption[END_REF]. [START_REF] Lashermes | A dfa on aes based on the entropy of error distributions[END_REF].m col j } f aulted j = h(ARK(round [START_REF] Li | Exploring the relations between fault sensitivity and power consumption[END_REF].s row j , f (k sch[10] j ))) with round [START_REF] Li | Exploring the relations between fault sensitivity and power consumption[END_REF].start k = SB -1 (SR -1 (ARK(cipher j , k sch[10] j ))) k sch [START_REF] Lashermes | A dfa on aes based on the entropy of error distributions[END_REF] k = g(ARK(round [START_REF] Li | Exploring the relations between fault sensitivity and power consumption[END_REF].start k , round [START_REF] Lashermes | A dfa on aes based on the entropy of error distributions[END_REF].m col k )) round [START_REF] Li | Exploring the relations between fault sensitivity and power consumption[END_REF].s row j = SR(SB(ARK(k sch [START_REF] Lashermes | A dfa on aes based on the entropy of error distributions[END_REF] k , round [START_REF] Lashermes | A dfa on aes based on the entropy of error distributions[END_REF].s col k ))) Variant P = {power} Table 1. Relationships used to break the AES128 with physical cryptanalysis

REL0 O = {plain} P = {cipher} C = {k sch[0]} cipher = AES(plain, f (k sch[0])) REL1 O = {plain j } P = {power} C = {k sch[0] j } power = f (round
start k = SB -1 (SR -1 (ARK(cipher j , k sch[10] j ))) REL4 O = {cipher j } P = {f aulted j } C = {k sch[10] j , round

Key retrieving algorithm

Step 0: Notations Let's note A a set of n variables noted {a 1 , a 2 , . . . , a n }. We consider that each variable a i is discrete and has its own finite set of definition, noted A i with cardinal |A i |. When a variable a i takes a particular value, noted a i (j) with 0 ≤ j < |A i |, this variable is said 'instantiated'. By extension, Ã denotes the set of all the possible values of A. So, there are

| Ã| = |A 1 | * |A 2 | * . . . * |A n | distinct possible instances. Each of these instances is noted Ã(j).
Step 1: Choice of the attack path Among the different relationships described in Table 1 and depending of his experimental set-up, the attacker chooses a relation P = REL(C, F, O), with C and F unknown and with O and P known by the attacker.

Step 2: Definition of the search space The attacker chooses hypotheses on the values of C and F . The set of hypothesis on the physical functions is noted F and the set of hypotheses on the internal variables is noted C. The set C * F is called the search space and has | C| * | F | elements. This sets are chosen such that C contains C and such that at least a physical function of F approximates the function F . As it is impossible to try all the possible physical functions (the set of leakage functions is infinite and the set of all the error functions for an octet is constituted of 256 256 = 2 2048 elements), heuristics have to be used. These heuristics are based on the knowledge that the attacker has on the circuit and on his experimental set-up. In some scenarii, the attackers may take advantage of a 'profiling' phase on a circuit identical to the circuit under attack. During such an optional phase, he is able to estimate the leakage functions (and thus refine his hypotheses). In the other cases, he models the physical functions with a priori functions detailed in 3.2.

Step 3 : Experiments The attacker performs a set of experiments to measure and record the reactions P of the circuit for different stimuli O. The stimulus used for the experiment e is noted O(e) and the reaction measured for this experiment is noted P (e). From all the set of measurements, the attacker is able to compute P r(P, O).

Step 4 : Predictions The attacker builds a set of hypothesis of relationship by replacing in REL the elements of C by all the values C(i) ∈ C of internal variables and the elements of F by all the physical functions F (j) ∈ F . Each element of this set of relationship is called 'model' parametrized by C(i) et F (j) and noted M od(i, j). Then, depending of the kind of chosen physical functions (deterministic or probabilistic), two cases arise:

-Deterministic: For all the models and for each experiment e realized during the previous step, the attacker predicts the reactions noted P M od(i,j) (e) = REL( C(i), F (j), O(e)). -Probabilistic: For all the models, the attacker estimates the probability of having the reaction and the stimuli P r(P M od(i,j) , O) on the all set of experiments.

Note that the joint probability P r(P M od(i,j) , O) may be also calculated in the first case (i.e. when the physical functions are deterministic). Note also that in the second case, the stimuli used to compute the joint probability do not have to be strictly identical to those used during the measurement step. The stimuli just have to have the same probability distribution.

Step 5 : Comparison between predictions and measures Then, the attacker compares his predictions and the measurements. According to the values of hypothesis, two cases arise when the relation REL has statistical properties (which is the case for those reported in Table 4.1).

1. Good hypothesis: When the physical function F could be soundly approximated (or is equal in very particular cases) by a function in F , then there is an index j 0 such that F (j 0 ) F . In this case, for i = i 0 , with i 0 being the index of C in C, the predicted reactions are 'quasi-identical' to the measured ones for all the experiments. So, we have P M od(i0,j0) (e) P (e)∀e when the physical functions are deterministic and P r(P M od(i0,j0) , O) P r(P, O) when the physical functions are probabilistic. In such case, the model parametrized by the key C(i 0 ) and the function F (j 0 ) 'explains the data'. 2. Bad hypothesis: On the contrary, when i = i 0 or j = j 0 , P (e) and P M od(i,j) (e)

are not identical for all the experiments in the deterministic case and in the probabilistic case P r(P M od(i0,j0) , O) and P r(P, O) are distinct.

Different algorithms are used to implement the comparator cited above (also called 'distinguisher'). In the deterministic case, ad-hoc algorithms have been proposed such as the three following ones:

-The 'sieve' algorithm return a binary value equal to 1 if and only if P M od(i,j) (e) = P (e) for all the experiments. The model explains the data if and only if the return value is 1. -The 'count' algorithm returns the number of times that P M od(i,j) (e) = P (e).

The higher, the better the hypothesis explains the data. -When the possible values for the predictions are restricted to the set {0, 1}, Kocher and al. have proposed to compute the difference of the mean ('DoM' for short) of the set of measures associated with the prediction '1' and the mean of the set of measures associated with the prediction '0' [START_REF] Kocher | Differential power analysis[END_REF]. The higher, the better the hypothesis explains the data.

Other more general algorithms, based on information theory or on statistics operators have been proposed. In the deterministic case, comparing P M od(i0,j0) (e) P (e)∀e is equivalent to compare the pmf P r(P M od(i0,j0) ) and P r(P ). In the probabilistic cases, comparing if the joint pmf P r(P M od(i0,j0) , O) and P r(P, O) are identical, is equivalent to compare the pmf P M od(i0,j0) and P r(P ). So, the two cases (i.e. probabilistic and deterministic cases) collapse. A survey of operators for comparison is available in [START_REF] Cha | Comprehensive survey on distance/similarity measures between probability density functions[END_REF]. Two of them are described below.

-As the predictions and the measures are supposed to be 'similar', the Pearson coefficient has been used to test the linearity between P and P . The coefficient returns a values between 1 and -1. The higher in absolute value, the better the model explains the data. -As the predictions and the measures are supposed to share information, the mutual information (MI) between the random variables P M od(i,j) and P has also been proposed. The MI return a value between 0 and 1. The higher, the better the model explains the data.

When the good and bad hypothesis cases are distinguishable, the attacker gets information on the internal data (value of C) but also on the physical functions associated with the circuit and with the experimental set-up. Examples of instances of this key retrieving algorithm are proposed in the following section.

Illustrations

In the Table 2 are presented the different parameters defined in the framework proposed above for some well known attacks on the AES. For the 128-bit version of this algorithm, the attacker has to perform 16 times an elementary attack (which enables him to retrieve the octet j of the key).

Semi-exhaustive The principle of this (rather theoretical) attack consists in forcing with any fault injection mean, 15 bytes of the key to "00" and in leaving unchanged the value of the byte j. The attacker records a couple plain/cipher texts obtained in such conditions. In a second step, the attacker generates the set of 256 keys such that all the bytes of these keys are equal to "0" except the j th one which takes a value i among {0, . . . , 255}. The attacker computes, by using the AES algorithm, the cipher text obtained for each value of this set of keys hypothesis. Only one value, for example i 0 , explains the cipher text from the plain text. The attacker deduces that the byte j of the key is equal to i 0 .

µ-probing In this example, let's suppose that the attacker targets the software implementation of the AES on a 8-bit micro-controller and that he knows exactly when the output of the S-Box of the first round of one byte of the state is moved from the processor to the memory. We also suppose that the attacker is able to measure the signal of one (and only one) wire of the data bus but that the index of this bit is unknown. In such a rather pedagogical than realistic scenario, the attacker measures one bit during each experiment, which consists in computing a cipher from a known plain text. As the index of the bit is unknown, the attack has to test 8 different physical functions, each of them being a monobit restriction that corresponds to an index of the bit in the byte. All kind of distinguisher could be used to retrieve the value of the key hypothesis. DPA In the case of DPA, the physical function used to model the power consumption is a monobit restriction. So, the attacker has to test 8 possible physical functions (one for each bit) for each of the 256 values of key hypothesis. The difference of means could be used to distinguished the correct key and the false key.

CPA In the case of CPA, the attacker supposes that the power consumption depends on the SubBytes output but also on another value (which could be the previous value in the register which store the SubByte outputs). As this value is unknown, it can be seen as a parameter of the leakage function. So, the attacker has to try the 256 values of the secret key for each of these leakage functions. The distinguisher of CPA is the Pearson correlation coefficient. MIA In the case of MIA, the attacker supposes that the power consumption depends on the SubBytes output but also on another value (as for the CPA). But the MIA takes into account an additive Gaussian noise (so the model is probabilistic). The distinguisher of MIA is the mutual information.

Attack

Relationships

Physical function Kind of physical functions

Similarity and distance tools

Semi- R0 f (x) = x if x is Determ. All exhaustive O = {plain} the j th octet (on octet j) P = {cipher} f (x) = 0 else C = {k sch[0]} µ-probing R1 f (x) = RΩ(x) with Determ. All O = {plain j } Ω ∈ {1, 2, 4, . . . , 128} P = {probe} C = {k sch[0] j } DPA [8] R2 f (x) = RΩ(x) with Determ. DoM O = {cipher j } Ω ∈ {1, 2, 4, . . . , 128} or P = {P ower} Pearson C = {k sch[10] j } correlation CPA [3] R1 f (x) = HW (x ⊕ Ω) Determ. Pearson O = {plain j } with Ω ∈ [[1, 255]] correlation P = {power} C = {k sch[0] j } MIA [18] R1 f (x) = HW (x) + N with Probab. Mutual O = {plain j } N a Gaussian noise information P = {power} C = {k sch[0] j } DFA1 [7] R3 f (x) = x ⊕ Ω with Probab. Sieve O = {cipher j } Ω ∈ {1, 2, 4, . . . , 128} P = {f aulted j } and (P r(Ω) = 1/8) ∀Ω C = {k sch[10] j } DFA2 [16] R4 h(x) = x and g(x, Ω) = x ⊕ Ω Determ. Count O = {cipher j } with Ω ∈ [[1, 255]] P = {f aulted j } f (y, Γ ) = y ⊕ Γ with C = {k sch[10] j , Γ ∈ [[1, 255]] round[9].m col j } DFA+ [16] R4 h(x) = HW (x) Determ. Pearson O = {cipher j } f and g as above correlation P = {power} C = {k sch[10] j , round[9].m col j } DBA [15] R1 f (x) = (RΩ(x) == 0) with Determ. Pearson O = {plain j } Ω ∈ [[1, 255]] correlation P = {behavior} C = {k sch[0] j } FSA [12] R2 f (x) = HW (x) or Determ. Pearson O = {cipher j } f (x) = RΩ(x) with correlation P = {intensity j } Ω ∈ {1, 2, 4, . . . , 128} C = {k sch[10] j } Table 2.
Examples of physical attacks and associated parameters DFA1 The DFA proposed in [START_REF] Giraud | DFA on AES[END_REF] uses the theoretical error function described in 3.3. The distinguisher is a sieve algorithm.

DFA2

The DFA proposed in [START_REF] Roche | Combined fault and sidechannel attack on protected implementations of AES[END_REF] use a constant error (or at least which provides a 'good repeatability') which spreads across the key schedule. This error creates 2 faults on the State and the values of these faults are unknown by the attacker. So, he tests all the possible values of these faults (but also tests the values of the key) in order to find the model which explains the data. The distinguisher used is a count algorithm.

DFA+ The principle of the DFA+ consists in combining side channel and fault attacks. In such attack, two physical functions are used: one for the error function (a constant error such as in DFA1) and one for the leakage function (an Hamming Weight). The chosen distinguisher is the Person coefficient.

DBA The principle of the DBA consists in explaining a behaviour (i.e. the circuit works correctly or not) by using a model parametrized by the value of the key and a constant (but unknown) fault model (for example the set or the reset of some bits of the outputs of a SubByte). The distinguisher is a Person correlation. This attack is particularly effective when the circuit embeds protections against DFA.

FSA FSA consists in explaining a fault sensitivity (i.e. the behaviour of the circuit to a fault injection mean whose intensity is variable) by using a model parametrized by the value of the key and a constant (but unknown) fault model (for example an Hamming Weight or set/reset of a particular bit of the input of a SubByte). The distinguisher is a Pearson correlation.

Conclusion

We showed in this article that most side channel and fault attacks share the same principles. This merge has been made possible by extending the concept of leakage functions by the concept of error functions and by using probability mass functions to model both of them. Many possible further works have been identified : First, we plan to describe a wider set of attacks with our framework. In particular, it could be interesting to extend our approach to asymmetric cryptography (and include attacks described in [START_REF] Barthe | Synthesis of fault attacks on cryptographic implementations[END_REF]). Second, for a given set of models of physical functions, we could plan to formally study the attack paths and thus automatically generate new ones. Third, this work could be seen as the basis for merging the advantages of attack-specific protections to enable a more generic set of countermeasures. At last, because physical functions are at the heart of the attack, we believe that their studies are a promising way to fairly estimate the security of the device. But these studies give way to a lot of open questions:

-How to estimate the error between the model and the actual physical functions? This question has been covered by several articles like [START_REF] Durvaux | How to certify the leakage of a chip?[END_REF] but they will certainly have to be updated to take into account the pmf of error functions. Indeed, these functions have very different statistical properties than the pmf of leakage functions. -Do some physical functions leak more information than others? Intuitively and as suggested in [START_REF] Lashermes | A dfa on aes based on the entropy of error distributions[END_REF][START_REF] Li | Yet another fault-based leakage in non-uniform faulty ciphertexts[END_REF], if the pmf of a physical function is the uniformly random distribution, there are certainly less risks than if the pmf of the function is one of those described in 3.3. It could be interesting to find mathematical criteria (certainly based on the measure of randomness of the pmf ) to evaluate the intrinsic leakage of physical functions. -A corollary is how to find the critical physical functions that leak the most?

In this article, we have considered that the physical functions take only one argument. But theoretically, each observable depends on all the other variables. For example, an error function could depend on X, on the previous value of X but also on other observables such as the voltage, the temperature and even perhaps, due to cross-talk, on many other internal variables. Thus, the number of possible physical functions appears to be tremendous. Enumerating all of them, even for a very small circuit is to our point of view, impossible. The community will have to define heuristic to find the most critical physical functions. But the use of such non exhaustive search could lead to potential undetected leakage.

In other words, from our point of view, the estimation of the information leakage of a chip is far from being solved.

3. 1

 1 Definitions Data representation A byte B is a set of 8 bits noted {b 7 , . . . , b 0 }. We match it with B the binary value B b = b 7 b 6 b 5 b 4 b 3 b 2 b 1 b 0 but for the sake of simplicity, B and B b will be used indifferently. The decimal value associated with B is noted B d (for this conversion, b 0 is the less significant bit).

Fig. 1 .

 1 Fig. 1. Joint pmf of the leakage functions : theoretical (left) and experimental (right)

Fig. 2 .

 2 Fig. 2. Joint pmf of the error functions : theoretical (left) and experimental (right)

  MixColumns (MC for short) is a linear matrix multiplication working on each column of the State. The result of this operation at round i is noted

	round[i].m col
	-AddRoundKey (ARK for short) is a bitwise XOR between the State and a
	value k sch[i], computed from the key (according to a transform called Key
	Expansion which is not detailed in this paper). The result of this operation
	is the start of the next round noted round[i + 1].start.

The result of this operation at round i is noted round[i].s box -ShiftRows (SR for short) is a rotation operation on each row of the State. The result of this operation at round i is noted round[i].s row -

  1, 0, 0}, we have Ω d = 36 and the restriction of B by R 36 is the set of bits {b 5 , b 2 } of B. Note that if B is constituted of N values, there are 2 N -1 possible restrictions. A restriction is said monobit when only one bit of the byte is considered. So, the monobit restrictions are R 1 , R 2 , R 4 , . . . , R 128 .

Acknowledgements

The authors would like to thank D. Aboulkassimi, J.-M Dutertre, I. Exurville, J. Fournier, R. Lashermes, J.-B. Rigaud, A. Tria and Jean-Yves Zie for their contributions to this work. We would like to thank the anonymous referees and Ph. Maurine for their valuable comments and suggestions. This research is in part supported by the French government through the CALISSON 2 and the HOMERE+ projects.


Hélène Le Bouder

Ronan Lashermes

Yanis Linge

Bruno Robisson

Assia Tria

A Unified Formalism for Physical Attacks

Keywords: Formalism, physical attacks, side channels, fault injections

The security of cryptographic algorithms can be considered in two contexts. On the one hand, these algorithms can be proven secure mathematically. On the other hand, physical attacks can weaken the implementation of an algorithm yet proven secure. Under the common name of physical attacks, different attacks are regrouped: side channel attacks and fault injection attacks. This paper presents a common formalism for these attacks and highlights their underlying principles. All physical attacks on symmetric algorithms can be described with a 3-step process. Moreover it is possible to compare different physical attacks, by separating the theoretical attack path and the experimental parts of the attacks.

Introduction

When discussing about the security of a cryptographic algorithm, numerous tools allow the cryptographers to prove the security of a cipher. Unfortunately those tools do not consider the interaction of the computing unit with its physical environment. Physical attacks are a real threat, even for cryptographic algorithms proved secure mathematically. Physical attacks are divided in two families: the side channel attacks and the fault injection attacks and can target the secret key or reverse engineer the algorithm. Regrettably, no framework exists that gathers physical attacks under a common formalism. Our paper proposes one for secret key ciphers and presents a new tool to compare them.

The paper is organised as follows. In the section 2 we expose the context and the motivations for a unifying formalism. A 3-step description of physical attacks is given in section 3. How to compare these attacks is explained in section 4. Some examples of the utilization of the formalism are exposed in 5. Finally the conclusion is drawn in section 6.

Context

Notations and Algorithm

Our formalism is valid for secret key ciphers only. The well known algorithm AES [START_REF] Tria | Specification for the Advanced Encryption Standard[END_REF] has been chosen as an example in order to illustrate it. In this article, the plaintext is noted T , the ciphertext is noted C, the cipher key is noted K Advanced Encryption Standard The AES is a standard established by the NIST [START_REF] Tria | Specification for the Advanced Encryption Standard[END_REF] for symmetric key cryptography. In this paper, we focus on the 128-bits key version of the AES. It is a block cipher, as illustrated in Fig. 1.

- -----------------------tour 1 à 9 ------------------------tour 0 -----------------------

Physical attacks

A physical access to the circuit may give information about the internal computations of the cryptographic algorithm and thus, indirectly, about secret values in the algorithm. We distinguish physical attacks according to two criteria: their principle and their goal.

• There are two main kinds of physical attacks, the side channel attacks and the fault injection attacks.

-Side Channel Attacks noted SCA are based on observations of the circuit behaviour during the computation, for example in [START_REF] Kocher | Differential Power Analysis[END_REF][START_REF] Brier | Correlation Power Analysis with a Leakage Model[END_REF]. Side channel attacks exploit the fact that some physical values of a circuit depend on intermediary values of the computation. This is the so-called leakage of information of the circuit.

-Fault Injection Attacks notes FIA consist in disturbing the circuit behaviour in order to alter the correct progress of the algorithm [START_REF] Biham | Differential Fault Analysis of Secret Key Cryptosystems[END_REF]. Faults are injected into the device using various means such as laser, clock glitches, spikes on the power supply or electromagnetic perturbations. A rougher technique consists in modifying the circuit operation by modifying internal computations through micro-probes, or even modifying the circuit itself using Focused Ion Beam. In this paper a faulty variable is denoted by an asterisk * .

The current trend is to mix the two kinds in order to build other attacks. These are called hybrid attacks, as for example in [START_REF] Li | Fault Sensitivity Analysis[END_REF][START_REF] Robisson | Differential Behavioral Analysis[END_REF].

• The target or the secret noted K is the goal of the attack. The domain of definition of the target is noted K. The target is often the cipher key K, but physical attacks are also used to reverse engineer an algorithm, i.e. the goal is to retrieve information on a private algorithm. An example may be an AES with custom and secret s-boxes: in this case, the attacker knows the key and he tries to recover the s-boxes as in section 5.6.

Motivations behind our formalism

Physical attacks add another dimension with respect to cryptanalysis: the interaction of the implemented algorithm with the physical environment. This work intends to be a guide to help identify the important parameters in a physical attack, so that they can be compared. Unifying the different attacks under a same formalism allows to deal with them with common tools.

Several works have been proposed to described them with a common framework [START_REF] Micali | Physically Observable Cryptography[END_REF][START_REF] Mangard | One for All -All for One: Unifying Standard DPA Attacks[END_REF][START_REF] Standaert | How to compare profiled side-channel attacks?[END_REF][START_REF] Standaert | A formal practiceoriented model for the analysis of side-channel attacks[END_REF][START_REF] Standaert | A unified framework for the analysis of side-channel key recovery attacks[END_REF][START_REF] Mangard | One for all-all for one: unifying standard differential power analysis attacks[END_REF][START_REF] Abdelaziz | Practical improvements of profiled side-channel attacks on a hardware crypto-accelerator[END_REF][START_REF] Whitnall | The myth of generic DPA... and the magic of learning[END_REF]. However these works only cover side channel attacks. In particular, [START_REF] Mangard | One for All -All for One: Unifying Standard DPA Attacks[END_REF][START_REF] Whitnall | The myth of generic DPA... and the magic of learning[END_REF] propose to write various side channel attacks all as Differential Power Analyses. Likewise there are frameworks for fault injection attacks [START_REF] Verbauwhede | The Fault Attack Jungle-A Classification Model to Guide You[END_REF][START_REF] Moradi | A generalized method of differential fault attack against AES cryptosystem[END_REF][START_REF] Sakiyama | Information-Theoretic Approach to Optimal Differential Fault Analysis[END_REF]. The improvement of our formalism is to unify the two families. As a consequence, it becomes possible to compare side channel attacks and fault injection attacks. In [START_REF] Standaert | A unified framework for the analysis of side-channel key recovery attacks[END_REF], Standaert et al. underline the interface between theory and practice for side channel attacks, we enlarge this vision for both families. Finally we want to compare the attacks between them in order to guide the designer in the choices required to harden its implementation.

3 Description of the attacks in 3-step by the formalism All attack on symmetric ciphers can be decomposed in the following 3-step process.

Step 1: Campaign

An experiment E is a pair (O S , O R ) of measurements called observables, taken during the execution of the cipher algorithm of one text T with a key K. O S is called a stimuli and O R a reaction.

A set of N experiments is called a campaign. Examples of observables are: plaintext, ciphertext, faulty ciphertext, EM traces, power traces, signal provided by a micro-probe, behaviour (i.e. the normal or abnormal working) of the circuit or computation time.

A classical example of pairs of observables for a SCA is

(O S = T, O R = pow)
A classical example of pairs of observables for a FIA is

(O S = C, O R = C * )
The attack path is an exploitable relation R between our observables and the target K. Inputs are K and O S and the output is O R . This relation is composed of physical functions f j and algorithm functions g i .

O R = R(O S , K) R = f 1 • g 1 • • • • • f n • g n (1)
More precisely the g j are composed of several cipher-algorithm functions. For example in the case of AES, g j is built with {SB, SR, M C, ARK}.

The physical functions f j cannot always be described with a mathematical expression since they are often non deterministic. There is often only one physical function.

Step 2: Predictions

In the attack path R there are two unknowns: the target K and the physical functions f . To build predictions they have to be replaced, either by guesses or models.

The attacker make guesses k on the target K. The good guess is noted k. A divide and conquer approach is generally chosen. The domain of definition of the target, K, should be short enough so that all guesses can be tested.

For example if the target is the cipher key of an AES. Generally a round key K r is chosen as a target and is split in bytes. So K = [[0, 255]] and has size 256.

As already pointed out, physical functions f do not always have a mathematical expression. But f can be approximated by mathematical functions m called models. In fault injection attacks, models are called error functions and leakage functions in side channel attacks. It is impossible to test every possible model because of their tremendous number. Indeed each endomorphism of a set of bits can be considered as a possible error function, so the number of these functions is too big to be efficiently managed. Even worse, the number of leakage functions is an infinite uncountable set. Commonly, one or a small set of models is used.

Finally the predictions are built with the attack path described in Step 1 (section 3.1) for each guess h on the secret, where the physical functions are replaced by models m.

1. Define K, the set of guesses k on the target K.

Choose one set of models

m = {m j } with j ∈ [[1, n]]
where n is the number of physical functions in R, In practice, several models m i,j can be tested for one physical function f j . There are two possibilities. The first is to use the models separately, for example in SCA, the attacker often has the choice between Hamming weight or Hamming distance as a model of the power consumption. The second is to take into account all models at once. As an example, it is possible to choose a single-bit fault in a FIA, where there are 8 models for one byte [START_REF] Micali | Physically Observable Cryptography[END_REF]]. 3. Replace the physical functions f j by models m j in the equation Eq. (1). 4. For each h, and each set of models m, compute P m,k with the stimuli O S .

m i = 2 i with i ∈ [[0,
P m,k = R m (O S , h) R m = m 1 • g 1 • • • • • m n • g n (2)

Step 3: Confrontation

For each hypothesis k and set of models m, P m,k is confronted with respect to O R with a distinguisher. A distinguisher is a statistic tool which is able to find the correct guess on the target. The distinguishers highlight links between physical functions f and mathematical models m, they are based on different statistical criteria. -Sieves and counters [START_REF] Biham | Differential Fault Analysis of Secret Key Cryptosystems[END_REF] are used essentially for fault injection attacks. They suppose that models m are identical to the physical functions f . -The difference of mean [START_REF] Kocher | Differential Power Analysis[END_REF] and the correlation [START_REF] Brier | Correlation Power Analysis with a Leakage Model[END_REF] are based on a linear dependency between the model and the physical function. -The entropy [START_REF] Lashermes | A DFA on AES Based on the Entropy of Error Distributions[END_REF] and the mutual information [START_REF] Benedikt Gierlichs | Mutual Information Analysis -A Universal Differential Side-Channel Attack[END_REF] are based on the Shannon information and use non-linear dependencies between the model and the physical function.

-The Kolmogorov-Smirnov test [START_REF] Whitnall | An exploration of the kolmogorov-smirnov test as a competitor to mutual information analysis[END_REF] is a seemingly attractive alternative to mutual information, it is similarly able to generically compare the distributions of two samples but achieves this without explicit estimation of their probability density functions. -The differential cluster analysis [START_REF] Batina | Differential cluster analysis[END_REF] analyses the variances.

-The principal component [START_REF] Souissi | First Principal Components Analysis: A New Side Channel Distinguisher[END_REF] and the linear discriminant [START_REF] Balakrishnama | Linear Discriminant Analysis -A Brief Tutorial[END_REF] use properties of inter-class and intra-class variances.

The difference and the comparisons of these distinguishers are explained in [START_REF] Maghrebi | Comparison between Side-Channel Analysis Distinguishers[END_REF].

There is an active ongoing research on the distinguishers but they are out of the scope of this paper.

Attack step by step

Some attacks cannot directly retrieve the target. They first require to retrieve one (or several) intermediate secret(s). In this case the 3-step approach described in 3.1, 3.2 and 3.3 is repeated many times, for different attack paths with different targets and observables. We note as an exponent the order of the attack path. The target K i is an observable for the attack path R i+1 .

R i+1 (O i+1 S , K i+1 ) = O i+1 R with K i = O i+1 S or O i+1 R
4 How to compare physical attacks ?

In this section a compare tool for all physical attacks is presented.

State of the art

The question that naturally arises is: how to compare physical attacks? They are often compared in terms of equipments: how much they cost, what kind of fault injections are needed. They are also compared by the computational power of the attack they require. The number of measurements needed or the ability to modify the circuit are also points of comparison. For example the different kinds of fault injection possible for a given equipment are described in [START_REF] Barenghi | Fault Injection Attacks on Cryptographic Devices: Theory, Practice, and Countermeasures[END_REF]. In the case of side channel attacks, a lot of work has been done to compare distinguishers as in [START_REF] Maghrebi | Comparison between Side-Channel Analysis Distinguishers[END_REF]. Generally we compare different distinguishers on a same circuit or a same distinguisher on different circuits or different models for a same distinguisher. Indeed, as said in section 3.3 different distinguishers do not rely on the same statistical properties.

This paper presents a different approach. The main idea is to evaluate a physical attack in the two first steps. First in a theoretical study, the models are evaluated independently from the physical functions i.e R m in equation Eq. ( 2) is studied. Only in a second time the uncertainty due to the use of experimental apparatus is taken into account. The adequacy of the models with respect to the physical functions is evaluated, but without distinguishers, since the comparison of physical attacks is performed before the step of confrontation 3.3.

Oracle

In the second step 3.2 of our formalism, the predictions are computed. The set of predictions noted P, has a cardinal α (i.e. there are α predictions possible). One has to remark that it is possible that α = card (K). Indeed two guesses can have the same prediction during an attack.

Θm OS P m, k Fig. 2: Oracle Θ m
Let Θ m be an oracle associated with a set of models m as illustrated in Fig. 2 The oracle Θ m returns P m, k = R m (O S , K) i.e the prediction which corresponds to the good guess under models m. The required number of queries (in average) to Θ m in order to retrieve the target K is noted θ. It is a measure of how efficient the attack path would be with the set of models m, i.e R m .

An oracle can combine sets of models. Let m be a set of (set of) models m i . For each m i there is an oracle Θ mi . An oracle Θ m can be constructed by randomly choosing a model m i at each call and returning the result of Θ mi .

There is often only one physical function used in a relation R and therefore only one model in the set m used in R m . Yet, several possibilities are evaluated (e.g. 8 fault models to approximate a single-bit fault model) which form the set m in our previous example,

m i = 2 i i ∈ [[0, 7]]

Matching Probability

This section deals with the link between observables O R and the good prediction P m, k. More precisely the two codomains, for the attack path R and for R m are compared (for a given target K and a given set of models m). One has to remark that the attack path R is not really a function since for a same input O S , different outputs O R are possible. Additionally there is not necessarily a bijection between the codomains (the prediction P m, k and the observables O R ), as it has already been shown in [START_REF] Micali | Physically Observable Cryptography[END_REF][START_REF] Standaert | A formal practiceoriented model for the analysis of side-channel attacks[END_REF][START_REF] Standaert | A unified framework for the analysis of side-channel key recovery attacks[END_REF][START_REF] Whitnall | The myth of generic DPA... and the magic of learning[END_REF].

A contingency table is filled with the results of N experiments. All the possible values of P m, k are noted ρ i , i ∈ [ [1, α]] and the possible values of O R are noted o j , j ∈ [ [1, β]]. For each experiment E = (O S , O R ), the reaction O R is stored and P m, k is computed. Then in the contingency table, shown in Table 1, the value at the corresponding row i is incremented (prediction is equal to ρ i ) and column j (reaction is equal to o j ). At the end, the value a i,j is the number of times the attacker computed the prediction ρ i in conjunction with the measurement of the reaction o j , i.e. the number of experiments which verifies P m, k = ρ i and O r = o j . We now focus on the repeatability probability. An experience E is associated with a pair (O R = ô = o j1 , P m, k = ρ = ρ i1 ). What is the probability that another experiment with the same observable has also the same predictive value? This probability is noted p.

OR = o1 OR = o2 • • • OR = o β total P m, k = ρ1 a1,1 a1,2 • • • a 1,β β j=1 a1,j P m, k = ρ2 a2,1 a2,2 • • • a 2,β β j=1 a2,j . . . . . . . . . • • • . . . . . . P m, k = ρα aα,1 aα,2 • • • a α,β β j=1 aα,j total α i=1 ai,1 α i=1 ai,2 • • • α i=1 a i,β N
In order to estimate p, a statistical experience using the Table 1 is presented. A first urn contains a total of N balls, specifically for each i, j, a i,j balls are labelled with the pair (ρ i , o j ). It represents the Table 1. In the other hand, we have β urns. With urn j containing a i,j balls labelled with ρ i for each i. Each urn represents a column of Table 1. The statistical experience is the following :

1. A random draw in the first urn.

The result is (ô = o j1 , ρ = ρ i1 ). 2. A random draw in the urn j 1 (j 1 defined by the first draw).

The result is ρ i2 .

We are interested in the probability :

p = P (ρ i2 = ρ i1 ) P (ρ i2 = ρ i1 |o j1 ) = N i=1 a 2 i,J n 2
Finally we have:

p = M j=1 P (ρ i2 = ρ i1 |o j ) • P (o j ) = M j=1 o j n • N i=1 a 2 i,j n 2 (3)
This probability p is called matching probability.

A tool to compare physical attacks

The oracle θ allows to evaluate the quality of an attack path R m with the models m. A smaller θ means a better adequacy between the attack path and the model. The matching probability p represents the quality of the measures O R with respect to the predictions P m, k. A bigger p means a better adequacy between the physical function and the model. Finally θ and p are combined to globally evaluate the experimental attack with respect to the models.

A new oracle Θ p (Fig. 3) is introduced which mixes Θ m and p. It returns P m, k thank to O S but with a probability of success p. For n experimentations, the probability to have θ successes is computed with a Bernoulli trial. The probability P of θ or more successes in the experiment B(n, p) is given by the equation Eq. ( 4):

P = P (obtain at least θ success) = n θ n θ p θ • (1 -p) n-θ (4)
Finally the new tool to compare the physical attacks is P for n texts. This probability can be seen as a success rate. P depends on the models and the measurements. Another possibility is to compute the number of experiments n needed to have P > 0.99. The third step of the formalism is not used in this comparison tool. However the choice of the distinguisher is important for an attack to succeed. In this paper, the idea is to compare attacks before this step.

To illustrate our formalism description, some classic attacks on AES are chosen. Three attacks which aim at finding a cipher key were realized on the same programmable circuit: fpga -Xilinx Spartan3 700A. The same cipher key A3B0D09804584269DC7FB0CDABAD57F8 and the same 5000 plaintexts were used.

Experimental protocol

In this section, the description of the acquisition benches is given.

EM bench

The EM curves are acquired with the protocols described by Dehbaoui in [START_REF] Dehbaoui | Analyse Sécuritaire des Émanations Électromagnétiques des Circuits Intégrés[END_REF]. The EM bench is composed of a control computer, an oscilloscope, and a commercial EM probe (with large bandwidth). At the contact of the circuit, the EM probe receives the EM emission, then sends the measurements to the oscilloscope. A trigger signal sent by the FPGA indicates when the oscilloscope saves the traces. The experimental protocol is illustrated in Fig. 4. in [START_REF] Zussa | Power supply glitch induced faults on FPGA: An in-depth analysis of the injection mechanism[END_REF][START_REF] Zussa | Analysis of the fault injection mechanism related to negative and positive power supply glitches using an on-chip voltmeter[END_REF]. The idea is to change the internal clock and to reduce the frequency of the clock to obtain faults. The glitchy clock was generated using a Xilinx Virtex-5 fpga, used as a clock source for our targeted fpga. The first attack presented is a classic attack by electromagnetic analysis on the last round of the AES.

-The target is a byte of the key at round 10, K = K 10 . There are only 256 possible values.

-The stimuli is the ciphertext O S = C. -The reaction is the measured electromagnetic field, O R = EM curve. -R = f • g with : f = em electromagnetic radiation and g = SB -1 • SR -1 • ⊕. The attack path is illustrated in Fig. 6 -R m = m • g with m = HD Hamming distance. So P HD,h = HD(C, SB -1 • SR -1 • (C ⊕ h)) -
The distinguisher can be a difference of mean [START_REF] Kocher | Differential Power Analysis[END_REF], a correlation [START_REF] Brier | Correlation Power Analysis with a Leakage Model[END_REF], a mutual information [START_REF] Benedikt Gierlichs | Mutual Information Analysis -A Universal Differential Side-Channel Attack[END_REF], a principal component [START_REF] Souissi | First Principal Components Analysis: A New Side Channel Distinguisher[END_REF] or a linear discriminant [START_REF] Balakrishnama | Linear Discriminant Analysis -A Brief Tutorial[END_REF]. -The question to evaluate θ is how many pairs (C, P HD,K10 ) are needed in average to recover a byte of K 10 ? In this case we have θ = 4. This value was obtained by simulating 1000000 attacks using the Hamming distance as an input. -For the different bytes of the round key K 10 , the contingency table is generated to compute the matching probability.

The O R are the measured values at the instant of the EM curves were a correlation allows to find the value of the target and the P m,K are Hamming distances. The attack has not succeeded for the bytes 3 and 13. Finally, the results are displayed in Table 2.

Example of Fault Injection Attack (FIA) a on AES

This example is a classic differential fault analysis [START_REF] Biham | Differential Fault Analysis of Secret Key Cryptosystems[END_REF]. The faults are obtained for the same list of 5000 plaintexts as in the previous attack SCA in section 5. -R = g 2 • f • g 1 with: f = single-bit fault injection process,

g 1 = SB -1 • SR -1 • ⊕ and g 2 = ⊕ • SR • SB.
The attack path is illustrated in Fig. 7 -R m = g 2 • m • g 1 with 8 possible models, ⊕2 j with j ∈ [[0, 7]], considered together. -The distinguisher is a sieve [START_REF] Biham | Differential Fault Analysis of Secret Key Cryptosystems[END_REF] or a counter [START_REF] Giraud | DFA on AES[END_REF].

-How many pairs (C, P ⊕2 i ,K10 ) such that i is randomly chosen are needed to recover a byte of the K 10 ? In this case θ = 2.24 was claimed in [START_REF] Lashermes | A DFA on AES Based on the Entropy of Error Distributions[END_REF]. θ is rounded up to 3. -For the different bytes of the round key K 10 , the contingency table is generated to compute the matching probability. The O R are the faulty ciphertexts observed. The P m,K are the faulty ciphertexts computed with the models ⊕2 i . In this precise case the matching probability directly corresponds to the uncertainty of the generated faults when a sufficient number of faults were injected. This value does not depends on the model ⊕v nor on the key value.

As an example, a fault generator which injects two different fault values (⊕v 1 or ⊕v 2 ) with equal probability would create a contingency table with matching probability p = 0.5 regardless of the model ⊕v used. This is why the Table 3 shows the matching probability for only one of the eight models (⊕2 0 ), the other tables are identical up to a permutation of the columns. Finally, the results are displayed in the Table 3. A Fault Sensitivity Analysis was performed on the FPGA with the same setup as the previous fault attack. But when creating a clock glitch, the difference of a normal clock period with the glitchy clock period is a discrete multiple (value named u) of the fixed delay 25ps. The value u was stored as the stress of the injection process.

Comparison of the three attacks

The comparison of the number of experiments n required to have P > 0.99 shows that the presented FIA (section 5.3) is more efficient. Indeed, in average it requires less experiments than the two other attacks. Additionally, for a same attack some bytes of the key are more difficult to extract than others. The difficulty to extract a key byte varies in the different attacks. For example bytes 3 and 13 cannot be extracted with the SCA (section 5.2), but they are easy to extract with the FIA (section 5.3). Moreover, the byte 12 has the biggest n for the FIA (section 5.3), but in the two other attacks it has the smallest. For each attack, the most difficult bytes to retrieve are different.

Reverse Engineering examples

A classic SCARE (Side Channel Analysis for Reverse Engineering) attack as in [START_REF] Guilley | Defeating any secret cryptography with SCARE attacks[END_REF][START_REF] Manuel San | FIRE: fault injection for reverse engineering[END_REF] is chosen to illustrate that our formalism is still valid for reverse engineering attacks. An AES-like cryptosystem with customized s-boxes is chosen, i.e. s-boxes are the target. One has to remark that the cipher key is often considered known in a reverse engineering attack. We did not test this attack on our fpga.

Conclusion

A new technique to compare physical attacks has been presented. This method is able to compare all physical attacks between them, including a side channel attack with respect to a fault injection attack. Additionally using physical attacks in order to find the cipher key or in order to reverse engineer an algorithm do not change the formalism. The main idea is to compare attacks at each step of the attack (campaign, predictions, confrontation) and not only at the end. The improvement comes from the fact that the attack is decomposed in three steps, where the first two are analysed independently. In a first time, only the models are studied with θ the average number of queries to the oracle Θ m . Then in a second time, only the predictions and the reactions are confronted, without taking into account the distinguishers, with a matching probability p. A smaller θ means a better adequacy between the attack path and the model. A bigger p means a better adequacy between the physical function and the model. Finally a new oracle Θ p which combines both is introduced by creating an oracle with a probability of failure not equal to zero. Two attacks can be compared with the probability of success for n texts or with the number n of experiments required to have a probability of success bigger than a chosen value. So if an attack fails, it becomes possible to know if the model is wrong or if the attack path is bad.

It is a new approach which do not confront distinguishers. Instead the comparison is performed before this final step allowing to measure the effectiveness of the other steps. Moreover in a future work we would like to extract from the contingency table some hindsight on what distinguisher is the most likely to work in order to extract a key.

As a perspective, our 3-step approach suggests that by modifying only one of this step, we create a new physical attack. We suggest instead that the components of an attack should be studied independently.

10 Fig. 1 :

 101 Fig. 1: Scheme of AES

  P m,k and O R can be considered as random variables. The distinguishers return the guess k d , if k d = k the attack has failed. Some examples of distinguishers are listed in the following paragraph.

Fig. 4 :

 4 Fig. 4: Scheme of EM bench

Fig. 5 :

 5 Fig. 5: Scheme of clock glitch bench

2 .-

 2 The target is a byte of the key at round 10, K = K 10 . There are only 256 possible values. -The stimuli is the ciphertext O S = C. -The reaction is the faulty ciphertext O R = C * .

Table 3 :Fig. 7 :

 37 Fig. 7: Attack path of DFA

10 stressFig. 8 :

 108 Fig. 8: Attack path of FSA

-

  The target is an s-box i.e. a boolean function b 8→8 , SB(x) = y. A divide and conquer strategy is achieved by splitting the target into 8 boolean functions b 8 → 1. K = b 8→1 There are only 256 possible values. -The stimuli is the plaintext O S = T . -The reaction is the power consumption or the radiation of an electromagnetic field, O R = EM or O R = P ow. -R = f • g with : f = EM radiation of electromagnetic field or f = P ow power consumption and g = ⊕k 0 . -R m = m • g with m = HW Hamming weight, or m = HD Hamming distance. The two models are considered separately. -The distinguisher is a correlation.

Table 1 :

 1 Contingency table of the measured O R and the predicted values P m,

	k

  The best attack has the biggest P for a given n. Or the best attack has the smallest n for P > 0.99.The improvements of this probability of success P come from the fact that it is decomposed in two parts. So if an attack fails, it is possible to know if the model is wrong (too different w.r.t. the reality) or if the attack path is bad.

	O S
	Θ p
	p	1 -p
	success : P m, k failure
	Fig. 3: Oracle with a probability of error p

Table 2 :

 2 Matching probability p for the different bytes of K 10 and n for P > 0.99

	EM
	SB
	SR
	K 10
	C
	Fig. 6: Attack path of the SCA

  table is generated to compute the matching probability. The O R are the values u and the P m,K are Hamming weights. The results are displayed in the Table 4.

	byte 0	1	2	3	4	5	6	7	8	9 10 11 12 13 14 15
	p 0.20 0.20 0.20 0.20 0.21 0.20 0.20 0.20 0.20 0.20 0.20 0.20 0.22 0.21 0.20 0.20
	n 48 48 48 48 46 48 48 48 48 48 48 48 43 46 48 48

Table 4 :

 4 Matching probability for the different bytes of K 10 and n for P > 0.99