Bruno Robisson
email: bruno.robisson@cea.fr

Hélène Le Bouder

Physical functions : the common factor of side-channel and fault attacks ?

Keywords: Differential Power Analysis, Differential Fault Analysis, Differential Behavioural Analysis, Template Attacks, Fault Sensitivity Analysis, AES 128

Security is a key component for information technologies and communication. Among the security threats, a very important one is certainly due to vulnerabilities of the integrated circuits that implement cryptographic algorithms. These electronic devices (such as smartcards) could fall into the hands of malicious people and then could be subject to "physical attacks". These attacks are generally classified into two categories : fault and side-channel attacks. One of the main challenges to secure circuits against such attacks is to propose methods and tools to estimate as soundly as possible, the efficiency of protections. Numerous works attend to provide tools based on sound statistical techniques but, to our knowledge, only address side-channel attacks. In this article, a formal link between fault and side-channel attacks is presented. The common factor between them is what we called the 'physical' function which is an extension of the concept of 'leakage function' widely used in side-channel community. We think that our work could make possible the re-use (certainly modulo some adjustments) for fault attacks of the strong theoretical background developed for side-channel attacks. This work could also make easier the combination of side-channel and fault attacks and thus, certainly could facilitate the discovery of new attack paths. But more importantly, the notion of physical functions opens from now new challenges about estimating the protection of circuits.

Introduction

Security is a key component for information technologies and communication. Among the security threats, a very important one is certainly due to vulnerabilities of the integrated circuits that implement cryptographic algorithms to ensure confidentiality, authentication or data integrity. These electronic devices (such as smartcards) could fall into the hands of malicious people and then could be subject to "physical attacks". These attacks are generally classified into two categories, fault and side-channel attacks and aim at bypassing the security functions, or at retrieving the details of their design, or at finding out the manipulated data (cryptographic materials, PIN code, personal data, etc.). In the latter case and when the attacker targets cryptographic material only, we often speak of 'physical cryptanalysis' or 'key recovering' techniques. These techniques seem very different at first sight because they require different experimental methods and different algorithms. But several works have been proposed to described them in a common framework [START_REF] Micali | Physically observable cryptography[END_REF][START_REF] Standaert | A unified framework for the analysis of sidechannel key recovery attacks[END_REF][START_REF] Durvaux | How to certify the leakage of a chip?[END_REF]. The aim of such frameworks is to provide strong theoretical basis but practical tools to fairly estimate the information leakage of circuits and thus increase the level of trust in such devices. But these works only cover side channel attacks. This paper describes concepts and algorithms which are common to key recovery techniques which use fault or side channel experimental set-ups. These concepts and algorithms are illustrated on the AES 128 cryptographic algorithm [START_REF]NIST: Announcing the Advanced Encryption Standard (AES)[END_REF].

In the first part of this article, we describe a model of circuits on which most of the attacks on AES 128 are based. It appears that this model uses deterministic and probabilistic functions to model the information leakage. A focus on such critical functions is provided in the second part of the article. Then, the principles of fault and side channel attacks based on this model are proposed and some illustrations are given.

2 Model of the cryptographic circuits

Observables versus internal variables

The physical attacks are based on experiments, i.e. the launches of cryptographic operations on the target with or without modifying its behaviour. During these experiments, the attacker is able to directly measure data, further called 'observables'. These kinds of data are numerous :

the electromagnetic emissions (noted EM ), current consumption (or 'power' for short) traces (noted power ) or the signal provided by a µ-probe. the plaintexts or the ciphertexts obtained without or with perturbations (faulty ciphertexts). the behaviour (i.e. the normal or abnormal working) of the circuit in case of fault. This behaviour may be determined, for example, by comparing the correct and faulty ciphering, by detecting the start of an alarm or not, the rise time of the alarm or by detecting a more or less premature stop in computation.

the running time. One way to measure this computation time consists in reducing the clock period step by step (on a specific clock cycle) and analysing the circuit's behaviour. The step in which the behaviour of the circuit switches from normal to abnormal is considered as an indicator of the computation time. This particular step is called "fault intensity" in [START_REF] Li | Fault sensitivity analysis[END_REF].

It should be noticed that we consider that any combination of observables or any observable obtained by applying any signal processing technique or any mathematical transformation (such as filtering, temporal to frequency transformation, etc.) is considered as an observable.

Opposite to the observables, the execution of a cryptographic algorithm involves data that cannot be directly measured by the attacker. This piece of data is called internal data in the following paragraphs. Some of these internal data are searched by the attacker and are further called 'target' or 'secret'.

Relationships

As they are computed by, or emanate from the same circuit, variables (i.e. hidden data and observables) are related to each others. Some relationships are known by the attacker and some are not. In the physical cryptanalysis scenario (i.e. only the cryptographic materials are searched), the known relationships are generally described by an algorithm (such as a cryptographic standard) and so will further be called 'algorithmic' relationships. In this scenario, unknown relationships are generally those which link some internal data and possibly some observables together and then will further be called 'physical' relationships.

Known (or algorithmic) relationships

In this paper, we focus on the 128bit version of the AES standard (noted AES 128 ). This is a standard established by the NIST [START_REF]NIST: Announcing the Advanced Encryption Standard (AES)[END_REF] for symmetric key cryptography. The algorithmic relationships involved in the AES 128 are now described. This algorithm ciphers a 128-bit long data (called plaintext or input) by using a 128-bit long key to obtain a 128-bit long data (called ciphertext or output). The encryption consists first in transforming the input data into a two-dimensional array of bytes, called the State. Then, after a preliminary bitwise XOR between the input and the key, AES 128 executes 10 times a function (called round ) that operates on the State. The operations used during these rounds are the following ones:

-SubBytes (SB for short) is a non-linear transform working independently on individual bytes of the State. The rounds are identical, except for the last one in which the MixColumns operation is skipped. At the end of the ciphering operations, the State is copied to the output.

Unknown (or physical) relationships

The relationships which link some internal data and eventually some observables together have been called leakage functions in [START_REF] Standaert | A unified framework for the analysis of sidechannel key recovery attacks[END_REF] for side channel attacks. To extend this notion to fault attacks, we also consider "error leakage" functions (or "error functions" for short) which formalize the relationships between some internal data and the same internal data but in the presence of perturbations. Leakage and error functions will further indifferently be called 'physical functions or 'physical relationships'. These functions deeply depend of the circuit under attack and of the experimental setup. As they are at the heart of the physical attacks, they are detailed in the following section.

Models of physical functions

Except for very particular cases (such as a direct probing of an internal data), physical functions have no analytical expressions. To deal with this issue, models of these relationships have been proposed and fall into two categories. Some are 'real functions' in the mathematical mean of the term, and some consider inputs and outputs as random variables. These two cases are respectively further be called 'deterministic' and 'probabilistic' physical functions. In these two cases, the models are built on the following small set of functions but note that even the more complex ones are only a model and so do not perfectly describe the real behaviour of the circuit. Bit level functions The logical operations AND (symbol &), OR (symbol |) and XOR (symbol ⊕) defined on a byte are considered bitwise.

Select subset (or restriction) of bits Let B (resp. Ω) be a set of bits b i (resp.

ω i ). The set of bits b i of B such that ω i of Ω is equal to "1", is noted R Ω (B). Example: if Ω = {0, 0, 1, 0, 0,

Subset of bits equal to

Let Ω and B be two sets of N bits. Let M be the number of bits of the restriction of R Ω (B) and α a set of M bits. We note R Ω (B) == α the function that returns 1 when, for any bit i of R Ω (B) and α, we have R Ω (B) i == α i and returns 0 otherwise. For example, R 36 (B) == {0, 1} returns 1 if b 5 == 0 and b 2 == 1 and return 0 in all the other cases.

Deterministic physical functions

Deterministic leakage functions The simplest model proposed for power consumption consists in considering the value of a single bit. In this case, the leakage function is R i with i ∈ {1, 2, 4, . . . , 128}. But more generally, side channel functions are chosen as a combination of restrictions and weighted sums. For example, the number of 1 values in a binary number B is called Hamming Weight and is noted HW (B). A variation consists in considering the number of transitions between two binary values. This function, called Hamming Distance, is noted HD(B, Ω) = HW (B ⊕ Ω).

Deterministic error functions

Bit flip A fault may invert a set of bits. The function which models the bit flip is the bitwise XOR between B and Ω with Ω d ∈ [1, . . . , 255]. When all the bits of the Ω are equal to 1 (resp. 0), all the bits are inverted (resp. unchanged).

Set and reset A fault which forces bits to '0' (resp. '1') is generally called a reset (resp. set). The function which models such a reset (resp. set) is the bitwise AND (resp. OR) between B and Ω with

Ω d ∈ [1, . . . , 255]. A reset with Ω d = 0 returns a set of 0. A set with Ω d = 255 returns a set of 1.
Behaviour As a generalization of the set and reset models, a fault may force the bits R Ω (B) of B to some value α. In such a case, the circuit behaviour is normal only when the perturbed result is expected to be equal to α and is abnormal otherwise. Such a behaviour may be described by using the function R Ω (B) == α.

Running time (or 'fault intensity') When the faults are created by violating the set-up time of latches, these faults may impact first the bytes which have the higher Hamming Weight or may impact first only one bit. In the first case, chip's behaviour may be described by a Hamming Weight and in the second case by the function that selects one bit R i with i ∈ {1, 2, 4, . . . , 128}.

Probabilistic physical functions

In this case, the input X and output Y of the physical functions are considered as two discrete random variables. As observables are measured with digital equipments (such as a digital oscilloscope) and as internal data are also generally organized into finite set of bits (called registers), without loss of generality, we consider that observables and internal data are discrete data. So, X and Y have respectively sample spaces S X = {0; 2 M -1} (with M being, for example, the size of a register) and S Y = {0; 2 N -1} (with N being, for example, the number of bits fixed by the vertical resolution of the oscilloscope). The AES 128 algorithm, considered in this article, is generally attacked thanks to a divide and conquer approach. As this method enables to recover the key byte per byte, M is further supposed to be equal to 8. Furthermore, as most of oscilloscopes have an 8-bit vertical resolution, N is further supposed to be equal to 8. As suggested in [START_REF] Li | Exploring the relations between fault sensitivity and power consumption[END_REF], we propose to model a probabilistic relationship with a joint probability mass function (or joint pmf ). The joint pmf of the discrete variables X and Y (used to model a physical function f with domain X and co-domain Y) is noted f X,Y (x, y) = P r(X = x, Y = y) whatever x ∈ S X and y ∈ S Y . Examples of such pmf are described in the next sections.

Probabilistic leakage functions Let's consider a physical relationship which links the integer values of an 8-bit data and the current consumption measured on the circuit when it handles these values. One classical probabilistic leakage function is to consider that the current consumption of the data x is the sum of the Hamming weight of x and a Gaussian noise [START_REF] Chari | Template attacks[END_REF]. This assumption holds for example when the data switches from the all-zero value to the value x. It occurs, for example, during the transfer of this data on a precharged bus between the memory and the pipeline of a microprocessor. In such a case, we have f (x) = HW (x) + e with e being a normal random variable with mean 0 and a given standard deviation. The left part of the figure above describes the associated pmf (with a standard deviation of 4/10, chosen arbitrarily as an illustration). The integer values of the 8-bit data is reported in abscissa and the associated current consumption in ordinates. The darker in the Figure, the higher the probability that the circuit consumes the current of value y when the manipulated data has the value x is (shorter x 'consumes' y). The right part of the figure is the same pmf but measured on a real component (a 32-bit unsecured up-to-date micro-controller). One can see in this very particular case that the theoretical and practical relationships fit particularly well. . The theoretical and experimental pmf are in this example rather distinct. In fact, in the experimental set-up, we can distinguish monobit faults but some bits appear much more easy to modify than another. In this case, the equal likelihood hypothesis is not validated.

Application to physical cryptanalysis

The physical cryptanalysis scenario (i.e. only the cryptographic materials are targeted) corresponds to numerous attacks proposed in the literature : µ-probing attacks, differential power analysis (with or without profiling), template attacks, differential fault analysis and safe-error attacks (among them differential behavioural analysis and fault sensitivity analysis). All these physical attacks share the following key retrieving algorithm.

Attack path

Definition An attack path is a relationship between observables that involves the secret and that enables to recover information about it. As such attacks use a divide and conquer approach, a relationship needs to involve only a partial key (i.e. a small piece of the key). In the following paragraphs, we note

P = REL(C, F, O)
the attack path that links together the observables O and P according to the (unknown) value of the internal variables C (among them is the secret) and to a set of (unknown) physical functions F . Even if there is not always a causality relation between P and O, the observables O are further called 'stimuli' and the observables P are called 'reactions' or 'response'.

Examples of attack paths

The attack path used in [START_REF] Kocher | Differential power analysis[END_REF] and noted REL power links the j th byte of the plain text (noted plain j ), the j th byte of the first round key (noted k sch[0] j ) and the power consumption measured when the computation of the j th SubBytes of the first round is performed. The algorithmic functions involved in this relationship are the SubBytes and the bitwise XOR of the AES 128 . The physical relationship involved links the value at the output of j th SubByte of the first round and the power consumption of the circuit when this value is computed. The associated physical function, noted f , has no analytical expression. The secret variable here is {k sch[0] j }. With

-O = {plain j }, -P = {power}, -C = {k sch[0] j },
-F = {f }, the relationship REL power may be written :

power = f power (SB(ARK(plain j , k sch[0] j ))

Variants of this relationship are indifferently used in side-channel and fault attacks. In the first case, the measure performed in by the attacker may be an electromagnetic radiation or a signal recovered by a µ-probe. In the second case, the observables such as the behaviour or the running time are obtained by modifying the circuit's functioning. Nevertheless, to obtain the associated relationship, the physical function f power has only to be replaced, respectively by f EM , f µ-probe , f behaviour or f time .

Other examples of relations widely used to break the AES 128 with physical attacks are reported in the Figure 4.1. In these relations, k is the index of a byte of the State of the AES 128 (so 0 ≤ k < 16) before the Shif tRow and j is the index of the same byte after this operation (so 0 ≤ j < 16). According to the notation used in the standard, k = r + 4 * c with 0 ≤ r < 4 et 0 ≤ c < 4 and j = r + 4 * c with c = (r -c)M odulo(4). In these relations, the functions f , g or h are leakage or error functions. Some of them will be detailed in 4.3. Variants of these relations are also proposed. They are obtained by changing the kind of the reactions. [START_REF] Agoyan | When clocks fail: On critical paths and clock faults[END_REF].start j ) with round [START_REF] Agoyan | When clocks fail: On critical paths and clock faults[END_REF].start j = SB(ARK(plain j , k sch[0] j )) Variants P = {EM } or P = {µ -probe} or P = {behaviour} or P = {time} REL2 O = {cipher j } P = {power} C = {k sch[10] j } power = f (round [START_REF] Li | Exploring the relations between fault sensitivity and power consumption[END_REF].start k ) with round [START_REF] Li | Exploring the relations between fault sensitivity and power consumption[END_REF].start k = SB -1 (SR -1 (ARK(cipher j , k sch[10] j ))) Variants P = {EM } or P = {µ -probe} or P = {behaviour} or P = {time} REL3 O = {cipher j } P = {f aulted j } C = {k sch[10] j } f aulted j = ARK(SR(SB(f (round [START_REF] Li | Exploring the relations between fault sensitivity and power consumption[END_REF].start k ))), k sch[10] j ) with round [START_REF] Li | Exploring the relations between fault sensitivity and power consumption[END_REF]. [START_REF] Lashermes | A dfa on aes based on the entropy of error distributions[END_REF].m col j } f aulted j = h(ARK(round [START_REF] Li | Exploring the relations between fault sensitivity and power consumption[END_REF].s row j , f (k sch[10] j ))) with round [START_REF] Li | Exploring the relations between fault sensitivity and power consumption[END_REF].start k = SB -1 (SR -1 (ARK(cipher j , k sch[10] j ))) k sch [START_REF] Lashermes | A dfa on aes based on the entropy of error distributions[END_REF] k = g(ARK(round [START_REF] Li | Exploring the relations between fault sensitivity and power consumption[END_REF].start k , round [START_REF] Lashermes | A dfa on aes based on the entropy of error distributions[END_REF].m col k )) round [START_REF] Li | Exploring the relations between fault sensitivity and power consumption[END_REF].s row j = SR(SB(ARK(k sch [START_REF] Lashermes | A dfa on aes based on the entropy of error distributions[END_REF] k , round [START_REF] Lashermes | A dfa on aes based on the entropy of error distributions[END_REF].s col k ))) Variant P = {power} Table 1. Relationships used to break the AES128 with physical cryptanalysis

REL0 O = {plain} P = {cipher} C = {k sch[0]} cipher = AES(plain, f (k sch[0])) REL1 O = {plain j } P = {power} C = {k sch[0] j } power = f (round
start k = SB -1 (SR -1 (ARK(cipher j , k sch[10] j ))) REL4 O = {cipher j } P = {f aulted j } C = {k sch[10] j , round

Key retrieving algorithm

Step 0: Notations Let's note A a set of n variables noted {a 1 , a 2 , . . . , a n }. We consider that each variable a i is discrete and has its own finite set of definition, noted A i with cardinal |A i |. When a variable a i takes a particular value, noted a i (j) with 0 ≤ j < |A i |, this variable is said 'instantiated'. By extension, Ã denotes the set of all the possible values of A. So, there are

| Ã| = |A 1 | * |A 2 | * . . . * |A n | distinct possible instances. Each of these instances is noted Ã(j).
Step 1: Choice of the attack path Among the different relationships described in Table 1 and depending of his experimental set-up, the attacker chooses a relation P = REL(C, F, O), with C and F unknown and with O and P known by the attacker.

Step 2: Definition of the search space The attacker chooses hypotheses on the values of C and F . The set of hypothesis on the physical functions is noted F and the set of hypotheses on the internal variables is noted C. The set C * F is called the search space and has | C| * | F | elements. This sets are chosen such that C contains C and such that at least a physical function of F approximates the function F . As it is impossible to try all the possible physical functions (the set of leakage functions is infinite and the set of all the error functions for an octet is constituted of 256 256 = 2 2048 elements), heuristics have to be used. These heuristics are based on the knowledge that the attacker has on the circuit and on his experimental set-up. In some scenarii, the attackers may take advantage of a 'profiling' phase on a circuit identical to the circuit under attack. During such an optional phase, he is able to estimate the leakage functions (and thus refine his hypotheses). In the other cases, he models the physical functions with a priori functions detailed in 3.2.

Step 3 : Experiments The attacker performs a set of experiments to measure and record the reactions P of the circuit for different stimuli O. The stimulus used for the experiment e is noted O(e) and the reaction measured for this experiment is noted P (e). From all the set of measurements, the attacker is able to compute P r(P, O).

Step 4 : Predictions The attacker builds a set of hypothesis of relationship by replacing in REL the elements of C by all the values C(i) ∈ C of internal variables and the elements of F by all the physical functions F (j) ∈ F . Each element of this set of relationship is called 'model' parametrized by C(i) et F (j) and noted M od(i, j). Then, depending of the kind of chosen physical functions (deterministic or probabilistic), two cases arise:

-Deterministic: For all the models and for each experiment e realized during the previous step, the attacker predicts the reactions noted P M od(i,j) (e) = REL( C(i), F (j), O(e)). -Probabilistic: For all the models, the attacker estimates the probability of having the reaction and the stimuli P r(P M od(i,j) , O) on the all set of experiments.

Note that the joint probability P r(P M od(i,j) , O) may be also calculated in the first case (i.e. when the physical functions are deterministic). Note also that in the second case, the stimuli used to compute the joint probability do not have to be strictly identical to those used during the measurement step. The stimuli just have to have the same probability distribution.

Step 5 : Comparison between predictions and measures Then, the attacker compares his predictions and the measurements. According to the values of hypothesis, two cases arise when the relation REL has statistical properties (which is the case for those reported in Table 4.1).

1. Good hypothesis: When the physical function F could be soundly approximated (or is equal in very particular cases) by a function in F , then there is an index j 0 such that F (j 0 ) F . In this case, for i = i 0 , with i 0 being the index of C in C, the predicted reactions are 'quasi-identical' to the measured ones for all the experiments. So, we have P M od(i0,j0) (e) P (e)∀e when the physical functions are deterministic and P r(P M od(i0,j0) , O) P r(P, O) when the physical functions are probabilistic. In such case, the model parametrized by the key C(i 0 ) and the function F (j 0 ) 'explains the data'. 2. Bad hypothesis: On the contrary, when i = i 0 or j = j 0 , P (e) and P M od(i,j) (e)

are not identical for all the experiments in the deterministic case and in the probabilistic case P r(P M od(i0,j0) , O) and P r(P, O) are distinct.

Different algorithms are used to implement the comparator cited above (also called 'distinguisher'). In the deterministic case, ad-hoc algorithms have been proposed such as the three following ones:

-The 'sieve' algorithm return a binary value equal to 1 if and only if P M od(i,j) (e) = P (e) for all the experiments. The model explains the data if and only if the return value is 1. -The 'count' algorithm returns the number of times that P M od(i,j) (e) = P (e).

The higher, the better the hypothesis explains the data. -When the possible values for the predictions are restricted to the set {0, 1}, Kocher and al. have proposed to compute the difference of the mean ('DoM' for short) of the set of measures associated with the prediction '1' and the mean of the set of measures associated with the prediction '0' [START_REF] Kocher | Differential power analysis[END_REF]. The higher, the better the hypothesis explains the data.

Other more general algorithms, based on information theory or on statistics operators have been proposed. In the deterministic case, comparing P M od(i0,j0) (e) P (e)∀e is equivalent to compare the pmf P r(P M od(i0,j0) ) and P r(P ). In the probabilistic cases, comparing if the joint pmf P r(P M od(i0,j0) , O) and P r(P, O) are identical, is equivalent to compare the pmf P M od(i0,j0) and P r(P ). So, the two cases (i.e. probabilistic and deterministic cases) collapse. A survey of operators for comparison is available in [START_REF] Cha | Comprehensive survey on distance/similarity measures between probability density functions[END_REF]. Two of them are described below.

-As the predictions and the measures are supposed to be 'similar', the Pearson coefficient has been used to test the linearity between P and P . The coefficient returns a values between 1 and -1. The higher in absolute value, the better the model explains the data. -As the predictions and the measures are supposed to share information, the mutual information (MI) between the random variables P M od(i,j) and P has also been proposed. The MI return a value between 0 and 1. The higher, the better the model explains the data.

When the good and bad hypothesis cases are distinguishable, the attacker gets information on the internal data (value of C) but also on the physical functions associated with the circuit and with the experimental set-up. Examples of instances of this key retrieving algorithm are proposed in the following section.

Illustrations

In the Table 2 are presented the different parameters defined in the framework proposed above for some well known attacks on the AES. For the 128-bit version of this algorithm, the attacker has to perform 16 times an elementary attack (which enables him to retrieve the octet j of the key).

Semi-exhaustive The principle of this (rather theoretical) attack consists in forcing with any fault injection mean, 15 bytes of the key to "00" and in leaving unchanged the value of the byte j. The attacker records a couple plain/cipher texts obtained in such conditions. In a second step, the attacker generates the set of 256 keys such that all the bytes of these keys are equal to "0" except the j th one which takes a value i among {0, . . . , 255}. The attacker computes, by using the AES algorithm, the cipher text obtained for each value of this set of keys hypothesis. Only one value, for example i 0 , explains the cipher text from the plain text. The attacker deduces that the byte j of the key is equal to i 0 .

µ-probing In this example, let's suppose that the attacker targets the software implementation of the AES on a 8-bit micro-controller and that he knows exactly when the output of the S-Box of the first round of one byte of the state is moved from the processor to the memory. We also suppose that the attacker is able to measure the signal of one (and only one) wire of the data bus but that the index of this bit is unknown. In such a rather pedagogical than realistic scenario, the attacker measures one bit during each experiment, which consists in computing a cipher from a known plain text. As the index of the bit is unknown, the attack has to test 8 different physical functions, each of them being a monobit restriction that corresponds to an index of the bit in the byte. All kind of distinguisher could be used to retrieve the value of the key hypothesis. DPA In the case of DPA, the physical function used to model the power consumption is a monobit restriction. So, the attacker has to test 8 possible physical functions (one for each bit) for each of the 256 values of key hypothesis. The difference of means could be used to distinguished the correct key and the false key.

CPA In the case of CPA, the attacker supposes that the power consumption depends on the SubBytes output but also on another value (which could be the previous value in the register which store the SubByte outputs). As this value is unknown, it can be seen as a parameter of the leakage function. So, the attacker has to try the 256 values of the secret key for each of these leakage functions. The distinguisher of CPA is the Pearson correlation coefficient. MIA In the case of MIA, the attacker supposes that the power consumption depends on the SubBytes output but also on another value (as for the CPA). But the MIA takes into account an additive Gaussian noise (so the model is probabilistic). The distinguisher of MIA is the mutual information.

Attack

Relationships

Physical function Kind of physical functions

Similarity and distance tools

Semi- R0 f (x) = x if x is Determ. All exhaustive O = {plain} the j th octet (on octet j) P = {cipher} f (x) = 0 else C = {k sch[0]} µ-probing R1 f (x) = RΩ(x) with Determ. All O = {plain j } Ω ∈ {1, 2, 4, . . . , 128} P = {probe} C = {k sch[0] j } DPA [8] R2 f (x) = RΩ(x) with Determ. DoM O = {cipher j } Ω ∈ {1, 2, 4, . . . , 128} or P = {P ower} Pearson C = {k sch[10] j } correlation CPA [3] R1 f (x) = HW (x ⊕ Ω) Determ. Pearson O = {plain j } with Ω ∈ [[1, 255]] correlation P = {power} C = {k sch[0] j } MIA [18] R1 f (x) = HW (x) + N with Probab. Mutual O = {plain j } N a Gaussian noise information P = {power} C = {k sch[0] j } DFA1 [7] R3 f (x) = x ⊕ Ω with Probab. Sieve O = {cipher j } Ω ∈ {1, 2, 4, . . . , 128} P = {f aulted j } and (P r(Ω) = 1/8) ∀Ω C = {k sch[10] j } DFA2 [16] R4 h(x) = x and g(x, Ω) = x ⊕ Ω Determ. Count O = {cipher j } with Ω ∈ [[1, 255]] P = {f aulted j } f (y, Γ ) = y ⊕ Γ with C = {k sch[10] j , Γ ∈ [[1, 255]] round[9].m col j } DFA+ [16] R4 h(x) = HW (x) Determ. Pearson O = {cipher j } f and g as above correlation P = {power} C = {k sch[10] j , round[9].m col j } DBA [15] R1 f (x) = (RΩ(x) == 0) with Determ. Pearson O = {plain j } Ω ∈ [[1, 255]] correlation P = {behavior} C = {k sch[0] j } FSA [12] R2 f (x) = HW (x) or Determ. Pearson O = {cipher j } f (x) = RΩ(x) with correlation P = {intensity j } Ω ∈ {1, 2, 4, . . . , 128} C = {k sch[10] j } Table 2.
Examples of physical attacks and associated parameters DFA1 The DFA proposed in [START_REF] Giraud | DFA on AES[END_REF] uses the theoretical error function described in 3.3. The distinguisher is a sieve algorithm.

DFA2

The DFA proposed in [START_REF] Roche | Combined fault and sidechannel attack on protected implementations of AES[END_REF] use a constant error (or at least which provides a 'good repeatability') which spreads across the key schedule. This error creates 2 faults on the State and the values of these faults are unknown by the attacker. So, he tests all the possible values of these faults (but also tests the values of the key) in order to find the model which explains the data. The distinguisher used is a count algorithm.

DFA+ The principle of the DFA+ consists in combining side channel and fault attacks. In such attack, two physical functions are used: one for the error function (a constant error such as in DFA1) and one for the leakage function (an Hamming Weight). The chosen distinguisher is the Person coefficient.

DBA The principle of the DBA consists in explaining a behaviour (i.e. the circuit works correctly or not) by using a model parametrized by the value of the key and a constant (but unknown) fault model (for example the set or the reset of some bits of the outputs of a SubByte). The distinguisher is a Person correlation. This attack is particularly effective when the circuit embeds protections against DFA.

FSA FSA consists in explaining a fault sensitivity (i.e. the behaviour of the circuit to a fault injection mean whose intensity is variable) by using a model parametrized by the value of the key and a constant (but unknown) fault model (for example an Hamming Weight or set/reset of a particular bit of the input of a SubByte). The distinguisher is a Pearson correlation.

Conclusion

We showed in this article that most side channel and fault attacks share the same principles. This merge has been made possible by extending the concept of leakage functions by the concept of error functions and by using probability mass functions to model both of them. Many possible further works have been identified : First, we plan to describe a wider set of attacks with our framework. In particular, it could be interesting to extend our approach to asymmetric cryptography (and include attacks described in [START_REF] Barthe | Synthesis of fault attacks on cryptographic implementations[END_REF]). Second, for a given set of models of physical functions, we could plan to formally study the attack paths and thus automatically generate new ones. Third, this work could be seen as the basis for merging the advantages of attack-specific protections to enable a more generic set of countermeasures. At last, because physical functions are at the heart of the attack, we believe that their studies are a promising way to fairly estimate the security of the device. But these studies give way to a lot of open questions:

-How to estimate the error between the model and the actual physical functions? This question has been covered by several articles like [START_REF] Durvaux | How to certify the leakage of a chip?[END_REF] but they will certainly have to be updated to take into account the pmf of error functions. Indeed, these functions have very different statistical properties than the pmf of leakage functions. -Do some physical functions leak more information than others? Intuitively and as suggested in [START_REF] Lashermes | A dfa on aes based on the entropy of error distributions[END_REF][START_REF] Li | Yet another fault-based leakage in non-uniform faulty ciphertexts[END_REF], if the pmf of a physical function is the uniformly random distribution, there are certainly less risks than if the pmf of the function is one of those described in 3.3. It could be interesting to find mathematical criteria (certainly based on the measure of randomness of the pmf ) to evaluate the intrinsic leakage of physical functions. -A corollary is how to find the critical physical functions that leak the most?

In this article, we have considered that the physical functions take only one argument. But theoretically, each observable depends on all the other variables. For example, an error function could depend on X, on the previous value of X but also on other observables such as the voltage, the temperature and even perhaps, due to cross-talk, on many other internal variables. Thus, the number of possible physical functions appears to be tremendous. Enumerating all of them, even for a very small circuit is to our point of view, impossible. The community will have to define heuristic to find the most critical physical functions. But the use of such non exhaustive search could lead to potential undetected leakage.

In other words, from our point of view, the estimation of the information leakage of a chip is far from being solved.

3. 1

 1 Definitions Data representation A byte B is a set of 8 bits noted {b 7 , . . . , b 0 }. We match it with B the binary value B b = b 7 b 6 b 5 b 4 b 3 b 2 b 1 b 0 but for the sake of simplicity, B and B b will be used indifferently. The decimal value associated with B is noted B d (for this conversion, b 0 is the less significant bit).

Fig. 1 .

 1 Fig. 1. Joint pmf of the leakage functions : theoretical (left) and experimental (right)

Fig. 2 .

 2 Fig. 2. Joint pmf of the error functions : theoretical (left) and experimental (right)

  MixColumns (MC for short) is a linear matrix multiplication working on each column of the State. The result of this operation at round i is noted

	round[i].m col
	-AddRoundKey (ARK for short) is a bitwise XOR between the State and a
	value k sch[i], computed from the key (according to a transform called Key
	Expansion which is not detailed in this paper). The result of this operation
	is the start of the next round noted round[i + 1].start.

The result of this operation at round i is noted round[i].s box -ShiftRows (SR for short) is a rotation operation on each row of the State. The result of this operation at round i is noted round[i].s row -

  1, 0, 0}, we have Ω d = 36 and the restriction of B by R 36 is the set of bits {b 5 , b 2 } of B. Note that if B is constituted of N values, there are 2 N -1 possible restrictions. A restriction is said monobit when only one bit of the byte is considered. So, the monobit restrictions are R 1 , R 2 , R 4 , . . . , R 128 .

Acknowledgements

The authors would like to thank D. Aboulkassimi, J.-M Dutertre, I. Exurville, J. Fournier, R. Lashermes, J.-B. Rigaud, A. Tria and Jean-Yves Zie for their contributions to this work. We would like to thank the anonymous referees and Ph. Maurine for their valuable comments and suggestions. This research is in part supported by the French government through the CALISSON 2 and the HOMERE+ projects.


J.-M André

P Jonnard

C Michaelsen

J Wiesmann

F Bridou

M.-F Ravet

A Jérome

F Delmotte

E O Filatova

La/B 4 C small period multilayer interferential mirrors for the analysis of boron

A La/B 4 C multilayer interferential mirror with small period d (4.8 nm) was produced by diode sputtering for the detection of the boron K emission by wavelength-dispersive x-ray spectrometry at a large Bragg angle (close to 45°). The structure of the mirror has been characterized by grazing incidence x-ray reflectometry, and its performance at the energy of the boron K emission (183 eV) was evaluated by means of polarized synchrotron radiation. A spectrometric measurement shows that the La/B 4 C mirror has improved the detection limit of boron using by a factor of 2 with respect to similar Mo/B 4 C mirrors, and by a factor of 4 with respect to a lead stearate crystal.

INTRODUCTION

The analysis of the boron emission by Wavelength Dispersive X-Ray Fluorescence (WDXRF) or Electron Probe MicroAnalysis (Castaing microprobe, or EPMA) is of considerable importance in semiconductor, ceramic and glass industries, and also for geological investigations. Until the advent of multilayer analyzers, lead stearate (LS) soap films, made up by the Langmuir-Blodgett technique, were extensively used to analyze the B-K emission. Since the nineties, Mo/B 4 C multilayer interferential mirrors (MIMs) are commercially available. They had progressively taken the place of the soap films for the analysis of boron emission since they offer a larger integrated reflectivity [1].

Recently it has been pointed out that La/B 4 C MIMs can be advantageously implemented for the detection of boron emission by WDXRF. Basically, this fact comes from the small absorption of lanthanum in the energy range of the boron K emission, compared to that of molybdenum or tungsten. The La/B 4 C MIMs improve the detection limit of B in silicon wafer by about 28% with respect to conventional Mo/B 4 C MIMs [2]. In this paper we present an extended characterization of a small period La/B 4 C MIM (d = 4.8 nm), both by hard x-ray grazing incidence reflectometry and soft x-ray reflectometry using polarized synchrotron radiation. The performance of La/B 4 C MIMs with larger periods has been investigated in a previous work [3]. Decreasing the period allows to increase the Bragg angle and consequently to improve the spectral dispersion. Moreover the period that we have chosen leads to a Bragg angle close to 45° at 183 eV, which gives the MIM the quality of a polarizer, since the TM component of the electric field is cancelled by the reflection.

Unfortunately diminishing the thickness of the layers in a MIM leads generally to a decrease in its performance for various reasons : the influence of the interfacial layers on the reflectivity caused by interdiffusion process, chemical reactions and implantation during the sputtering process is increased. Moreover the correlation between the substrate and film roughness can become very important for MIMs with short period.

The purpose of this paper is to give the state-of-the-art in the soft x-ray reflectivity performances of small period La/B 4 C MIMs. They are characterized by Grazing Incidence Xray Reflectometry (GIXR) at 0.154 nm. The advantageous performance of this new La/B4C MIM in the case of boron is shown by comparing it to the one of a similar Mo/B 4 C MIM and of a LS film, in a typical spectroscopic application.

MIRROR FABRICATION

Four La/B 4 C multilayers were produced in the same batch, leading to identical parameters. They were deposited onto Si wafers one inch in diameter, by conventional diode magnetron sputtering in a vacuum system with a base pressure in the 10 -6 Pa range [4]. Ar of purity 6.0 at a pressure of typically 0.1 Pa was used as the sputtering ambient. The substrate holder was water-cooled. The deposition times were controlled by a computer-driven shutter located between the sample and the targets. Typical deposition rates were in the order of 0.1 nm/s. After deposition, the film thickness and the ratio of the La layer thickness to the period (gamma ratio) were determined at various positions along the mirror surface by x-ray reflectometry using a Bruker AXS D8 Advance diffractometer.

At the same time, two Mo/B 4 C multilayers with a similar period were fabricated by ion beam sputtering in a ultra-high vacuum chamber [5] using an ION TECH Inc. 3 cm ion beam source with a hollow cathode, a hollow cathode neutralizer, and a three position target holder. A base pressure in the 10 -7 Pa range is reached by using a cryopump and by baking out the chamber during around 6 hours, then by filling a cold trap with liquid nitrogen. A mixture of 10% H 2 in Ar gas is injected into the ion gun and pure argon is injected into the neutralizer. The 5 inches diameter molybdenum and silicon targets are successively sputtered by rotating the target holder system. Multilayers were deposited in this case on float glass substrates with a 20 mm diameter and a 3 mm thickness. The layer thickness is roughly controlled during the deposition by using an in-situ reflectometer working at 0.154 nm.

CHARACTERIZATION

Grazing incidence x-ray reflectometry at the 0.154 nm wavelength (Cu Kα emission), together with appropriate software, is a well-mastered and efficient technique to determine the characteristics of MIMs. It gives the layer thickness in-depth distribution of the stack and the interfacial roughness parameters [6].

The GIXR has been applied to characterize the La/B 4 C and Mo/B 4 C MIMs. Table 1 and 2 give the parameters obtained for the MIMs. One notes that the value of the root mean square (rms) roughness σ depends on the order of deposition, a fact which is well-known in multilayer physics. The La decrement of the optical index is equal to the theoretical one multiplied by a factor of 0.81. That value corresponds to 81% of the bulk density. The uncertainty on the period is about 0.1 nm, while the thickness of each layer in this period is defined in a precision range of about 0.2 nm.

ABSOLUTE REFLECTIVITY AT 183 eV

The absolute reflectivity at the energy of the B-K emission (183 eV), has been measured by means of the polarimeter set-up [7] at the UE56/1-PGM beamline of the BESSY II synchrotron facility. The beamline is equipped with an undulator and a 1200 l/mm plane grating monochromator. The spectral bandwidth of the monochromatic radiation is less than 20 meV at 183 eV for the width of the exit slit chosen in our measurements. The polarization of the radiation can be adjusted by varying the configuration of the undulator.

Figure 1 displays the experimental reflectivity versus glancing angle at 183 eV for circularly polarized radiation. The experimental results are adjusted by using the data of the GIXR measurements as starting values is given in Figure 1. The fit implements the matrix formalism with the transition layer model to calculate the reflectivity in presence of interfacial roughness [8]. We have chosen to determine the parameters of the MIM from the reflectivity measurement at fixed energy, because in this case, the fitting process is not affected by the badly known variations of the optical constants (dispersion) as a function of the energy. In the inset of the Figure 1,we have noted the values of the thickness retained to obtain an « exact » fit ; these values lie in the domain of confidence of the GIXR measurements. In the inset we also give the value of the global Debye-Waller factor, σ = 0.3 nm, needed to take into account the interfacial roughness effect in the Debye-Waller model. One notes that this value is slightly smaller than the rms values estimated by a more sophisticated model that takes into account independently the effects of each interfacial roughness [6]. The slight difference in the d-spacings observed by hard and by soft x-rays may be due to a limited knowledge of the optical constants for the materials used.

Figures 2 and3 show the experimental reflectivity versus photon energy for the circularly polarized and TE (s) radiation respectively, at a glancing angle of 45°, together with the fit obtained using the parameters (thicknesses, roughnesses and densities) of the above "exact" fit. The TM (p) reflection is practically cancelled as expected because the glancing angle is very close to the Brewster angle. The agreement between experimental results and fit is good, indicating that the theoretical reflection curves calculated using the parameters from the GIXR measurements are in close agreement with the soft x-ray experiments.

We have performed the same calculations for Mo instead of La, keeping the other parameters fixed. The peak reflectivity for TE polarization that reached 42.8% with La as absorbing layer, is only 21.2% with Mo as absorbing layer, and the peak reflectivity for circular polarization which is 21.4% for La drops to 10.6% for Mo. No significant change of the spectral bandwidth occurs by substituting La for Mo. These results show, both theoretically and experimentally, that the La/B 4 C structure is more efficient than the Mo/B 4 C structure for spectroscopic applications at 183 eV.

SPECTROSCOPIC APPLICATIONS

The La/B 4 C and Mo/B 4 C MIMs and the LS crystal have been used to analyze the B-K emission from the same hexagonal BN bulk sample in the same electron excitation conditions (10 mA, 3 kV). The measurements were carried out by means of the original spectrogoniometer MONOX [9]. Figure 4 gives a comparison of the relative intensities of the B-K emission obtained with the three analyzers. It is seen from this figure that the reflectivity of the La/B 4 C MIM is twice as that of the Mo/B 4 C MIM, and about ten times that of the LS crystal. These results confirm the low efficiency of the LS crystal and the superiority of La/B 4 C MIM with respect to the Mo/B 4 C MIM in terms of peak reflectivity. We have calculated the detection limit of boron, C lim , for each analyzer. It can be defined in a 3 standard deviations of the confidence interval by :

C lim = 3 b 1/2 p -1 C
, where b and p are the number of counts of the background and the peak, respectively, and C the concentration of boron atoms in the BN sample. The detection limit calculated for the present experimental conditions (3 keV, 10 mA, 10 s) are presented in Table 3. The detection limit improves by a factor of 2 going from LS to Mo/B 4 C, and by another factor of 2 from Mo/B 4 C to La/B 4 C. These detection limits can be improved still further by increasing the acquisition time or the electron current. Nevertheless the detection of boron traces by MIMs containing boron in their composition remains problematic because of the anomalous reflection. Let us recall that in the vicinity of an absorption egde of an element constituting an x -ray reflector (here boron in a La/B 4 C multilayer mirror), x-ray anomalous scattering by this element occurs, giving rise to troublesome structures in the reflection [10,11].

CONCLUSION

La/B 4 C MIMs with small period for WDXRF detection of boron at a Bragg angle of 45° have been produced and successfully tested. They offer performances similar to larger period La/B 4 C MIMs developed to detect boron at a lower Bragg angle [3]. The boron detection limit of these MIMs is a factor 2 better compared to Mo/B 4 C MIMs.

Moreover, the possibility to diffract efficiently photons of 183 eV at 45°, that is close to the Brewster angle, should make these MIMs useful as polarizers, and the development of luminous spectroscopic devices, such as the one recently developed by S. Ishikawa et al. [12] for the study of anisotropic boron compounds.

Figure 1 :

 1 Figure 1 : Experimental (dots) and theoretical (line) reflectivity versus glancing angle at 183 eV for circularly polarized radiation. The theoretical reflectivity curve is a fit using the results of the GIXR measurements as starting values. In the inset we have noted the values used to obtain an « exact » fit : d(La) and d(B4C) are the thicknesses of the La and B 4 C layers, respectively, ρ(La) and ρ(B4C) are the densities relative to those of the bulk materials, respectively, and σ is the Debye-Waller roughness.

Figure 2 :

 2 Figure 2 : Experimental reflectivity (dots) versus energy at a 45° glancing angle for circularly polarized radiation. « Theory » (line) is the reflectivity calculated with the same parameters as in Fig. 1.

Figure 3 :

 3 Figure 3 : Experimental reflectivity (dots) versus energy at a 45° glancing angle for TE polarization of the radiation. « Theory » (line) is the reflectivity calculated with with the same parameters as in Fig. 1.

Figure 4 :

 4 Figure 4 : Comparison of the B-K emission spectrum from a BN sample recorded with the La/B 4 C (solid line) and Mo/B 4 C (dotted line) MIMs and the LS crystal (dashed line).

Table 1 :

 1 Parameters of the La/B 4 C MIM deduced from GIXR measurements at 0.154 nm. N° is the number of the layer within the stack. "Absorption" means the imaginary part of the optical index.

	Layer	(N°) Thickness (nm) Roughness (nm) Refractive index (1-n) x 10 6	Absorption x10 6
	Substrate	0	∞	0.48	7.7	0.13
	La	1	2.3	0.59	12.8	1.7
	B 4 C	2	2.5	0.44	6.84	0.71
	…
	B 4 C	140	6.2	0.86	7.12	0.71

Table 2 :

 2 Parameters of the Mo/B 4 C MIM deduced from GIXR measurements at 0.154 nm.N° is the number of the layer within the stack. "Absorption" means the imaginary part of the optical index.

	Layer	(N°) Thickness (nm) Roughness (nm) Refractive index (1-n) x 10 6	Absorption x10 6
	Substrate	0	∞	0.44	7.7	0.13
	Mo	1	2.5	0.45	24.93	1.6
	B 4 C	2	2.4	0.26	6.46	0.71
	…
	B 4 C	166	2.4	0.49	6.46	0.71

Table 3

 3 Detection limit for the boron atoms with the three studied analyzers.

	Analyzer	Detection limit
		(10 20 at.cm -3 )
	La/B 4 C	4.9
	Mo/B 4 C	10.7
	Lead stearate	18.8

Acknowledgements

This work has been partly carried out at BESSY II in the framework of the project BESSY-Number HPP33/150902 and supported by the European Commission under the "Human Potential Programme, Transnational Access to Major Research Infrastructures", Contract No HPRI-1999-00028. The authors thank H.-C. Mertins and D. Abramsohn for their help during the measurements at BESSY II.